packet-dcerpc-netlogon.c

   1 /* packet-dcerpc-netlogon.c
   2  * Routines for SMB \PIPE\NETLOGON packet disassembly
   3  * Copyright 2001,2003 Tim Potter <tpot@samba.org>
   4  *  2002 structure and command dissectors by Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-netlogon.c,v 1.93 2003/09/27 23:48:04 sahlberg Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-dcerpc.h"
  34 #include "packet-dcerpc-nt.h"
  35 #include "packet-dcerpc-netlogon.h"
  36 #include "smb.h"        /* for "NT_errors[]" */
  37 #include "packet-smb-common.h"
  38 #include "packet-dcerpc-lsa.h"
  39
  40 static int proto_dcerpc_netlogon = -1;
  41 static int hf_netlogon_opnum = -1;
  42 static int hf_netlogon_guid = -1;
  43 static int hf_netlogon_rc = -1;
  44 static int hf_netlogon_len = -1;
  45 static int hf_netlogon_sensitive_data_flag = -1;
  46 static int hf_netlogon_sensitive_data_len = -1;
  47 static int hf_netlogon_sensitive_data = -1;
  48 static int hf_netlogon_security_information = -1;
  49 static int hf_netlogon_dummy = -1;
  50 static int hf_netlogon_neg_flags = -1;
  51 static int hf_netlogon_minworkingsetsize = -1;
  52 static int hf_netlogon_maxworkingsetsize = -1;
  53 static int hf_netlogon_pagedpoollimit = -1;
  54 static int hf_netlogon_pagefilelimit = -1;
  55 static int hf_netlogon_timelimit = -1;
  56 static int hf_netlogon_nonpagedpoollimit = -1;
  57 static int hf_netlogon_pac_size = -1;
  58 static int hf_netlogon_pac_data = -1;
  59 static int hf_netlogon_auth_size = -1;
  60 static int hf_netlogon_auth_data = -1;
  61 static int hf_netlogon_cipher_len = -1;
  62 static int hf_netlogon_cipher_maxlen = -1;
  63 static int hf_netlogon_cipher_current_data = -1;
  64 static int hf_netlogon_cipher_current_set_time = -1;
  65 static int hf_netlogon_cipher_old_data = -1;
  66 static int hf_netlogon_cipher_old_set_time = -1;
  67 static int hf_netlogon_priv = -1;
  68 static int hf_netlogon_privilege_entries = -1;
  69 static int hf_netlogon_privilege_control = -1;
  70 static int hf_netlogon_privilege_name = -1;
  71 static int hf_netlogon_systemflags = -1;
  72 static int hf_netlogon_pdc_connection_status = -1;
  73 static int hf_netlogon_tc_connection_status = -1;
  74 static int hf_netlogon_restart_state = -1;
  75 static int hf_netlogon_attrs = -1;
  76 static int hf_netlogon_count = -1;
  77 static int hf_netlogon_entries = -1;
  78 static int hf_netlogon_minpasswdlen = -1;
  79 static int hf_netlogon_passwdhistorylen = -1;
  80 static int hf_netlogon_level16 = -1;
  81 static int hf_netlogon_validation_level = -1;
  82 static int hf_netlogon_reference = -1;
  83 static int hf_netlogon_next_reference = -1;
  84 static int hf_netlogon_timestamp = -1;
  85 static int hf_netlogon_level = -1;
  86 static int hf_netlogon_challenge = -1;
  87 static int hf_netlogon_reserved = -1;
  88 static int hf_netlogon_audit_retention_period = -1;
  89 static int hf_netlogon_auditing_mode = -1;
  90 static int hf_netlogon_max_audit_event_count = -1;
  91 static int hf_netlogon_event_audit_option = -1;
  92 static int hf_netlogon_unknown_string = -1;
  93 static int hf_netlogon_unknown_long = -1;
  94 static int hf_netlogon_unknown_short = -1;
  95 static int hf_netlogon_unknown_char = -1;
  96 static int hf_netlogon_logon_time = -1;
  97 static int hf_netlogon_logoff_time = -1;
  98 static int hf_netlogon_kickoff_time = -1;
  99 static int hf_netlogon_pwd_last_set_time = -1;
 100 static int hf_netlogon_pwd_can_change_time = -1;
 101 static int hf_netlogon_pwd_must_change_time = -1;
 102 static int hf_netlogon_nt_chal_resp = -1;
 103 static int hf_netlogon_lm_chal_resp = -1;
 104 static int hf_netlogon_credential = -1;
 105 static int hf_netlogon_acct_name = -1;
 106 static int hf_netlogon_acct_desc = -1;
 107 static int hf_netlogon_group_desc = -1;
 108 static int hf_netlogon_full_name = -1;
 109 static int hf_netlogon_comment = -1;
 110 static int hf_netlogon_parameters = -1;
 111 static int hf_netlogon_logon_script = -1;
 112 static int hf_netlogon_profile_path = -1;
 113 static int hf_netlogon_home_dir = -1;
 114 static int hf_netlogon_dir_drive = -1;
 115 static int hf_netlogon_logon_count = -1;
 116 static int hf_netlogon_logon_count16 = -1;
 117 static int hf_netlogon_bad_pw_count = -1;
 118 static int hf_netlogon_bad_pw_count16 = -1;
 119 static int hf_netlogon_user_rid = -1;
 120 static int hf_netlogon_alias_rid = -1;
 121 static int hf_netlogon_group_rid = -1;
 122 static int hf_netlogon_logon_srv = -1;
 123 static int hf_netlogon_principal = -1;
 124 static int hf_netlogon_logon_dom = -1;
 125 static int hf_netlogon_downlevel_domain_name = -1;
 126 static int hf_netlogon_dns_domain_name = -1;
 127 static int hf_netlogon_domain_name = -1;
 128 static int hf_netlogon_domain_create_time = -1;
 129 static int hf_netlogon_domain_modify_time = -1;
 130 static int hf_netlogon_modify_count = -1;
 131 static int hf_netlogon_db_modify_time = -1;
 132 static int hf_netlogon_db_create_time = -1;
 133 static int hf_netlogon_oem_info = -1;
 134 static int hf_netlogon_serial_number = -1;
 135 static int hf_netlogon_num_rids = -1;
 136 static int hf_netlogon_num_trusts = -1;
 137 static int hf_netlogon_num_controllers = -1;
 138 static int hf_netlogon_num_other_groups = -1;
 139 static int hf_netlogon_computer_name = -1;
 140 static int hf_netlogon_site_name = -1;
 141 static int hf_netlogon_trusted_dc_name = -1;
 142 static int hf_netlogon_dc_name = -1;
 143 static int hf_netlogon_dc_site_name = -1;
 144 static int hf_netlogon_dns_forest_name = -1;
 145 static int hf_netlogon_dc_address = -1;
 146 static int hf_netlogon_dc_address_type = -1;
 147 static int hf_netlogon_client_site_name = -1;
 148 static int hf_netlogon_workstation = -1;
 149 static int hf_netlogon_workstation_site_name = -1;
 150 static int hf_netlogon_workstation_os = -1;
 151 static int hf_netlogon_workstations = -1;
 152 static int hf_netlogon_workstation_fqdn = -1;
 153 static int hf_netlogon_group_name = -1;
 154 static int hf_netlogon_alias_name = -1;
 155 static int hf_netlogon_country = -1;
 156 static int hf_netlogon_codepage = -1;
 157 static int hf_netlogon_flags = -1;
 158 static int hf_netlogon_trust_attribs = -1;
 159 static int hf_netlogon_trust_type = -1;
 160 static int hf_netlogon_trust_flags = -1;
 161 static int hf_netlogon_trust_flags_inbound = -1;
 162 static int hf_netlogon_trust_flags_outbound = -1;
 163 static int hf_netlogon_trust_flags_in_forest = -1;
 164 static int hf_netlogon_trust_flags_native_mode = -1;
 165 static int hf_netlogon_trust_flags_primary = -1;
 166 static int hf_netlogon_trust_flags_tree_root = -1;
 167 static int hf_netlogon_trust_parent_index = -1;
 168 static int hf_netlogon_user_flags = -1;
 169 static int hf_netlogon_auth_flags = -1;
 170 static int hf_netlogon_pwd_expired = -1;
 171 static int hf_netlogon_nt_pwd_present = -1;
 172 static int hf_netlogon_lm_pwd_present = -1;
 173 static int hf_netlogon_code = -1;
 174 static int hf_netlogon_database_id = -1;
 175 static int hf_netlogon_sync_context = -1;
 176 static int hf_netlogon_max_size = -1;
 177 static int hf_netlogon_max_log_size = -1;
 178 static int hf_netlogon_dns_host = -1;
 179 static int hf_netlogon_acct_expiry_time = -1;
 180 static int hf_netlogon_encrypted_lm_owf_password = -1;
 181 static int hf_netlogon_lm_owf_password = -1;
 182 static int hf_netlogon_nt_owf_password = -1;
 183 static int hf_netlogon_param_ctrl = -1;
 184 static int hf_netlogon_logon_id = -1;
 185 static int hf_netlogon_num_deltas = -1;
 186 static int hf_netlogon_user_session_key = -1;
 187 static int hf_netlogon_blob_size = -1;
 188 static int hf_netlogon_blob = -1;
 189 static int hf_netlogon_logon_attempts = -1;
 190 static int hf_netlogon_authoritative = -1;
 191 static int hf_netlogon_secure_channel_type = -1;
 192 static int hf_netlogon_logonsrv_handle = -1;
 193 static int hf_netlogon_delta_type = -1;
 194 static int hf_netlogon_get_dcname_request_flags = -1;
 195 static int hf_netlogon_get_dcname_request_flags_force_rediscovery = -1;
 196 static int hf_netlogon_get_dcname_request_flags_directory_service_required = -1;
 197 static int hf_netlogon_get_dcname_request_flags_directory_service_preferred = -1;
 198 static int hf_netlogon_get_dcname_request_flags_gc_server_required = -1;
 199 static int hf_netlogon_get_dcname_request_flags_pdc_required = -1;
 200 static int hf_netlogon_get_dcname_request_flags_background_only = -1;
 201 static int hf_netlogon_get_dcname_request_flags_ip_required = -1;
 202 static int hf_netlogon_get_dcname_request_flags_kdc_required = -1;
 203 static int hf_netlogon_get_dcname_request_flags_timeserv_required = -1;
 204 static int hf_netlogon_get_dcname_request_flags_writable_required = -1;
 205 static int hf_netlogon_get_dcname_request_flags_good_timeserv_preferred = -1;
 206 static int hf_netlogon_get_dcname_request_flags_avoid_self = -1;
 207 static int hf_netlogon_get_dcname_request_flags_only_ldap_needed = -1;
 208 static int hf_netlogon_get_dcname_request_flags_is_flat_name = -1;
 209 static int hf_netlogon_get_dcname_request_flags_is_dns_name = -1;
 210 static int hf_netlogon_get_dcname_request_flags_return_dns_name = -1;
 211 static int hf_netlogon_get_dcname_request_flags_return_flat_name = -1;
 212 static int hf_netlogon_dc_flags = -1;
 213 static int hf_netlogon_dc_flags_pdc_flag = -1;
 214 static int hf_netlogon_dc_flags_gc_flag = -1;
 215 static int hf_netlogon_dc_flags_ldap_flag = -1;
 216 static int hf_netlogon_dc_flags_ds_flag = -1;
 217 static int hf_netlogon_dc_flags_kdc_flag = -1;
 218 static int hf_netlogon_dc_flags_timeserv_flag = -1;
 219 static int hf_netlogon_dc_flags_closest_flag = -1;
 220 static int hf_netlogon_dc_flags_writable_flag = -1;
 221 static int hf_netlogon_dc_flags_good_timeserv_flag = -1;
 222 static int hf_netlogon_dc_flags_ndnc_flag = -1;
 223 static int hf_netlogon_dc_flags_dns_controller_flag = -1;
 224 static int hf_netlogon_dc_flags_dns_domain_flag = -1;
 225 static int hf_netlogon_dc_flags_dns_forest_flag = -1;
 226
 227 static gint ett_dcerpc_netlogon = -1;
 228 static gint ett_QUOTA_LIMITS = -1;
 229 static gint ett_IDENTITY_INFO = -1;
 230 static gint ett_DELTA_ENUM = -1;
 231 static gint ett_CYPHER_VALUE = -1;
 232 static gint ett_UNICODE_MULTI = -1;
 233 static gint ett_DOMAIN_CONTROLLER_INFO = -1;
 234 static gint ett_UNICODE_STRING_512 = -1;
 235 static gint ett_TYPE_50 = -1;
 236 static gint ett_TYPE_52 = -1;
 237 static gint ett_DELTA_ID_UNION = -1;
 238 static gint ett_TYPE_44 = -1;
 239 static gint ett_DELTA_UNION = -1;
 240 static gint ett_LM_OWF_PASSWORD = -1;
 241 static gint ett_NT_OWF_PASSWORD = -1;
 242 static gint ett_GROUP_MEMBERSHIP = -1;
 243 static gint ett_BLOB = -1;
 244 static gint ett_DS_DOMAIN_TRUSTS = -1;
 245 static gint ett_DOMAIN_TRUST_INFO = -1;
 246 static gint ett_trust_flags = -1;
 247 static gint ett_get_dcname_request_flags = -1;
 248 static gint ett_dc_flags = -1;
 249
 250 static e_uuid_t uuid_dcerpc_netlogon = {
 251         0x12345678, 0x1234, 0xabcd,
 252         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0xcf, 0xfb }
 253 };
 254
 255 static guint16 ver_dcerpc_netlogon = 1;
 256
 257
 258
 259 static int
 260 netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset,
 261                         packet_info *pinfo, proto_tree *tree,
 262                         char *drep)
 263 {
 264         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 265                 NDR_POINTER_UNIQUE, "Server Handle",
 266                 hf_netlogon_logonsrv_handle, 0);
 267
 268         return offset;
 269 }
 270
 271 /*
 272  * IDL typedef struct {
 273  * IDL    [unique][string] wchar_t *effective_name;
 274  * IDL    long priv;
 275  * IDL    long auth_flags;
 276  * IDL    long logon_count;
 277  * IDL    long bad_pw_count;
 278  * IDL    long last_logon;
 279  * IDL    long last_logoff;
 280  * IDL    long logoff_time;
 281  * IDL    long kickoff_time;
 282  * IDL    long password_age;
 283  * IDL    long pw_can_change;
 284  * IDL    long pw_must_change;
 285  * IDL    [unique][string] wchar_t *computer;
 286  * IDL    [unique][string] wchar_t *domain;
 287  * IDL    [unique][string] wchar_t *script_path;
 288  * IDL    long reserved;
 289  */
 290 static int
 291 netlogon_dissect_VALIDATION_UAS_INFO(tvbuff_t *tvb, int offset,
 292                         packet_info *pinfo, proto_tree *tree,
 293                         char *drep)
 294 {
 295         dcerpc_info *di;
 296
 297         di=pinfo->private_data;
 298         if(di->conformant_run){
 299                 /*just a run to handle conformant arrays, nothing to dissect */
 300                 return offset;
 301         }
 302
 303         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 304                 NDR_POINTER_UNIQUE, "Effective Account",
 305                 hf_netlogon_acct_name, 0);
 306
 307         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 308                 hf_netlogon_priv, NULL);
 309
 310         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 311                 hf_netlogon_auth_flags, NULL);
 312
 313         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 314                 hf_netlogon_logon_count, NULL);
 315
 316         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 317                 hf_netlogon_bad_pw_count, NULL);
 318
 319         /* XXX - are these all UNIX "time_t"s, like the time stamps in
 320            credentials?
 321
 322            Or are they, as per some RAP-based operations, UTIMEs? */
 323         proto_tree_add_text(tree, tvb, offset, 4, "Last Logon: unknown time format");
 324         offset+= 4;
 325
 326         proto_tree_add_text(tree, tvb, offset, 4, "Last Logoff: unknown time format");
 327         offset+= 4;
 328
 329         proto_tree_add_text(tree, tvb, offset, 4, "Logoff Time: unknown time format");
 330         offset+= 4;
 331
 332         proto_tree_add_text(tree, tvb, offset, 4, "Kickoff Time: unknown time format");
 333         offset+= 4;
 334
 335         proto_tree_add_text(tree, tvb, offset, 4, "Password Age: unknown time format");
 336         offset+= 4;
 337
 338         proto_tree_add_text(tree, tvb, offset, 4, "PW Can Change: unknown time format");
 339         offset+= 4;
 340
 341         proto_tree_add_text(tree, tvb, offset, 4, "PW Must Change: unknown time format");
 342         offset+= 4;
 343
 344         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 345                 NDR_POINTER_UNIQUE, "Computer", hf_netlogon_computer_name, 0);
 346
 347         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 348                 NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0);
 349
 350         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 351                 NDR_POINTER_UNIQUE, "Script", hf_netlogon_logon_script, 0);
 352
 353         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 354                 hf_netlogon_reserved, NULL);
 355
 356         return offset;
 357 }
 358
 359 /*
 360  * IDL long NetrLogonUasLogon(
 361  * IDL      [in][unique][string] wchar_t *ServerName,
 362  * IDL      [in][ref][string] wchar_t *UserName,
 363  * IDL      [in][ref][string] wchar_t *Workstation,
 364  * IDL      [out][unique] VALIDATION_UAS_INFO *info
 365  * IDL );
 366  */
 367 static int
 368 netlogon_dissect_netrlogonuaslogon_rqst(tvbuff_t *tvb, int offset,
 369         packet_info *pinfo, proto_tree *tree, char *drep)
 370 {
 371         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
 372                 pinfo, tree, drep);
 373
 374         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 375                 NDR_POINTER_REF, "Account", hf_netlogon_acct_name, 0);
 376
 377         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 378                 NDR_POINTER_REF, "Workstation", hf_netlogon_workstation, 0);
 379
 380         return offset;
 381 }
 382
 383
 384 static int
 385 netlogon_dissect_netrlogonuaslogon_reply(tvbuff_t *tvb, int offset,
 386         packet_info *pinfo, proto_tree *tree, char *drep)
 387 {
 388         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 389                 netlogon_dissect_VALIDATION_UAS_INFO, NDR_POINTER_UNIQUE,
 390                 "VALIDATION_UAS_INFO", -1);
 391
 392         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 393                                   hf_netlogon_rc, NULL);
 394
 395         return offset;
 396 }
 397
 398 /*
 399  * IDL typedef struct {
 400  * IDL   long duration;
 401  * IDL   short logon_count;
 402  * IDL } LOGOFF_UAS_INFO;
 403  */
 404 static int
 405 netlogon_dissect_LOGOFF_UAS_INFO(tvbuff_t *tvb, int offset,
 406                         packet_info *pinfo, proto_tree *tree,
 407                         char *drep)
 408 {
 409         dcerpc_info *di;
 410
 411         di=pinfo->private_data;
 412         if(di->conformant_run){
 413                 /*just a run to handle conformant arrays, nothing to dissect */
 414                 return offset;
 415         }
 416
 417         proto_tree_add_text(tree, tvb, offset, 4, "Duration: unknown time format");
 418         offset+= 4;
 419
 420         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 421                 hf_netlogon_logon_count16, NULL);
 422
 423         return offset;
 424 }
 425
 426 /*
 427  * IDL long NetrLogonUasLogoff(
 428  * IDL      [in][unique][string] wchar_t *ServerName,
 429  * IDL      [in][ref][string] wchar_t *UserName,
 430  * IDL      [in][ref][string] wchar_t *Workstation,
 431  * IDL      [out][ref] LOGOFF_UAS_INFO *info
 432  * IDL );
 433  */
 434 static int
 435 netlogon_dissect_netrlogonuaslogoff_rqst(tvbuff_t *tvb, int offset,
 436         packet_info *pinfo, proto_tree *tree, char *drep)
 437 {
 438         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
 439                 pinfo, tree, drep);
 440
 441         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 442                 NDR_POINTER_REF, "Account", hf_netlogon_acct_name, 0);
 443
 444         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
 445                 NDR_POINTER_REF, "Workstation", hf_netlogon_workstation, 0);
 446
 447         return offset;
 448 }
 449
 450
 451 static int
 452 netlogon_dissect_netrlogonuaslogoff_reply(tvbuff_t *tvb, int offset,
 453         packet_info *pinfo, proto_tree *tree, char *drep)
 454 {
 455         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 456                 netlogon_dissect_LOGOFF_UAS_INFO, NDR_POINTER_REF,
 457                 "LOGOFF_UAS_INFO", -1);
 458
 459         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
 460                                   hf_netlogon_rc, NULL);
 461
 462         return offset;
 463 }
 464
 465
 466
 467
 468 /*
 469  * IDL typedef struct {
 470  * IDL   UNICODESTRING LogonDomainName;
 471  * IDL   long ParameterControl;
 472  * IDL   uint64 LogonID;
 473  * IDL   UNICODESTRING UserName;
 474  * IDL   UNICODESTRING Workstation;
 475  * IDL } LOGON_IDENTITY_INFO;
 476  */
 477 static int
 478 netlogon_dissect_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
 479                         packet_info *pinfo, proto_tree *parent_tree,
 480                         char *drep)
 481 {
 482         proto_item *item=NULL;
 483         proto_tree *tree=NULL;
 484         int old_offset=offset;
 485
 486         if(parent_tree){
 487                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 488                         "IDENTITY_INFO:");
 489                 tree = proto_item_add_subtree(item, ett_IDENTITY_INFO);
 490         }
 491
 492         /* XXX: It would be nice to get the domain and account name
 493            displayed in COL_INFO. */
 494
 495         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 496                 hf_netlogon_logon_dom, 0);
 497
 498         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 499                 hf_netlogon_param_ctrl, NULL);
 500
 501         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 502                 hf_netlogon_logon_id, NULL);
 503
 504         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 505                 hf_netlogon_acct_name, 0);
 506
 507         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 508                 hf_netlogon_workstation, 0);
 509
 510 #ifdef REMOVED
 511         /* NetMon does not recognize these bytes. Ill comment them out until someone complains */
 512         /* XXX 8 extra bytes here */
 513         /* there were 8 extra bytes, either here or in NETWORK_INFO that does not match
 514            the idl file. Could be a bug in either the NETLOGON implementation or in the
 515            idl file.
 516         */
 517         offset = netlogon_dissect_8_unknown_bytes(tvb, offset, pinfo, tree, drep);
 518 #endif
 519
 520         proto_item_set_len(item, offset-old_offset);
 521         return offset;
 522 }
 523
 524
 525 /*
 526  * IDL typedef struct {
 527  * IDL   char password[16];
 528  * IDL } LM_OWF_PASSWORD;
 529  */
 530 static int
 531 netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 532                         packet_info *pinfo, proto_tree *parent_tree,
 533                         char *drep _U_)
 534 {
 535         proto_item *item=NULL;
 536         proto_tree *tree=NULL;
 537         dcerpc_info *di;
 538
 539         di=pinfo->private_data;
 540         if(di->conformant_run){
 541                 /*just a run to handle conformant arrays, nothing to dissect.*/
 542                 return offset;
 543         }
 544
 545         if(parent_tree){
 546                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 547                         "LM_OWF_PASSWORD:");
 548                 tree = proto_item_add_subtree(item, ett_LM_OWF_PASSWORD);
 549         }
 550
 551         proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16,
 552                 FALSE);
 553         offset += 16;
 554
 555         return offset;
 556 }
 557
 558 /*
 559  * IDL typedef struct {
 560  * IDL   char password[16];
 561  * IDL } NT_OWF_PASSWORD;
 562  */
 563 static int
 564 netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 565                         packet_info *pinfo, proto_tree *parent_tree,
 566                         char *drep _U_)
 567 {
 568         proto_item *item=NULL;
 569         proto_tree *tree=NULL;
 570         dcerpc_info *di;
 571
 572         di=pinfo->private_data;
 573         if(di->conformant_run){
 574                 /*just a run to handle conformant arrays, nothing to dissect.*/
 575                 return offset;
 576         }
 577
 578         if(parent_tree){
 579                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 580                         "NT_OWF_PASSWORD:");
 581                 tree = proto_item_add_subtree(item, ett_NT_OWF_PASSWORD);
 582         }
 583
 584         proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16,
 585                 FALSE);
 586         offset += 16;
 587
 588         return offset;
 589 }
 590
 591
 592 /*
 593  * IDL typedef struct {
 594  * IDL   LOGON_IDENTITY_INFO identity_info;
 595  * IDL   LM_OWF_PASSWORD lmpassword;
 596  * IDL   NT_OWF_PASSWORD ntpassword;
 597  * IDL } INTERACTIVE_INFO;
 598  */
 599 static int
 600 netlogon_dissect_INTERACTIVE_INFO(tvbuff_t *tvb, int offset,
 601                         packet_info *pinfo, proto_tree *tree,
 602                         char *drep)
 603 {
 604         offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
 605                 pinfo, tree, drep);
 606
 607         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
 608                 pinfo, tree, drep);
 609
 610         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
 611                 pinfo, tree, drep);
 612
 613         return offset;
 614 }
 615
 616 /*
 617  * IDL typedef struct {
 618  * IDL   char chl[8];
 619  * IDL } CHALLENGE;
 620  */
 621 static int
 622 netlogon_dissect_CHALLENGE(tvbuff_t *tvb, int offset,
 623                         packet_info *pinfo, proto_tree *tree,
 624                         char *drep _U_)
 625 {
 626         dcerpc_info *di;
 627
 628         di=pinfo->private_data;
 629         if(di->conformant_run){
 630                 /*just a run to handle conformant arrays, nothing to dissect.*/
 631                 return offset;
 632         }
 633
 634         proto_tree_add_item(tree, hf_netlogon_challenge, tvb, offset, 8,
 635                 FALSE);
 636         offset += 8;
 637
 638         return offset;
 639 }
 640
 641 /*
 642  * IDL typedef struct {
 643  * IDL   LOGON_IDENTITY_INFO logon_info;
 644  * IDL   CHALLENGE chal;
 645  * IDL   STRING ntchallengeresponse;
 646  * IDL   STRING lmchallengeresponse;
 647  * IDL } NETWORK_INFO;
 648  */
 649
 650 static void dissect_nt_chal_resp_cb(packet_info *pinfo _U_, proto_tree *tree,
 651                                     proto_item *item _U_, tvbuff_t *tvb,
 652                                     int start_offset, int end_offset,
 653                                     void *callback_args _U_)
 654 {
 655         int len;
 656
 657         /* Skip over 3 guint32's in NDR format */
 658
 659         if (start_offset % 4)
 660                 start_offset += 4 - (start_offset % 4);
 661
 662         start_offset += 12;
 663         len = end_offset - start_offset;
 664
 665         /* Call ntlmv2 response dissector */
 666
 667         if (len > 24)
 668                 dissect_ntlmv2_response(tvb, tree, start_offset, len);
 669 }
 670
 671 static int
 672 netlogon_dissect_NETWORK_INFO(tvbuff_t *tvb, int offset,
 673                 packet_info *pinfo, proto_tree *tree,
 674                 char *drep)
 675 {
 676         offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
 677                 pinfo, tree, drep);
 678
 679         offset = netlogon_dissect_CHALLENGE(tvb, offset,
 680                 pinfo, tree, drep);
 681
 682         offset = dissect_ndr_counted_byte_array_cb(
 683                 tvb, offset, pinfo, tree, drep, hf_netlogon_nt_chal_resp,
 684                 dissect_nt_chal_resp_cb, NULL);
 685
 686         offset = dissect_ndr_counted_byte_array(tvb, offset, pinfo, tree, drep,
 687                 hf_netlogon_lm_chal_resp);
 688
 689         return offset;
 690 }
 691
 692 /*
 693  * IDL typedef struct {
 694  * IDL   LOGON_IDENTITY_INFO logon_info;
 695  * IDL   LM_OWF_PASSWORD lmpassword;
 696  * IDL   NT_OWF_PASSWORD ntpassword;
 697  * IDL } SERVICE_INFO;
 698  */
 699 static int
 700 netlogon_dissect_SERVICE_INFO(tvbuff_t *tvb, int offset,
 701                 packet_info *pinfo, proto_tree *tree,
 702                 char *drep)
 703 {
 704         offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
 705                 pinfo, tree, drep);
 706
 707         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
 708                 pinfo, tree, drep);
 709
 710         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
 711                 pinfo, tree, drep);
 712
 713         return offset;
 714 }
 715
 716 /*
 717  * IDL typedef [switch_type(short)] union {
 718  * IDL    [case(1)][unique] INTERACTIVE_INFO *iinfo;
 719  * IDL    [case(2)][unique] NETWORK_INFO *ninfo;
 720  * IDL    [case(3)][unique] SERVICE_INFO *sinfo;
 721  * IDL } LEVEL;
 722  */
 723 static int
 724 netlogon_dissect_LEVEL(tvbuff_t *tvb, int offset,
 725                         packet_info *pinfo, proto_tree *tree,
 726                         char *drep)
 727 {
 728         guint16 level;
 729
 730         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 731                 hf_netlogon_level16, &level);
 732
 733         ALIGN_TO_4_BYTES;
 734         switch(level){
 735         case 1:
 736                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 737                         netlogon_dissect_INTERACTIVE_INFO, NDR_POINTER_UNIQUE,
 738                         "INTERACTIVE_INFO:", -1);
 739                 break;
 740         case 2:
 741                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 742                         netlogon_dissect_NETWORK_INFO, NDR_POINTER_UNIQUE,
 743                         "NETWORK_INFO:", -1);
 744                 break;
 745         case 3:
 746                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 747                         netlogon_dissect_SERVICE_INFO, NDR_POINTER_UNIQUE,
 748                         "SERVICE_INFO:", -1);
 749                 break;
 750         }
 751
 752         return offset;
 753 }
 754
 755 /*
 756  * IDL typedef struct {
 757  * IDL   char cred[8];
 758  * IDL } CREDENTIAL;
 759  */
 760 static int
 761 netlogon_dissect_CREDENTIAL(tvbuff_t *tvb, int offset,
 762                         packet_info *pinfo, proto_tree *tree,
 763                         char *drep _U_)
 764 {
 765         dcerpc_info *di;
 766
 767         di=pinfo->private_data;
 768         if(di->conformant_run){
 769                 /*just a run to handle conformant arrays, nothing to dissect.*/
 770                 return offset;
 771         }
 772
 773         proto_tree_add_item(tree, hf_netlogon_credential, tvb, offset, 8,
 774                 FALSE);
 775         offset += 8;
 776
 777         return offset;
 778 }
 779
 780
 781 /*
 782  * IDL typedef struct {
 783  * IDL   CREDENTIAL cred;
 784  * IDL   long timestamp;
 785  * IDL } AUTHENTICATOR;
 786  */
 787 static int
 788 netlogon_dissect_AUTHENTICATOR(tvbuff_t *tvb, int offset,
 789                         packet_info *pinfo, proto_tree *tree,
 790                         char *drep)
 791 {
 792         dcerpc_info *di;
 793         nstime_t ts;
 794
 795         di=pinfo->private_data;
 796         if(di->conformant_run){
 797                 /*just a run to handle conformant arrays, nothing to dissect */
 798                 return offset;
 799         }
 800
 801         offset = netlogon_dissect_CREDENTIAL(tvb, offset,
 802                 pinfo, tree, drep);
 803
 804         /*
 805          * XXX - this appears to be a UNIX time_t in some credentials, but
 806          * appears to be random junk in other credentials.
 807          * For example, it looks like a UNIX time_t in "credential"
 808          * AUTHENTICATORs, but like random junk in "return_authenticator"
 809          * AUTHENTICATORs.
 810          */
 811         ALIGN_TO_4_BYTES;
 812         ts.secs = tvb_get_letohl(tvb, offset);
 813         ts.nsecs = 0;
 814         proto_tree_add_time(tree, hf_netlogon_timestamp, tvb, offset, 4, &ts);
 815         offset+= 4;
 816
 817         return offset;
 818 }
 819
 820
 821 /*
 822  * IDL typedef struct {
 823  * IDL   long user_id;
 824  * IDL   long attributes;
 825  * IDL } GROUP_MEMBERSHIP;
 826  */
 827 static int
 828 netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
 829                         packet_info *pinfo, proto_tree *parent_tree,
 830                         char *drep)
 831 {
 832         proto_item *item=NULL;
 833         proto_tree *tree=NULL;
 834
 835         if(parent_tree){
 836                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 837                         "GROUP_MEMBERSHIP:");
 838                 tree = proto_item_add_subtree(item, ett_GROUP_MEMBERSHIP);
 839         }
 840
 841         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 842                 hf_netlogon_group_rid, NULL);
 843
 844         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 845                 hf_netlogon_attrs, NULL);
 846
 847         return offset;
 848 }
 849
 850 static int
 851 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset,
 852                         packet_info *pinfo, proto_tree *tree,
 853                         char *drep)
 854 {
 855         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 856                 netlogon_dissect_GROUP_MEMBERSHIP);
 857
 858         return offset;
 859 }
 860
 861 /*
 862  * IDL typedef struct {
 863  * IDL   char user_session_key[16];
 864  * IDL } USER_SESSION_KEY;
 865  */
 866 static int
 867 netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset,
 868                         packet_info *pinfo, proto_tree *tree,
 869                         char *drep _U_)
 870 {
 871         dcerpc_info *di;
 872
 873         di=pinfo->private_data;
 874         if(di->conformant_run){
 875                 /*just a run to handle conformant arrays, nothing to dissect.*/
 876                 return offset;
 877         }
 878
 879         proto_tree_add_item(tree, hf_netlogon_user_session_key, tvb, offset, 16,
 880                 FALSE);
 881         offset += 16;
 882
 883         return offset;
 884 }
 885
 886 /*
 887  * IDL typedef struct {
 888  * IDL   uint64 LogonTime;
 889  * IDL   uint64 LogoffTime;
 890  * IDL   uint64 KickOffTime;
 891  * IDL   uint64 PasswdLastSet;
 892  * IDL   uint64 PasswdCanChange;
 893  * IDL   uint64 PasswdMustChange;
 894  * IDL   unicodestring effectivename;
 895  * IDL   unicodestring fullname;
 896  * IDL   unicodestring logonscript;
 897  * IDL   unicodestring profilepath;
 898  * IDL   unicodestring homedirectory;
 899  * IDL   unicodestring homedirectorydrive;
 900  * IDL   short LogonCount;
 901  * IDL   short BadPasswdCount;
 902  * IDL   long userid;
 903  * IDL   long primarygroup;
 904  * IDL   long groupcount;
 905  * IDL   [unique][size_is(groupcount)] GROUP_MEMBERSHIP *groupids;
 906  * IDL   long userflags;
 907  * IDL   USER_SESSION_KEY key;
 908  * IDL   unicodestring logonserver;
 909  * IDL   unicodestring domainname;
 910  * IDL   [unique] SID logondomainid;
 911  * IDL   long expansionroom[10];
 912  * IDL } VALIDATION_SAM_INFO;
 913  */
 914 static int
 915 netlogon_dissect_VALIDATION_SAM_INFO(tvbuff_t *tvb, int offset,
 916                 packet_info *pinfo, proto_tree *tree,
 917                 char *drep)
 918 {
 919         int i;
 920
 921         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 922                 hf_netlogon_logon_time);
 923
 924         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 925                 hf_netlogon_logoff_time);
 926
 927         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 928                 hf_netlogon_kickoff_time);
 929
 930         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 931                 hf_netlogon_pwd_last_set_time);
 932
 933         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 934                 hf_netlogon_pwd_can_change_time);
 935
 936         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 937                 hf_netlogon_pwd_must_change_time);
 938
 939         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 940                 hf_netlogon_acct_name, 0);
 941
 942         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 943                 hf_netlogon_full_name, 0);
 944
 945         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 946                 hf_netlogon_logon_script, 0);
 947
 948         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 949                 hf_netlogon_profile_path, 0);
 950
 951         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 952                 hf_netlogon_home_dir, 0);
 953
 954         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 955                 hf_netlogon_dir_drive, 0);
 956
 957         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 958                 hf_netlogon_logon_count16, NULL);
 959
 960         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 961                 hf_netlogon_bad_pw_count16, NULL);
 962
 963         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 964                 hf_netlogon_user_rid, NULL);
 965
 966         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 967                 hf_netlogon_group_rid, NULL);
 968
 969         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 970                 hf_netlogon_num_rids, NULL);
 971
 972         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 973                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
 974                 "GROUP_MEMBERSHIP_ARRAY", -1);
 975
 976         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 977                 hf_netlogon_user_flags, NULL);
 978
 979         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 980                 pinfo, tree, drep);
 981
 982         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 983                 hf_netlogon_logon_srv, 0);
 984
 985         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 986                 hf_netlogon_logon_dom, 0);
 987
 988         offset = dissect_ndr_nt_PSID(tvb, offset,
 989                 pinfo, tree, drep, -1);
 990
 991         for(i=0;i<10;i++){
 992                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 993                         hf_netlogon_reserved, NULL);
 994         }
 995
 996         return offset;
 997 }
 998
 999
1000
1001 /*
1002  * IDL typedef struct {
1003  * IDL   uint64 LogonTime;
1004  * IDL   uint64 LogoffTime;
1005  * IDL   uint64 KickOffTime;
1006  * IDL   uint64 PasswdLastSet;
1007  * IDL   uint64 PasswdCanChange;
1008  * IDL   uint64 PasswdMustChange;
1009  * IDL   unicodestring effectivename;
1010  * IDL   unicodestring fullname;
1011  * IDL   unicodestring logonscript;
1012  * IDL   unicodestring profilepath;
1013  * IDL   unicodestring homedirectory;
1014  * IDL   unicodestring homedirectorydrive;
1015  * IDL   short LogonCount;
1016  * IDL   short BadPasswdCount;
1017  * IDL   long userid;
1018  * IDL   long primarygroup;
1019  * IDL   long groupcount;
1020  * IDL   [unique] GROUP_MEMBERSHIP *groupids;
1021  * IDL   long userflags;
1022  * IDL   USER_SESSION_KEY key;
1023  * IDL   unicodestring logonserver;
1024  * IDL   unicodestring domainname;
1025  * IDL   [unique] SID logondomainid;
1026  * IDL   long expansionroom[10];
1027  * IDL   long sidcount;
1028  * IDL   [unique] SID_AND_ATTRIBS;
1029  * IDL } VALIDATION_SAM_INFO2;
1030  */
1031 static int
1032 netlogon_dissect_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset,
1033                         packet_info *pinfo, proto_tree *tree,
1034                         char *drep)
1035 {
1036         int i;
1037
1038         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1039                 hf_netlogon_logon_time);
1040
1041         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1042                 hf_netlogon_logoff_time);
1043
1044         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1045                 hf_netlogon_kickoff_time);
1046
1047         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1048                 hf_netlogon_pwd_last_set_time);
1049
1050         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1051                 hf_netlogon_pwd_can_change_time);
1052
1053         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1054                 hf_netlogon_pwd_must_change_time);
1055
1056         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1057                 hf_netlogon_acct_name, 0);
1058
1059         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1060                 hf_netlogon_full_name, 0);
1061
1062         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1063                 hf_netlogon_logon_script, 0);
1064
1065         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1066                 hf_netlogon_profile_path, 0);
1067
1068         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1069                 hf_netlogon_home_dir, 0);
1070
1071         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1072                 hf_netlogon_dir_drive, 0);
1073
1074         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1075                 hf_netlogon_logon_count16, NULL);
1076
1077         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1078                 hf_netlogon_bad_pw_count16, NULL);
1079
1080         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1081                 hf_netlogon_user_rid, NULL);
1082
1083         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1084                 hf_netlogon_group_rid, NULL);
1085
1086         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1087                 hf_netlogon_num_rids, NULL);
1088
1089         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1090                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
1091                 "GROUP_MEMBERSHIP_ARRAY", -1);
1092
1093         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1094                 hf_netlogon_user_flags, NULL);
1095
1096         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
1097                 pinfo, tree, drep);
1098
1099         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1100                 hf_netlogon_logon_srv, 0);
1101
1102         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1103                 hf_netlogon_logon_dom, 0);
1104
1105         offset = dissect_ndr_nt_PSID(tvb, offset,
1106                 pinfo, tree, drep, -1);
1107
1108         for(i=0;i<10;i++){
1109                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1110                         hf_netlogon_unknown_long, NULL);
1111         }
1112
1113         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1114                 hf_netlogon_num_other_groups, NULL);
1115
1116         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1117                 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
1118                 "SID_AND_ATTRIBUTES_ARRAY:", -1);
1119
1120         return offset;
1121 }
1122
1123
1124
1125 static int
1126 netlogon_dissect_PAC(tvbuff_t *tvb, int offset,
1127                         packet_info *pinfo, proto_tree *tree,
1128                         char *drep _U_)
1129 {
1130         dcerpc_info *di;
1131         guint32 pac_size;
1132
1133         di=pinfo->private_data;
1134         if(di->conformant_run){
1135                 /*just a run to handle conformant arrays, nothing to dissect */
1136                 return offset;
1137         }
1138
1139         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1140                 hf_netlogon_pac_size, &pac_size);
1141
1142         proto_tree_add_item(tree, hf_netlogon_pac_data, tvb, offset, pac_size,
1143                 FALSE);
1144         offset += pac_size;
1145
1146         return offset;
1147 }
1148
1149 static int
1150 netlogon_dissect_AUTH(tvbuff_t *tvb, int offset,
1151                         packet_info *pinfo, proto_tree *tree,
1152                         char *drep _U_)
1153 {
1154         dcerpc_info *di;
1155         guint32 auth_size;
1156
1157         di=pinfo->private_data;
1158         if(di->conformant_run){
1159                 /*just a run to handle conformant arrays, nothing to dissect */
1160                 return offset;
1161         }
1162
1163         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1164                 hf_netlogon_auth_size, &auth_size);
1165
1166         proto_tree_add_item(tree, hf_netlogon_auth_data, tvb, offset, auth_size,
1167                 FALSE);
1168         offset += auth_size;
1169
1170         return offset;
1171 }
1172
1173
1174 /*
1175  * IDL typedef struct {
1176  * IDL   long pac_size
1177  * IDL   [unique][size_is(pac_size)] char *pac;
1178  * IDL   UNICODESTRING logondomain;
1179  * IDL   UNICODESTRING logonserver;
1180  * IDL   UNICODESTRING principalname;
1181  * IDL   long auth_size;
1182  * IDL   [unique][size_is(auth_size)] char *auth;
1183  * IDL   USER_SESSION_KEY user_session_key;
1184  * IDL   long expansionroom[10];
1185  * IDL   UNICODESTRING dummy1;
1186  * IDL   UNICODESTRING dummy2;
1187  * IDL   UNICODESTRING dummy3;
1188  * IDL   UNICODESTRING dummy4;
1189  * IDL } VALIDATION_PAC_INFO;
1190  */
1191 static int
1192 netlogon_dissect_VALIDATION_PAC_INFO(tvbuff_t *tvb, int offset,
1193                         packet_info *pinfo, proto_tree *tree,
1194                         char *drep)
1195 {
1196         int i;
1197
1198         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1199                 hf_netlogon_pac_size, NULL);
1200
1201         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1202                 netlogon_dissect_PAC, NDR_POINTER_UNIQUE, "PAC:", -1);
1203
1204         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1205                 hf_netlogon_logon_dom, 0);
1206
1207         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1208                 hf_netlogon_logon_srv, 0);
1209
1210         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1211                 hf_netlogon_principal, 0);
1212
1213         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1214                 hf_netlogon_auth_size, NULL);
1215
1216         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1217                 netlogon_dissect_AUTH, NDR_POINTER_UNIQUE, "AUTH:", -1);
1218
1219         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
1220                 pinfo, tree, drep);
1221
1222         for(i=0;i<10;i++){
1223                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1224                         hf_netlogon_unknown_long, NULL);
1225         }
1226
1227         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1228                 hf_netlogon_dummy, 0);
1229
1230         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1231                 hf_netlogon_dummy, 0);
1232
1233         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1234                 hf_netlogon_dummy, 0);
1235
1236         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1237                 hf_netlogon_dummy, 0);
1238
1239         return offset;
1240 }
1241
1242
1243 /*
1244  * IDL typedef [switch_type(short)] union {
1245  * IDL    [case(2)][unique] VALIDATION_SAM_INFO *sam;
1246  * IDL    [case(3)][unique] VALIDATION_SAM_INFO2 *sam2;
1247  * IDL    [case(4)][unique] VALIDATION_PAC_INFO *pac;
1248  * IDL    [case(5)][unique] VALIDATION_PAC_INFO *pac2;
1249  * IDL } VALIDATION;
1250  */
1251 static int
1252 netlogon_dissect_VALIDATION(tvbuff_t *tvb, int offset,
1253                         packet_info *pinfo, proto_tree *tree,
1254                         char *drep)
1255 {
1256         guint16 level;
1257
1258         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1259                 hf_netlogon_validation_level, &level);
1260
1261         ALIGN_TO_4_BYTES;
1262         switch(level){
1263         case 2:
1264                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1265                         netlogon_dissect_VALIDATION_SAM_INFO, NDR_POINTER_UNIQUE,
1266                         "VALIDATION_SAM_INFO:", -1);
1267                 break;
1268         case 3:
1269                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1270                         netlogon_dissect_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE,
1271                         "VALIDATION_SAM_INFO2:", -1);
1272                 break;
1273         case 4:
1274                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1275                         netlogon_dissect_VALIDATION_PAC_INFO, NDR_POINTER_UNIQUE,
1276                         "VALIDATION_PAC_INFO:", -1);
1277                 break;
1278         case 5:
1279                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1280                         netlogon_dissect_VALIDATION_PAC_INFO, NDR_POINTER_UNIQUE,
1281                         "VALIDATION_PAC_INFO:", -1);
1282                 break;
1283         }
1284
1285         return offset;
1286 }
1287
1288
1289 /*
1290  * IDL long NetrLogonSamLogon(
1291  * IDL      [in][unique][string] wchar_t *ServerName,
1292  * IDL      [in][unique][string] wchar_t *Workstation,
1293  * IDL      [in][unique] AUTHENTICATOR *credential,
1294  * IDL      [in][out][unique] AUTHENTICATOR *returnauthenticator,
1295  * IDL      [in] short LogonLevel,
1296  * IDL      [in][ref] LOGON_LEVEL *logonlevel,
1297  * IDL      [in] short ValidationLevel,
1298  * IDL      [out][ref] VALIDATION *validation,
1299  * IDL      [out][ref] boolean Authorative
1300  * IDL );
1301  */
1302 static int
1303 netlogon_dissect_netrlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
1304         packet_info *pinfo, proto_tree *tree, char *drep)
1305 {
1306         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1307                 pinfo, tree, drep);
1308
1309         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1310                 NDR_POINTER_UNIQUE, "Computer Name",
1311                 hf_netlogon_computer_name, 0);
1312
1313         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1314                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1315                 "AUTHENTICATOR: credential", -1);
1316
1317         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1318                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1319                 "AUTHENTICATOR: return_authenticator", -1);
1320
1321         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1322                 hf_netlogon_level16, NULL);
1323
1324         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1325                 netlogon_dissect_LEVEL, NDR_POINTER_REF,
1326                 "LEVEL: LogonLevel", -1);
1327
1328         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1329                 hf_netlogon_validation_level, NULL);
1330
1331         return offset;
1332 }
1333
1334 static int
1335 netlogon_dissect_netrlogonsamlogon_reply(tvbuff_t *tvb, int offset,
1336         packet_info *pinfo, proto_tree *tree, char *drep)
1337 {
1338         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1339                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1340                 "AUTHENTICATOR: return_authenticator", -1);
1341
1342         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1343                 netlogon_dissect_VALIDATION, NDR_POINTER_REF,
1344                 "VALIDATION:", -1);
1345
1346         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1347                 hf_netlogon_authoritative, NULL);
1348
1349         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1350                                   hf_netlogon_rc, NULL);
1351
1352         return offset;
1353 }
1354
1355
1356 /*
1357  * IDL long NetrLogonSamLogoff(
1358  * IDL      [in][unique][string] wchar_t *ServerName,
1359  * IDL      [in][unique][string] wchar_t *ComputerName,
1360  * IDL      [in][unique] AUTHENTICATOR credential,
1361  * IDL      [in][unique] AUTHENTICATOR return_authenticator,
1362  * IDL      [in] short logon_level,
1363  * IDL      [in][ref] LEVEL logoninformation
1364  * IDL );
1365  */
1366 static int
1367 netlogon_dissect_netrlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
1368         packet_info *pinfo, proto_tree *tree, char *drep)
1369 {
1370         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1371                 pinfo, tree, drep);
1372
1373         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1374                 NDR_POINTER_UNIQUE, "Computer Name",
1375                 hf_netlogon_computer_name, 0);
1376
1377         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1378                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1379                 "AUTHENTICATOR: credential", -1);
1380
1381         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1382                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1383                 "AUTHENTICATOR: return_authenticator", -1);
1384
1385         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1386                 hf_netlogon_level16, NULL);
1387
1388         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1389                 netlogon_dissect_LEVEL, NDR_POINTER_REF,
1390                 "LEVEL: logoninformation", -1);
1391
1392         return offset;
1393 }
1394 static int
1395 netlogon_dissect_netrlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
1396         packet_info *pinfo, proto_tree *tree, char *drep)
1397 {
1398
1399         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1400                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
1401                 "AUTHENTICATOR: return_authenticator", -1);
1402
1403         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1404                                   hf_netlogon_rc, NULL);
1405
1406         return offset;
1407 }
1408
1409
1410 /*
1411  * IDL long NetrServerReqChallenge(
1412  * IDL      [in][unique][string] wchar_t *ServerName,
1413  * IDL      [in][ref][string] wchar_t *ComputerName,
1414  * IDL      [in][ref] CREDENTIAL client_credential,
1415  * IDL      [out][ref] CREDENTIAL server_credential
1416  * IDL );
1417  */
1418 static int
1419 netlogon_dissect_netrserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
1420         packet_info *pinfo, proto_tree *tree, char *drep)
1421 {
1422         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1423                 pinfo, tree, drep);
1424
1425         offset = dissect_ndr_pointer_cb(
1426                 tvb, offset, pinfo, tree, drep,
1427                 dissect_ndr_wchar_cvstring, NDR_POINTER_REF,
1428                 "Computer Name", hf_netlogon_computer_name,
1429                 cb_wstr_postprocess,
1430                 GINT_TO_POINTER(CB_STR_COL_INFO | 1));
1431
1432         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1433                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
1434                 "CREDENTIAL: client challenge", -1);
1435
1436         return offset;
1437 }
1438 static int
1439 netlogon_dissect_netrserverreqchallenge_reply(tvbuff_t *tvb, int offset,
1440         packet_info *pinfo, proto_tree *tree, char *drep)
1441 {
1442         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1443                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
1444                 "CREDENTIAL: server credential", -1);
1445
1446         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1447                                   hf_netlogon_rc, NULL);
1448
1449         return offset;
1450 }
1451
1452
1453 static int
1454 netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset,
1455                         packet_info *pinfo, proto_tree *tree,
1456                         char *drep)
1457 {
1458         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1459                         hf_netlogon_secure_channel_type, NULL);
1460
1461         return offset;
1462 }
1463
1464
1465 /*
1466  * IDL long NetrServerAuthenticate(
1467  * IDL      [in][unique][string] wchar_t *ServerName,
1468  * IDL      [in][ref][string] wchar_t *UserName,
1469  * IDL      [in] short secure_challenge_type,
1470  * IDL      [in][ref][string] wchar_t *ComputerName,
1471  * IDL      [in][ref] CREDENTIAL client_challenge,
1472  * IDL      [out][ref] CREDENTIAL server_challenge
1473  * IDL );
1474  */
1475 static int
1476 netlogon_dissect_netrserverauthenticate_rqst(tvbuff_t *tvb, int offset,
1477         packet_info *pinfo, proto_tree *tree, char *drep)
1478 {
1479         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1480                 pinfo, tree, drep);
1481
1482         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1483                 NDR_POINTER_REF, "User Name", hf_netlogon_acct_name, 0);
1484
1485         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
1486                 pinfo, tree, drep);
1487
1488         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1489                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
1490
1491         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1492                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
1493                 "CREDENTIAL: client challenge", -1);
1494
1495         return offset;
1496 }
1497 static int
1498 netlogon_dissect_netrserverauthenticate_reply(tvbuff_t *tvb, int offset,
1499         packet_info *pinfo, proto_tree *tree, char *drep)
1500 {
1501         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1502                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
1503                 "CREDENTIAL: server challenge", -1);
1504
1505         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1506                                   hf_netlogon_rc, NULL);
1507
1508         return offset;
1509 }
1510
1511
1512
1513 /*
1514  * IDL typedef struct {
1515  * IDL   char encrypted_password[16];
1516  * IDL } ENCRYPTED_LM_OWF_PASSWORD;
1517  */
1518 static int
1519 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
1520                         packet_info *pinfo, proto_tree *tree,
1521                         char *drep _U_)
1522 {
1523         dcerpc_info *di;
1524
1525         di=pinfo->private_data;
1526         if(di->conformant_run){
1527                 /*just a run to handle conformant arrays, nothing to dissect.*/
1528                 return offset;
1529         }
1530
1531         proto_tree_add_item(tree, hf_netlogon_encrypted_lm_owf_password, tvb, offset, 16,
1532                 FALSE);
1533         offset += 16;
1534
1535         return offset;
1536 }
1537
1538 /*
1539  * IDL long NetrServerPasswordSet(
1540  * IDL      [in][unique][string] wchar_t *ServerName,
1541  * IDL      [in][ref][string] wchar_t *UserName,
1542  * IDL      [in] short secure_challenge_type,
1543  * IDL      [in][ref][string] wchar_t *ComputerName,
1544  * IDL      [in][ref] AUTHENTICATOR credential,
1545  * IDL      [in][ref] LM_OWF_PASSWORD UasNewPassword,
1546  * IDL      [out][ref] AUTHENTICATOR return_authenticator
1547  * IDL );
1548  */
1549 static int
1550 netlogon_dissect_netrserverpasswordset_rqst(tvbuff_t *tvb, int offset,
1551         packet_info *pinfo, proto_tree *tree, char *drep)
1552 {
1553         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
1554                 pinfo, tree, drep);
1555
1556         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1557                 NDR_POINTER_REF, "User Name", hf_netlogon_acct_name, 0);
1558
1559         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
1560                 pinfo, tree, drep);
1561
1562         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1563                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
1564
1565         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1566                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
1567                 "AUTHENTICATOR: credential", -1);
1568
1569         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1570                 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF,
1571                 "ENCRYPTED_LM_OWF_PASSWORD: hashed_pwd", -1);
1572
1573         return offset;
1574 }
1575 static int
1576 netlogon_dissect_netrserverpasswordset_reply(tvbuff_t *tvb, int offset,
1577         packet_info *pinfo, proto_tree *tree, char *drep)
1578 {
1579         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1580                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
1581                 "AUTHENTICATOR: return_authenticator", -1);
1582
1583         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
1584                                   hf_netlogon_rc, NULL);
1585
1586         return offset;
1587 }
1588
1589
1590 /*
1591  * IDL typedef struct {
1592  * IDL   [unique][string] wchar_t *UserName;
1593  * IDL   UNICODESTRING dummy1;
1594  * IDL   UNICODESTRING dummy2;
1595  * IDL   UNICODESTRING dummy3;
1596  * IDL   UNICODESTRING dummy4;
1597  * IDL   long dummy5;
1598  * IDL   long dummy6;
1599  * IDL   long dummy7;
1600  * IDL   long dummy8;
1601  * IDL } DELTA_DELETE_USER;
1602  */
1603 static int
1604 netlogon_dissect_DELTA_DELETE_USER(tvbuff_t *tvb, int offset,
1605                         packet_info *pinfo, proto_tree *tree,
1606                         char *drep)
1607 {
1608         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
1609                 NDR_POINTER_UNIQUE, "Account Name", hf_netlogon_acct_name, 0);
1610
1611         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1612                 hf_netlogon_dummy, 0);
1613
1614         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1615                 hf_netlogon_dummy, 0);
1616
1617         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1618                 hf_netlogon_dummy, 0);
1619
1620         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1621                 hf_netlogon_dummy, 0);
1622
1623         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1624                 hf_netlogon_reserved, NULL);
1625
1626         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1627                 hf_netlogon_reserved, NULL);
1628
1629         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1630                 hf_netlogon_reserved, NULL);
1631
1632         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1633                 hf_netlogon_reserved, NULL);
1634
1635         return offset;
1636 }
1637
1638
1639 /*
1640  * IDL typedef struct {
1641  * IDL   bool SensitiveDataFlag;
1642  * IDL   long DataLength;
1643  * IDL   [unique][size_is(DataLength)] char *SensitiveData;
1644  * IDL } USER_PRIVATE_INFO;
1645  */
1646 static int
1647 netlogon_dissect_SENSITIVE_DATA(tvbuff_t *tvb, int offset,
1648                         packet_info *pinfo, proto_tree *tree,
1649                         char *drep)
1650 {
1651         dcerpc_info *di;
1652         guint32 data_len;
1653
1654         di=pinfo->private_data;
1655         if(di->conformant_run){
1656                 /*just a run to handle conformant arrays, nothing to dissect */
1657                 return offset;
1658         }
1659
1660         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1661                 hf_netlogon_sensitive_data_len, &data_len);
1662
1663         proto_tree_add_item(tree, hf_netlogon_sensitive_data, tvb, offset,
1664                 data_len, FALSE);
1665         offset += data_len;
1666
1667         return offset;
1668 }
1669 static int
1670 netlogon_dissect_USER_PRIVATE_INFO(tvbuff_t *tvb, int offset,
1671                         packet_info *pinfo, proto_tree *tree,
1672                         char *drep)
1673 {
1674         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1675                 hf_netlogon_sensitive_data_flag, NULL);
1676
1677         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1678                 hf_netlogon_sensitive_data_len, NULL);
1679
1680         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1681                 netlogon_dissect_SENSITIVE_DATA, NDR_POINTER_UNIQUE,
1682                 "SENSITIVE_DATA", -1);
1683
1684         return offset;
1685 }
1686
1687 /*
1688  * IDL typedef struct {
1689  * IDL   UNICODESTRING UserName;
1690  * IDL   UNICODESTRING FullName;
1691  * IDL   long UserID;
1692  * IDL   long PrimaryGroupID;
1693  * IDL   UNICODESTRING HomeDir;
1694  * IDL   UNICODESTRING HomeDirDrive;
1695  * IDL   UNICODESTRING LogonScript;
1696  * IDL   UNICODESTRING Comment;
1697  * IDL   UNICODESTRING Workstations;
1698  * IDL   NTTIME LastLogon;
1699  * IDL   NTTIME LastLogoff;
1700  * IDL   LOGON_HOURS logonhours;
1701  * IDL   short BadPwCount;
1702  * IDL   short LogonCount;
1703  * IDL   NTTIME PwLastSet;
1704  * IDL   NTTIME AccountExpires;
1705  * IDL   long AccountControl;
1706  * IDL   LM_OWF_PASSWORD lmpw;
1707  * IDL   NT_OWF_PASSWORD ntpw;
1708  * IDL   bool NTPwPresent;
1709  * IDL   bool LMPwPresent;
1710  * IDL   bool PwExpired;
1711  * IDL   UNICODESTRING UserComment;
1712  * IDL   UNICODESTRING Parameters;
1713  * IDL   short CountryCode;
1714  * IDL   short CodePage;
1715  * IDL   USER_PRIVATE_INFO user_private_info;
1716  * IDL   long SecurityInformation;
1717  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
1718  * IDL   UNICODESTRING dummy1;
1719  * IDL   UNICODESTRING dummy2;
1720  * IDL   UNICODESTRING dummy3;
1721  * IDL   UNICODESTRING dummy4;
1722  * IDL   long dummy5;
1723  * IDL   long dummy6;
1724  * IDL   long dummy7;
1725  * IDL   long dummy8;
1726  * IDL } DELTA_USER;
1727  */
1728 static int
1729 netlogon_dissect_DELTA_USER(tvbuff_t *tvb, int offset,
1730                         packet_info *pinfo, proto_tree *tree,
1731                         char *drep)
1732 {
1733         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1734                 hf_netlogon_acct_name, 3);
1735
1736         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1737                 hf_netlogon_full_name, 0);
1738
1739         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1740                 hf_netlogon_user_rid, NULL);
1741
1742         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1743                 hf_netlogon_group_rid, NULL);
1744
1745         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1746                 hf_netlogon_home_dir, 0);
1747
1748         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1749                 hf_netlogon_dir_drive, 0);
1750
1751         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1752                 hf_netlogon_logon_script, 0);
1753
1754         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1755                 hf_netlogon_acct_desc, 0);
1756
1757         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1758                 hf_netlogon_workstations, 0);
1759
1760         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1761                 hf_netlogon_logon_time);
1762
1763         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1764                 hf_netlogon_logoff_time);
1765
1766         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
1767
1768         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1769                 hf_netlogon_bad_pw_count16, NULL);
1770
1771         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1772                 hf_netlogon_logon_count16, NULL);
1773
1774         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1775                 hf_netlogon_pwd_last_set_time);
1776
1777         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1778                 hf_netlogon_acct_expiry_time);
1779
1780         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
1781
1782         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
1783                 pinfo, tree, drep);
1784
1785         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
1786                 pinfo, tree, drep);
1787
1788         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1789                 hf_netlogon_nt_pwd_present, NULL);
1790
1791         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1792                 hf_netlogon_lm_pwd_present, NULL);
1793
1794         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1795                 hf_netlogon_pwd_expired, NULL);
1796
1797         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1798                 hf_netlogon_comment, 0);
1799
1800         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1801                 hf_netlogon_parameters, 0);
1802
1803         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1804                 hf_netlogon_country, NULL);
1805
1806         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1807                 hf_netlogon_codepage, NULL);
1808
1809         offset = netlogon_dissect_USER_PRIVATE_INFO(tvb, offset, pinfo, tree,
1810                 drep);
1811
1812         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1813                 hf_netlogon_security_information, NULL);
1814
1815         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
1816                 pinfo, tree, drep);
1817
1818         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1819                 hf_netlogon_dummy, 0);
1820
1821         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1822                 hf_netlogon_dummy, 0);
1823
1824         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1825                 hf_netlogon_dummy, 0);
1826
1827         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1828                 hf_netlogon_dummy, 0);
1829
1830         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1831                 hf_netlogon_reserved, NULL);
1832
1833         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1834                 hf_netlogon_reserved, NULL);
1835
1836         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1837                 hf_netlogon_reserved, NULL);
1838
1839         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1840                 hf_netlogon_reserved, NULL);
1841
1842         return offset;
1843 }
1844
1845
1846 /*
1847  * IDL typedef struct {
1848  * IDL   UNICODESTRING DomainName;
1849  * IDL   UNICODESTRING OEMInfo;
1850  * IDL   NTTIME forcedlogoff;
1851  * IDL   short minpasswdlen;
1852  * IDL   short passwdhistorylen;
1853  * IDL   NTTIME pwd_must_change_time;
1854  * IDL   NTTIME pwd_can_change_time;
1855  * IDL   NTTIME domain_modify_time;
1856  * IDL   NTTIME domain_create_time;
1857  * IDL   long SecurityInformation;
1858  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
1859  * IDL   UNICODESTRING dummy1;
1860  * IDL   UNICODESTRING dummy2;
1861  * IDL   UNICODESTRING dummy3;
1862  * IDL   UNICODESTRING dummy4;
1863  * IDL   long dummy5;
1864  * IDL   long dummy6;
1865  * IDL   long dummy7;
1866  * IDL   long dummy8;
1867  * IDL } DELTA_DOMAIN;
1868  */
1869 static int
1870 netlogon_dissect_DELTA_DOMAIN(tvbuff_t *tvb, int offset,
1871                         packet_info *pinfo, proto_tree *tree,
1872                         char *drep)
1873 {
1874         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1875                 hf_netlogon_domain_name, 3);
1876
1877         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1878                 hf_netlogon_oem_info, 0);
1879
1880         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1881                 hf_netlogon_kickoff_time);
1882
1883         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1884                 hf_netlogon_minpasswdlen, NULL);
1885
1886         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1887                 hf_netlogon_passwdhistorylen, NULL);
1888
1889         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1890                 hf_netlogon_pwd_must_change_time);
1891
1892         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1893                 hf_netlogon_pwd_can_change_time);
1894
1895         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1896                 hf_netlogon_domain_modify_time);
1897
1898         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1899                 hf_netlogon_domain_create_time);
1900
1901         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1902                 hf_netlogon_security_information, NULL);
1903
1904         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
1905                 pinfo, tree, drep);
1906
1907         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1908                 hf_netlogon_dummy, 0);
1909
1910         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1911                 hf_netlogon_dummy, 0);
1912
1913         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1914                 hf_netlogon_dummy, 0);
1915
1916         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1917                 hf_netlogon_dummy, 0);
1918
1919         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1920                 hf_netlogon_reserved, NULL);
1921
1922         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1923                 hf_netlogon_reserved, NULL);
1924
1925         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1926                 hf_netlogon_reserved, NULL);
1927
1928         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1929                 hf_netlogon_reserved, NULL);
1930
1931         return offset;
1932 }
1933
1934
1935 /*
1936  * IDL typedef struct {
1937  * IDL   UNICODESTRING groupname;
1938  * IDL   GROUP_MEMBERSHIP group_membership;
1939  * IDL   UNICODESTRING comment;
1940  * IDL   long SecurityInformation;
1941  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
1942  * IDL   UNICODESTRING dummy1;
1943  * IDL   UNICODESTRING dummy2;
1944  * IDL   UNICODESTRING dummy3;
1945  * IDL   UNICODESTRING dummy4;
1946  * IDL   long dummy5;
1947  * IDL   long dummy6;
1948  * IDL   long dummy7;
1949  * IDL   long dummy8;
1950  * IDL } DELTA_GROUP;
1951  */
1952 static int
1953 netlogon_dissect_DELTA_GROUP(tvbuff_t *tvb, int offset,
1954                         packet_info *pinfo, proto_tree *tree,
1955                         char *drep)
1956 {
1957         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1958                 hf_netlogon_group_name, 3);
1959
1960         offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset,
1961                 pinfo, tree, drep);
1962
1963         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1964                 hf_netlogon_group_desc, 0);
1965
1966         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1967                 hf_netlogon_security_information, NULL);
1968
1969         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
1970                 pinfo, tree, drep);
1971
1972         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1973                 hf_netlogon_dummy, 0);
1974
1975         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1976                 hf_netlogon_dummy, 0);
1977
1978         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1979                 hf_netlogon_dummy, 0);
1980
1981         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1982                 hf_netlogon_dummy, 0);
1983
1984         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1985                 hf_netlogon_reserved, NULL);
1986
1987         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1988                 hf_netlogon_reserved, NULL);
1989
1990         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1991                 hf_netlogon_reserved, NULL);
1992
1993         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1994                 hf_netlogon_reserved, NULL);
1995
1996         return offset;
1997 }
1998
1999
2000 /*
2001  * IDL typedef struct {
2002  * IDL   UNICODESTRING OldName;
2003  * IDL   UNICODESTRING NewName;
2004  * IDL   UNICODESTRING dummy1;
2005  * IDL   UNICODESTRING dummy2;
2006  * IDL   UNICODESTRING dummy3;
2007  * IDL   UNICODESTRING dummy4;
2008  * IDL   long dummy5;
2009  * IDL   long dummy6;
2010  * IDL   long dummy7;
2011  * IDL   long dummy8;
2012  * IDL } DELTA_RENAME;
2013  */
2014 static int
2015 netlogon_dissect_DELTA_RENAME(tvbuff_t *tvb, int offset,
2016                         packet_info *pinfo, proto_tree *tree,
2017                         char *drep)
2018 {
2019         dcerpc_info *di;
2020
2021         di=pinfo->private_data;
2022
2023         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2024                 di->hf_index, 0);
2025
2026         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2027                 di->hf_index, 0);
2028
2029         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2030                 hf_netlogon_dummy, 0);
2031
2032         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2033                 hf_netlogon_dummy, 0);
2034
2035         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2036                 hf_netlogon_dummy, 0);
2037
2038         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2039                 hf_netlogon_dummy, 0);
2040
2041         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2042                 hf_netlogon_reserved, NULL);
2043
2044         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2045                 hf_netlogon_reserved, NULL);
2046
2047         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2048                 hf_netlogon_reserved, NULL);
2049
2050         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2051                 hf_netlogon_reserved, NULL);
2052
2053         return offset;
2054 }
2055
2056
2057 static int
2058 netlogon_dissect_RID(tvbuff_t *tvb, int offset,
2059                         packet_info *pinfo, proto_tree *tree,
2060                         char *drep)
2061 {
2062         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2063                                 hf_netlogon_user_rid, NULL);
2064
2065         return offset;
2066 }
2067
2068 static int
2069 netlogon_dissect_RID_array(tvbuff_t *tvb, int offset,
2070                         packet_info *pinfo, proto_tree *tree,
2071                         char *drep)
2072 {
2073         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2074                         netlogon_dissect_RID);
2075
2076         return offset;
2077 }
2078
2079 static int
2080 netlogon_dissect_ATTRIB(tvbuff_t *tvb, int offset,
2081                         packet_info *pinfo, proto_tree *tree,
2082                         char *drep)
2083 {
2084         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2085                 hf_netlogon_attrs, NULL);
2086
2087         return offset;
2088 }
2089
2090 static int
2091 netlogon_dissect_ATTRIB_array(tvbuff_t *tvb, int offset,
2092                         packet_info *pinfo, proto_tree *tree,
2093                         char *drep)
2094 {
2095         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2096                         netlogon_dissect_ATTRIB);
2097
2098         return offset;
2099 }
2100
2101 /*
2102  * IDL typedef struct {
2103  * IDL   [unique][size_is(num_rids)] long *rids;
2104  * IDL   [unique][size_is(num_rids)] long *attribs;
2105  * IDL   long num_rids;
2106  * IDL   long dummy1;
2107  * IDL   long dummy2;
2108  * IDL   long dummy3;
2109  * IDL   long dummy4;
2110  * IDL } DELTA_GROUP_MEMBER;
2111  */
2112 static int
2113 netlogon_dissect_DELTA_GROUP_MEMBER(tvbuff_t *tvb, int offset,
2114                         packet_info *pinfo, proto_tree *tree,
2115                         char *drep)
2116 {
2117         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2118                 netlogon_dissect_RID_array, NDR_POINTER_UNIQUE,
2119                 "RIDs:", -1);
2120
2121         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2122                 netlogon_dissect_ATTRIB_array, NDR_POINTER_UNIQUE,
2123                 "Attribs:", -1);
2124
2125         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2126                 hf_netlogon_num_rids, NULL);
2127
2128         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2129                 hf_netlogon_reserved, NULL);
2130
2131         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2132                 hf_netlogon_reserved, NULL);
2133
2134         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2135                 hf_netlogon_reserved, NULL);
2136
2137         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2138                 hf_netlogon_reserved, NULL);
2139
2140         return offset;
2141 }
2142
2143
2144 /*
2145  * IDL typedef struct {
2146  * IDL   UNICODESTRING alias_name;
2147  * IDL   long rid;
2148  * IDL   long SecurityInformation;
2149  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2150  * IDL   UNICODESTRING dummy1;
2151  * IDL   UNICODESTRING dummy2;
2152  * IDL   UNICODESTRING dummy3;
2153  * IDL   UNICODESTRING dummy4;
2154  * IDL   long dummy5;
2155  * IDL   long dummy6;
2156  * IDL   long dummy7;
2157  * IDL   long dummy8;
2158  * IDL } DELTA_ALIAS;
2159  */
2160 static int
2161 netlogon_dissect_DELTA_ALIAS(tvbuff_t *tvb, int offset,
2162                         packet_info *pinfo, proto_tree *tree,
2163                         char *drep)
2164 {
2165         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2166                 hf_netlogon_alias_name, 0);
2167
2168         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2169                 hf_netlogon_alias_rid, NULL);
2170
2171         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2172                 hf_netlogon_security_information, NULL);
2173
2174         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2175                 pinfo, tree, drep);
2176
2177         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2178                 hf_netlogon_dummy, 0);
2179
2180         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2181                 hf_netlogon_dummy, 0);
2182
2183         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2184                 hf_netlogon_dummy, 0);
2185
2186         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2187                 hf_netlogon_dummy, 0);
2188
2189         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2190                 hf_netlogon_reserved, NULL);
2191
2192         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2193                 hf_netlogon_reserved, NULL);
2194
2195         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2196                 hf_netlogon_reserved, NULL);
2197
2198         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2199                 hf_netlogon_reserved, NULL);
2200
2201         return offset;
2202 }
2203
2204
2205 /*
2206  * IDL typedef struct {
2207  * IDL   [unique] SID_ARRAY sids;
2208  * IDL   long dummy1;
2209  * IDL   long dummy2;
2210  * IDL   long dummy3;
2211  * IDL   long dummy4;
2212  * IDL } DELTA_ALIAS_MEMBER;
2213  */
2214 static int
2215 netlogon_dissect_DELTA_ALIAS_MEMBER(tvbuff_t *tvb, int offset,
2216                         packet_info *pinfo, proto_tree *tree,
2217                         char *drep)
2218 {
2219         offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, drep);
2220
2221         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2222                 hf_netlogon_reserved, NULL);
2223
2224         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2225                 hf_netlogon_reserved, NULL);
2226
2227         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2228                 hf_netlogon_reserved, NULL);
2229
2230         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2231                 hf_netlogon_reserved, NULL);
2232
2233         return offset;
2234 }
2235
2236
2237 static int
2238 netlogon_dissect_EVENT_AUDIT_OPTION(tvbuff_t *tvb, int offset,
2239                         packet_info *pinfo, proto_tree *tree,
2240                         char *drep)
2241 {
2242         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2243                 hf_netlogon_event_audit_option, NULL);
2244
2245         return offset;
2246 }
2247
2248 static int
2249 netlogon_dissect_EVENT_AUDIT_OPTIONS_ARRAY(tvbuff_t *tvb, int offset,
2250                         packet_info *pinfo, proto_tree *tree,
2251                         char *drep)
2252 {
2253         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2254                 netlogon_dissect_EVENT_AUDIT_OPTION);
2255
2256         return offset;
2257 }
2258
2259
2260 /*
2261  * IDL typedef struct {
2262  * IDL   long pagedpoollimit;
2263  * IDL   long nonpagedpoollimit;
2264  * IDL   long minimumworkingsetsize;
2265  * IDL   long maximumworkingsetsize;
2266  * IDL   long pagefilelimit;
2267  * IDL   NTTIME timelimit;
2268  * IDL } QUOTA_LIMITS;
2269  */
2270 static int
2271 netlogon_dissect_QUOTA_LIMITS(tvbuff_t *tvb, int offset,
2272                         packet_info *pinfo, proto_tree *parent_tree,
2273                         char *drep)
2274 {
2275         proto_item *item=NULL;
2276         proto_tree *tree=NULL;
2277         int old_offset=offset;
2278
2279         if(parent_tree){
2280                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2281                         "QUOTA_LIMTS:");
2282                 tree = proto_item_add_subtree(item, ett_QUOTA_LIMITS);
2283         }
2284
2285         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2286                 hf_netlogon_pagedpoollimit, NULL);
2287
2288         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2289                 hf_netlogon_nonpagedpoollimit, NULL);
2290
2291         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2292                 hf_netlogon_minworkingsetsize, NULL);
2293
2294         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2295                 hf_netlogon_maxworkingsetsize, NULL);
2296
2297         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2298                 hf_netlogon_pagefilelimit, NULL);
2299
2300         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2301                 hf_netlogon_timelimit);
2302
2303         proto_item_set_len(item, offset-old_offset);
2304         return offset;
2305 }
2306
2307
2308 /*
2309  * IDL typedef struct {
2310  * IDL   long maxlogsize;
2311  * IDL   NTTIME auditretentionperiod;
2312  * IDL   bool auditingmode;
2313  * IDL   long maxauditeventcount;
2314  * IDL   [unique][size_is(maxauditeventcount)] long *eventauditoptions;
2315  * IDL   UNICODESTRING primarydomainname;
2316  * IDL   [unique] SID *sid;
2317  * IDL   QUOTA_LIMITS quota_limits;
2318  * IDL   NTTIME db_modify_time;
2319  * IDL   NTTIME db_create_time;
2320  * IDL   long SecurityInformation;
2321  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2322  * IDL   UNICODESTRING dummy1;
2323  * IDL   UNICODESTRING dummy2;
2324  * IDL   UNICODESTRING dummy3;
2325  * IDL   UNICODESTRING dummy4;
2326  * IDL   long dummy5;
2327  * IDL   long dummy6;
2328  * IDL   long dummy7;
2329  * IDL   long dummy8;
2330  * IDL } DELTA_POLICY;
2331  */
2332 static int
2333 netlogon_dissect_DELTA_POLICY(tvbuff_t *tvb, int offset,
2334                         packet_info *pinfo, proto_tree *tree,
2335                         char *drep)
2336 {
2337         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2338                 hf_netlogon_max_log_size, NULL);
2339
2340         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2341                 hf_netlogon_audit_retention_period);
2342
2343         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2344                 hf_netlogon_auditing_mode, NULL);
2345
2346         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2347                 hf_netlogon_max_audit_event_count, NULL);
2348
2349         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2350                 netlogon_dissect_EVENT_AUDIT_OPTIONS_ARRAY, NDR_POINTER_UNIQUE,
2351                 "Event Audit Options:", -1);
2352
2353         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2354                 hf_netlogon_domain_name, 0);
2355
2356         offset = dissect_ndr_nt_PSID(tvb, offset,
2357                 pinfo, tree, drep, -1);
2358
2359         offset = netlogon_dissect_QUOTA_LIMITS(tvb, offset,
2360                 pinfo, tree, drep);
2361
2362         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2363                 hf_netlogon_db_modify_time);
2364
2365         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2366                 hf_netlogon_db_create_time);
2367
2368         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2369                 hf_netlogon_security_information, NULL);
2370
2371         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2372                 pinfo, tree, drep);
2373
2374         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2375                 hf_netlogon_dummy, 0);
2376
2377         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2378                 hf_netlogon_dummy, 0);
2379
2380         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2381                 hf_netlogon_dummy, 0);
2382
2383         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2384                 hf_netlogon_dummy, 0);
2385
2386         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2387                 hf_netlogon_reserved, NULL);
2388
2389         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2390                 hf_netlogon_reserved, NULL);
2391
2392         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2393                 hf_netlogon_reserved, NULL);
2394
2395         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2396                 hf_netlogon_reserved, NULL);
2397
2398         return offset;
2399 }
2400
2401
2402 static int
2403 netlogon_dissect_CONTROLLER(tvbuff_t *tvb, int offset,
2404                         packet_info *pinfo, proto_tree *tree,
2405                         char *drep)
2406 {
2407         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2408                 hf_netlogon_dc_name, 0);
2409
2410         return offset;
2411 }
2412
2413 static int
2414 netlogon_dissect_CONTROLLER_ARRAY(tvbuff_t *tvb, int offset,
2415                         packet_info *pinfo, proto_tree *tree,
2416                         char *drep)
2417 {
2418         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2419                 netlogon_dissect_CONTROLLER);
2420
2421         return offset;
2422 }
2423
2424
2425 /*
2426  * IDL typedef struct {
2427  * IDL   UNICODESTRING DomainName;
2428  * IDL   long num_controllers;
2429  * IDL   [unique][size_is(num_controllers)] UNICODESTRING *controller_names;
2430  * IDL   long SecurityInformation;
2431  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2432  * IDL   UNICODESTRING dummy1;
2433  * IDL   UNICODESTRING dummy2;
2434  * IDL   UNICODESTRING dummy3;
2435  * IDL   UNICODESTRING dummy4;
2436  * IDL   long dummy5;
2437  * IDL   long dummy6;
2438  * IDL   long dummy7;
2439  * IDL   long dummy8;
2440  * IDL } DELTA_TRUSTED_DOMAINS;
2441  */
2442 static int
2443 netlogon_dissect_DELTA_TRUSTED_DOMAINS(tvbuff_t *tvb, int offset,
2444                         packet_info *pinfo, proto_tree *tree,
2445                         char *drep)
2446 {
2447         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2448                 hf_netlogon_domain_name, 0);
2449
2450         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2451                 hf_netlogon_num_controllers, NULL);
2452
2453         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2454                 netlogon_dissect_CONTROLLER_ARRAY, NDR_POINTER_UNIQUE,
2455                 "Domain Controllers:", -1);
2456
2457         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2458                 hf_netlogon_security_information, NULL);
2459
2460         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2461                 pinfo, tree, drep);
2462
2463         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2464                 hf_netlogon_dummy, 0);
2465
2466         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2467                 hf_netlogon_dummy, 0);
2468
2469         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2470                 hf_netlogon_dummy, 0);
2471
2472         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2473                 hf_netlogon_dummy, 0);
2474
2475         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2476                 hf_netlogon_reserved, NULL);
2477
2478         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2479                 hf_netlogon_reserved, NULL);
2480
2481         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2482                 hf_netlogon_reserved, NULL);
2483
2484         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2485                 hf_netlogon_reserved, NULL);
2486
2487         return offset;
2488 }
2489
2490
2491 static int
2492 netlogon_dissect_PRIV_ATTR(tvbuff_t *tvb, int offset,
2493                         packet_info *pinfo, proto_tree *tree,
2494                         char *drep)
2495 {
2496         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2497                 hf_netlogon_attrs, NULL);
2498
2499         return offset;
2500 }
2501
2502 static int
2503 netlogon_dissect_PRIV_ATTR_ARRAY(tvbuff_t *tvb, int offset,
2504                         packet_info *pinfo, proto_tree *tree,
2505                         char *drep)
2506 {
2507         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2508                 netlogon_dissect_PRIV_ATTR);
2509
2510         return offset;
2511 }
2512
2513 static int
2514 netlogon_dissect_PRIV_NAME(tvbuff_t *tvb, int offset,
2515                         packet_info *pinfo, proto_tree *tree,
2516                         char *drep)
2517 {
2518         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2519                 hf_netlogon_privilege_name, 1);
2520
2521         return offset;
2522 }
2523
2524 static int
2525 netlogon_dissect_PRIV_NAME_ARRAY(tvbuff_t *tvb, int offset,
2526                         packet_info *pinfo, proto_tree *tree,
2527                         char *drep)
2528 {
2529         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2530                 netlogon_dissect_PRIV_NAME);
2531
2532         return offset;
2533 }
2534
2535
2536
2537 /*
2538  * IDL typedef struct {
2539  * IDL   long privilegeentries;
2540  * IDL   long provolegecontrol;
2541  * IDL   [unique][size_is(privilege_entries)] long *privilege_attrib;
2542  * IDL   [unique][size_is(privilege_entries)] UNICODESTRING *privilege_name;
2543  * IDL   QUOTALIMITS quotalimits;
2544  * IDL   long SecurityInformation;
2545  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2546  * IDL   UNICODESTRING dummy1;
2547  * IDL   UNICODESTRING dummy2;
2548  * IDL   UNICODESTRING dummy3;
2549  * IDL   UNICODESTRING dummy4;
2550  * IDL   long dummy5;
2551  * IDL   long dummy6;
2552  * IDL   long dummy7;
2553  * IDL   long dummy8;
2554  * IDL } DELTA_ACCOUNTS;
2555  */
2556 static int
2557 netlogon_dissect_DELTA_ACCOUNTS(tvbuff_t *tvb, int offset,
2558                         packet_info *pinfo, proto_tree *tree,
2559                         char *drep)
2560 {
2561         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2562                 hf_netlogon_privilege_entries, NULL);
2563
2564         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2565                 hf_netlogon_privilege_control, NULL);
2566
2567         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2568                 netlogon_dissect_PRIV_ATTR_ARRAY, NDR_POINTER_UNIQUE,
2569                 "PRIV_ATTR_ARRAY:", -1);
2570
2571         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2572                 netlogon_dissect_PRIV_NAME_ARRAY, NDR_POINTER_UNIQUE,
2573                 "PRIV_NAME_ARRAY:", -1);
2574
2575         offset = netlogon_dissect_QUOTA_LIMITS(tvb, offset,
2576                 pinfo, tree, drep);
2577
2578         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2579                 hf_netlogon_systemflags, NULL);
2580
2581         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2582                 hf_netlogon_security_information, NULL);
2583
2584         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2585                 pinfo, tree, drep);
2586
2587         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2588                 hf_netlogon_dummy, 0);
2589
2590         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2591                 hf_netlogon_dummy, 0);
2592
2593         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2594                 hf_netlogon_dummy, 0);
2595
2596         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2597                 hf_netlogon_dummy, 0);
2598
2599         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2600                 hf_netlogon_reserved, NULL);
2601
2602         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2603                 hf_netlogon_reserved, NULL);
2604
2605         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2606                 hf_netlogon_reserved, NULL);
2607
2608         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2609                 hf_netlogon_reserved, NULL);
2610
2611         return offset;
2612 }
2613
2614 /*
2615  * IDL typedef struct {
2616  * IDL   long len;
2617  * IDL   long maxlen;
2618  * IDL   [unique][size_is(maxlen)][length_is(len)] char *cipher_data;
2619  * IDL } CIPHER_VALUE;
2620  */
2621 static int
2622 netlogon_dissect_CIPHER_VALUE_DATA(tvbuff_t *tvb, int offset,
2623                         packet_info *pinfo, proto_tree *tree,
2624                         char *drep)
2625 {
2626         dcerpc_info *di;
2627         guint32 data_len;
2628
2629         di=pinfo->private_data;
2630         if(di->conformant_run){
2631                 /*just a run to handle conformant arrays, nothing to dissect */
2632                 return offset;
2633         }
2634
2635         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2636                 hf_netlogon_cipher_maxlen, NULL);
2637
2638         /* skip offset */
2639         offset += 4;
2640
2641         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2642                 hf_netlogon_cipher_len, &data_len);
2643
2644         proto_tree_add_item(tree, di->hf_index, tvb, offset,
2645                 data_len, FALSE);
2646         offset += data_len;
2647
2648         return offset;
2649 }
2650 static int
2651 netlogon_dissect_CIPHER_VALUE(tvbuff_t *tvb, int offset,
2652                         packet_info *pinfo, proto_tree *parent_tree,
2653                         char *drep, char *name, int hf_index)
2654 {
2655         proto_item *item=NULL;
2656         proto_tree *tree=NULL;
2657         int old_offset=offset;
2658
2659         if(parent_tree){
2660                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2661                         name);
2662                 tree = proto_item_add_subtree(item, ett_CYPHER_VALUE);
2663         }
2664
2665         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2666                 hf_netlogon_cipher_len, NULL);
2667
2668         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2669                 hf_netlogon_cipher_maxlen, NULL);
2670
2671         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2672                 netlogon_dissect_CIPHER_VALUE_DATA, NDR_POINTER_UNIQUE,
2673                 name, hf_index);
2674
2675         proto_item_set_len(item, offset-old_offset);
2676         return offset;
2677 }
2678
2679 /*
2680  * IDL typedef struct {
2681  * IDL   CIPHER_VALUE current_cipher;
2682  * IDL   NTTIME current_cipher_set_time;
2683  * IDL   CIPHER_VALUE old_cipher;
2684  * IDL   NTTIME old_cipher_set_time;
2685  * IDL   long SecurityInformation;
2686  * IDL   LSA_SECURITY_DESCRIPTOR sec_desc;
2687  * IDL   UNICODESTRING dummy1;
2688  * IDL   UNICODESTRING dummy2;
2689  * IDL   UNICODESTRING dummy3;
2690  * IDL   UNICODESTRING dummy4;
2691  * IDL   long dummy5;
2692  * IDL   long dummy6;
2693  * IDL   long dummy7;
2694  * IDL   long dummy8;
2695  * IDL } DELTA_SECRET;
2696  */
2697 static int
2698 netlogon_dissect_DELTA_SECRET(tvbuff_t *tvb, int offset,
2699                         packet_info *pinfo, proto_tree *tree,
2700                         char *drep)
2701 {
2702         offset = netlogon_dissect_CIPHER_VALUE(tvb, offset,
2703                 pinfo, tree, drep,
2704                 "CIPHER_VALUE: current cipher value",
2705                 hf_netlogon_cipher_current_data);
2706
2707         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2708                 hf_netlogon_cipher_current_set_time);
2709
2710         offset = netlogon_dissect_CIPHER_VALUE(tvb, offset,
2711                 pinfo, tree, drep,
2712                 "CIPHER_VALUE: old cipher value",
2713                 hf_netlogon_cipher_old_data);
2714
2715         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
2716                 hf_netlogon_cipher_old_set_time);
2717
2718         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2719                 hf_netlogon_security_information, NULL);
2720
2721         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
2722                 pinfo, tree, drep);
2723
2724         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2725                 hf_netlogon_dummy, 0);
2726
2727         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2728                 hf_netlogon_dummy, 0);
2729
2730         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2731                 hf_netlogon_dummy, 0);
2732
2733         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2734                 hf_netlogon_dummy, 0);
2735
2736         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2737                 hf_netlogon_reserved, NULL);
2738
2739         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2740                 hf_netlogon_reserved, NULL);
2741
2742         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2743                 hf_netlogon_reserved, NULL);
2744
2745         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2746                 hf_netlogon_reserved, NULL);
2747
2748         return offset;
2749 }
2750
2751 /*
2752  * IDL typedef struct {
2753  * IDL   long low_value;
2754  * IDL   long high_value;
2755  * } MODIFIED_COUNT;
2756  */
2757 static int
2758 netlogon_dissect_MODIFIED_COUNT(tvbuff_t *tvb, int offset,
2759                         packet_info *pinfo, proto_tree *tree,
2760                         char *drep)
2761 {
2762         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
2763                 hf_netlogon_modify_count, NULL);
2764
2765         return offset;
2766 }
2767
2768
2769 #define DT_DELTA_DOMAIN                 1
2770 #define DT_DELTA_GROUP                  2
2771 #define DT_DELTA_RENAME_GROUP           4
2772 #define DT_DELTA_USER                   5
2773 #define DT_DELTA_RENAME_USER            7
2774 #define DT_DELTA_GROUP_MEMBER           8
2775 #define DT_DELTA_ALIAS                  9
2776 #define DT_DELTA_RENAME_ALIAS           11
2777 #define DT_DELTA_ALIAS_MEMBER           12
2778 #define DT_DELTA_POLICY                 13
2779 #define DT_DELTA_TRUSTED_DOMAINS        14
2780 #define DT_DELTA_ACCOUNTS               16
2781 #define DT_DELTA_SECRET                 18
2782 #define DT_DELTA_DELETE_GROUP           20
2783 #define DT_DELTA_DELETE_USER            21
2784 #define DT_MODIFIED_COUNT               22
2785 static const value_string delta_type_vals[] = {
2786         { DT_DELTA_DOMAIN,              "Domain" },
2787         { DT_DELTA_GROUP,               "Group" },
2788         { DT_DELTA_RENAME_GROUP,        "Rename Group" },
2789         { DT_DELTA_USER,                "User" },
2790         { DT_DELTA_RENAME_USER,         "Rename User" },
2791         { DT_DELTA_GROUP_MEMBER,        "Group Member" },
2792         { DT_DELTA_ALIAS,               "Alias" },
2793         { DT_DELTA_RENAME_ALIAS,        "Rename Alias" },
2794         { DT_DELTA_ALIAS_MEMBER,        "Alias Member" },
2795         { DT_DELTA_POLICY,              "Policy" },
2796         { DT_DELTA_TRUSTED_DOMAINS,     "Trusted Domains" },
2797         { DT_DELTA_ACCOUNTS,            "Accounts" },
2798         { DT_DELTA_SECRET,              "Secret" },
2799         { DT_DELTA_DELETE_GROUP,        "Delete Group" },
2800         { DT_DELTA_DELETE_USER,         "Delete User" },
2801         { DT_MODIFIED_COUNT,            "Modified Count" },
2802         { 0, NULL }
2803 };
2804 /*
2805  * IDL typedef [switch_type(short)] union {
2806  * IDL   [case(1)][unique] DELTA_DOMAIN *domain;
2807  * IDL   [case(2)][unique] DELTA_GROUP *group;
2808  * IDL   [case(4)][unique] DELTA_RENAME_GROUP *rename_group;
2809  * IDL   [case(5)][unique] DELTA_USER *user;
2810  * IDL   [case(7)][unique] DELTA_RENAME_USER *rename_user;
2811  * IDL   [case(8)][unique] DELTA_GROUP_MEMBER *group_member;
2812  * IDL   [case(9)][unique] DELTA_ALIAS *alias;
2813  * IDL   [case(11)][unique] DELTA_RENAME_ALIAS *rename_alias;
2814  * IDL   [case(12)][unique] DELTA_ALIAS_MEMBER *alias_member;
2815  * IDL   [case(13)][unique] DELTA_POLICY *policy;
2816  * IDL   [case(14)][unique] DELTA_TRUSTED_DOMAINS *trusted_domains;
2817  * IDL   [case(16)][unique] DELTA_ACCOUNTS *accounts;
2818  * IDL   [case(18)][unique] DELTA_SECRET *secret;
2819  * IDL   [case(20)][unique] DELTA_DELETE_USER *delete_group;
2820  * IDL   [case(21)][unique] DELTA_DELETE_USER *delete_user;
2821  * IDL   [case(22)][unique] MODIFIED_COUNT *modified_count;
2822  * IDL } DELTA_UNION;
2823  */
2824 static int
2825 netlogon_dissect_DELTA_UNION(tvbuff_t *tvb, int offset,
2826                         packet_info *pinfo, proto_tree *parent_tree,
2827                         char *drep)
2828 {
2829         proto_item *item=NULL;
2830         proto_tree *tree=NULL;
2831         int old_offset=offset;
2832         guint16 level;
2833
2834         if(parent_tree){
2835                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2836                         "DELTA_UNION:");
2837                 tree = proto_item_add_subtree(item, ett_DELTA_UNION);
2838         }
2839
2840         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2841                 hf_netlogon_delta_type, &level);
2842
2843         ALIGN_TO_4_BYTES;
2844         switch(level){
2845         case 1:
2846                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2847                         netlogon_dissect_DELTA_DOMAIN, NDR_POINTER_UNIQUE,
2848                         "DELTA_DOMAIN:", -1);
2849                 break;
2850         case 2:
2851                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2852                         netlogon_dissect_DELTA_GROUP, NDR_POINTER_UNIQUE,
2853                         "DELTA_GROUP:", -1);
2854                 break;
2855         case 4:
2856                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2857                         netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
2858                         "DELTA_RENAME_GROUP:", hf_netlogon_group_name);
2859                 break;
2860         case 5:
2861                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2862                         netlogon_dissect_DELTA_USER, NDR_POINTER_UNIQUE,
2863                         "DELTA_USER:", -1);
2864                 break;
2865         case 7:
2866                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2867                         netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
2868                         "DELTA_RENAME_USER:", hf_netlogon_acct_name);
2869                 break;
2870         case 8:
2871                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2872                         netlogon_dissect_DELTA_GROUP_MEMBER, NDR_POINTER_UNIQUE,
2873                         "DELTA_GROUP_MEMBER:", -1);
2874                 break;
2875         case 9:
2876                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2877                         netlogon_dissect_DELTA_ALIAS, NDR_POINTER_UNIQUE,
2878                         "DELTA_ALIAS:", -1);
2879                 break;
2880         case 11:
2881                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2882                         netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
2883                         "DELTA_RENAME_ALIAS:", hf_netlogon_alias_name);
2884                 break;
2885         case 12:
2886                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2887                         netlogon_dissect_DELTA_ALIAS_MEMBER, NDR_POINTER_UNIQUE,
2888                         "DELTA_ALIAS_MEMBER:", -1);
2889                 break;
2890         case 13:
2891                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2892                         netlogon_dissect_DELTA_POLICY, NDR_POINTER_UNIQUE,
2893                         "DELTA_POLICY:", -1);
2894                 break;
2895         case 14:
2896                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2897                         netlogon_dissect_DELTA_TRUSTED_DOMAINS, NDR_POINTER_UNIQUE,
2898                         "DELTA_TRUSTED_DOMAINS:", -1);
2899                 break;
2900         case 16:
2901                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2902                         netlogon_dissect_DELTA_ACCOUNTS, NDR_POINTER_UNIQUE,
2903                         "DELTA_ACCOUNTS:", -1);
2904                 break;
2905         case 18:
2906                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2907                         netlogon_dissect_DELTA_SECRET, NDR_POINTER_UNIQUE,
2908                         "DELTA_SECRET:", -1);
2909                 break;
2910         case 20:
2911                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2912                         netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
2913                         "DELTA_DELETE_GROUP:", -1);
2914                 break;
2915         case 21:
2916                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2917                         netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
2918                         "DELTA_DELETE_USER:", -1);
2919                 break;
2920         case 22:
2921                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2922                         netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_UNIQUE,
2923                         "MODIFIED_COUNT:", -1);
2924                 break;
2925         }
2926
2927         proto_item_set_len(item, offset-old_offset);
2928         return offset;
2929 }
2930
2931
2932
2933 /* IDL XXX must verify this one, especially 13-19
2934  * IDL typedef [switch_type(short)] union {
2935  * IDL   [case(1)] long rid;
2936  * IDL   [case(2)] long rid;
2937  * IDL   [case(3)] long rid;
2938  * IDL   [case(4)] long rid;
2939  * IDL   [case(5)] long rid;
2940  * IDL   [case(6)] long rid;
2941  * IDL   [case(7)] long rid;
2942  * IDL   [case(8)] long rid;
2943  * IDL   [case(9)] long rid;
2944  * IDL   [case(10)] long rid;
2945  * IDL   [case(11)] long rid;
2946  * IDL   [case(12)] long rid;
2947  * IDL   [case(13)] [unique] SID *sid;
2948  * IDL   [case(14)] [unique] SID *sid;
2949  * IDL   [case(15)] [unique] SID *sid;
2950  * IDL   [case(16)] [unique] SID *sid;
2951  * IDL   [case(17)] [unique] SID *sid;
2952  * IDL   [case(18)] [unique][string] wchar_t *Name ;
2953  * IDL   [case(19)] [unique][string] wchar_t *Name ;
2954  * IDL   [case(20)] long rid;
2955  * IDL   [case(21)] long rid;
2956  * IDL } DELTA_ID_UNION;
2957  */
2958 static int
2959 netlogon_dissect_DELTA_ID_UNION(tvbuff_t *tvb, int offset,
2960                         packet_info *pinfo, proto_tree *parent_tree,
2961                         char *drep)
2962 {
2963         proto_item *item=NULL;
2964         proto_tree *tree=NULL;
2965         int old_offset=offset;
2966         guint16 level;
2967
2968         if(parent_tree){
2969                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2970                         "DELTA_ID_UNION:");
2971                 tree = proto_item_add_subtree(item, ett_DELTA_ID_UNION);
2972         }
2973
2974         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2975                 hf_netlogon_delta_type, &level);
2976
2977         ALIGN_TO_4_BYTES;
2978         switch(level){
2979         case 1:
2980                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2981                         hf_netlogon_group_rid, NULL);
2982                 break;
2983         case 2:
2984                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2985                         hf_netlogon_user_rid, NULL);
2986                 break;
2987         case 3:
2988                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2989                         hf_netlogon_user_rid, NULL);
2990                 break;
2991         case 4:
2992                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2993                         hf_netlogon_user_rid, NULL);
2994                 break;
2995         case 5:
2996                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2997                         hf_netlogon_user_rid, NULL);
2998                 break;
2999         case 6:
3000                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3001                         hf_netlogon_user_rid, NULL);
3002                 break;
3003         case 7:
3004                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3005                         hf_netlogon_user_rid, NULL);
3006                 break;
3007         case 8:
3008                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3009                         hf_netlogon_user_rid, NULL);
3010                 break;
3011         case 9:
3012                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3013                         hf_netlogon_user_rid, NULL);
3014                 break;
3015         case 10:
3016                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3017                         hf_netlogon_user_rid, NULL);
3018                 break;
3019         case 11:
3020                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3021                         hf_netlogon_user_rid, NULL);
3022                 break;
3023         case 12:
3024                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3025                         hf_netlogon_user_rid, NULL);
3026                 break;
3027         case 13:
3028                 offset = dissect_ndr_nt_PSID(tvb, offset,
3029                         pinfo, tree, drep, -1);
3030                 break;
3031         case 14:
3032                 offset = dissect_ndr_nt_PSID(tvb, offset,
3033                         pinfo, tree, drep, -1);
3034                 break;
3035         case 15:
3036                 offset = dissect_ndr_nt_PSID(tvb, offset,
3037                         pinfo, tree, drep, -1);
3038                 break;
3039         case 16:
3040                 offset = dissect_ndr_nt_PSID(tvb, offset,
3041                         pinfo, tree, drep, -1);
3042                 break;
3043         case 17:
3044                 offset = dissect_ndr_nt_PSID(tvb, offset,
3045                         pinfo, tree, drep, -1);
3046                 break;
3047         case 18:
3048                 offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
3049                         tree, drep, NDR_POINTER_UNIQUE, "unknown",
3050                         hf_netlogon_unknown_string, 0);
3051                 break;
3052         case 19:
3053                 offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
3054                         tree, drep, NDR_POINTER_UNIQUE, "unknown",
3055                         hf_netlogon_unknown_string, 0);
3056                 break;
3057         case 20:
3058                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3059                         hf_netlogon_user_rid, NULL);
3060                 break;
3061         case 21:
3062                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3063                         hf_netlogon_user_rid, NULL);
3064                 break;
3065         }
3066
3067         proto_item_set_len(item, offset-old_offset);
3068         return offset;
3069 }
3070
3071 /*
3072  * IDL typedef struct {
3073  * IDL   short delta_type;
3074  * IDL   DELTA_ID_UNION delta_id_union;
3075  * IDL   DELTA_UNION delta_union;
3076  * IDL } DELTA_ENUM;
3077  */
3078 static int
3079 netlogon_dissect_DELTA_ENUM(tvbuff_t *tvb, int offset,
3080                         packet_info *pinfo, proto_tree *parent_tree,
3081                         char *drep)
3082 {
3083         proto_item *item=NULL;
3084         proto_tree *tree=NULL;
3085         int old_offset=offset;
3086         guint16 type;
3087
3088         if(parent_tree){
3089                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3090                         "DELTA_ENUM:");
3091                 tree = proto_item_add_subtree(item, ett_DELTA_ENUM);
3092         }
3093
3094         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3095                 hf_netlogon_delta_type, &type);
3096
3097         proto_item_append_text(item, val_to_str(
3098                                        type, delta_type_vals, "Unknown"));
3099
3100         offset = netlogon_dissect_DELTA_ID_UNION(tvb, offset,
3101                 pinfo, tree, drep);
3102
3103         offset = netlogon_dissect_DELTA_UNION(tvb, offset,
3104                 pinfo, tree, drep);
3105
3106         proto_item_set_len(item, offset-old_offset);
3107         return offset;
3108 }
3109
3110 static int
3111 netlogon_dissect_DELTA_ENUM_array(tvbuff_t *tvb, int offset,
3112                         packet_info *pinfo, proto_tree *tree,
3113                         char *drep)
3114 {
3115         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3116                 netlogon_dissect_DELTA_ENUM);
3117
3118         return offset;
3119 }
3120
3121 /*
3122  * IDL typedef struct {
3123  * IDL   long num_deltas;
3124  * IDL   [unique][size_is(num_deltas)] DELTA_ENUM *delta_enum;
3125  * IDL } DELTA_ENUM_ARRAY;
3126  */
3127 static int
3128 netlogon_dissect_DELTA_ENUM_ARRAY(tvbuff_t *tvb, int offset,
3129                         packet_info *pinfo, proto_tree *tree,
3130                         char *drep)
3131 {
3132         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3133                 hf_netlogon_num_deltas, NULL);
3134
3135         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3136                 netlogon_dissect_DELTA_ENUM_array, NDR_POINTER_UNIQUE,
3137                 "DELTA_ENUM: deltas", -1);
3138
3139         return offset;
3140 }
3141
3142
3143 /*
3144  * IDL long NetrDatabaseDeltas(
3145  * IDL      [in][string][ref] wchar_t *logonserver, # REF!!!
3146  * IDL      [in][string][ref] wchar_t *computername,
3147  * IDL      [in][ref] AUTHENTICATOR credential,
3148  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3149  * IDL      [in] long database_id,
3150  * IDL      [in][out][ref] MODIFIED_COUNT domain_modify_count,
3151  * IDL      [in] long preferredmaximumlength,
3152  * IDL      [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
3153  * IDL );
3154  */
3155 static int
3156 netlogon_dissect_netrdatabasedeltas_rqst(tvbuff_t *tvb, int offset,
3157         packet_info *pinfo, proto_tree *tree, char *drep)
3158 {
3159         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3160                 NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
3161
3162         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3163                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
3164
3165         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3166                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3167                 "AUTHENTICATOR: credential", -1);
3168
3169         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3170                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3171                 "AUTHENTICATOR: return_authenticator", -1);
3172
3173         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3174                 hf_netlogon_database_id, NULL);
3175
3176         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3177                 netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_REF,
3178                 "MODIFIED_COUNT: domain modified count", -1);
3179
3180         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3181                 hf_netlogon_max_size, NULL);
3182
3183         return offset;
3184 }
3185 static int
3186 netlogon_dissect_netrdatabasedeltas_reply(tvbuff_t *tvb, int offset,
3187         packet_info *pinfo, proto_tree *tree, char *drep)
3188 {
3189         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3190                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3191                 "AUTHENTICATOR: return_authenticator", -1);
3192
3193         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3194                 netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_REF,
3195                 "MODIFIED_COUNT: domain modified count", -1);
3196
3197         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3198                 netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
3199                 "DELTA_ENUM_ARRAY: deltas", -1);
3200
3201         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3202                                   hf_netlogon_rc, NULL);
3203
3204         return offset;
3205 }
3206
3207
3208 /*
3209  * IDL long NetrDatabaseSync(
3210  * IDL      [in][string][ref] wchar_t *logonserver, # REF!!!
3211  * IDL      [in][string][ref] wchar_t *computername,
3212  * IDL      [in][ref] AUTHENTICATOR credential,
3213  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3214  * IDL      [in] long database_id,
3215  * IDL      [in][out][ref] long sync_context,
3216  * IDL      [in] long preferredmaximumlength,
3217  * IDL      [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
3218  * IDL );
3219  */
3220 static int
3221 netlogon_dissect_netrdatabasesync_rqst(tvbuff_t *tvb, int offset,
3222         packet_info *pinfo, proto_tree *tree, char *drep)
3223 {
3224         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3225                 NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
3226
3227         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3228                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
3229
3230         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3231                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3232                 "AUTHENTICATOR: credential", -1);
3233
3234         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3235                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3236                 "AUTHENTICATOR: return_authenticator", -1);
3237
3238         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3239                 hf_netlogon_database_id, NULL);
3240
3241         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3242                 hf_netlogon_sync_context, NULL);
3243
3244         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3245                 hf_netlogon_max_size, NULL);
3246
3247         return offset;
3248 }
3249
3250
3251 static int
3252 netlogon_dissect_netrdatabasesync_reply(tvbuff_t *tvb, int offset,
3253         packet_info *pinfo, proto_tree *tree, char *drep)
3254 {
3255         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3256                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3257                 "AUTHENTICATOR: return_authenticator", -1);
3258
3259         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3260                 hf_netlogon_sync_context, NULL);
3261
3262         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3263                 netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
3264                 "DELTA_ENUM_ARRAY: deltas", -1);
3265
3266         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3267                                   hf_netlogon_rc, NULL);
3268
3269         return offset;
3270 }
3271
3272 /*
3273  * IDL typedef struct {
3274  * IDL   char computer_name[16];
3275  * IDL   long timecreated;
3276  * IDL   long serial_number;
3277  * IDL } UAS_INFO_0;
3278  */
3279 static int
3280 netlogon_dissect_UAS_INFO_0(tvbuff_t *tvb, int offset,
3281                         packet_info *pinfo, proto_tree *tree,
3282                         char *drep)
3283 {
3284         dcerpc_info *di;
3285
3286         di=pinfo->private_data;
3287         if(di->conformant_run){
3288                 /*just a run to handle conformant arrays, nothing to dissect */
3289                 return offset;
3290         }
3291
3292         proto_tree_add_item(tree, hf_netlogon_computer_name, tvb, offset, 16, FALSE);
3293         offset += 16;
3294
3295         proto_tree_add_text(tree, tvb, offset, 4, "Time Created: unknown time format");
3296         offset+= 4;
3297
3298         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3299                 hf_netlogon_serial_number, NULL);
3300
3301         return offset;
3302 }
3303
3304
3305 static int
3306 netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
3307                         packet_info *pinfo, proto_tree *tree,
3308                         char *drep)
3309 {
3310                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
3311                         hf_netlogon_unknown_char, NULL);
3312
3313         return offset;
3314 }
3315
3316 static int
3317 netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
3318                         packet_info *pinfo, proto_tree *tree,
3319                         char *drep)
3320 {
3321         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3322                 netlogon_dissect_BYTE_byte);
3323
3324         return offset;
3325 }
3326
3327 /*
3328  * IDL long NetrAccountDeltas(
3329  * IDL      [in][string][unique] wchar_t *logonserver,
3330  * IDL      [in][string][ref] wchar_t *computername,
3331  * IDL      [in][ref] AUTHENTICATOR credential,
3332  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3333  * IDL      [out][ref][size_is(count_returned)] char *Buffer,
3334  * IDL      [out][ref] long count_returned,
3335  * IDL      [out][ref] long total_entries,
3336  * IDL      [in][out][ref] UAS_INFO_0 recordid,
3337  * IDL      [in][long] count,
3338  * IDL      [in][long] level,
3339  * IDL      [in][long] buffersize,
3340  * IDL );
3341  */
3342 static int
3343 netlogon_dissect_netraccountdeltas_rqst(tvbuff_t *tvb, int offset,
3344         packet_info *pinfo, proto_tree *tree, char *drep)
3345 {
3346         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3347                 pinfo, tree, drep);
3348
3349         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3350                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
3351
3352         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3353                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3354                 "AUTHENTICATOR: credential", -1);
3355
3356         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3357                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3358                 "AUTHENTICATOR: return_authenticator", -1);
3359
3360         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3361                 netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
3362                 "UAS_INFO_0: RecordID", -1);
3363
3364         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3365                 hf_netlogon_count, NULL);
3366
3367         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3368                 hf_netlogon_level, NULL);
3369
3370         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3371                 hf_netlogon_max_size, NULL);
3372
3373         return offset;
3374 }
3375 static int
3376 netlogon_dissect_netraccountdeltas_reply(tvbuff_t *tvb, int offset,
3377         packet_info *pinfo, proto_tree *tree, char *drep)
3378 {
3379         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3380                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3381                 "AUTHENTICATOR: return_authenticator", -1);
3382
3383         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3384                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3385                 "BYTE_array: Buffer", -1);
3386
3387         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3388                 hf_netlogon_count, NULL);
3389
3390         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3391                 hf_netlogon_entries, NULL);
3392
3393         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3394                 netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
3395                 "UAS_INFO_0: RecordID", -1);
3396
3397         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3398                                   hf_netlogon_rc, NULL);
3399
3400         return offset;
3401 }
3402
3403
3404 /*
3405  * IDL long NetrAccountSync(
3406  * IDL      [in][string][unique] wchar_t *logonserver,
3407  * IDL      [in][string][ref] wchar_t *computername,
3408  * IDL      [in][ref] AUTHENTICATOR credential,
3409  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3410  * IDL      [out][ref][size_is(count_returned)] char *Buffer,
3411  * IDL      [out][ref] long count_returned,
3412  * IDL      [out][ref] long total_entries,
3413  * IDL      [out][ref] long next_reference,
3414  * IDL      [in][long] reference,
3415  * IDL      [in][long] level,
3416  * IDL      [in][long] buffersize,
3417  * IDL      [in][out][ref] UAS_INFO_0 recordid,
3418  * IDL );
3419  */
3420 static int
3421 netlogon_dissect_netraccountsync_rqst(tvbuff_t *tvb, int offset,
3422         packet_info *pinfo, proto_tree *tree, char *drep)
3423 {
3424         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3425                 pinfo, tree, drep);
3426
3427         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3428                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
3429
3430         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3431                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3432                 "AUTHENTICATOR: credential", -1);
3433
3434         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3435                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3436                 "AUTHENTICATOR: return_authenticator", -1);
3437
3438         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3439                 hf_netlogon_reference, NULL);
3440
3441         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3442                 hf_netlogon_level, NULL);
3443
3444         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3445                 hf_netlogon_max_size, NULL);
3446
3447         return offset;
3448 }
3449 static int
3450 netlogon_dissect_netraccountsync_reply(tvbuff_t *tvb, int offset,
3451         packet_info *pinfo, proto_tree *tree, char *drep)
3452 {
3453         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3454                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3455                 "AUTHENTICATOR: return_authenticator", -1);
3456
3457         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3458                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3459                 "BYTE_array: Buffer", -1);
3460
3461         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3462                 hf_netlogon_count, NULL);
3463
3464         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3465                 hf_netlogon_entries, NULL);
3466
3467         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3468                 hf_netlogon_next_reference, NULL);
3469
3470         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3471                 netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
3472                 "UAS_INFO_0: RecordID", -1);
3473
3474         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3475                                   hf_netlogon_rc, NULL);
3476
3477         return offset;
3478 }
3479
3480
3481 /*
3482  * IDL long NetrGetDcName(
3483  * IDL    [in][ref][string] wchar_t *logon_server,
3484  * IDL    [in][unique][string] wchar_t *domainname,
3485  * IDL    [out][unique][string] wchar_t *dcname,
3486  * IDL };
3487  */
3488 static int
3489 netlogon_dissect_netrgetdcname_rqst(tvbuff_t *tvb, int offset,
3490         packet_info *pinfo, proto_tree *tree, char *drep)
3491 {
3492         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3493                 NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
3494
3495         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3496                 NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0);
3497
3498         return offset;
3499 }
3500 static int
3501 netlogon_dissect_netrgetdcname_reply(tvbuff_t *tvb, int offset,
3502         packet_info *pinfo, proto_tree *tree, char *drep)
3503 {
3504         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3505                 NDR_POINTER_UNIQUE, "Domain", hf_netlogon_dc_name, 0);
3506
3507         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3508                                   hf_netlogon_rc, NULL);
3509
3510         return offset;
3511 }
3512
3513
3514
3515 /*
3516  * IDL typedef struct {
3517  * IDL   long flags;
3518  * IDL   long pdc_connection_status;
3519  * IDL } NETLOGON_INFO_1;
3520  */
3521 static int
3522 netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
3523                         packet_info *pinfo, proto_tree *tree,
3524                         char *drep)
3525 {
3526         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3527                 hf_netlogon_flags, NULL);
3528
3529         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3530                 hf_netlogon_pdc_connection_status, NULL);
3531
3532         return offset;
3533 }
3534
3535
3536 /*
3537  * IDL typedef struct {
3538  * IDL   long flags;
3539  * IDL   long pdc_connection_status;
3540  * IDL   [unique][string] wchar_t trusted_dc_name;
3541  * IDL   long tc_connection_status;
3542  * IDL } NETLOGON_INFO_2;
3543  */
3544 static int
3545 netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
3546                         packet_info *pinfo, proto_tree *tree,
3547                         char *drep)
3548 {
3549         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3550                 hf_netlogon_flags, NULL);
3551
3552         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3553                 hf_netlogon_pdc_connection_status, NULL);
3554
3555         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3556                 NDR_POINTER_UNIQUE, "Trusted DC Name",
3557                 hf_netlogon_trusted_dc_name, 0);
3558
3559         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3560                 hf_netlogon_tc_connection_status, NULL);
3561
3562         return offset;
3563 }
3564
3565
3566 /*
3567  * IDL typedef struct {
3568  * IDL   long flags;
3569  * IDL   long logon_attempts;
3570  * IDL   long reserved;
3571  * IDL   long reserved;
3572  * IDL   long reserved;
3573  * IDL   long reserved;
3574  * IDL   long reserved;
3575  * IDL } NETLOGON_INFO_3;
3576  */
3577 static int
3578 netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
3579                         packet_info *pinfo, proto_tree *tree,
3580                         char *drep)
3581 {
3582         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3583                 hf_netlogon_flags, NULL);
3584
3585         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3586                 hf_netlogon_logon_attempts, NULL);
3587
3588         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3589                 hf_netlogon_reserved, NULL);
3590
3591         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3592                 hf_netlogon_reserved, NULL);
3593
3594         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3595                 hf_netlogon_reserved, NULL);
3596
3597         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3598                 hf_netlogon_reserved, NULL);
3599
3600         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3601                 hf_netlogon_reserved, NULL);
3602
3603         return offset;
3604 }
3605
3606
3607 /*
3608  * IDL typedef [switch_type(long)] union {
3609  * IDL   [case(1)] [unique] NETLOGON_INFO_1 *i1;
3610  * IDL   [case(2)] [unique] NETLOGON_INFO_2 *i2;
3611  * IDL   [case(3)] [unique] NETLOGON_INFO_3 *i3;
3612  * IDL } CONTROL_QUERY_INFORMATION;
3613  */
3614 static int
3615 netlogon_dissect_CONTROL_QUERY_INFORMATION(tvbuff_t *tvb, int offset,
3616                         packet_info *pinfo, proto_tree *tree,
3617                         char *drep)
3618 {
3619         guint32 level;
3620
3621         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3622                 hf_netlogon_level, &level);
3623
3624         ALIGN_TO_4_BYTES;
3625         switch(level){
3626         case 1:
3627                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3628                         netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_UNIQUE,
3629                         "NETLOGON_INFO_1:", -1);
3630                 break;
3631         case 2:
3632                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3633                         netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_UNIQUE,
3634                         "NETLOGON_INFO_2:", -1);
3635                 break;
3636         case 3:
3637                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3638                         netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_UNIQUE,
3639                         "NETLOGON_INFO_3:", -1);
3640                 break;
3641         }
3642
3643         return offset;
3644 }
3645
3646
3647 /*
3648  * IDL long NetrLogonControl(
3649  * IDL      [in][string][unique] wchar_t *logonserver,
3650  * IDL      [in] long function_code,
3651  * IDL      [in] long level,
3652  * IDL      [out][ref] CONTROL_QUERY_INFORMATION
3653  * IDL );
3654  */
3655 static int
3656 netlogon_dissect_netrlogoncontrol_rqst(tvbuff_t *tvb, int offset,
3657         packet_info *pinfo, proto_tree *tree, char *drep)
3658 {
3659         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3660                 pinfo, tree, drep);
3661
3662         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3663                 hf_netlogon_code, NULL);
3664
3665         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3666                 hf_netlogon_level, NULL);
3667
3668         return offset;
3669 }
3670 static int
3671 netlogon_dissect_netrlogoncontrol_reply(tvbuff_t *tvb, int offset,
3672         packet_info *pinfo, proto_tree *tree, char *drep)
3673 {
3674         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3675                 netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
3676                 "CONTROL_QUERY_INFORMATION:", -1);
3677
3678         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3679                                   hf_netlogon_rc, NULL);
3680
3681         return offset;
3682 }
3683
3684
3685 /*
3686  * IDL long NetrGetAnyDCName(
3687  * IDL    [in][unique][string] wchar_t *logon_server,
3688  * IDL    [in][unique][string] wchar_t *domainname,
3689  * IDL    [out][unique][string] wchar_t *dcname,
3690  * IDL };
3691  */
3692 static int
3693 netlogon_dissect_netrgetanydcname_rqst(tvbuff_t *tvb, int offset,
3694         packet_info *pinfo, proto_tree *tree, char *drep)
3695 {
3696         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3697                 NDR_POINTER_UNIQUE, "Server Handle",
3698                 hf_netlogon_logonsrv_handle, 0);
3699
3700         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3701                 NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0);
3702
3703         return offset;
3704 }
3705 static int
3706 netlogon_dissect_netrgetanydcname_reply(tvbuff_t *tvb, int offset,
3707         packet_info *pinfo, proto_tree *tree, char *drep)
3708 {
3709         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3710                 NDR_POINTER_UNIQUE, "Domain", hf_netlogon_dc_name, 0);
3711
3712         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3713                                   hf_netlogon_rc, NULL);
3714
3715         return offset;
3716 }
3717
3718
3719 /*
3720  * IDL typedef [switch_type(long)] union {
3721  * IDL   [case(5)] [unique][string] wchar_t *unknown;
3722  * IDL   [case(6)] [unique][string] wchar_t *unknown;
3723  * IDL   [case(0xfffe)] long unknown;
3724  * IDL   [case(7)] [unique][string] wchar_t *unknown;
3725  * IDL } CONTROL_DATA_INFORMATION;
3726  */
3727 /* XXX
3728  * According to muddle this is what CONTROL_DATA_INFORMATION is supposed
3729  * to look like. However NetMon does not recognize any such informationlevels.
3730  *
3731  * Ill leave it as CONTROL_DATA_INFORMATION with no informationlevels
3732  * until someone has any source of better authority to call upon.
3733  */
3734 static int
3735 netlogon_dissect_CONTROL_DATA_INFORMATION(tvbuff_t *tvb, int offset,
3736                         packet_info *pinfo, proto_tree *tree,
3737                         char *drep)
3738 {
3739         guint32 level;
3740
3741         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3742                 hf_netlogon_level, &level);
3743
3744         ALIGN_TO_4_BYTES;
3745         switch(level){
3746         case 5:
3747                 offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
3748                         tree, drep, NDR_POINTER_UNIQUE, "unknown",
3749                         hf_netlogon_unknown_string, 0);
3750                 break;
3751         case 6:
3752                 offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
3753                         tree, drep, NDR_POINTER_UNIQUE, "unknown",
3754                         hf_netlogon_unknown_string, 0);
3755                 break;
3756         case 0xfffe:
3757                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3758                         hf_netlogon_unknown_long, NULL);
3759                 break;
3760         case 8:
3761                 offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
3762                         tree, drep, NDR_POINTER_UNIQUE, "unknown",
3763                         hf_netlogon_unknown_string, 0);
3764                 break;
3765         }
3766
3767         return offset;
3768 }
3769
3770
3771 /*
3772  * IDL long NetrLogonControl2(
3773  * IDL      [in][string][unique] wchar_t *logonserver,
3774  * IDL      [in] long function_code,
3775  * IDL      [in] long level,
3776  * IDL      [in][ref] CONTROL_DATA_INFORMATION *data,
3777  * IDL      [out][ref] CONTROL_QUERY_INFORMATION *query
3778  * IDL );
3779  */
3780 static int
3781 netlogon_dissect_netrlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
3782         packet_info *pinfo, proto_tree *tree, char *drep)
3783 {
3784         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3785                 pinfo, tree, drep);
3786
3787         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3788                 hf_netlogon_code, NULL);
3789
3790         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3791                 hf_netlogon_level, NULL);
3792
3793         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3794                 netlogon_dissect_CONTROL_DATA_INFORMATION, NDR_POINTER_REF,
3795                 "CONTROL_DATA_INFORMATION: ", -1);
3796
3797         return offset;
3798 }
3799
3800 static int
3801 netlogon_dissect_netrlogoncontrol2_reply(tvbuff_t *tvb, int offset,
3802         packet_info *pinfo, proto_tree *tree, char *drep)
3803 {
3804         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3805                 netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
3806                 "CONTROL_QUERY_INFORMATION:", -1);
3807
3808         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3809                                   hf_netlogon_rc, NULL);
3810
3811         return offset;
3812 }
3813
3814
3815 /*
3816  * IDL long NetrServerAuthenticate2(
3817  * IDL      [in][string][unique] wchar_t *logonserver,
3818  * IDL      [in][ref][string] wchar_t *username,
3819  * IDL      [in] short secure_channel_type,
3820  * IDL      [in][ref][string] wchar_t *computername,
3821  * IDL      [in][ref] CREDENTIAL *client_chal,
3822  * IDL      [out][ref] CREDENTIAL *server_chal,
3823  * IDL      [in][out][ref] long *negotiate_flags,
3824  * IDL );
3825  */
3826 static int
3827 netlogon_dissect_netrserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
3828         packet_info *pinfo, proto_tree *tree, char *drep)
3829 {
3830         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3831                 pinfo, tree, drep);
3832
3833         offset = dissect_ndr_pointer_cb(
3834                 tvb, offset, pinfo, tree, drep,
3835                 dissect_ndr_wchar_cvstring, NDR_POINTER_REF,
3836                 "User Name", hf_netlogon_acct_name,
3837                 cb_wstr_postprocess, GINT_TO_POINTER(CB_STR_COL_INFO | 1));
3838
3839         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3840                 pinfo, tree, drep);
3841
3842         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3843                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
3844
3845         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3846                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
3847                 "CREDENTIAL: client_chal", -1);
3848
3849         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3850                 hf_netlogon_neg_flags, NULL);
3851
3852         return offset;
3853 }
3854
3855 static int
3856 netlogon_dissect_netrserverauthenticate2_reply(tvbuff_t *tvb, int offset,
3857         packet_info *pinfo, proto_tree *tree, char *drep)
3858 {
3859         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3860                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
3861                 "CREDENTIAL: server_chal", -1);
3862
3863         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3864                 hf_netlogon_neg_flags, NULL);
3865
3866         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3867                                   hf_netlogon_rc, NULL);
3868
3869         return offset;
3870 }
3871
3872
3873 /*
3874  * IDL long NetrDatabaseSync2(
3875  * IDL      [in][string][ref] wchar_t *logonserver, # REF!!!
3876  * IDL      [in][string][ref] wchar_t *computername,
3877  * IDL      [in][ref] AUTHENTICATOR credential,
3878  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3879  * IDL      [in] long database_id,
3880  * IDL      [in] short restart_state,
3881  * IDL      [in][out][ref] long *sync_context,
3882  * IDL      [in] long preferredmaximumlength,
3883  * IDL      [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
3884  * IDL );
3885  */
3886 static int
3887 netlogon_dissect_netrdatabasesync2_rqst(tvbuff_t *tvb, int offset,
3888         packet_info *pinfo, proto_tree *tree, char *drep)
3889 {
3890         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3891                 NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
3892
3893         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3894                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
3895
3896         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3897                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3898                 "AUTHENTICATOR: credential", -1);
3899
3900         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3901                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3902                 "AUTHENTICATOR: return_authenticator", -1);
3903
3904         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3905                 hf_netlogon_database_id, NULL);
3906
3907         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3908                 hf_netlogon_restart_state, NULL);
3909
3910         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3911                 hf_netlogon_sync_context, NULL);
3912
3913         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3914                 hf_netlogon_max_size, NULL);
3915
3916         return offset;
3917 }
3918
3919 static int
3920 netlogon_dissect_netrdatabasesync2_reply(tvbuff_t *tvb, int offset,
3921         packet_info *pinfo, proto_tree *tree, char *drep)
3922 {
3923         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3924                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3925                 "AUTHENTICATOR: return_authenticator", -1);
3926
3927         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3928                 hf_netlogon_sync_context, NULL);
3929
3930         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3931                 netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
3932                 "DELTA_ENUM_ARRAY: deltas", -1);
3933
3934         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3935                                   hf_netlogon_rc, NULL);
3936
3937         return offset;
3938 }
3939
3940
3941 /*
3942  * IDL long NetrDatabaseRedo(
3943  * IDL      [in][string][ref] wchar_t *logonserver, # REF!!!
3944  * IDL      [in][string][ref] wchar_t *computername,
3945  * IDL      [in][ref] AUTHENTICATOR credential,
3946  * IDL      [in][out][ref] AUTHENTICATOR return_authenticator,
3947  * IDL      [in][ref][size_is(change_log_entry_size)] char *change_log_entry,
3948  * IDL      [in] long change_log_entry_size,
3949  * IDL      [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
3950  * IDL );
3951  */
3952 static int
3953 netlogon_dissect_netrdatabaseredo_rqst(tvbuff_t *tvb, int offset,
3954         packet_info *pinfo, proto_tree *tree, char *drep)
3955 {
3956         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3957                 NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
3958
3959         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
3960                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
3961
3962         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3963                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3964                 "AUTHENTICATOR: credential", -1);
3965
3966         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3967                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3968                 "AUTHENTICATOR: return_authenticator", -1);
3969
3970         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3971                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3972                 "Change log entry: ", -1);
3973
3974         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3975                 hf_netlogon_max_log_size, NULL);
3976
3977         return offset;
3978 }
3979
3980 static int
3981 netlogon_dissect_netrdatabaseredo_reply(tvbuff_t *tvb, int offset,
3982         packet_info *pinfo, proto_tree *tree, char *drep)
3983 {
3984         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3985                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
3986                 "AUTHENTICATOR: return_authenticator", -1);
3987
3988         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3989                 netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
3990                 "DELTA_ENUM_ARRAY: deltas", -1);
3991
3992         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3993                                   hf_netlogon_rc, NULL);
3994
3995         return offset;
3996 }
3997
3998
3999 /*
4000  * IDL long NetrLogonControl2Ex(
4001  * IDL      [in][string][unique] wchar_t *logonserver,
4002  * IDL      [in] long function_code,
4003  * IDL      [in] long level,
4004  * IDL      [in][ref] CONTROL_DATA_INFORMATION *data,
4005  * IDL      [out][ref] CONTROL_QUERY_INFORMATION *query
4006  * IDL );
4007  */
4008 static int
4009 netlogon_dissect_netrlogoncontrol2ex_rqst(tvbuff_t *tvb, int offset,
4010         packet_info *pinfo, proto_tree *tree, char *drep)
4011 {
4012         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4013                 pinfo, tree, drep);
4014
4015         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4016                 hf_netlogon_code, NULL);
4017
4018         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4019                 hf_netlogon_level, NULL);
4020
4021         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4022                 netlogon_dissect_CONTROL_DATA_INFORMATION, NDR_POINTER_REF,
4023                 "CONTROL_DATA_INFORMATION: ", -1);
4024
4025         return offset;
4026 }
4027 static int
4028 netlogon_dissect_netrlogoncontrol2ex_reply(tvbuff_t *tvb, int offset,
4029         packet_info *pinfo, proto_tree *tree, char *drep)
4030 {
4031         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4032                 netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
4033                 "CONTROL_QUERY_INFORMATION:", -1);
4034
4035         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4036                                   hf_netlogon_rc, NULL);
4037
4038         return offset;
4039 }
4040
4041
4042
4043
4044 static const value_string trust_type_vals[] = {
4045         { 1,                            "DOWNLEVEL" },
4046         { 2,                            "UPLEVEL" },
4047         { 3,                            "MIT" },
4048         { 4,                            "DCE" },
4049         { 0, NULL }
4050 };
4051
4052 #define DS_INET_ADDRESS         1
4053 #define DS_NETBIOS_ADDRESS      2
4054 static const value_string dc_address_types[] = {
4055         { DS_INET_ADDRESS,              "IP/DNS name" },
4056         { DS_NETBIOS_ADDRESS,           "NetBIOS name" },
4057         { 0, NULL}
4058 };
4059
4060
4061 #define DS_DOMAIN_IN_FOREST             0x0001
4062 #define DS_DOMAIN_DIRECT_OUTBOUND       0x0002
4063 #define DS_DOMAIN_TREE_ROOT             0x0004
4064 #define DS_DOMAIN_PRIMARY               0x0008
4065 #define DS_DOMAIN_NATIVE_MODE           0x0010
4066 #define DS_DOMAIN_DIRECT_INBOUND        0x0020
4067 static const true_false_string trust_inbound = {
4068         "There is a DIRECT INBOUND trust for the servers domain",
4069         "There is NO direct inbound trust for the servers domain"
4070 };
4071 static const true_false_string trust_outbound = {
4072         "There is a DIRECT OUTBOUND trust for this domain",
4073         "There is NO direct outbound trust for this domain"
4074 };
4075 static const true_false_string trust_in_forest = {
4076         "The domain is a member IN the same FOREST as the queried server",
4077         "The domain is NOT a member of the queried servers domain"
4078 };
4079 static const true_false_string trust_native_mode = {
4080         "The primary domain is a NATIVE MODE w2k domain",
4081         "The primary is NOT a native mode w2k domain"
4082 };
4083 static const true_false_string trust_primary = {
4084         "The domain is the PRIMARY domain of the queried server",
4085         "The domain is NOT the primary domain of the queried server"
4086 };
4087 static const true_false_string trust_tree_root = {
4088         "The domain is the ROOT of a domain TREE",
4089         "The domain is NOT a root of a domain tree"
4090 };
4091 static int
4092 netlogon_dissect_DOMAIN_TRUST_FLAGS(tvbuff_t *tvb, int offset,
4093         packet_info *pinfo, proto_tree *parent_tree, char *drep)
4094 {
4095         guint32 mask;
4096         proto_item *item = NULL;
4097         proto_tree *tree = NULL;
4098         dcerpc_info *di;
4099
4100         di=pinfo->private_data;
4101         if(di->conformant_run){
4102                 /*just a run to handle conformant arrays, nothing to dissect */
4103                 return offset;
4104         }
4105
4106         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
4107                         hf_netlogon_trust_flags, &mask);
4108
4109         if(parent_tree){
4110                 item = proto_tree_add_uint(parent_tree, hf_netlogon_trust_flags,
4111                         tvb, offset-4, 4, mask);
4112                 tree = proto_item_add_subtree(item, ett_trust_flags);
4113         }
4114
4115         proto_tree_add_boolean(tree, hf_netlogon_trust_flags_inbound,
4116                 tvb, offset-4, 4, mask);
4117         proto_tree_add_boolean(tree, hf_netlogon_trust_flags_native_mode,
4118                 tvb, offset-4, 4, mask);
4119         proto_tree_add_boolean(tree, hf_netlogon_trust_flags_primary,
4120                 tvb, offset-4, 4, mask);
4121         proto_tree_add_boolean(tree, hf_netlogon_trust_flags_tree_root,
4122                 tvb, offset-4, 4, mask);
4123         proto_tree_add_boolean(tree, hf_netlogon_trust_flags_outbound,
4124                 tvb, offset-4, 4, mask);
4125         proto_tree_add_boolean(tree, hf_netlogon_trust_flags_in_forest,
4126                 tvb, offset-4, 4, mask);
4127
4128         return offset;
4129 }
4130
4131
4132 #define DS_FORCE_REDISCOVERY            0x00000001
4133 #define DS_DIRECTORY_SERVICE_REQUIRED   0x00000010
4134 #define DS_DIRECTORY_SERVICE_PREFERRED  0x00000020
4135 #define DS_GC_SERVER_REQUIRED           0x00000040
4136 #define DS_PDC_REQUIRED                 0x00000080
4137 #define DS_BACKGROUND_ONLY              0x00000100
4138 #define DS_IP_REQUIRED                  0x00000200
4139 #define DS_KDC_REQUIRED                 0x00000400
4140 #define DS_TIMESERV_REQUIRED            0x00000800
4141 #define DS_WRITABLE_REQUIRED            0x00001000
4142 #define DS_GOOD_TIMESERV_PREFERRED      0x00002000
4143 #define DS_AVOID_SELF                   0x00004000
4144 #define DS_ONLY_LDAP_NEEDED             0x00008000
4145 #define DS_IS_FLAT_NAME                 0x00010000
4146 #define DS_IS_DNS_NAME                  0x00020000
4147 #define DS_RETURN_DNS_NAME              0x40000000
4148 #define DS_RETURN_FLAT_NAME             0x80000000
4149 static const true_false_string get_dcname_request_flags_force_rediscovery = {
4150         "FORCE REDISCOVERY of any cached data",
4151         "You may return cached data"
4152 };
4153 static const true_false_string get_dcname_request_flags_directory_service_required = {
4154         "DIRECRTORY SERVICE is REQUIRED on the server",
4155         "We do NOT require directory service servers"
4156 };
4157 static const true_false_string get_dcname_request_flags_directory_service_preferred = {
4158         "DIRECTORY SERVICE servers are PREFERRED",
4159         "We do NOT have a preference for directory service servers"
4160 };
4161 static const true_false_string get_dcname_request_flags_gc_server_required = {
4162         "GC SERVER is REQUIRED",
4163         "gc server is NOT required"
4164 };
4165 static const true_false_string get_dcname_request_flags_pdc_required = {
4166         "PDC SERVER is REQUIRED",
4167         "pdc server is NOT required"
4168 };
4169 static const true_false_string get_dcname_request_flags_background_only = {
4170         "Only returned cahced data, even if it has expired",
4171         "Return cached data unless it has expired"
4172 };
4173 static const true_false_string get_dcname_request_flags_ip_required = {
4174         "IP address is REQUIRED",
4175         "ip address is NOT required"
4176 };
4177 static const true_false_string get_dcname_request_flags_kdc_required = {
4178         "KDC server is REQUIRED",
4179         "kdc server is NOT required"
4180 };
4181 static const true_false_string get_dcname_request_flags_timeserv_required = {
4182         "TIMESERV service is REQUIRED",
4183         "timeserv service is NOT required"
4184 };
4185 static const true_false_string get_dcname_request_flags_writable_required = {
4186         "the requrned dc MUST be WRITEABLE",
4187         "a read-only dc may be returned"
4188 };
4189 static const true_false_string get_dcname_request_flags_good_timeserv_preferred = {
4190         "GOOD TIMESERV servers are PREFERRED",
4191         "we do NOT have a preference for good timeserv servers"
4192 };
4193 static const true_false_string get_dcname_request_flags_avoid_self = {
4194         "do NOT return self as dc, return someone else",
4195         "you may return yourSELF as the dc"
4196 };
4197 static const true_false_string get_dcname_request_flags_only_ldap_needed = {
4198         "we ONLY NEED LDAP, you dont have to return a dc",
4199         "we need a normal dc, an ldap only server will not do"
4200 };
4201 static const true_false_string get_dcname_request_flags_is_flat_name = {
4202         "the name we specify is a NetBIOS name",
4203         "the name we specify is NOT a NetBIOS name"
4204 };
4205 static const true_false_string get_dcname_request_flags_is_dns_name = {
4206         "the name we specify is a DNS name",
4207         "ther name we specify is NOT a dns name"
4208 };
4209 static const true_false_string get_dcname_request_flags_return_dns_name = {
4210         "return a DNS name",
4211         "you may return a NON-dns name"
4212 };
4213 static const true_false_string get_dcname_request_flags_return_flat_name = {
4214         "return a NetBIOS name",
4215         "you may return a NON-NetBIOS name"
4216 };
4217 static int
4218 netlogon_dissect_GET_DCNAME_REQUEST_FLAGS(tvbuff_t *tvb, int offset,
4219         packet_info *pinfo, proto_tree *parent_tree, char *drep)
4220 {
4221         guint32 mask;
4222         proto_item *item = NULL;
4223         proto_tree *tree = NULL;
4224         dcerpc_info *di;
4225
4226         di=pinfo->private_data;
4227         if(di->conformant_run){
4228                 /*just a run to handle conformant arrays, nothing to dissect */
4229                 return offset;
4230         }
4231
4232         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
4233                         hf_netlogon_get_dcname_request_flags, &mask);
4234
4235         if(parent_tree){
4236                 item = proto_tree_add_uint(parent_tree, hf_netlogon_get_dcname_request_flags,
4237                         tvb, offset-4, 4, mask);
4238                 tree = proto_item_add_subtree(item, ett_get_dcname_request_flags);
4239         }
4240
4241         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_return_flat_name,
4242                 tvb, offset-4, 4, mask);
4243         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_return_dns_name,
4244                 tvb, offset-4, 4, mask);
4245         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_is_flat_name,
4246                 tvb, offset-4, 4, mask);
4247         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_is_dns_name,
4248                 tvb, offset-4, 4, mask);
4249         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_only_ldap_needed,
4250                 tvb, offset-4, 4, mask);
4251         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_avoid_self,
4252                 tvb, offset-4, 4, mask);
4253         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_good_timeserv_preferred,
4254                 tvb, offset-4, 4, mask);
4255         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_writable_required,
4256                 tvb, offset-4, 4, mask);
4257         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_timeserv_required,
4258                 tvb, offset-4, 4, mask);
4259         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_kdc_required,
4260                 tvb, offset-4, 4, mask);
4261         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_ip_required,
4262                 tvb, offset-4, 4, mask);
4263         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_background_only,
4264                 tvb, offset-4, 4, mask);
4265         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_pdc_required,
4266                 tvb, offset-4, 4, mask);
4267         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_gc_server_required,
4268                 tvb, offset-4, 4, mask);
4269         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_directory_service_preferred,
4270                 tvb, offset-4, 4, mask);
4271         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_directory_service_required,
4272                 tvb, offset-4, 4, mask);
4273         proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_force_rediscovery,
4274                 tvb, offset-4, 4, mask);
4275
4276         return offset;
4277 }
4278
4279
4280
4281 #define DS_PDC_FLAG             0x00000001
4282 #define DS_GC_FLAG              0x00000004
4283 #define DS_LDAP_FLAG            0x00000008
4284 #define DS_DS_FLAG              0x00000010
4285 #define DS_KDC_FLAG             0x00000020
4286 #define DS_TIMESERV_FLAG        0x00000040
4287 #define DS_CLOSEST_FLAG         0x00000080
4288 #define DS_WRITABLE_FLAG        0x00000100
4289 #define DS_GOOD_TIMESERV_FLAG   0x00000200
4290 #define DS_NDNC_FLAG            0x00000400
4291 #define DS_DNS_CONTROLLER_FLAG  0x20000000
4292 #define DS_DNS_DOMAIN_FLAG      0x40000000
4293 #define DS_DNS_FOREST_FLAG      0x80000000
4294 static const true_false_string dc_flags_pdc_flag = {
4295         "this is the PDC of the domain",
4296         "this is NOT the pdc of the domain"
4297 };
4298 static const true_false_string dc_flags_gc_flag = {
4299         "this is the GC of the forest",
4300         "this is NOT the gc of the forest"
4301 };
4302 static const true_false_string dc_flags_ldap_flag = {
4303         "this is an LDAP server",
4304         "this is NOT an ldap server"
4305 };
4306 static const true_false_string dc_flags_ds_flag = {
4307         "this is a DS server",
4308         "this is NOT a ds server"
4309 };
4310 static const true_false_string dc_flags_kdc_flag = {
4311         "this is a KDC server",
4312         "this is NOT a kdc server"
4313 };
4314 static const true_false_string dc_flags_timeserv_flag = {
4315         "this is a TIMESERV server",
4316         "this is NOT a timeserv server"
4317 };
4318 static const true_false_string dc_flags_closest_flag = {
4319         "this is the CLOSEST server",
4320         "this is NOT the closest server"
4321 };
4322 static const true_false_string dc_flags_writable_flag = {
4323         "this server has a WRITABLE ds database",
4324         "this server has a READ-ONLY ds database"
4325 };
4326 static const true_false_string dc_flags_good_timeserv_flag = {
4327         "this server is a GOOD TIMESERV server",
4328         "this is NOT a good timeserv server"
4329 };
4330 static const true_false_string dc_flags_ndnc_flag = {
4331         "NDNC is set",
4332         "ndnc is NOT set"
4333 };
4334 static const true_false_string dc_flags_dns_controller_flag = {
4335         "DomainControllerName is a DNS name",
4336         "DomainControllerName is NOT a dns name"
4337 };
4338 static const true_false_string dc_flags_dns_domain_flag = {
4339         "DomainName is a DNS name",
4340         "DomainName is NOT a dns name"
4341 };
4342 static const true_false_string dc_flags_dns_forest_flag = {
4343         "DnsForestName is a DNS name",
4344         "DnsForestName is NOT a dns name"
4345 };
4346 static int
4347 netlogon_dissect_DC_FLAGS(tvbuff_t *tvb, int offset,
4348         packet_info *pinfo, proto_tree *parent_tree, char *drep)
4349 {
4350         guint32 mask;
4351         proto_item *item = NULL;
4352         proto_tree *tree = NULL;
4353         dcerpc_info *di;
4354
4355         di=pinfo->private_data;
4356         if(di->conformant_run){
4357                 /*just a run to handle conformant arrays, nothing to dissect */
4358                 return offset;
4359         }
4360
4361         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
4362                         hf_netlogon_dc_flags, &mask);
4363
4364         if(parent_tree){
4365                 item = proto_tree_add_uint_format(parent_tree, hf_netlogon_dc_flags,
4366                                 tvb, offset-4, 4, mask, "Domain Controller Flags: 0x%08x%s", mask, (mask==0x0000ffff)?"  PING (mask==0x0000ffff)":"");
4367                 tree = proto_item_add_subtree(item, ett_dc_flags);
4368         }
4369
4370         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_dns_forest_flag,
4371                 tvb, offset-4, 4, mask);
4372         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_dns_domain_flag,
4373                 tvb, offset-4, 4, mask);
4374         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_dns_controller_flag,
4375                 tvb, offset-4, 4, mask);
4376         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_ndnc_flag,
4377                 tvb, offset-4, 4, mask);
4378         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_good_timeserv_flag,
4379                 tvb, offset-4, 4, mask);
4380         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_writable_flag,
4381                 tvb, offset-4, 4, mask);
4382         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_closest_flag,
4383                 tvb, offset-4, 4, mask);
4384         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_timeserv_flag,
4385                 tvb, offset-4, 4, mask);
4386         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_kdc_flag,
4387                 tvb, offset-4, 4, mask);
4388         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_ds_flag,
4389                 tvb, offset-4, 4, mask);
4390         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_ldap_flag,
4391                 tvb, offset-4, 4, mask);
4392         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_gc_flag,
4393                 tvb, offset-4, 4, mask);
4394         proto_tree_add_boolean(tree, hf_netlogon_dc_flags_pdc_flag,
4395                 tvb, offset-4, 4, mask);
4396
4397         return offset;
4398 }
4399
4400
4401
4402 static int
4403 netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
4404                              packet_info *pinfo, proto_tree *tree,
4405                              char *drep)
4406 {
4407         dcerpc_info *di;
4408
4409         di=pinfo->private_data;
4410         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
4411                                      di->hf_index, NULL);
4412         return offset;
4413 }
4414
4415 static int
4416 netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
4417                              packet_info *pinfo, proto_tree *tree,
4418                              char *drep)
4419 {
4420         dcerpc_info *di;
4421
4422         di=pinfo->private_data;
4423         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4424                                      di->hf_index, NULL);
4425         return offset;
4426 }
4427
4428 static int
4429 netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
4430                         packet_info *pinfo, proto_tree *tree,
4431                         char *drep)
4432 {
4433                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4434                         hf_netlogon_unknown_char, NULL);
4435
4436         return offset;
4437 }
4438
4439 static int
4440 netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
4441                         packet_info *pinfo, proto_tree *tree,
4442                         char *drep)
4443 {
4444         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4445                 netlogon_dissect_UNICODE_MULTI_byte);
4446
4447         return offset;
4448 }
4449
4450 static int
4451 netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
4452                         packet_info *pinfo, proto_tree *parent_tree,
4453                         char *drep)
4454 {
4455         proto_item *item=NULL;
4456         proto_tree *tree=NULL;
4457         int old_offset=offset;
4458
4459         if(parent_tree){
4460                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4461                         "UNICODE_MULTI:");
4462                 tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
4463         }
4464
4465         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4466                 hf_netlogon_len, NULL);
4467
4468         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4469                 netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_UNIQUE,
4470                 "unknown", hf_netlogon_unknown_string);
4471
4472         proto_item_set_len(item, offset-old_offset);
4473         return offset;
4474 }
4475
4476 int
4477 dissect_nt_GUID(tvbuff_t *tvb, int offset,
4478                         packet_info *pinfo, proto_tree *tree,
4479                         char *drep)
4480 {
4481         offset=dissect_ndr_uuid_t(tvb, offset, pinfo, tree, drep, hf_netlogon_guid, NULL);
4482
4483         return offset;
4484 }
4485
4486 static int
4487 netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
4488                         packet_info *pinfo, proto_tree *parent_tree,
4489                         char *drep)
4490 {
4491         proto_item *item=NULL;
4492         proto_tree *tree=NULL;
4493         int old_offset=offset;
4494
4495         if(parent_tree){
4496                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4497                         "DOMAIN_CONTROLLER_INFO:");
4498                 tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
4499         }
4500
4501         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4502                 NDR_POINTER_UNIQUE, "DC Name", hf_netlogon_dc_name, 0);
4503
4504         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4505                 NDR_POINTER_UNIQUE, "DC Address", hf_netlogon_dc_address, 0);
4506
4507         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4508                 hf_netlogon_dc_address_type, NULL);
4509
4510         offset = dissect_nt_GUID(tvb, offset,
4511                 pinfo, tree, drep);
4512
4513         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4514                 NDR_POINTER_UNIQUE, "Logon Domain", hf_netlogon_logon_dom, 0);
4515
4516         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4517                 NDR_POINTER_UNIQUE, "DNS Forest", hf_netlogon_dns_forest_name, 0);
4518
4519         offset = netlogon_dissect_DC_FLAGS(tvb, offset, pinfo, tree, drep);
4520
4521         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4522                 NDR_POINTER_UNIQUE, "DC Site", hf_netlogon_dc_site_name, 0);
4523
4524         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4525                 NDR_POINTER_UNIQUE, "Client Site",
4526                 hf_netlogon_client_site_name, 0);
4527
4528         proto_item_set_len(item, offset-old_offset);
4529         return offset;
4530 }
4531
4532 static int
4533 netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
4534                         packet_info *pinfo, proto_tree *tree,
4535                         char *drep)
4536 {
4537         guint32 len;
4538         dcerpc_info *di;
4539
4540         di=pinfo->private_data;
4541         if(di->conformant_run){
4542                 /*just a run to handle conformant arrays, nothing to dissect.*/
4543                 return offset;
4544         }
4545
4546         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4547                 hf_netlogon_blob_size, &len);
4548
4549         proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
4550                 FALSE);
4551         offset += len;
4552
4553         return offset;
4554 }
4555
4556 static int
4557 netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
4558                         packet_info *pinfo, proto_tree *parent_tree,
4559                         char *drep)
4560 {
4561         proto_item *item=NULL;
4562         proto_tree *tree=NULL;
4563
4564         if(parent_tree){
4565                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4566                         "BLOB:");
4567                 tree = proto_item_add_subtree(item, ett_BLOB);
4568         }
4569
4570         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4571                 hf_netlogon_blob_size, NULL);
4572
4573         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4574                 netlogon_dissect_BLOB_array, NDR_POINTER_UNIQUE,
4575                 "BLOB:", -1);
4576
4577         return offset;
4578 }
4579
4580 static int
4581 netlogon_dissect_DOMAIN_TRUST_INFO(tvbuff_t *tvb, int offset,
4582                         packet_info *pinfo, proto_tree *parent_tree,
4583                         char *drep)
4584 {
4585         proto_item *item=NULL;
4586         proto_tree *tree=NULL;
4587         int old_offset=offset;
4588
4589         if(parent_tree){
4590                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4591                         "DOMAIN_TRUST_INFO:");
4592                 tree = proto_item_add_subtree(item, ett_DOMAIN_TRUST_INFO);
4593         }
4594
4595
4596         offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvb, offset, pinfo, tree, drep);
4597
4598         /* Guesses at best. */
4599         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4600                 hf_netlogon_unknown_string, 0);
4601
4602         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4603                 hf_netlogon_unknown_string, 0);
4604
4605         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4606                 hf_netlogon_unknown_string, 0);
4607
4608         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4609                 hf_netlogon_unknown_string, 0);
4610
4611         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4612                 hf_netlogon_unknown_long, NULL);
4613
4614         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4615                 hf_netlogon_unknown_long, NULL);
4616
4617         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4618                 hf_netlogon_unknown_long, NULL);
4619
4620         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4621                 hf_netlogon_unknown_long, NULL);
4622
4623         proto_item_set_len(item, offset-old_offset);
4624         return offset;
4625 }
4626
4627 static int
4628 netlogon_dissect_DOMAIN_TRUST_INFO_ARRAY(tvbuff_t *tvb, int offset,
4629                         packet_info *pinfo, proto_tree *tree,
4630                         char *drep)
4631 {
4632         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4633                 netlogon_dissect_DOMAIN_TRUST_INFO);
4634
4635         return offset;
4636 }
4637
4638 static int
4639 netlogon_dissect_DOMAIN_QUERY_1(tvbuff_t *tvb, int offset,
4640                         packet_info *pinfo, proto_tree *tree,
4641                         char *drep)
4642 {
4643         offset = netlogon_dissect_BLOB(tvb, offset,
4644                 pinfo, tree, drep);
4645
4646         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4647                 NDR_POINTER_UNIQUE, "Workstation FQDN",
4648                 hf_netlogon_workstation_fqdn, 0);
4649
4650         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4651                 NDR_POINTER_UNIQUE, "Workstation Site",
4652                 hf_netlogon_workstation_site_name, 0);
4653
4654         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4655                 NDR_POINTER_UNIQUE, "unknown", hf_netlogon_unknown_string, 0);
4656
4657         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4658                 NDR_POINTER_UNIQUE, "unknown", hf_netlogon_unknown_string, 0);
4659
4660         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4661                 NDR_POINTER_UNIQUE, "unknown", hf_netlogon_unknown_string, 0);
4662
4663         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4664                 NDR_POINTER_UNIQUE, "unknown", hf_netlogon_unknown_string, 0);
4665
4666         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4667                 hf_netlogon_unknown_string, 0);
4668
4669         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4670                 hf_netlogon_workstation_os, 0);
4671
4672         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4673                 hf_netlogon_unknown_string, 0);
4674
4675         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4676                 hf_netlogon_unknown_string, 0);
4677
4678         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4679                 hf_netlogon_unknown_long, NULL);
4680
4681         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4682                 hf_netlogon_unknown_long, NULL);
4683
4684         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4685                 hf_netlogon_unknown_long, NULL);
4686
4687         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4688                 hf_netlogon_unknown_long, NULL);
4689
4690         return offset;
4691 }
4692
4693 static int
4694 netlogon_dissect_DOMAIN_INFO_1(tvbuff_t *tvb, int offset,
4695                         packet_info *pinfo, proto_tree *tree,
4696                         char *drep)
4697 {
4698         offset = netlogon_dissect_DOMAIN_TRUST_INFO(tvb, offset, pinfo, tree, drep);
4699
4700         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4701                 hf_netlogon_num_trusts, NULL);
4702
4703         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4704                 netlogon_dissect_DOMAIN_TRUST_INFO_ARRAY, NDR_POINTER_UNIQUE,
4705                 "DOMAIN_TRUST_ARRAY: Trusts", -1);
4706
4707         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4708                 hf_netlogon_num_trusts, NULL);
4709
4710         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4711                 netlogon_dissect_DOMAIN_TRUST_INFO_ARRAY, NDR_POINTER_UNIQUE,
4712                 "DOMAIN_TRUST_ARRAY:", -1);
4713
4714         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4715                 hf_netlogon_dns_domain_name, 0);
4716
4717         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4718                 hf_netlogon_unknown_string, 0);
4719
4720         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4721                 hf_netlogon_unknown_string, 0);
4722
4723         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
4724                 hf_netlogon_unknown_string, 0);
4725
4726         /* These four integers appear to mirror the last four in the query. */
4727         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4728                 hf_netlogon_unknown_long, NULL);
4729
4730         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4731                 hf_netlogon_unknown_long, NULL);
4732
4733         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4734                 hf_netlogon_unknown_long, NULL);
4735
4736         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4737                 hf_netlogon_unknown_long, NULL);
4738
4739         return offset;
4740 }
4741
4742
4743 static int
4744 netlogon_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset,
4745                         packet_info *pinfo, proto_tree *tree,
4746                         char *drep)
4747 {
4748         guint32 level;
4749
4750         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4751                 hf_netlogon_level, &level);
4752
4753         ALIGN_TO_4_BYTES;
4754         switch(level){
4755         case 1:
4756                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4757                         netlogon_dissect_DOMAIN_INFO_1, NDR_POINTER_UNIQUE,
4758                         "DOMAIN_INFO_1:", -1);
4759                 break;
4760         }
4761
4762         return offset;
4763 }
4764
4765 static int
4766 netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
4767                         packet_info *pinfo, proto_tree *parent_tree,
4768                         char *drep)
4769 {
4770         proto_item *item=NULL;
4771         proto_tree *tree=NULL;
4772         int old_offset=offset;
4773         int i;
4774
4775         if(parent_tree){
4776                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4777                         "UNICODE_STRING_512:");
4778                 tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
4779         }
4780
4781         for(i=0;i<512;i++){
4782                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4783                         hf_netlogon_unknown_short, NULL);
4784         }
4785
4786         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4787                 hf_netlogon_unknown_long, NULL);
4788
4789         proto_item_set_len(item, offset-old_offset);
4790         return offset;
4791 }
4792
4793 static int
4794 netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
4795                         packet_info *pinfo, proto_tree *tree,
4796                         char *drep)
4797 {
4798                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4799                         hf_netlogon_unknown_char, NULL);
4800
4801         return offset;
4802 }
4803
4804 static int
4805 netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
4806                         packet_info *pinfo, proto_tree *tree,
4807                         char *drep)
4808 {
4809         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4810                 netlogon_dissect_element_844_byte);
4811
4812         return offset;
4813 }
4814
4815 static int
4816 netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
4817                         packet_info *pinfo, proto_tree *parent_tree,
4818                         char *drep)
4819 {
4820         proto_item *item=NULL;
4821         proto_tree *tree=NULL;
4822         int old_offset=offset;
4823
4824         if(parent_tree){
4825                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4826                         "TYPE_50:");
4827                 tree = proto_item_add_subtree(item, ett_TYPE_50);
4828         }
4829
4830         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4831                 hf_netlogon_unknown_long, NULL);
4832
4833         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4834                 netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
4835                 "unknown", hf_netlogon_unknown_string);
4836
4837         proto_item_set_len(item, offset-old_offset);
4838         return offset;
4839 }
4840
4841 static int
4842 netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
4843                         packet_info *pinfo, proto_tree *tree,
4844                         char *drep)
4845 {
4846         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4847                 netlogon_dissect_TYPE_50, NDR_POINTER_UNIQUE,
4848                 "TYPE_50 pointer: unknown_TYPE_50", -1);
4849
4850         return offset;
4851 }
4852
4853 static int
4854 netlogon_dissect_DS_DOMAIN_TRUSTS(tvbuff_t *tvb, int offset,
4855         packet_info *pinfo, proto_tree *parent_tree, char *drep)
4856 {
4857         guint32 tmp;
4858         proto_item *item=NULL;
4859         proto_tree *tree=NULL;
4860         int old_offset=offset;
4861
4862         if(parent_tree){
4863                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4864                         "DS_DOMAIN_TRUSTS");
4865                 tree = proto_item_add_subtree(item, ett_DS_DOMAIN_TRUSTS);
4866         }
4867
4868         /* name */
4869         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4870                 NDR_POINTER_UNIQUE, "NetBIOS Name",
4871                 hf_netlogon_downlevel_domain_name, 0);
4872
4873         /* domain */
4874         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
4875                 NDR_POINTER_UNIQUE, "DNS Domain Name",
4876                 hf_netlogon_dns_domain_name, 0);
4877
4878         offset = netlogon_dissect_DOMAIN_TRUST_FLAGS(tvb, offset, pinfo, tree, drep);
4879
4880         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4881                 hf_netlogon_trust_parent_index, &tmp);
4882
4883         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4884                 hf_netlogon_trust_type, &tmp);
4885
4886         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4887                 hf_netlogon_trust_attribs, &tmp);
4888
4889         /* SID pointer */
4890         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep, -1);
4891
4892         /* GUID */
4893         offset = dissect_nt_GUID(tvb, offset, pinfo, tree, drep);
4894
4895         proto_item_set_len(item, offset-old_offset);
4896         return offset;
4897 }
4898
4899 static int
4900 netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY(tvbuff_t *tvb, int offset,
4901                         packet_info *pinfo, proto_tree *tree,
4902                         char *drep)
4903 {
4904         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4905                 netlogon_dissect_DS_DOMAIN_TRUSTS);
4906
4907         return offset;
4908 }
4909
4910 static int
4911 netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
4912                         packet_info *pinfo, proto_tree *tree,
4913                         char *drep)
4914 {
4915                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4916                         hf_netlogon_unknown_char, NULL);
4917
4918         return offset;
4919 }
4920
4921 static int
4922 netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
4923                         packet_info *pinfo, proto_tree *tree,
4924                         char *drep)
4925 {
4926         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4927                 netlogon_dissect_element_865_byte);
4928
4929         return offset;
4930 }
4931
4932 static int
4933 netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
4934                         packet_info *pinfo, proto_tree *tree,
4935                         char *drep)
4936 {
4937                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4938                         hf_netlogon_unknown_char, NULL);
4939
4940         return offset;
4941 }
4942
4943 static int
4944 netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
4945                         packet_info *pinfo, proto_tree *tree,
4946                         char *drep)
4947 {
4948         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
4949                 netlogon_dissect_element_866_byte);
4950
4951         return offset;
4952 }
4953
4954 static int
4955 netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
4956                         packet_info *pinfo, proto_tree *parent_tree,
4957                         char *drep)
4958 {
4959         proto_item *item=NULL;
4960         proto_tree *tree=NULL;
4961         int old_offset=offset;
4962
4963         if(parent_tree){
4964                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
4965                         "TYPE_52:");
4966                 tree = proto_item_add_subtree(item, ett_TYPE_52);
4967         }
4968
4969         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4970                 hf_netlogon_unknown_long, NULL);
4971
4972         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4973                 netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
4974                 "unknown", hf_netlogon_unknown_string);
4975
4976         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4977                 netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
4978                 "unknown", hf_netlogon_unknown_string);
4979
4980         proto_item_set_len(item, offset-old_offset);
4981         return offset;
4982 }
4983
4984 static int
4985 netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
4986                         packet_info *pinfo, proto_tree *tree,
4987                         char *drep)
4988 {
4989         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4990                 netlogon_dissect_TYPE_52, NDR_POINTER_UNIQUE,
4991                 "TYPE_52 pointer: unknown_TYPE_52", -1);
4992         return offset;
4993 }
4994
4995
4996 static int
4997 netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
4998                         packet_info *pinfo, proto_tree *parent_tree,
4999                         char *drep)
5000 {
5001         proto_item *item=NULL;
5002         proto_tree *tree=NULL;
5003         int old_offset=offset;
5004         guint32 level;
5005
5006         if(parent_tree){
5007                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
5008                         "TYPE_44:");
5009                 tree = proto_item_add_subtree(item, ett_TYPE_44);
5010         }
5011
5012         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5013                 hf_netlogon_level, &level);
5014
5015         ALIGN_TO_4_BYTES;
5016         switch(level){
5017         case 1:
5018                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5019                         hf_netlogon_unknown_long, NULL);
5020                 break;
5021         }
5022
5023         proto_item_set_len(item, offset-old_offset);
5024         return offset;
5025 }
5026
5027 static int
5028 netlogon_dissect_DOMAIN_QUERY(tvbuff_t *tvb, int offset,
5029                         packet_info *pinfo, proto_tree *tree,
5030                         char *drep)
5031 {
5032         guint32 level;
5033
5034         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5035                 hf_netlogon_level, &level);
5036
5037         ALIGN_TO_4_BYTES;
5038         switch(level){
5039         case 1:
5040                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5041                         netlogon_dissect_DOMAIN_QUERY_1, NDR_POINTER_UNIQUE,
5042                         "DOMAIN_QUERY_1:", -1);
5043                 break;
5044         case 2:
5045                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5046                         netlogon_dissect_DOMAIN_QUERY_1, NDR_POINTER_UNIQUE,
5047                         "DOMAIN_QUERY_1:", -1);
5048                 break;
5049         }
5050
5051         return offset;
5052 }
5053
5054 static int
5055 netlogon_dissect_netrenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset,
5056         packet_info *pinfo, proto_tree *tree, char *drep)
5057 {
5058         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5059                 pinfo, tree, drep);
5060
5061         return offset;
5062 }
5063
5064
5065 static int
5066 netlogon_dissect_netrenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset,
5067         packet_info *pinfo, proto_tree *tree, char *drep)
5068 {
5069         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5070                 netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF,
5071                 "UNICODE_MULTI pointer: trust_dom_name_list", -1);
5072
5073         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5074                                   hf_netlogon_rc, NULL);
5075
5076         return offset;
5077 }
5078
5079 static int
5080 netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
5081         packet_info *pinfo, proto_tree *tree, char *drep)
5082 {
5083         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5084                 pinfo, tree, drep);
5085
5086         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5087                 NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0);
5088
5089         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5090                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5091                 "GUID pointer: domain_guid", -1);
5092
5093         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5094                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5095                 "GUID pointer: site_guid", -1);
5096
5097         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5098                 hf_netlogon_flags, NULL);
5099
5100         return offset;
5101 }
5102
5103
5104 static int
5105 netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
5106         packet_info *pinfo, proto_tree *tree, char *drep)
5107 {
5108         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5109                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
5110                 "DOMAIN_CONTROLLER_INFO:", -1);
5111
5112         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5113                                   hf_netlogon_rc, NULL);
5114
5115         return offset;
5116 }
5117
5118 static int
5119 netlogon_dissect_netrlogondummyroutine1_rqst(tvbuff_t *tvb, int offset,
5120         packet_info *pinfo, proto_tree *tree, char *drep)
5121 {
5122         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5123                 pinfo, tree, drep);
5124
5125         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5126                 NDR_POINTER_UNIQUE, "unknown string",
5127                 hf_netlogon_unknown_string, 0);
5128
5129         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5130                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5131                 "AUTHENTICATOR: credential", -1);
5132
5133         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5134                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
5135                 "AUTHENTICATOR: return_authenticator", -1);
5136
5137         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5138                 hf_netlogon_unknown_long, NULL);
5139
5140         return offset;
5141 }
5142
5143
5144 static int
5145 netlogon_dissect_netrlogondummyroutine1_reply(tvbuff_t *tvb, int offset,
5146         packet_info *pinfo, proto_tree *tree, char *drep)
5147 {
5148         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5149                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
5150                 "AUTHENTICATOR: return_authenticator", -1);
5151
5152         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5153                 netlogon_dissect_TYPE_44, NDR_POINTER_UNIQUE,
5154                 "TYPE_44 pointer: unknown_TYPE_44", -1);
5155
5156         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5157                                   hf_netlogon_rc, NULL);
5158
5159         return offset;
5160 }
5161
5162 static int
5163 netlogon_dissect_netrlogonsetservicebits_rqst(tvbuff_t *tvb, int offset,
5164         packet_info *pinfo, proto_tree *tree, char *drep)
5165 {
5166         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5167                 pinfo, tree, drep);
5168
5169         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5170                 hf_netlogon_unknown_long, NULL);
5171
5172         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5173                 hf_netlogon_unknown_long, NULL);
5174
5175         return offset;
5176 }
5177
5178
5179 static int
5180 netlogon_dissect_netrlogonsetservicebits_reply(tvbuff_t *tvb, int offset,
5181         packet_info *pinfo, proto_tree *tree, char *drep)
5182 {
5183         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5184                                   hf_netlogon_rc, NULL);
5185
5186         return offset;
5187 }
5188
5189
5190 static int
5191 netlogon_dissect_netrlogongettrustrid_rqst(tvbuff_t *tvb, int offset,
5192         packet_info *pinfo, proto_tree *tree, char *drep)
5193 {
5194         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5195                 pinfo, tree, drep);
5196
5197         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5198                 NDR_POINTER_UNIQUE, "unknown string",
5199                 hf_netlogon_unknown_string, 0);
5200
5201         return offset;
5202 }
5203
5204
5205 static int
5206 netlogon_dissect_netrlogongettrustrid_reply(tvbuff_t *tvb, int offset,
5207         packet_info *pinfo, proto_tree *tree, char *drep)
5208 {
5209         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5210                 netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
5211                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long);
5212
5213         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5214                                   hf_netlogon_rc, NULL);
5215
5216         return offset;
5217 }
5218
5219
5220 static int
5221 netlogon_dissect_netrlogoncomputeserverdigest_rqst(tvbuff_t *tvb, int offset,
5222         packet_info *pinfo, proto_tree *tree, char *drep)
5223 {
5224         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5225                 pinfo, tree, drep);
5226
5227         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5228                 hf_netlogon_unknown_long, NULL);
5229
5230         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5231                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
5232                 "BYTE pointer: unknown_BYTE", -1);
5233
5234         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5235                 hf_netlogon_unknown_long, NULL);
5236
5237         return offset;
5238 }
5239
5240 static int
5241 netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset,
5242         packet_info *pinfo, proto_tree *tree, char *drep)
5243 {
5244         int i;
5245
5246         for(i=0;i<16;i++){
5247                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
5248                         hf_netlogon_unknown_char, NULL);
5249         }
5250
5251         return offset;
5252 }
5253
5254 static int
5255 netlogon_dissect_netrlogoncomputeserverdigest_reply(tvbuff_t *tvb, int offset,
5256         packet_info *pinfo, proto_tree *tree, char *drep)
5257 {
5258         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5259                 netlogon_dissect_BYTE_16_array, NDR_POINTER_UNIQUE,
5260                 "BYTE pointer: unknown_BYTE", -1);
5261
5262         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5263                                   hf_netlogon_rc, NULL);
5264
5265         return offset;
5266 }
5267
5268 static int
5269 netlogon_dissect_netrlogoncomputeclientdigest_rqst(tvbuff_t *tvb, int offset,
5270         packet_info *pinfo, proto_tree *tree, char *drep)
5271 {
5272         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5273                 pinfo, tree, drep);
5274
5275         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5276                 NDR_POINTER_UNIQUE, "unknown string",
5277                 hf_netlogon_unknown_string, 0);
5278
5279         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5280                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
5281                 "BYTE pointer: unknown_BYTE", -1);
5282
5283         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5284                 hf_netlogon_unknown_long, NULL);
5285
5286         return offset;
5287 }
5288
5289
5290 static int
5291 netlogon_dissect_netrlogoncomputeclientdigest_reply(tvbuff_t *tvb, int offset,
5292         packet_info *pinfo, proto_tree *tree, char *drep)
5293 {
5294         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5295                 netlogon_dissect_BYTE_16_array, NDR_POINTER_UNIQUE,
5296                 "BYTE pointer: unknown_BYTE", -1);
5297
5298         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5299                                   hf_netlogon_rc, NULL);
5300
5301         return offset;
5302 }
5303
5304 static int
5305 netlogon_dissect_netrserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
5306         packet_info *pinfo, proto_tree *tree, char *drep)
5307 {
5308         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5309                 pinfo, tree, drep);
5310
5311         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5312                 NDR_POINTER_REF, "Acct Name", hf_netlogon_acct_name, 0);
5313
5314         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
5315                 pinfo, tree, drep);
5316
5317         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5318                 NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
5319
5320         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5321                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
5322                 "CREDENTIAL: authenticator", -1);
5323
5324         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5325                 hf_netlogon_neg_flags, NULL);
5326
5327         return offset;
5328 }
5329
5330
5331 static int
5332 netlogon_dissect_netrserverauthenticate3_reply(tvbuff_t *tvb, int offset,
5333         packet_info *pinfo, proto_tree *tree, char *drep)
5334 {
5335         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5336                 netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
5337                 "CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1);
5338
5339         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5340                 hf_netlogon_neg_flags, NULL);
5341
5342         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5343                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
5344                 "ULONG: unknown_ULONG", hf_netlogon_unknown_long);
5345
5346         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5347                                   hf_netlogon_rc, NULL);
5348
5349         return offset;
5350 }
5351
5352 static int
5353 netlogon_dissect_dsrgetdcnameex_rqst(tvbuff_t *tvb, int offset,
5354         packet_info *pinfo, proto_tree *tree, char *drep)
5355 {
5356         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5357                 pinfo, tree, drep);
5358
5359         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5360                 NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0);
5361
5362         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5363                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5364                 "GUID pointer: domain_guid", -1);
5365
5366         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5367                 NDR_POINTER_UNIQUE, "Site Name", hf_netlogon_site_name, 0);
5368
5369         offset = netlogon_dissect_GET_DCNAME_REQUEST_FLAGS(tvb, offset, pinfo, tree, drep);
5370
5371         return offset;
5372 }
5373
5374
5375 static int
5376 netlogon_dissect_dsrgetdcnameex_reply(tvbuff_t *tvb, int offset,
5377         packet_info *pinfo, proto_tree *tree, char *drep)
5378 {
5379         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5380                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
5381                 "DOMAIN_CONTROLLER_INFO:", -1);
5382
5383         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5384                                   hf_netlogon_rc, NULL);
5385
5386         return offset;
5387 }
5388
5389 static int
5390 netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset,
5391         packet_info *pinfo, proto_tree *tree, char *drep)
5392 {
5393         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5394                 pinfo, tree, drep);
5395
5396         return offset;
5397 }
5398
5399
5400 static int
5401 netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset,
5402         packet_info *pinfo, proto_tree *tree, char *drep)
5403 {
5404
5405         /* XXX hmmm this does not really look like a UNIQUE pointer but
5406            will do for now.   I think it is really a 32bit integer followed by
5407            a REF pointer to a unicode string */
5408         offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, drep,
5409                 dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Site Name",
5410                 hf_netlogon_site_name, cb_wstr_postprocess,
5411                 GINT_TO_POINTER(CB_STR_COL_INFO | 1));
5412
5413         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5414                                   hf_netlogon_rc, NULL);
5415
5416         return offset;
5417 }
5418
5419 static int
5420 netlogon_dissect_netrlogongetdomaininfo_rqst(tvbuff_t *tvb, int offset,
5421         packet_info *pinfo, proto_tree *tree, char *drep)
5422 {
5423        /* Unlike the other NETLOGON RPCs, this is not a unique pointer. */
5424        offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5425                NDR_POINTER_REF, "Server Handle", hf_netlogon_computer_name, 0);
5426
5427         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5428                 NDR_POINTER_UNIQUE, "Computer Name",
5429                 hf_netlogon_computer_name, 0);
5430
5431         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5432                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5433                 "AUTHENTICATOR: credential", -1);
5434
5435         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5436                 hf_netlogon_unknown_long, NULL);
5437
5438         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5439                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5440                 "AUTHENTICATOR: return_authenticator", -1);
5441
5442         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5443                 netlogon_dissect_DOMAIN_QUERY, NDR_POINTER_REF,
5444                 "DOMAIN_QUERY: ", -1);
5445
5446         return offset;
5447 }
5448
5449
5450 static int
5451 netlogon_dissect_netrlogongetdomaininfo_reply(tvbuff_t *tvb, int offset,
5452         packet_info *pinfo, proto_tree *tree, char *drep)
5453 {
5454         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5455                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5456                 "AUTHENTICATOR: return_authenticator", -1);
5457
5458         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5459                 netlogon_dissect_DOMAIN_INFO, NDR_POINTER_REF,
5460                 "DOMAIN_INFO: ", -1);
5461
5462         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5463                                   hf_netlogon_rc, NULL);
5464
5465         return offset;
5466 }
5467
5468 static int
5469 netlogon_dissect_netrserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
5470         packet_info *pinfo, proto_tree *tree, char *drep)
5471 {
5472         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5473                 pinfo, tree, drep);
5474
5475         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5476                 NDR_POINTER_UNIQUE, "unknown string",
5477                 hf_netlogon_unknown_string, 0);
5478
5479         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
5480                 hf_netlogon_unknown_short, NULL);
5481
5482         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5483                 NDR_POINTER_UNIQUE, "unknown string",
5484                 hf_netlogon_unknown_string, 0);
5485
5486         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5487                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5488                 "AUTHENTICATOR: credential", -1);
5489
5490         offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset,
5491                 pinfo, tree, drep);
5492
5493         return offset;
5494 }
5495
5496
5497 static int
5498 netlogon_dissect_netrserverpasswordset2_reply(tvbuff_t *tvb, int offset,
5499         packet_info *pinfo, proto_tree *tree, char *drep)
5500 {
5501         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5502                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
5503                 "AUTHENTICATOR: return_authenticator", -1);
5504
5505         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5506                                   hf_netlogon_rc, NULL);
5507
5508         return offset;
5509 }
5510
5511 static int
5512 netlogon_dissect_netrserverpasswordget_rqst(tvbuff_t *tvb, int offset,
5513         packet_info *pinfo, proto_tree *tree, char *drep)
5514 {
5515         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5516                 pinfo, tree, drep);
5517
5518         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5519                 NDR_POINTER_UNIQUE, "Acct Name", hf_netlogon_acct_name, 0);
5520
5521         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
5522                 pinfo, tree, drep);
5523
5524         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5525                 NDR_POINTER_UNIQUE, "Computer Name",
5526                 hf_netlogon_computer_name, 0);
5527
5528         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5529                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5530                 "AUTHENTICATOR: credential", -1);
5531
5532         return offset;
5533 }
5534
5535
5536 static int
5537 netlogon_dissect_netrserverpasswordget_reply(tvbuff_t *tvb, int offset,
5538         packet_info *pinfo, proto_tree *tree, char *drep)
5539 {
5540         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5541                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5542                 "AUTHENTICATOR: return_authenticator", -1);
5543
5544         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5545                 netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF,
5546                 "LM_OWF_PASSWORD pointer: server_pwd", -1);
5547
5548         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5549                                   hf_netlogon_rc, NULL);
5550
5551         return offset;
5552 }
5553
5554 static int
5555 netlogon_dissect_netrlogonsendtosam_rqst(tvbuff_t *tvb, int offset,
5556         packet_info *pinfo, proto_tree *tree, char *drep)
5557 {
5558         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5559                 pinfo, tree, drep);
5560
5561         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5562                 NDR_POINTER_UNIQUE, "unknown string",
5563                 hf_netlogon_unknown_string, 0);
5564
5565         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5566                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
5567                 "AUTHENTICATOR: credential", -1);
5568
5569         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5570                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
5571                 "BYTE pointer: unknown_BYTE", -1);
5572
5573         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5574                 hf_netlogon_unknown_long, NULL);
5575
5576         return offset;
5577 }
5578
5579
5580 static int
5581 netlogon_dissect_netrlogonsendtosam_reply(tvbuff_t *tvb, int offset,
5582         packet_info *pinfo, proto_tree *tree, char *drep)
5583 {
5584         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5585                 netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
5586                 "AUTHENTICATOR: return_authenticator", -1);
5587
5588         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5589                                   hf_netlogon_rc, NULL);
5590
5591         return offset;
5592 }
5593
5594 static int
5595 netlogon_dissect_dsraddresstositenamesw_rqst(tvbuff_t *tvb, int offset,
5596         packet_info *pinfo, proto_tree *tree, char *drep)
5597 {
5598         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5599                 pinfo, tree, drep);
5600
5601         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5602                 hf_netlogon_unknown_long, NULL);
5603
5604         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5605                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
5606                 "BYTE pointer: unknown_BYTE", -1);
5607
5608         return offset;
5609 }
5610
5611
5612 static int
5613 netlogon_dissect_dsraddresstositenamesw_reply(tvbuff_t *tvb, int offset,
5614         packet_info *pinfo, proto_tree *tree, char *drep)
5615 {
5616         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5617                 netlogon_dissect_TYPE_50_ptr, NDR_POINTER_UNIQUE,
5618                 "TYPE_50** pointer: unknown_TYPE_50", -1);
5619
5620         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5621                                   hf_netlogon_rc, NULL);
5622
5623         return offset;
5624 }
5625
5626 static int
5627 netlogon_dissect_dsrgetdcnameex2_rqst(tvbuff_t *tvb, int offset,
5628         packet_info *pinfo, proto_tree *tree, char *drep)
5629 {
5630         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5631                 pinfo, tree, drep);
5632
5633         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5634                 NDR_POINTER_UNIQUE, "unknown string",
5635                 hf_netlogon_unknown_string, 0);
5636
5637         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5638                 hf_netlogon_unknown_long, NULL);
5639
5640         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5641                 NDR_POINTER_UNIQUE, "unknown string",
5642                 hf_netlogon_unknown_string, 0);
5643
5644         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5645                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5646                 "GUID pointer: unknown_GUID", -1);
5647
5648         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5649                 NDR_POINTER_UNIQUE, "unknown string",
5650                 hf_netlogon_unknown_string, 0);
5651
5652         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5653                 hf_netlogon_unknown_long, NULL);
5654
5655         return offset;
5656 }
5657
5658
5659 static int
5660 netlogon_dissect_dsrgetdcnameex2_reply(tvbuff_t *tvb, int offset,
5661         packet_info *pinfo, proto_tree *tree, char *drep)
5662 {
5663         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5664                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
5665                 "DOMAIN_CONTROLLER_INFO:", -1);
5666
5667         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5668                                   hf_netlogon_rc, NULL);
5669
5670         return offset;
5671 }
5672
5673 static int
5674 netlogon_dissect_netrlogongettimeserviceparentdomain_rqst(tvbuff_t *tvb, int offset,
5675         packet_info *pinfo, proto_tree *tree, char *drep)
5676 {
5677         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5678                 pinfo, tree, drep);
5679
5680         return offset;
5681 }
5682
5683
5684 static int
5685 netlogon_dissect_netrlogongettimeserviceparentdomain_reply(tvbuff_t *tvb, int offset,
5686         packet_info *pinfo, proto_tree *tree, char *drep)
5687 {
5688         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5689                 NDR_POINTER_UNIQUE, "unknown string",
5690                 hf_netlogon_unknown_string, 0);
5691
5692         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5693                 netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
5694                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long);
5695
5696         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5697                                   hf_netlogon_rc, NULL);
5698
5699         return offset;
5700 }
5701
5702 static int
5703 netlogon_dissect_netrenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset,
5704         packet_info *pinfo, proto_tree *tree, char *drep)
5705 {
5706         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5707                 pinfo, tree, drep);
5708
5709         return offset;
5710 }
5711
5712 static int
5713 netlogon_dissect_netrenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset,
5714         packet_info *pinfo, proto_tree *tree, char *drep)
5715 {
5716         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5717                 hf_netlogon_entries, NULL);
5718
5719         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5720                 netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY, NDR_POINTER_UNIQUE,
5721                 "DS_DOMAIN_TRUSTS_ARRAY:", -1);
5722
5723         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5724                                   hf_netlogon_rc, NULL);
5725
5726         return offset;
5727 }
5728
5729 static int
5730 netlogon_dissect_dsraddresstositenamesexw_rqst(tvbuff_t *tvb, int offset,
5731         packet_info *pinfo, proto_tree *tree, char *drep)
5732 {
5733         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5734                 pinfo, tree, drep);
5735
5736         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5737                 hf_netlogon_unknown_long, NULL);
5738
5739         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5740                 netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
5741                 "BYTE pointer: unknown_BYTE", -1);
5742
5743         return offset;
5744 }
5745
5746
5747 static int
5748 netlogon_dissect_dsraddresstositenamesexw_reply(tvbuff_t *tvb, int offset,
5749         packet_info *pinfo, proto_tree *tree, char *drep)
5750 {
5751         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5752                 netlogon_dissect_TYPE_52_ptr, NDR_POINTER_UNIQUE,
5753                 "TYPE_52 pointer: unknown_TYPE_52", -1);
5754
5755         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5756                                   hf_netlogon_rc, NULL);
5757
5758         return offset;
5759 }
5760
5761
5762 static int
5763 netlogon_dissect_site_name_item(tvbuff_t *tvb, int offset,
5764         packet_info *pinfo, proto_tree *tree, char *drep)
5765 {
5766         offset = dissect_ndr_counted_string_cb(
5767                 tvb, offset, pinfo, tree, drep, hf_netlogon_site_name,
5768                 cb_wstr_postprocess,
5769                 GINT_TO_POINTER(CB_STR_COL_INFO | 1));
5770
5771         return offset;
5772 }
5773 static int
5774 netlogon_dissect_site_name_array(tvbuff_t *tvb, int offset,
5775         packet_info *pinfo, proto_tree *tree, char *drep)
5776 {
5777         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
5778                 netlogon_dissect_site_name_item);
5779
5780         return offset;
5781 }
5782
5783 static int
5784 netlogon_dissect_site_names(tvbuff_t *tvb, int offset,
5785         packet_info *pinfo, proto_tree *tree, char *drep)
5786 {
5787         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5788                 hf_netlogon_count, NULL);
5789
5790         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5791                 netlogon_dissect_site_name_array, NDR_POINTER_UNIQUE,
5792                 "Site name array", -1);
5793
5794         return offset;
5795 }
5796
5797 static int
5798 netlogon_dissect_dsrgetdcsitecoveragew_rqst(tvbuff_t *tvb, int offset,
5799         packet_info *pinfo, proto_tree *tree, char *drep)
5800 {
5801         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5802                 pinfo, tree, drep);
5803
5804         return offset;
5805 }
5806
5807
5808 static int
5809 netlogon_dissect_dsrgetdcsitecoveragew_reply(tvbuff_t *tvb, int offset,
5810         packet_info *pinfo, proto_tree *tree, char *drep)
5811 {
5812         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5813                 netlogon_dissect_site_names, NDR_POINTER_UNIQUE,
5814                 "Site names", -1);
5815
5816         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5817                                   hf_netlogon_rc, NULL);
5818
5819         return offset;
5820 }
5821
5822 static int
5823 netlogon_dissect_netrlogonsamlogonex_rqst(tvbuff_t *tvb, int offset,
5824         packet_info *pinfo, proto_tree *tree, char *drep)
5825 {
5826         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5827                 NDR_POINTER_UNIQUE, "unknown string",
5828                 hf_netlogon_unknown_string, 0);
5829
5830         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5831                 NDR_POINTER_UNIQUE, "unknown string",
5832                 hf_netlogon_unknown_string, 0);
5833
5834         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
5835                 hf_netlogon_unknown_short, NULL);
5836
5837         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5838                 netlogon_dissect_LEVEL, NDR_POINTER_UNIQUE,
5839                 "LEVEL pointer: unknown_NETLOGON_LEVEL", -1);
5840
5841         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
5842                 hf_netlogon_unknown_short, NULL);
5843
5844         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5845                 netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
5846                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long);
5847         return offset;
5848 }
5849
5850
5851 static int
5852 netlogon_dissect_netrlogonsamlogonex_reply(tvbuff_t *tvb, int offset,
5853         packet_info *pinfo, proto_tree *tree, char *drep)
5854 {
5855         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5856                 netlogon_dissect_VALIDATION, NDR_POINTER_UNIQUE,
5857                 "VALIDATION: unknown_NETLOGON_VALIDATION", -1);
5858
5859         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5860                 netlogon_dissect_pointer_char, NDR_POINTER_UNIQUE,
5861                 "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char);
5862
5863         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5864                 netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
5865                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long);
5866
5867         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5868                                   hf_netlogon_rc, NULL);
5869
5870         return offset;
5871 }
5872
5873
5874 static int
5875 netlogon_dissect_dsrenumeratedomaintrusts_rqst(tvbuff_t *tvb, int offset,
5876         packet_info *pinfo, proto_tree *tree, char *drep)
5877 {
5878         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5879                 pinfo, tree, drep);
5880
5881         offset = netlogon_dissect_DOMAIN_TRUST_FLAGS(tvb, offset, pinfo, tree, drep);
5882
5883         return offset;
5884 }
5885
5886
5887 static int
5888 netlogon_dissect_dsrenumeratedomaintrusts_reply(tvbuff_t *tvb, int offset,
5889         packet_info *pinfo, proto_tree *tree, char *drep)
5890 {
5891         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5892                 hf_netlogon_entries, NULL);
5893
5894         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5895                 netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY, NDR_POINTER_UNIQUE,
5896                 "DS_DOMAIN_TRUSTS_ARRAY:", -1);
5897
5898         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5899                                   hf_netlogon_rc, NULL);
5900
5901         return offset;
5902 }
5903
5904 static int
5905 netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset,
5906         packet_info *pinfo, proto_tree *tree, char *drep)
5907 {
5908         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5909                 pinfo, tree, drep);
5910
5911         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5912                 NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0);
5913
5914         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5915                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5916                 "GUID pointer: domain_guid", -1);
5917
5918         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5919                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5920                 "GUID pointer: dsa_guid", -1);
5921
5922         offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
5923                 NDR_POINTER_REF, "dns_host", hf_netlogon_dns_host, 0);
5924
5925         return offset;
5926 }
5927
5928
5929 static int
5930 netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset,
5931         packet_info *pinfo, proto_tree *tree, char *drep)
5932 {
5933         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5934                                   hf_netlogon_rc, NULL);
5935
5936         return offset;
5937 }
5938
5939 /* Dissect secure channel stuff */
5940
5941 static int hf_netlogon_secchan_bind_unknown1 = -1;
5942 static int hf_netlogon_secchan_bind_unknown2 = -1;
5943 static int hf_netlogon_secchan_domain = -1;
5944 static int hf_netlogon_secchan_host = -1;
5945 static int hf_netlogon_secchan_bind_ack_unknown1 = -1;
5946 static int hf_netlogon_secchan_bind_ack_unknown2 = -1;
5947 static int hf_netlogon_secchan_bind_ack_unknown3 = -1;
5948
5949 static gint ett_secchan_verf = -1;
5950 static gint ett_secchan_bind_creds = -1;
5951 static gint ett_secchan_bind_ack_creds = -1;
5952
5953 static int dissect_secchan_bind_creds(tvbuff_t *tvb, int offset,
5954                                       packet_info *pinfo,
5955                                       proto_tree *tree, char *drep)
5956 {
5957         proto_item *item = NULL;
5958         proto_tree *subtree = NULL;
5959         int len;
5960
5961         if (tree) {
5962                 item = proto_tree_add_text(
5963                         tree, tvb, offset, tvb_length(tvb),
5964                         "Secure Channel Bind Credentials");
5965                 subtree = proto_item_add_subtree(
5966                         item, ett_secchan_bind_creds);
5967         }
5968
5969         /* We can't use the NDR routines as the DCERPC call data hasn't
5970            been initialised since we haven't made a DCERPC call yet, just
5971            a bind request. */
5972
5973         offset = dissect_dcerpc_uint32(
5974                 tvb, offset, pinfo, subtree, drep,
5975                 hf_netlogon_secchan_bind_unknown1, NULL);
5976
5977         offset = dissect_dcerpc_uint32(
5978                 tvb, offset, pinfo, subtree, drep,
5979                 hf_netlogon_secchan_bind_unknown2, NULL);
5980
5981         len = tvb_strsize(tvb, offset);
5982
5983         proto_tree_add_item(
5984                 subtree, hf_netlogon_secchan_domain, tvb, offset, len, FALSE);
5985
5986         offset += len;
5987
5988         len = tvb_strsize(tvb, offset);
5989
5990         proto_tree_add_item(
5991                 subtree, hf_netlogon_secchan_host, tvb, offset, len, FALSE);
5992
5993         offset += len;
5994
5995         return offset;
5996 }
5997
5998 static int dissect_secchan_bind_ack_creds(tvbuff_t *tvb, int offset,
5999                                           packet_info *pinfo,
6000                                           proto_tree *tree, char *drep)
6001 {
6002         proto_item *item = NULL;
6003         proto_tree *subtree = NULL;
6004
6005         if (tree) {
6006                 item = proto_tree_add_text(
6007                         tree, tvb, offset, 0,
6008                         "Secure Channel Bind ACK Credentials");
6009                 subtree = proto_item_add_subtree(
6010                         item, ett_secchan_bind_ack_creds);
6011         }
6012
6013         /* Don't use NDR routines here */
6014
6015         offset = dissect_dcerpc_uint32(
6016                 tvb, offset, pinfo, subtree, drep,
6017                 hf_netlogon_secchan_bind_ack_unknown1, NULL);
6018
6019         offset = dissect_dcerpc_uint32(
6020                 tvb, offset, pinfo, subtree, drep,
6021                 hf_netlogon_secchan_bind_ack_unknown2, NULL);
6022
6023         offset = dissect_dcerpc_uint32(
6024                 tvb, offset, pinfo, subtree, drep,
6025                 hf_netlogon_secchan_bind_ack_unknown3, NULL);
6026
6027         return offset;
6028 }
6029
6030 /* Subdissectors */
6031
6032 static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = {
6033         { NETLOGON_NETRLOGONUASLOGON, "NetrLogonUasLogon",
6034                 netlogon_dissect_netrlogonuaslogon_rqst,
6035                 netlogon_dissect_netrlogonuaslogon_reply },
6036         { NETLOGON_NETRLOGONUASLOGOFF, "NetrLogonUasLogoff",
6037                 netlogon_dissect_netrlogonuaslogoff_rqst,
6038                 netlogon_dissect_netrlogonuaslogoff_reply },
6039         { NETLOGON_NETRLOGONSAMLOGON, "NetrLogonSamLogon",
6040                 netlogon_dissect_netrlogonsamlogon_rqst,
6041                 netlogon_dissect_netrlogonsamlogon_reply },
6042         { NETLOGON_NETRLOGONSAMLOGOFF, "NetrLogonSamLogoff",
6043                 netlogon_dissect_netrlogonsamlogoff_rqst,
6044                 netlogon_dissect_netrlogonsamlogoff_reply },
6045         { NETLOGON_NETRSERVERREQCHALLENGE, "NetrServerReqChallenge",
6046                 netlogon_dissect_netrserverreqchallenge_rqst,
6047                 netlogon_dissect_netrserverreqchallenge_reply },
6048         { NETLOGON_NETRSERVERAUTHENTICATE, "NetrServerAuthenticate",
6049                 netlogon_dissect_netrserverauthenticate_rqst,
6050                 netlogon_dissect_netrserverauthenticate_reply },
6051         { NETLOGON_NETRSERVERPASSWORDSET, "NetrServerPasswordSet",
6052                 netlogon_dissect_netrserverpasswordset_rqst,
6053                 netlogon_dissect_netrserverpasswordset_reply },
6054         { NETLOGON_NETRDATABASEDELTAS, "NetrDatabaseDeltas",
6055                 netlogon_dissect_netrdatabasedeltas_rqst,
6056                 netlogon_dissect_netrdatabasedeltas_reply },
6057         { NETLOGON_NETRDATABASESYNC, "NetrDatabaseSync",
6058                 netlogon_dissect_netrdatabasesync_rqst,
6059                 netlogon_dissect_netrdatabasesync_reply },
6060         { NETLOGON_NETRACCOUNTDELTAS, "NetrAccountDeltas",
6061                 netlogon_dissect_netraccountdeltas_rqst,
6062                 netlogon_dissect_netraccountdeltas_reply },
6063         { NETLOGON_NETRACCOUNTSYNC, "NetrAccountSync",
6064                 netlogon_dissect_netraccountsync_rqst,
6065                 netlogon_dissect_netraccountsync_reply },
6066         { NETLOGON_NETRGETDCNAME, "NetrGetDCName",
6067                 netlogon_dissect_netrgetdcname_rqst,
6068                 netlogon_dissect_netrgetdcname_reply },
6069         { NETLOGON_NETRLOGONCONTROL, "NetrLogonControl",
6070                 netlogon_dissect_netrlogoncontrol_rqst,
6071                 netlogon_dissect_netrlogoncontrol_reply },
6072         { NETLOGON_NETRGETANYDCNAME, "NetrGetAnyDCName",
6073                 netlogon_dissect_netrgetanydcname_rqst,
6074                 netlogon_dissect_netrgetanydcname_reply },
6075         { NETLOGON_NETRLOGONCONTROL2, "NetrLogonControl2",
6076                 netlogon_dissect_netrlogoncontrol2_rqst,
6077                 netlogon_dissect_netrlogoncontrol2_reply },
6078         { NETLOGON_NETRSERVERAUTHENTICATE2, "NetrServerAuthenticate2",
6079                 netlogon_dissect_netrserverauthenticate2_rqst,
6080                 netlogon_dissect_netrserverauthenticate2_reply },
6081         { NETLOGON_NETRDATABASESYNC2, "NetrDatabaseSync2",
6082                 netlogon_dissect_netrdatabasesync2_rqst,
6083                 netlogon_dissect_netrdatabasesync2_reply },
6084         { NETLOGON_NETRDATABASEREDO, "NetrDatabaseRedo",
6085                 netlogon_dissect_netrdatabaseredo_rqst,
6086                 netlogon_dissect_netrdatabaseredo_reply },
6087         { NETLOGON_NETRLOGONCONTROL2EX, "NetrLogonControl2Ex",
6088                 netlogon_dissect_netrlogoncontrol2ex_rqst,
6089                 netlogon_dissect_netrlogoncontrol2ex_reply },
6090         { NETLOGON_NETRENUMERATETRUSTEDDOMAINS, "NetrEnumerateTrustedDomains",
6091                 netlogon_dissect_netrenumeratetrusteddomains_rqst,
6092                 netlogon_dissect_netrenumeratetrusteddomains_reply },
6093         { NETLOGON_DSRGETDCNAME, "DsrGetDcName",
6094                 netlogon_dissect_dsrgetdcname_rqst,
6095                 netlogon_dissect_dsrgetdcname_reply },
6096         { NETLOGON_NETRLOGONDUMMYROUTINE1, "NetrLogonDummyRoutine1",
6097                 netlogon_dissect_netrlogondummyroutine1_rqst,
6098                 netlogon_dissect_netrlogondummyroutine1_reply },
6099         { NETLOGON_NETRLOGONSETSERVICEBITS, "NetrLogonSetServiceBits",
6100                 netlogon_dissect_netrlogonsetservicebits_rqst,
6101                 netlogon_dissect_netrlogonsetservicebits_reply },
6102         { NETLOGON_NETRLOGONGETTRUSTRID, "NetrLogonGetTrustRid",
6103                 netlogon_dissect_netrlogongettrustrid_rqst,
6104                 netlogon_dissect_netrlogongettrustrid_reply },
6105         { NETLOGON_NETRLOGONCOMPUTESERVERDIGEST, "NetrLogonComputeServerDigest",
6106                 netlogon_dissect_netrlogoncomputeserverdigest_rqst,
6107                 netlogon_dissect_netrlogoncomputeserverdigest_reply },
6108         { NETLOGON_NETRLOGONCOMPUTECLIENTDIGEST, "NetrLogonComputeClientDigest",
6109                 netlogon_dissect_netrlogoncomputeclientdigest_rqst,
6110                 netlogon_dissect_netrlogoncomputeclientdigest_reply },
6111         { NETLOGON_NETRSERVERAUTHENTICATE3, "NetrServerAuthenticate3",
6112                 netlogon_dissect_netrserverauthenticate3_rqst,
6113                 netlogon_dissect_netrserverauthenticate3_reply },
6114         { NETLOGON_DSRGETDCNAMEX, "DsrGetDcNameEx",
6115                 netlogon_dissect_dsrgetdcnameex_rqst,
6116                 netlogon_dissect_dsrgetdcnameex_reply },
6117         { NETLOGON_DSRGETSITENAME, "DsrGetSiteName",
6118                 netlogon_dissect_dsrgetsitename_rqst,
6119                 netlogon_dissect_dsrgetsitename_reply },
6120         { NETLOGON_NETRLOGONGETDOMAININFO, "NetrLogonGetDomainInfo",
6121                 netlogon_dissect_netrlogongetdomaininfo_rqst,
6122                 netlogon_dissect_netrlogongetdomaininfo_reply },
6123         { NETLOGON_NETRSERVERPASSWORDSET2, "NetrServerPasswordSet2",
6124                 netlogon_dissect_netrserverpasswordset2_rqst,
6125                 netlogon_dissect_netrserverpasswordset2_reply },
6126         { NETLOGON_NETRSERVERPASSWORDGET, "NetrServerPasswordGet",
6127                 netlogon_dissect_netrserverpasswordget_rqst,
6128                 netlogon_dissect_netrserverpasswordget_reply },
6129         { NETLOGON_NETRLOGONSENDTOSAM, "NetrLogonSendToSam",
6130                 netlogon_dissect_netrlogonsendtosam_rqst,
6131                 netlogon_dissect_netrlogonsendtosam_reply },
6132         { NETLOGON_DSRADDRESSTOSITENAMESW, "DsrAddressToSiteNamesW",
6133                 netlogon_dissect_dsraddresstositenamesw_rqst,
6134                 netlogon_dissect_dsraddresstositenamesw_reply },
6135         { NETLOGON_DSRGETDCNAMEEX2, "DsrGetDcNameEx2",
6136                 netlogon_dissect_dsrgetdcnameex2_rqst,
6137                 netlogon_dissect_dsrgetdcnameex2_reply },
6138         { NETLOGON_NETRLOGONGETTIMESERVICEPARENTDOMAIN,
6139                 "NetrLogonGetTimeServiceParentDomain",
6140                 netlogon_dissect_netrlogongettimeserviceparentdomain_rqst,
6141                 netlogon_dissect_netrlogongettimeserviceparentdomain_reply },
6142         { NETLOGON_NETRENUMERATETRUSTEDDOMAINSEX, "NetrEnumerateTrustedDomainsEx",
6143                 netlogon_dissect_netrenumeratetrusteddomainsex_rqst,
6144                 netlogon_dissect_netrenumeratetrusteddomainsex_reply },
6145         { NETLOGON_DSRADDRESSTOSITENAMESEXW, "DsrAddressToSiteNamesExW",
6146                 netlogon_dissect_dsraddresstositenamesexw_rqst,
6147                 netlogon_dissect_dsraddresstositenamesexw_reply },
6148         { NETLOGON_DSRGETDCSITECOVERAGEW, "DsrGetDcSiteCoverageW",
6149                 netlogon_dissect_dsrgetdcsitecoveragew_rqst,
6150                 netlogon_dissect_dsrgetdcsitecoveragew_reply },
6151         { NETLOGON_NETRLOGONSAMLOGONEX, "NetrLogonSamLogonEx",
6152                 netlogon_dissect_netrlogonsamlogonex_rqst,
6153                 netlogon_dissect_netrlogonsamlogonex_reply },
6154         { NETLOGON_DSRENUMERATEDOMAINTRUSTS, "DsrEnumerateDomainTrusts",
6155                 netlogon_dissect_dsrenumeratedomaintrusts_rqst,
6156                 netlogon_dissect_dsrenumeratedomaintrusts_reply },
6157         { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DsrDeregisterDnsHostRecords",
6158                 netlogon_dissect_dsrderegisterdnshostrecords_rqst,
6159                 netlogon_dissect_dsrderegisterdnshostrecords_reply },
6160         { NETLOGON_NETRSERVERTRUSTPASSWORDSGET, "NetrServerTrustPasswordsGet",
6161                 NULL, NULL },
6162         { NETLOGON_DSRGETFORESTTRUSTINFORMATION, "DsrGetForestTrustInformation",
6163                 NULL, NULL },
6164         { NETLOGON_NETRGETFORESTTRUSTINFORMATION, "NetrGetForestTrustInformation",
6165                 NULL, NULL },
6166         { NETLOGON_NETRLOGONSAMLOGONWITHFLAGS, "NetrLogonSamLogonWithFlags",
6167                 NULL, NULL },
6168         { NETLOGON_NETRSERVERGETTRUSTINFO, "NetrServerGetTrustInfo",
6169                 NULL, NULL },
6170         {0, NULL, NULL,  NULL }
6171 };
6172
6173 static int hf_netlogon_secchan_verf = -1;
6174 static int hf_netlogon_secchan_verf_sig = -1;
6175 static int hf_netlogon_secchan_verf_unk = -1;
6176 static int hf_netlogon_secchan_verf_seq = -1;
6177 static int hf_netlogon_secchan_verf_nonce = -1;
6178
6179 static int
6180 dissect_secchan_verf(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
6181                      proto_tree *tree, char *drep _U_)
6182 {
6183           proto_item *vf = NULL;
6184           proto_tree *subtree = NULL;
6185
6186           /*
6187            * Create a new tree, and split into 4 components ...
6188            */
6189           vf = proto_tree_add_item(tree, hf_netlogon_secchan_verf, tvb,
6190               offset, -1, FALSE);
6191           subtree = proto_item_add_subtree(vf, ett_secchan_verf);
6192
6193           proto_tree_add_item(subtree, hf_netlogon_secchan_verf_sig, tvb,
6194               offset, 8, FALSE);
6195           offset += 8;
6196
6197           proto_tree_add_item(subtree, hf_netlogon_secchan_verf_unk, tvb,
6198               offset, 8, FALSE);
6199           offset += 8;
6200
6201           proto_tree_add_item(subtree, hf_netlogon_secchan_verf_seq, tvb,
6202               offset, 8, FALSE);
6203           offset += 8;
6204
6205           proto_tree_add_item(subtree, hf_netlogon_secchan_verf_nonce, tvb,
6206               offset, 8, FALSE);
6207           offset += 8;
6208
6209           return offset;
6210 }
6211
6212 /* Secure channel types */
6213
6214 static const value_string sec_chan_type_vals[] = {
6215         { SEC_CHAN_WKSTA,  "Workstation" },
6216         { SEC_CHAN_DOMAIN, "Domain trust" },
6217         { SEC_CHAN_BDC,    "Backup domain controller" },
6218         { 0, NULL }
6219 };
6220
6221 void
6222 proto_register_dcerpc_netlogon(void)
6223 {
6224
6225 static hf_register_info hf[] = {
6226         { &hf_netlogon_opnum,
6227           { "Operation", "netlogon.opnum", FT_UINT16, BASE_DEC,
6228             NULL, 0x0, "Operation", HFILL }},
6229
6230         { &hf_netlogon_rc, {
6231                 "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
6232                 VALS(NT_errors), 0x0, "Netlogon return code", HFILL }},
6233
6234         { &hf_netlogon_param_ctrl, {
6235                 "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
6236                 NULL, 0x0, "Param ctrl", HFILL }},
6237
6238         { &hf_netlogon_logon_id, {
6239                 "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
6240                 NULL, 0x0, "Logon ID", HFILL }},
6241
6242         { &hf_netlogon_modify_count, {
6243                 "Modify Count", "netlogon.modify_count", FT_UINT64, BASE_DEC,
6244                 NULL, 0x0, "How many times the object has been modified", HFILL }},
6245
6246         { &hf_netlogon_security_information, {
6247                 "Security Information", "netlogon.security_information", FT_UINT32, BASE_DEC,
6248                 NULL, 0x0, "Security Information", HFILL }},
6249
6250         { &hf_netlogon_count, {
6251                 "Count", "netlogon.count", FT_UINT32, BASE_DEC,
6252                 NULL, 0x0, "", HFILL }},
6253
6254         { &hf_netlogon_entries, {
6255                 "Entries", "netlogon.entries", FT_UINT32, BASE_DEC,
6256                 NULL, 0x0, "", HFILL }},
6257
6258         { &hf_netlogon_credential, {
6259                 "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
6260                 NULL, 0x0, "Netlogon Credential", HFILL }},
6261
6262         { &hf_netlogon_challenge, {
6263                 "Challenge", "netlogon.challenge", FT_BYTES, BASE_HEX,
6264                 NULL, 0x0, "Netlogon challenge", HFILL }},
6265
6266         { &hf_netlogon_lm_owf_password, {
6267                 "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
6268                 NULL, 0x0, "LanManager OWF Password", HFILL }},
6269
6270         { &hf_netlogon_user_session_key, {
6271                 "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
6272                 NULL, 0x0, "User Session Key", HFILL }},
6273
6274         { &hf_netlogon_encrypted_lm_owf_password, {
6275                 "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
6276                 NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }},
6277
6278         { &hf_netlogon_nt_owf_password, {
6279                 "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
6280                 NULL, 0x0, "NT OWF Password", HFILL }},
6281
6282         { &hf_netlogon_blob, {
6283                 "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
6284                 NULL, 0x0, "BLOB", HFILL }},
6285
6286         { &hf_netlogon_len, {
6287                 "Len", "netlogon.len", FT_UINT32, BASE_DEC,
6288                 NULL, 0, "Length", HFILL }},
6289
6290         { &hf_netlogon_priv, {
6291                 "Priv", "netlogon.priv", FT_UINT32, BASE_DEC,
6292                 NULL, 0, "", HFILL }},
6293
6294         { &hf_netlogon_privilege_entries, {
6295                 "Privilege Entries", "netlogon.privilege_entries", FT_UINT32, BASE_DEC,
6296                 NULL, 0, "", HFILL }},
6297
6298         { &hf_netlogon_privilege_control, {
6299                 "Privilege Control", "netlogon.privilege_control", FT_UINT32, BASE_HEX,
6300                 NULL, 0, "", HFILL }},
6301
6302         { &hf_netlogon_privilege_name, {
6303                 "Privilege Name", "netlogon.privilege_name", FT_STRING, BASE_HEX,
6304                 NULL, 0, "", HFILL }},
6305
6306         { &hf_netlogon_pdc_connection_status, {
6307                 "PDC Connection Status", "netlogon.pdc_connection_status", FT_UINT32, BASE_DEC,
6308                 NULL, 0, "PDC Connection Status", HFILL }},
6309
6310         { &hf_netlogon_tc_connection_status, {
6311                 "TC Connection Status", "netlogon.tc_connection_status", FT_UINT32, BASE_DEC,
6312                 NULL, 0, "TC Connection Status", HFILL }},
6313
6314         { &hf_netlogon_attrs, {
6315                 "Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX,
6316                 NULL, 0, "Attributes", HFILL }},
6317
6318         { &hf_netlogon_unknown_string,
6319                 { "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE,
6320                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
6321         { &hf_netlogon_unknown_long,
6322                 { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
6323                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
6324         { &hf_netlogon_reserved,
6325                 { "Reserved", "netlogon.reserved", FT_UINT32, BASE_HEX,
6326                 NULL, 0x0, "Reserved", HFILL }},
6327         { &hf_netlogon_unknown_short,
6328                 { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
6329                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
6330
6331         { &hf_netlogon_unknown_char,
6332                 { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
6333                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
6334
6335         { &hf_netlogon_acct_expiry_time,
6336                 { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
6337                 NULL, 0x0, "When this account will expire", HFILL }},
6338
6339         { &hf_netlogon_nt_pwd_present,
6340                 { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
6341                 NULL, 0x0, "Is NT password present for this account?", HFILL }},
6342
6343         { &hf_netlogon_lm_pwd_present,
6344                 { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
6345                 NULL, 0x0, "Is LanManager password present for this account?", HFILL }},
6346
6347         { &hf_netlogon_pwd_expired,
6348                 { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
6349                 NULL, 0x0, "Whether this password has expired or not", HFILL }},
6350
6351         { &hf_netlogon_authoritative,
6352                 { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
6353                 NULL, 0x0, "", HFILL }},
6354
6355         { &hf_netlogon_sensitive_data_flag,
6356                 { "Sensitive Data", "netlogon.sensitive_data_flag", FT_UINT8, BASE_DEC,
6357                 NULL, 0x0, "Sensitive data flag", HFILL }},
6358
6359         { &hf_netlogon_auditing_mode,
6360                 { "Auditing Mode", "netlogon.auditing_mode", FT_UINT8, BASE_DEC,
6361                 NULL, 0x0, "Auditing Mode", HFILL }},
6362
6363         { &hf_netlogon_max_audit_event_count,
6364                 { "Max Audit Event Count", "netlogon.max_audit_event_count", FT_UINT32, BASE_DEC,
6365                 NULL, 0x0, "Max audit event count", HFILL }},
6366
6367         { &hf_netlogon_event_audit_option,
6368                 { "Event Audit Option", "netlogon.event_audit_option", FT_UINT32, BASE_HEX,
6369                 NULL, 0x0, "Event audit option", HFILL }},
6370
6371         { &hf_netlogon_sensitive_data_len,
6372                 { "Length", "netlogon.sensitive_data_len", FT_UINT32, BASE_DEC,
6373                 NULL, 0x0, "Length of sensitive data", HFILL }},
6374
6375         { &hf_netlogon_nt_chal_resp,
6376                 { "NT Chal resp", "netlogon.nt_chal_resp", FT_BYTES, BASE_HEX,
6377                 NULL, 0, "Challenge response for NT authentication", HFILL }},
6378
6379         { &hf_netlogon_lm_chal_resp,
6380                 { "LM Chal resp", "netlogon.lm_chal_resp", FT_BYTES, BASE_HEX,
6381                 NULL, 0, "Challenge response for LM authentication", HFILL }},
6382
6383         { &hf_netlogon_cipher_len,
6384                 { "Cipher Len", "netlogon.cipher_len", FT_UINT32, BASE_DEC,
6385                 NULL, 0, "", HFILL }},
6386
6387         { &hf_netlogon_cipher_maxlen,
6388                 { "Cipher Max Len", "netlogon.cipher_maxlen", FT_UINT32, BASE_DEC,
6389                 NULL, 0, "", HFILL }},
6390
6391         { &hf_netlogon_pac_data,
6392                 { "Pac Data", "netlogon.pac.data", FT_BYTES, BASE_HEX,
6393                 NULL, 0, "Pac Data", HFILL }},
6394
6395         { &hf_netlogon_sensitive_data,
6396                 { "Data", "netlogon.sensitive_data", FT_BYTES, BASE_HEX,
6397                 NULL, 0, "Sensitive Data", HFILL }},
6398
6399         { &hf_netlogon_auth_data,
6400                 { "Auth Data", "netlogon.auth.data", FT_BYTES, BASE_HEX,
6401                 NULL, 0, "Auth Data", HFILL }},
6402
6403         { &hf_netlogon_cipher_current_data,
6404                 { "Cipher Current Data", "netlogon.cipher_current_data", FT_BYTES, BASE_HEX,
6405                 NULL, 0, "", HFILL }},
6406
6407         { &hf_netlogon_cipher_old_data,
6408                 { "Cipher Old Data", "netlogon.cipher_old_data", FT_BYTES, BASE_HEX,
6409                 NULL, 0, "", HFILL }},
6410
6411         { &hf_netlogon_acct_name,
6412                 { "Acct Name", "netlogon.acct_name", FT_STRING, BASE_NONE,
6413                 NULL, 0, "Account Name", HFILL }},
6414
6415         { &hf_netlogon_acct_desc,
6416                 { "Acct Desc", "netlogon.acct_desc", FT_STRING, BASE_NONE,
6417                 NULL, 0, "Account Description", HFILL }},
6418
6419         { &hf_netlogon_group_desc,
6420                 { "Group Desc", "netlogon.group_desc", FT_STRING, BASE_NONE,
6421                 NULL, 0, "Group Description", HFILL }},
6422
6423         { &hf_netlogon_full_name,
6424                 { "Full Name", "netlogon.full_name", FT_STRING, BASE_NONE,
6425                 NULL, 0, "Full Name", HFILL }},
6426
6427         { &hf_netlogon_comment,
6428                 { "Comment", "netlogon.comment", FT_STRING, BASE_NONE,
6429                 NULL, 0, "Comment", HFILL }},
6430
6431         { &hf_netlogon_parameters,
6432                 { "Parameters", "netlogon.parameters", FT_STRING, BASE_NONE,
6433                 NULL, 0, "Parameters", HFILL }},
6434
6435         { &hf_netlogon_logon_script,
6436                 { "Logon Script", "netlogon.logon_script", FT_STRING, BASE_NONE,
6437                 NULL, 0, "Logon Script", HFILL }},
6438
6439         { &hf_netlogon_profile_path,
6440                 { "Profile Path", "netlogon.profile_path", FT_STRING, BASE_NONE,
6441                 NULL, 0, "Profile Path", HFILL }},
6442
6443         { &hf_netlogon_home_dir,
6444                 { "Home Dir", "netlogon.home_dir", FT_STRING, BASE_NONE,
6445                 NULL, 0, "Home Directory", HFILL }},
6446
6447         { &hf_netlogon_dir_drive,
6448                 { "Dir Drive", "netlogon.dir_drive", FT_STRING, BASE_NONE,
6449                 NULL, 0, "Drive letter for home directory", HFILL }},
6450
6451         { &hf_netlogon_logon_srv,
6452                 { "Server", "netlogon.server", FT_STRING, BASE_NONE,
6453                 NULL, 0, "Server", HFILL }},
6454
6455         { &hf_netlogon_principal,
6456                 { "Principal", "netlogon.principal", FT_STRING, BASE_NONE,
6457                 NULL, 0, "Principal", HFILL }},
6458
6459         { &hf_netlogon_logon_dom,
6460                 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
6461                 NULL, 0, "Domain", HFILL }},
6462
6463         { &hf_netlogon_computer_name,
6464                 { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
6465                 NULL, 0, "Computer Name", HFILL }},
6466
6467         { &hf_netlogon_site_name,
6468                 { "Site Name", "netlogon.site_name", FT_STRING, BASE_NONE,
6469                 NULL, 0, "Site Name", HFILL }},
6470
6471         { &hf_netlogon_dc_name,
6472                 { "DC Name", "netlogon.dc.name", FT_STRING, BASE_NONE,
6473                 NULL, 0, "DC Name", HFILL }},
6474
6475         { &hf_netlogon_dc_site_name,
6476                 { "DC Site Name", "netlogon.dc.site_name", FT_STRING, BASE_NONE,
6477                 NULL, 0, "DC Site Name", HFILL }},
6478
6479         { &hf_netlogon_dns_forest_name,
6480                 { "DNS Forest Name", "netlogon.dns.forest_name", FT_STRING, BASE_NONE,
6481                 NULL, 0, "DNS Forest Name", HFILL }},
6482
6483         { &hf_netlogon_dc_address,
6484                 { "DC Address", "netlogon.dc.address", FT_STRING, BASE_NONE,
6485                 NULL, 0, "DC Address", HFILL }},
6486
6487         { &hf_netlogon_dc_address_type,
6488                 { "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC,
6489                 VALS(dc_address_types), 0, "DC Address Type", HFILL }},
6490
6491         { &hf_netlogon_client_site_name,
6492                 { "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE,
6493                 NULL, 0, "Client Site Name", HFILL }},
6494
6495         { &hf_netlogon_workstation_site_name,
6496                 { "Wkst Site Name", "netlogon.wkst.site_name", FT_STRING, BASE_NONE,
6497                 NULL, 0, "Workstation Site Name", HFILL }},
6498
6499         { &hf_netlogon_workstation,
6500                 { "Wkst Name", "netlogon.wkst.name", FT_STRING, BASE_NONE,
6501                 NULL, 0, "Workstation Name", HFILL }},
6502
6503         { &hf_netlogon_workstation_os,
6504                 { "Wkst OS", "netlogon.wkst.os", FT_STRING, BASE_NONE,
6505                 NULL, 0, "Workstation OS", HFILL }},
6506
6507         { &hf_netlogon_workstations,
6508                 { "Workstations", "netlogon.wksts", FT_STRING, BASE_NONE,
6509                 NULL, 0, "Workstations", HFILL }},
6510
6511         { &hf_netlogon_workstation_fqdn,
6512                 { "Wkst FQDN", "netlogon.wkst.fqdn", FT_STRING, BASE_NONE,
6513                 NULL, 0, "Workstation FQDN", HFILL }},
6514
6515         { &hf_netlogon_group_name,
6516                 { "Group Name", "netlogon.group_name", FT_STRING, BASE_NONE,
6517                 NULL, 0, "Group Name", HFILL }},
6518
6519         { &hf_netlogon_alias_name,
6520                 { "Alias Name", "netlogon.alias_name", FT_STRING, BASE_NONE,
6521                 NULL, 0, "Alias Name", HFILL }},
6522
6523         { &hf_netlogon_dns_host,
6524                 { "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE,
6525                 NULL, 0, "DNS Host", HFILL }},
6526
6527         { &hf_netlogon_downlevel_domain_name,
6528                 { "Downlevel Domain", "netlogon.downlevel_domain", FT_STRING, BASE_NONE,
6529                 NULL, 0, "Downlevel Domain Name", HFILL }},
6530
6531         { &hf_netlogon_dns_domain_name,
6532                 { "DNS Domain", "netlogon.dns_domain", FT_STRING, BASE_NONE,
6533                 NULL, 0, "DNS Domain Name", HFILL }},
6534
6535         { &hf_netlogon_domain_name,
6536                 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
6537                 NULL, 0, "Domain Name", HFILL }},
6538
6539         { &hf_netlogon_oem_info,
6540                 { "OEM Info", "netlogon.oem_info", FT_STRING, BASE_NONE,
6541                 NULL, 0, "OEM Info", HFILL }},
6542
6543         { &hf_netlogon_trusted_dc_name,
6544                 { "Trusted DC", "netlogon.trusted_dc", FT_STRING, BASE_NONE,
6545                 NULL, 0, "Trusted DC", HFILL }},
6546
6547         { &hf_netlogon_logonsrv_handle,
6548                 { "Handle", "netlogon.handle", FT_STRING, BASE_NONE,
6549                 NULL, 0, "Logon Srv Handle", HFILL }},
6550
6551         { &hf_netlogon_dummy,
6552                 { "Dummy", "netlogon.dummy", FT_STRING, BASE_NONE,
6553                 NULL, 0, "Dummy string", HFILL }},
6554
6555         { &hf_netlogon_logon_count16,
6556                 { "Logon Count", "netlogon.logon_count16", FT_UINT16, BASE_DEC,
6557                 NULL, 0x0, "Number of successful logins", HFILL }},
6558
6559         { &hf_netlogon_logon_count,
6560                 { "Logon Count", "netlogon.logon_count", FT_UINT32, BASE_DEC,
6561                 NULL, 0x0, "Number of successful logins", HFILL }},
6562
6563         { &hf_netlogon_bad_pw_count16,
6564                 { "Bad PW Count", "netlogon.bad_pw_count16", FT_UINT16, BASE_DEC,
6565                 NULL, 0x0, "Number of failed logins", HFILL }},
6566
6567         { &hf_netlogon_bad_pw_count,
6568                 { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT32, BASE_DEC,
6569                 NULL, 0x0, "Number of failed logins", HFILL }},
6570
6571         { &hf_netlogon_country,
6572                 { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
6573                 VALS(ms_country_codes), 0x0, "Country setting for this account", HFILL }},
6574
6575         { &hf_netlogon_codepage,
6576                 { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
6577                 NULL, 0x0, "Codepage setting for this account", HFILL }},
6578
6579         { &hf_netlogon_level16,
6580                 { "Level", "netlogon.level16", FT_UINT16, BASE_DEC,
6581                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
6582
6583         { &hf_netlogon_validation_level,
6584                 { "Validation Level", "netlogon.validation_level", FT_UINT16, BASE_DEC,
6585                 NULL, 0x0, "Requested level of validation", HFILL }},
6586
6587         { &hf_netlogon_minpasswdlen,
6588                 { "Min Password Len", "netlogon.min_passwd_len", FT_UINT16, BASE_DEC,
6589                 NULL, 0x0, "Minimum length of password", HFILL }},
6590
6591         { &hf_netlogon_passwdhistorylen,
6592                 { "Passwd History Len", "netlogon.passwd_history_len", FT_UINT16, BASE_DEC,
6593                 NULL, 0x0, "Length of password history", HFILL }},
6594
6595         { &hf_netlogon_secure_channel_type,
6596                 { "Sec Chan Type", "netlogon.sec_chan_type", FT_UINT16, BASE_DEC,
6597                 VALS(sec_chan_type_vals), 0x0, "Secure Channel Type", HFILL }},
6598
6599         { &hf_netlogon_restart_state,
6600                 { "Restart State", "netlogon.restart_state", FT_UINT16, BASE_DEC,
6601                 NULL, 0x0, "Restart State", HFILL }},
6602
6603         { &hf_netlogon_delta_type,
6604                 { "Delta Type", "netlogon.delta_type", FT_UINT16, BASE_DEC,
6605                 VALS(delta_type_vals), 0x0, "Delta Type", HFILL }},
6606
6607         { &hf_netlogon_blob_size,
6608                 { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
6609                 NULL, 0x0, "Size in bytes of BLOB", HFILL }},
6610
6611         { &hf_netlogon_code,
6612                 { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
6613                 NULL, 0x0, "Code", HFILL }},
6614
6615         { &hf_netlogon_level,
6616                 { "Level", "netlogon.level", FT_UINT32, BASE_DEC,
6617                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
6618
6619         { &hf_netlogon_reference,
6620                 { "Reference", "netlogon.reference", FT_UINT32, BASE_DEC,
6621                 NULL, 0x0, "", HFILL }},
6622
6623         { &hf_netlogon_next_reference,
6624                 { "Next Reference", "netlogon.next_reference", FT_UINT32, BASE_DEC,
6625                 NULL, 0x0, "", HFILL }},
6626
6627         { &hf_netlogon_timestamp,
6628                 { "Timestamp", "netlogon.timestamp", FT_ABSOLUTE_TIME, BASE_NONE,
6629                 NULL, 0, "", HFILL }},
6630
6631         { &hf_netlogon_user_rid,
6632                 { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
6633                 NULL, 0x0, "", HFILL }},
6634
6635         { &hf_netlogon_alias_rid,
6636                 { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
6637                 NULL, 0x0, "", HFILL }},
6638
6639         { &hf_netlogon_group_rid,
6640                 { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
6641                 NULL, 0x0, "", HFILL }},
6642
6643         { &hf_netlogon_num_rids,
6644                 { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
6645                 NULL, 0x0, "Number of RIDs", HFILL }},
6646
6647         { &hf_netlogon_num_controllers,
6648                 { "Num DCs", "netlogon.num_dc", FT_UINT32, BASE_DEC,
6649                 NULL, 0x0, "Number of domain controllers", HFILL }},
6650
6651         { &hf_netlogon_num_other_groups,
6652                 { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
6653                 NULL, 0x0, "", HFILL }},
6654
6655         { &hf_netlogon_flags,
6656                 { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
6657                 NULL, 0x0, "", HFILL }},
6658
6659         { &hf_netlogon_user_flags,
6660                 { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
6661                 NULL, 0x0, "", HFILL }},
6662
6663         { &hf_netlogon_auth_flags,
6664                 { "Auth Flags", "netlogon.auth_flags", FT_UINT32, BASE_HEX,
6665                 NULL, 0x0, "", HFILL }},
6666
6667         { &hf_netlogon_systemflags,
6668                 { "System Flags", "netlogon.system_flags", FT_UINT32, BASE_HEX,
6669                 NULL, 0x0, "", HFILL }},
6670
6671         { &hf_netlogon_database_id,
6672                 { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
6673                 NULL, 0x0, "Database Id", HFILL }},
6674
6675         { &hf_netlogon_sync_context,
6676                 { "Sync Context", "netlogon.sync_context", FT_UINT32, BASE_DEC,
6677                 NULL, 0x0, "Sync Context", HFILL }},
6678
6679         { &hf_netlogon_max_size,
6680                 { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
6681                 NULL, 0x0, "Max Size of database", HFILL }},
6682
6683         { &hf_netlogon_max_log_size,
6684                 { "Max Log Size", "netlogon.max_log_size", FT_UINT32, BASE_DEC,
6685                 NULL, 0x0, "Max Size of log", HFILL }},
6686
6687         { &hf_netlogon_pac_size,
6688                 { "Pac Size", "netlogon.pac.size", FT_UINT32, BASE_DEC,
6689                 NULL, 0x0, "Size of PacData in bytes", HFILL }},
6690
6691         { &hf_netlogon_auth_size,
6692                 { "Auth Size", "netlogon.auth.size", FT_UINT32, BASE_DEC,
6693                 NULL, 0x0, "Size of AuthData in bytes", HFILL }},
6694
6695         { &hf_netlogon_num_deltas,
6696                 { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
6697                 NULL, 0x0, "Number of SAM Deltas in array", HFILL }},
6698
6699         { &hf_netlogon_num_trusts,
6700                 { "Num Trusts", "netlogon.num_trusts", FT_UINT32, BASE_DEC,
6701                 NULL, 0x0, "", HFILL }},
6702
6703         { &hf_netlogon_logon_attempts,
6704                 { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
6705                 NULL, 0x0, "Number of logon attempts", HFILL }},
6706
6707         { &hf_netlogon_pagefilelimit,
6708                 { "Page File Limit", "netlogon.page_file_limit", FT_UINT32, BASE_DEC,
6709                 NULL, 0x0, "", HFILL }},
6710
6711         { &hf_netlogon_pagedpoollimit,
6712                 { "Paged Pool Limit", "netlogon.paged_pool_limit", FT_UINT32, BASE_DEC,
6713                 NULL, 0x0, "", HFILL }},
6714
6715         { &hf_netlogon_nonpagedpoollimit,
6716                 { "Non-Paged Pool Limit", "netlogon.nonpaged_pool_limit", FT_UINT32, BASE_DEC,
6717                 NULL, 0x0, "", HFILL }},
6718
6719         { &hf_netlogon_minworkingsetsize,
6720                 { "Min Working Set Size", "netlogon.min_working_set_size", FT_UINT32, BASE_DEC,
6721                 NULL, 0x0, "", HFILL }},
6722
6723         { &hf_netlogon_maxworkingsetsize,
6724                 { "Max Working Set Size", "netlogon.max_working_set_size", FT_UINT32, BASE_DEC,
6725                 NULL, 0x0, "", HFILL }},
6726
6727         { &hf_netlogon_serial_number,
6728                 { "Serial Number", "netlogon.serial_number", FT_UINT32, BASE_DEC,
6729                 NULL, 0x0, "", HFILL }},
6730
6731         { &hf_netlogon_neg_flags,
6732                 { "Neg Flags", "netlogon.neg_flags", FT_UINT32, BASE_HEX,
6733                 NULL, 0x0, "Negotiation Flags", HFILL }},
6734
6735         { &hf_netlogon_dc_flags,
6736                 { "Flags", "netlogon.dc.flags", FT_UINT32, BASE_HEX,
6737                 NULL, 0x0, "Domain Controller Flags", HFILL }},
6738
6739         { &hf_netlogon_dc_flags_pdc_flag,
6740                 { "PDC", "netlogon.dc.flags.pdc",
6741                   FT_BOOLEAN, 32, TFS(&dc_flags_pdc_flag), DS_PDC_FLAG,
6742                   "If this server is a PDC", HFILL }},
6743
6744         { &hf_netlogon_dc_flags_gc_flag,
6745                 { "GC", "netlogon.dc.flags.gc",
6746                   FT_BOOLEAN, 32, TFS(&dc_flags_gc_flag), DS_GC_FLAG,
6747                   "If this server is a GC", HFILL }},
6748
6749         { &hf_netlogon_dc_flags_ldap_flag,
6750                 { "LDAP", "netlogon.dc.flags.ldap",
6751                   FT_BOOLEAN, 32, TFS(&dc_flags_ldap_flag), DS_LDAP_FLAG,
6752                   "If this is an LDAP server", HFILL }},
6753
6754         { &hf_netlogon_dc_flags_ds_flag,
6755                 { "DS", "netlogon.dc.flags.ds",
6756                   FT_BOOLEAN, 32, TFS(&dc_flags_ds_flag), DS_DS_FLAG,
6757                   "If this server is a DS", HFILL }},
6758
6759         { &hf_netlogon_dc_flags_kdc_flag,
6760                 { "KDC", "netlogon.dc.flags.kdc",
6761                   FT_BOOLEAN, 32, TFS(&dc_flags_kdc_flag), DS_KDC_FLAG,
6762                   "If this is a KDC", HFILL }},
6763
6764         { &hf_netlogon_dc_flags_timeserv_flag,
6765                 { "Timeserv", "netlogon.dc.flags.timeserv",
6766                   FT_BOOLEAN, 32, TFS(&dc_flags_timeserv_flag), DS_TIMESERV_FLAG,
6767                   "If this server is a TimeServer", HFILL }},
6768
6769         { &hf_netlogon_dc_flags_closest_flag,
6770                 { "Closest", "netlogon.dc.flags.closest",
6771                   FT_BOOLEAN, 32, TFS(&dc_flags_closest_flag), DS_CLOSEST_FLAG,
6772                   "If this is the closest server", HFILL }},
6773
6774         { &hf_netlogon_dc_flags_writable_flag,
6775                 { "Writable", "netlogon.dc.flags.writable",
6776                   FT_BOOLEAN, 32, TFS(&dc_flags_writable_flag), DS_WRITABLE_FLAG,
6777                   "If this server can do updates to the database", HFILL }},
6778
6779         { &hf_netlogon_dc_flags_good_timeserv_flag,
6780                 { "Good Timeserv", "netlogon.dc.flags.good_timeserv",
6781                   FT_BOOLEAN, 32, TFS(&dc_flags_good_timeserv_flag), DS_GOOD_TIMESERV_FLAG,
6782                   "If this is a Good TimeServer", HFILL }},
6783
6784         { &hf_netlogon_dc_flags_ndnc_flag,
6785                 { "NDNC", "netlogon.dc.flags.ndnc",
6786                   FT_BOOLEAN, 32, TFS(&dc_flags_ndnc_flag), DS_NDNC_FLAG,
6787                   "If this is an NDNC server", HFILL }},
6788
6789         { &hf_netlogon_dc_flags_dns_controller_flag,
6790                 { "DNS Controller", "netlogon.dc.flags.dns_controller",
6791                   FT_BOOLEAN, 32, TFS(&dc_flags_dns_controller_flag), DS_DNS_CONTROLLER_FLAG,
6792                   "If this server is a DNS Controller", HFILL }},
6793
6794         { &hf_netlogon_dc_flags_dns_domain_flag,
6795                 { "DNS Domain", "netlogon.dc.flags.dns_domain",
6796                   FT_BOOLEAN, 32, TFS(&dc_flags_dns_domain_flag), DS_DNS_DOMAIN_FLAG,
6797                   "", HFILL }},
6798
6799         { &hf_netlogon_dc_flags_dns_forest_flag,
6800                 { "DNS Forest", "netlogon.dc.flags.dns_forest",
6801                   FT_BOOLEAN, 32, TFS(&dc_flags_dns_forest_flag), DS_DNS_FOREST_FLAG,
6802                   "", HFILL }},
6803
6804         { &hf_netlogon_get_dcname_request_flags,
6805                 { "Flags", "netlogon.get_dcname.request.flags", FT_UINT32, BASE_HEX,
6806                 NULL, 0x0, "Flags for DSGetDCName request", HFILL }},
6807
6808         { &hf_netlogon_get_dcname_request_flags_force_rediscovery,
6809                 { "Force Rediscovery", "netlogon.get_dcname.request.flags.force_rediscovery",
6810                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_force_rediscovery), DS_FORCE_REDISCOVERY,
6811                   "Whether to allow the server to returned cached information or not", HFILL }},
6812
6813         { &hf_netlogon_get_dcname_request_flags_directory_service_required,
6814                 { "DS Required", "netlogon.get_dcname.request.flags.ds_required",
6815                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_required), DS_DIRECTORY_SERVICE_REQUIRED,
6816                   "Whether we require that the returned DC supports w2k or not", HFILL }},
6817
6818         { &hf_netlogon_get_dcname_request_flags_directory_service_preferred,
6819                 { "DS Preferred", "netlogon.get_dcname.request.flags.ds_preferred",
6820                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_preferred), DS_DIRECTORY_SERVICE_PREFERRED,
6821                   "Whether we prefer the call to return a w2k server (if available)", HFILL }},
6822
6823         { &hf_netlogon_get_dcname_request_flags_gc_server_required,
6824                 { "GC Required", "netlogon.get_dcname.request.flags.gc_server_required",
6825                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_gc_server_required), DS_GC_SERVER_REQUIRED,
6826                   "Whether we require that the returned DC is a Global Catalog server", HFILL }},
6827
6828         { &hf_netlogon_get_dcname_request_flags_pdc_required,
6829                 { "PDC Required", "netlogon.get_dcname.request.flags.pdc_required",
6830                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_pdc_required), DS_PDC_REQUIRED,
6831                   "Whether we require the returned DC to be the PDC", HFILL }},
6832
6833         { &hf_netlogon_get_dcname_request_flags_background_only,
6834                 { "Background Only", "netlogon.get_dcname.request.flags.background_only",
6835                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_background_only), DS_BACKGROUND_ONLY,
6836                   "If we want cached data, even if it may have expired", HFILL }},
6837
6838         { &hf_netlogon_get_dcname_request_flags_ip_required,
6839                 { "IP Required", "netlogon.get_dcname.request.flags.ip_required",
6840                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_ip_required), DS_IP_REQUIRED,
6841                   "If we requre the IP of the DC in the reply", HFILL }},
6842
6843         { &hf_netlogon_get_dcname_request_flags_kdc_required,
6844                 { "KDC Required", "netlogon.get_dcname.request.flags.kdc_required",
6845                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_kdc_required), DS_KDC_REQUIRED,
6846                   "If we require that the returned server is a KDC", HFILL }},
6847
6848         { &hf_netlogon_get_dcname_request_flags_timeserv_required,
6849                 { "Timeserv Required", "netlogon.get_dcname.request.flags.timeserv_required",
6850                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_timeserv_required), DS_TIMESERV_REQUIRED,
6851                   "If we require the retruned server to be a NTP serveruns WindowsTimeServicer", HFILL }},
6852
6853         { &hf_netlogon_get_dcname_request_flags_writable_required,
6854                 { "Writable Required", "netlogon.get_dcname.request.flags.writable_required",
6855                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_writable_required), DS_WRITABLE_REQUIRED,
6856                   "If we require that the return server is writable", HFILL }},
6857
6858         { &hf_netlogon_get_dcname_request_flags_good_timeserv_preferred,
6859                 { "Timeserv Preferred", "netlogon.get_dcname.request.flags.good_timeserv_preferred",
6860                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_good_timeserv_preferred), DS_GOOD_TIMESERV_PREFERRED,
6861                   "If we prefer Windows Time Servers", HFILL }},
6862
6863         { &hf_netlogon_get_dcname_request_flags_avoid_self,
6864                 { "Avoid Self", "netlogon.get_dcname.request.flags.avoid_self",
6865                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_avoid_self), DS_AVOID_SELF,
6866                   "Return another DC than the one we ask", HFILL }},
6867
6868         { &hf_netlogon_get_dcname_request_flags_only_ldap_needed,
6869                 { "Only LDAP Needed", "netlogon.get_dcname.request.flags.only_ldap_needed",
6870                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_only_ldap_needed), DS_ONLY_LDAP_NEEDED,
6871                   "We just want an LDAP server, it does not have to be a DC", HFILL }},
6872
6873         { &hf_netlogon_get_dcname_request_flags_is_flat_name,
6874                 { "Is Flat Name", "netlogon.get_dcname.request.flags.is_flat_name",
6875                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_flat_name), DS_IS_FLAT_NAME,
6876                   "If the specified domain name is a NetBIOS name", HFILL }},
6877
6878         { &hf_netlogon_get_dcname_request_flags_is_dns_name,
6879                 { "Is DNS Name", "netlogon.get_dcname.request.flags.is_dns_name",
6880                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_dns_name), DS_IS_DNS_NAME,
6881                   "If the specified domain name is a DNS name", HFILL }},
6882
6883         { &hf_netlogon_get_dcname_request_flags_return_dns_name,
6884                 { "Return DNS Name", "netlogon.get_dcname.request.flags.return_dns_name",
6885                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_dns_name), DS_RETURN_DNS_NAME,
6886                   "Only return a DNS name (or an error)", HFILL }},
6887
6888         { &hf_netlogon_get_dcname_request_flags_return_flat_name,
6889                 { "Return Flat Name", "netlogon.get_dcname.request.flags.return_flat_name",
6890                   FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_flat_name), DS_RETURN_FLAT_NAME,
6891                   "Only return a NetBIOS name (or an error)", HFILL }},
6892
6893         { &hf_netlogon_trust_attribs,
6894                 { "Trust Attributes", "netlogon.trust_attribs", FT_UINT32, BASE_HEX,
6895                 NULL, 0x0, "Trust Attributes", HFILL }},
6896
6897         { &hf_netlogon_trust_type,
6898                 { "Trust Type", "netlogon.trust_type", FT_UINT32, BASE_DEC,
6899                 VALS(trust_type_vals), 0x0, "Trust Type", HFILL }},
6900
6901         { &hf_netlogon_trust_flags,
6902                 { "Trust Flags", "netlogon.trust_flags", FT_UINT32, BASE_HEX,
6903                 NULL, 0x0, "Trust Flags", HFILL }},
6904
6905         { &hf_netlogon_trust_flags_inbound,
6906                 { "Inbound Trust", "netlogon.trust.flags.inbound",
6907                   FT_BOOLEAN, 32, TFS(&trust_inbound), DS_DOMAIN_DIRECT_INBOUND,
6908                   "Inbound trust. Whether the domain directly trusts the queried servers domain", HFILL }},
6909
6910         { &hf_netlogon_trust_flags_outbound,
6911                 { "Outbound Trust", "netlogon.trust.flags.outbound",
6912                   FT_BOOLEAN, 32, TFS(&trust_outbound), DS_DOMAIN_DIRECT_OUTBOUND,
6913                   "Outbound Trust. Whether the domain is directly trusted by the servers domain", HFILL }},
6914
6915         { &hf_netlogon_trust_flags_in_forest,
6916                 { "In Forest", "netlogon.trust.flags.in_forest",
6917                   FT_BOOLEAN, 32, TFS(&trust_in_forest), DS_DOMAIN_IN_FOREST,
6918                   "Whether this domain is a member of the same forest as the servers domain", HFILL }},
6919
6920         { &hf_netlogon_trust_flags_native_mode,
6921                 { "Native Mode", "netlogon.trust.flags.native_mode",
6922                   FT_BOOLEAN, 32, TFS(&trust_native_mode), DS_DOMAIN_NATIVE_MODE,
6923                   "Whether the domain is a w2k native mode domain or not", HFILL }},
6924
6925         { &hf_netlogon_trust_flags_primary,
6926                 { "Primary", "netlogon.trust.flags.primary",
6927                   FT_BOOLEAN, 32, TFS(&trust_primary), DS_DOMAIN_PRIMARY,
6928                   "Whether the domain is the primary domain for the queried server or not", HFILL }},
6929
6930         { &hf_netlogon_trust_flags_tree_root,
6931                 { "Tree Root", "netlogon.trust.flags.tree_root",
6932                   FT_BOOLEAN, 32, TFS(&trust_tree_root), DS_DOMAIN_TREE_ROOT,
6933                   "Whether the domain is the root of the tree for the queried server", HFILL }},
6934
6935         { &hf_netlogon_trust_parent_index,
6936                 { "Parent Index", "netlogon.parent_index", FT_UINT32, BASE_HEX,
6937                 NULL, 0x0, "Parent Index", HFILL }},
6938
6939         { &hf_netlogon_logon_time,
6940                 { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
6941                 NULL, 0, "Time for last time this user logged on", HFILL }},
6942
6943         { &hf_netlogon_kickoff_time,
6944                 { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
6945                 NULL, 0, "Time when this user will be kicked off", HFILL }},
6946
6947         { &hf_netlogon_logoff_time,
6948                 { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
6949                 NULL, 0, "Time for last time this user logged off", HFILL }},
6950
6951         { &hf_netlogon_pwd_last_set_time,
6952                 { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
6953                 NULL, 0, "Last time this users password was changed", HFILL }},
6954
6955         { &hf_netlogon_pwd_can_change_time,
6956                 { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
6957                 NULL, 0, "When this users password may be changed", HFILL }},
6958
6959         { &hf_netlogon_pwd_must_change_time,
6960                 { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
6961                 NULL, 0, "When this users password must be changed", HFILL }},
6962
6963         { &hf_netlogon_domain_create_time,
6964                 { "Domain Create Time", "netlogon.domain_create_time", FT_ABSOLUTE_TIME, BASE_NONE,
6965                 NULL, 0, "Time when this domain was created", HFILL }},
6966
6967         { &hf_netlogon_domain_modify_time,
6968                 { "Domain Modify Time", "netlogon.domain_modify_time", FT_ABSOLUTE_TIME, BASE_NONE,
6969                 NULL, 0, "Time when this domain was last modified", HFILL }},
6970
6971         { &hf_netlogon_db_modify_time,
6972                 { "DB Modify Time", "netlogon.db_modify_time", FT_ABSOLUTE_TIME, BASE_NONE,
6973                 NULL, 0, "Time when last modified", HFILL }},
6974
6975         { &hf_netlogon_db_create_time,
6976                 { "DB Create Time", "netlogon.db_create_time", FT_ABSOLUTE_TIME, BASE_NONE,
6977                 NULL, 0, "Time when created", HFILL }},
6978
6979         { &hf_netlogon_cipher_current_set_time,
6980                 { "Cipher Current Set Time", "netlogon.cipher_current_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
6981                 NULL, 0, "Time when current cipher was initiated", HFILL }},
6982
6983         { &hf_netlogon_cipher_old_set_time,
6984                 { "Cipher Old Set Time", "netlogon.cipher_old_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
6985                 NULL, 0, "Time when previous cipher was initiated", HFILL }},
6986
6987         { &hf_netlogon_audit_retention_period,
6988                 { "Audit Retention Period", "netlogon.audit_retention_period", FT_RELATIVE_TIME, BASE_NONE,
6989                 NULL, 0, "Audit retention period", HFILL }},
6990
6991         { &hf_netlogon_guid,
6992                 { "GUID", "netlogon.guid", FT_STRING, BASE_NONE,
6993                 NULL, 0x0, "GUID (uuid for groups?)", HFILL }},
6994
6995         { &hf_netlogon_timelimit,
6996                 { "Time Limit", "netlogon.time_limit", FT_RELATIVE_TIME, BASE_NONE,
6997                 NULL, 0, "", HFILL }},
6998
6999         /* Secure channel dissection */
7000
7001         { &hf_netlogon_secchan_bind_unknown1,
7002           { "Unknown1", "netlogon.secchan.bind.unknown1", FT_UINT32, BASE_HEX,
7003             NULL, 0x0, "", HFILL }},
7004
7005         { &hf_netlogon_secchan_bind_unknown2,
7006           { "Unknown2", "netlogon.secchan.bind.unknown2", FT_UINT32, BASE_HEX,
7007             NULL, 0x0, "", HFILL }},
7008
7009         { &hf_netlogon_secchan_domain,
7010           { "Domain", "netlogon.secchan.domain", FT_STRING, BASE_NONE,
7011             NULL, 0, "", HFILL }},
7012
7013         { &hf_netlogon_secchan_host,
7014           { "Host", "netlogon.secchan.host", FT_STRING, BASE_NONE,
7015             NULL, 0, "", HFILL }},
7016
7017         { &hf_netlogon_secchan_bind_ack_unknown1,
7018           { "Unknown1", "netlogon.secchan.bind_ack.unknown1", FT_UINT32,
7019             BASE_HEX, NULL, 0x0, "", HFILL }},
7020
7021         { &hf_netlogon_secchan_bind_ack_unknown2,
7022           { "Unknown2", "netlogon.secchan.bind_ack.unknown2", FT_UINT32,
7023             BASE_HEX, NULL, 0x0, "", HFILL }},
7024
7025         { &hf_netlogon_secchan_bind_ack_unknown3,
7026           { "Unknown3", "netlogon.secchan.bind_ack.unknown3", FT_UINT32,
7027             BASE_HEX, NULL, 0x0, "", HFILL }},
7028
7029         { &hf_netlogon_secchan_verf,
7030           { "Secure Channel Verifier", "netlogon.secchan.verifier", FT_NONE, BASE_NONE,
7031             NULL, 0x0, "Verifier", HFILL }},
7032
7033         { &hf_netlogon_secchan_verf_sig,
7034           { "Signature", "netlogon.secchan.sig", FT_BYTES, BASE_HEX, NULL,
7035             0x0, "Signature", HFILL }},
7036
7037         { &hf_netlogon_secchan_verf_unk,
7038           { "Unknown", "netlogon.secchan.unk", FT_BYTES, BASE_HEX, NULL,
7039           0x0, "Unknown", HFILL }},
7040
7041         { &hf_netlogon_secchan_verf_seq,
7042           { "Sequence No", "netlogon.secchan.seq", FT_BYTES, BASE_HEX, NULL,
7043           0x0, "Sequence No", HFILL }},
7044
7045         { &hf_netlogon_secchan_verf_nonce,
7046           { "Nonce", "netlogon.secchan.nonce", FT_BYTES, BASE_HEX, NULL,
7047           0x0, "Nonce", HFILL }},
7048         };
7049
7050         static gint *ett[] = {
7051                 &ett_dcerpc_netlogon,
7052                 &ett_CYPHER_VALUE,
7053                 &ett_QUOTA_LIMITS,
7054                 &ett_IDENTITY_INFO,
7055                 &ett_DELTA_ENUM,
7056                 &ett_UNICODE_MULTI,
7057                 &ett_DOMAIN_CONTROLLER_INFO,
7058                 &ett_UNICODE_STRING_512,
7059                 &ett_TYPE_50,
7060                 &ett_TYPE_52,
7061                 &ett_DELTA_ID_UNION,
7062                 &ett_TYPE_44,
7063                 &ett_DELTA_UNION,
7064                 &ett_LM_OWF_PASSWORD,
7065                 &ett_NT_OWF_PASSWORD,
7066                 &ett_GROUP_MEMBERSHIP,
7067                 &ett_DS_DOMAIN_TRUSTS,
7068                 &ett_BLOB,
7069                 &ett_DOMAIN_TRUST_INFO,
7070                 &ett_trust_flags,
7071                 &ett_get_dcname_request_flags,
7072                 &ett_dc_flags,
7073                 &ett_secchan_bind_creds,
7074                 &ett_secchan_bind_ack_creds,
7075                 &ett_secchan_verf
7076         };
7077
7078         proto_dcerpc_netlogon = proto_register_protocol(
7079                 "Microsoft Network Logon", "RPC_NETLOGON", "rpc_netlogon");
7080
7081         proto_register_field_array(proto_dcerpc_netlogon, hf,
7082                                    array_length(hf));
7083         proto_register_subtree_array(ett, array_length(ett));
7084 }
7085
7086 static dcerpc_auth_subdissector_fns secchan_auth_fns = {
7087         dissect_secchan_bind_creds,             /* Bind */
7088         dissect_secchan_bind_ack_creds,         /* Bind ACK */
7089         NULL,                                   /* AUTH3 */
7090         dissect_secchan_verf,                   /* Request verifier */
7091         dissect_secchan_verf,                   /* Response verifier */
7092         NULL,                                   /* Request data */
7093         NULL                                    /* Response data */
7094 };
7095
7096 void
7097 proto_reg_handoff_dcerpc_netlogon(void)
7098 {
7099         /* Register protocol as dcerpc */
7100
7101         dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
7102                          &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
7103                          dcerpc_netlogon_dissectors, hf_netlogon_opnum);
7104
7105         register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT_INTEGRITY,
7106                                           DCE_C_RPC_AUTHN_PROTOCOL_SEC_CHAN,
7107                                           &secchan_auth_fns);
7108         register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT_PRIVACY,
7109                                           DCE_C_RPC_AUTHN_PROTOCOL_SEC_CHAN,
7110                                           &secchan_auth_fns);
7111 }