/* packet-dcerpc-netlogon.c
- * Routines for SMB \\PIPE\\NETLOGON packet disassembly
- * Copyright 2001, Tim Potter <tpot@samba.org>
+ * Routines for SMB \PIPE\NETLOGON packet disassembly
+ * Copyright 2001,2003 Tim Potter <tpot@samba.org>
* 2002 structure and command dissectors by Ronnie Sahlberg
*
- * $Id: packet-dcerpc-netlogon.c,v 1.41 2002/07/08 12:53:28 sahlberg Exp $
+ * $Id: packet-dcerpc-netlogon.c,v 1.97 2004/03/05 23:12:09 sahlberg Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
* Copyright 1998 Gerald Combs
- *
+ *
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
static int proto_dcerpc_netlogon = -1;
static int hf_netlogon_opnum = -1;
+static int hf_netlogon_guid = -1;
static int hf_netlogon_rc = -1;
static int hf_netlogon_len = -1;
static int hf_netlogon_sensitive_data_flag = -1;
static int hf_netlogon_sensitive_data = -1;
static int hf_netlogon_security_information = -1;
static int hf_netlogon_dummy = -1;
+static int hf_netlogon_neg_flags = -1;
static int hf_netlogon_minworkingsetsize = -1;
static int hf_netlogon_maxworkingsetsize = -1;
static int hf_netlogon_pagedpoollimit = -1;
static int hf_netlogon_privilege_control = -1;
static int hf_netlogon_privilege_name = -1;
static int hf_netlogon_systemflags = -1;
-static int hf_netlogon_status = -1;
+static int hf_netlogon_pdc_connection_status = -1;
+static int hf_netlogon_tc_connection_status = -1;
+static int hf_netlogon_restart_state = -1;
static int hf_netlogon_attrs = -1;
static int hf_netlogon_count = -1;
+static int hf_netlogon_entries = -1;
static int hf_netlogon_minpasswdlen = -1;
static int hf_netlogon_passwdhistorylen = -1;
static int hf_netlogon_level16 = -1;
static int hf_netlogon_validation_level = -1;
+static int hf_netlogon_reference = -1;
+static int hf_netlogon_next_reference = -1;
+static int hf_netlogon_timestamp = -1;
static int hf_netlogon_level = -1;
static int hf_netlogon_challenge = -1;
static int hf_netlogon_reserved = -1;
static int hf_netlogon_auditing_mode = -1;
static int hf_netlogon_max_audit_event_count = -1;
static int hf_netlogon_event_audit_option = -1;
-static int hf_netlogon_unknown_time = -1;
static int hf_netlogon_unknown_string = -1;
static int hf_netlogon_unknown_long = -1;
static int hf_netlogon_unknown_short = -1;
static int hf_netlogon_pwd_last_set_time = -1;
static int hf_netlogon_pwd_can_change_time = -1;
static int hf_netlogon_pwd_must_change_time = -1;
-static int hf_netlogon_timestamp = -1;
static int hf_netlogon_nt_chal_resp = -1;
static int hf_netlogon_lm_chal_resp = -1;
static int hf_netlogon_credential = -1;
static int hf_netlogon_profile_path = -1;
static int hf_netlogon_home_dir = -1;
static int hf_netlogon_dir_drive = -1;
-static int hf_netlogon_last_logon = -1;
-static int hf_netlogon_last_logoff = -1;
static int hf_netlogon_logon_count = -1;
static int hf_netlogon_logon_count16 = -1;
static int hf_netlogon_bad_pw_count = -1;
static int hf_netlogon_logon_srv = -1;
static int hf_netlogon_principal = -1;
static int hf_netlogon_logon_dom = -1;
+static int hf_netlogon_resourcegroupdomainsid = -1;
+static int hf_netlogon_resourcegroupcount = -1;
+static int hf_netlogon_downlevel_domain_name = -1;
+static int hf_netlogon_dns_domain_name = -1;
static int hf_netlogon_domain_name = -1;
static int hf_netlogon_domain_create_time = -1;
static int hf_netlogon_domain_modify_time = -1;
static int hf_netlogon_db_modify_time = -1;
static int hf_netlogon_db_create_time = -1;
static int hf_netlogon_oem_info = -1;
-static int hf_netlogon_trusted_domain_name = -1;
+static int hf_netlogon_serial_number = -1;
static int hf_netlogon_num_rids = -1;
+static int hf_netlogon_num_trusts = -1;
static int hf_netlogon_num_controllers = -1;
static int hf_netlogon_num_other_groups = -1;
static int hf_netlogon_computer_name = -1;
static int hf_netlogon_dns_forest_name = -1;
static int hf_netlogon_dc_address = -1;
static int hf_netlogon_dc_address_type = -1;
-static int hf_netlogon_client_name = -1;
static int hf_netlogon_client_site_name = -1;
static int hf_netlogon_workstation = -1;
static int hf_netlogon_workstation_site_name = -1;
static int hf_netlogon_country = -1;
static int hf_netlogon_codepage = -1;
static int hf_netlogon_flags = -1;
+static int hf_netlogon_trust_attribs = -1;
+static int hf_netlogon_trust_type = -1;
+static int hf_netlogon_trust_flags = -1;
+static int hf_netlogon_trust_flags_inbound = -1;
+static int hf_netlogon_trust_flags_outbound = -1;
+static int hf_netlogon_trust_flags_in_forest = -1;
+static int hf_netlogon_trust_flags_native_mode = -1;
+static int hf_netlogon_trust_flags_primary = -1;
+static int hf_netlogon_trust_flags_tree_root = -1;
+static int hf_netlogon_trust_parent_index = -1;
static int hf_netlogon_user_flags = -1;
static int hf_netlogon_auth_flags = -1;
static int hf_netlogon_pwd_expired = -1;
static int hf_netlogon_max_size = -1;
static int hf_netlogon_max_log_size = -1;
static int hf_netlogon_dns_host = -1;
-static int hf_netlogon_num_pwd_pairs = -1;
static int hf_netlogon_acct_expiry_time = -1;
static int hf_netlogon_encrypted_lm_owf_password = -1;
static int hf_netlogon_lm_owf_password = -1;
static int hf_netlogon_secure_channel_type = -1;
static int hf_netlogon_logonsrv_handle = -1;
static int hf_netlogon_delta_type = -1;
+static int hf_netlogon_get_dcname_request_flags = -1;
+static int hf_netlogon_get_dcname_request_flags_force_rediscovery = -1;
+static int hf_netlogon_get_dcname_request_flags_directory_service_required = -1;
+static int hf_netlogon_get_dcname_request_flags_directory_service_preferred = -1;
+static int hf_netlogon_get_dcname_request_flags_gc_server_required = -1;
+static int hf_netlogon_get_dcname_request_flags_pdc_required = -1;
+static int hf_netlogon_get_dcname_request_flags_background_only = -1;
+static int hf_netlogon_get_dcname_request_flags_ip_required = -1;
+static int hf_netlogon_get_dcname_request_flags_kdc_required = -1;
+static int hf_netlogon_get_dcname_request_flags_timeserv_required = -1;
+static int hf_netlogon_get_dcname_request_flags_writable_required = -1;
+static int hf_netlogon_get_dcname_request_flags_good_timeserv_preferred = -1;
+static int hf_netlogon_get_dcname_request_flags_avoid_self = -1;
+static int hf_netlogon_get_dcname_request_flags_only_ldap_needed = -1;
+static int hf_netlogon_get_dcname_request_flags_is_flat_name = -1;
+static int hf_netlogon_get_dcname_request_flags_is_dns_name = -1;
+static int hf_netlogon_get_dcname_request_flags_return_dns_name = -1;
+static int hf_netlogon_get_dcname_request_flags_return_flat_name = -1;
+static int hf_netlogon_dc_flags = -1;
+static int hf_netlogon_dc_flags_pdc_flag = -1;
+static int hf_netlogon_dc_flags_gc_flag = -1;
+static int hf_netlogon_dc_flags_ldap_flag = -1;
+static int hf_netlogon_dc_flags_ds_flag = -1;
+static int hf_netlogon_dc_flags_kdc_flag = -1;
+static int hf_netlogon_dc_flags_timeserv_flag = -1;
+static int hf_netlogon_dc_flags_closest_flag = -1;
+static int hf_netlogon_dc_flags_writable_flag = -1;
+static int hf_netlogon_dc_flags_good_timeserv_flag = -1;
+static int hf_netlogon_dc_flags_ndnc_flag = -1;
+static int hf_netlogon_dc_flags_dns_controller_flag = -1;
+static int hf_netlogon_dc_flags_dns_domain_flag = -1;
+static int hf_netlogon_dc_flags_dns_forest_flag = -1;
static gint ett_dcerpc_netlogon = -1;
static gint ett_QUOTA_LIMITS = -1;
static gint ett_IDENTITY_INFO = -1;
static gint ett_DELTA_ENUM = -1;
static gint ett_CYPHER_VALUE = -1;
-static gint ett_TYPE_36 = -1;
-static gint ett_NETLOGON_INFO_1 = -1;
-static gint ett_NETLOGON_INFO_2 = -1;
-static gint ett_NETLOGON_INFO_3 = -1;
-static gint ett_NETLOGON_INFO_4 = -1;
static gint ett_UNICODE_MULTI = -1;
static gint ett_DOMAIN_CONTROLLER_INFO = -1;
-static gint ett_TYPE_46 = -1;
-static gint ett_TYPE_48 = -1;
static gint ett_UNICODE_STRING_512 = -1;
static gint ett_TYPE_50 = -1;
-static gint ett_TYPE_51 = -1;
static gint ett_TYPE_52 = -1;
static gint ett_DELTA_ID_UNION = -1;
-static gint ett_NETLOGON_CONTROL_QUERY_INFO = -1;
static gint ett_TYPE_44 = -1;
static gint ett_DELTA_UNION = -1;
-static gint ett_NETLOGON_INFO = -1;
-static gint ett_TYPE_45 = -1;
-static gint ett_TYPE_47 = -1;
-static gint ett_GUID = -1;
static gint ett_LM_OWF_PASSWORD = -1;
static gint ett_NT_OWF_PASSWORD = -1;
static gint ett_GROUP_MEMBERSHIP = -1;
static gint ett_BLOB = -1;
+static gint ett_DS_DOMAIN_TRUSTS = -1;
+static gint ett_DOMAIN_TRUST_INFO = -1;
+static gint ett_trust_flags = -1;
+static gint ett_get_dcname_request_flags = -1;
+static gint ett_dc_flags = -1;
static e_uuid_t uuid_dcerpc_netlogon = {
0x12345678, 0x1234, 0xabcd,
static int
netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Server Handle", hf_netlogon_logonsrv_handle, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Server Handle",
+ hf_netlogon_logonsrv_handle, 0);
return offset;
}
static int
netlogon_dissect_VALIDATION_UAS_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
dcerpc_info *di;
return offset;
}
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Effective Account", hf_netlogon_acct_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Effective Account",
+ hf_netlogon_acct_name, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_priv, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_bad_pw_count, NULL);
+ /* XXX - are these all UNIX "time_t"s, like the time stamps in
+ credentials?
+
+ Or are they, as per some RAP-based operations, UTIMEs? */
proto_tree_add_text(tree, tvb, offset, 4, "Last Logon: unknown time format");
offset+= 4;
proto_tree_add_text(tree, tvb, offset, 4, "PW Must Change: unknown time format");
offset+= 4;
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Computer", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Computer", hf_netlogon_computer_name, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Domain", hf_netlogon_domain_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Script", hf_netlogon_logon_script, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Script", hf_netlogon_logon_script, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_reserved, NULL);
}
/*
- * IDL long NetLogonUasLogon(
+ * IDL long NetrLogonUasLogon(
* IDL [in][unique][string] wchar_t *ServerName,
* IDL [in][ref][string] wchar_t *UserName,
* IDL [in][ref][string] wchar_t *Workstation,
* IDL );
*/
static int
-netlogon_dissect_netlogonuaslogon_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonuaslogon_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Account", hf_netlogon_acct_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Account", hf_netlogon_acct_name, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Workstation", hf_netlogon_workstation, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Workstation", hf_netlogon_workstation, 0);
return offset;
}
static int
-netlogon_dissect_netlogonuaslogon_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonuaslogon_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_VALIDATION_UAS_INFO, NDR_POINTER_UNIQUE,
- "VALIDATION_UAS_INFO", -1, 0);
+ "VALIDATION_UAS_INFO", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
static int
netlogon_dissect_LOGOFF_UAS_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
dcerpc_info *di;
}
/*
- * IDL long NetLogonUasLogoff(
+ * IDL long NetrLogonUasLogoff(
* IDL [in][unique][string] wchar_t *ServerName,
* IDL [in][ref][string] wchar_t *UserName,
* IDL [in][ref][string] wchar_t *Workstation,
* IDL );
*/
static int
-netlogon_dissect_netlogonuaslogoff_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonuaslogoff_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Account", hf_netlogon_acct_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Account", hf_netlogon_acct_name, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Workstation", hf_netlogon_workstation, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Workstation", hf_netlogon_workstation, 0);
return offset;
}
static int
-netlogon_dissect_netlogonuaslogoff_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonuaslogoff_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_LOGOFF_UAS_INFO, NDR_POINTER_REF,
- "LOGOFF_UAS_INFO", -1, 0);
+ "LOGOFF_UAS_INFO", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
static int
netlogon_dissect_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
tree = proto_item_add_subtree(item, ett_IDENTITY_INFO);
}
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ /* XXX: It would be nice to get the domain and account name
+ displayed in COL_INFO. */
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_dom, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_id, NULL);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_acct_name, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_workstation, 0);
#ifdef REMOVED
static int
netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep _U_)
+ guint8 *drep _U_)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
static int
netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep _U_)
+ guint8 *drep _U_)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
static int
netlogon_dissect_INTERACTIVE_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
pinfo, tree, drep);
static int
netlogon_dissect_CHALLENGE(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep _U_)
+ guint8 *drep _U_)
{
dcerpc_info *di;
* IDL STRING lmchallengeresponse;
* IDL } NETWORK_INFO;
*/
+
+static void dissect_nt_chal_resp_cb(packet_info *pinfo _U_, proto_tree *tree,
+ proto_item *item _U_, tvbuff_t *tvb,
+ int start_offset, int end_offset,
+ void *callback_args _U_)
+{
+ int len;
+
+ /* Skip over 3 guint32's in NDR format */
+
+ if (start_offset % 4)
+ start_offset += 4 - (start_offset % 4);
+
+ start_offset += 12;
+ len = end_offset - start_offset;
+
+ /* Call ntlmv2 response dissector */
+
+ if (len > 24)
+ dissect_ntlmv2_response(tvb, tree, start_offset, len);
+}
+
static int
netlogon_dissect_NETWORK_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
pinfo, tree, drep);
offset = netlogon_dissect_CHALLENGE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_nt_chal_resp, 0);
+ offset = dissect_ndr_counted_byte_array_cb(
+ tvb, offset, pinfo, tree, drep, hf_netlogon_nt_chal_resp,
+ dissect_nt_chal_resp_cb, NULL);
- offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_lm_chal_resp, 0);
+ offset = dissect_ndr_counted_byte_array(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_lm_chal_resp);
return offset;
}
static int
netlogon_dissect_SERVICE_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset,
pinfo, tree, drep);
static int
netlogon_dissect_LEVEL(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
guint16 level;
case 1:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_INTERACTIVE_INFO, NDR_POINTER_UNIQUE,
- "INTERACTIVE_INFO:", -1, 0);
+ "INTERACTIVE_INFO:", -1);
break;
case 2:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_NETWORK_INFO, NDR_POINTER_UNIQUE,
- "NETWORK_INFO:", -1, 0);
+ "NETWORK_INFO:", -1);
break;
case 3:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_SERVICE_INFO, NDR_POINTER_UNIQUE,
- "SERVICE_INFO:", -1, 0);
+ "SERVICE_INFO:", -1);
break;
}
static int
netlogon_dissect_CREDENTIAL(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep _U_)
+ guint8 *drep _U_)
{
dcerpc_info *di;
static int
netlogon_dissect_AUTHENTICATOR(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
+ dcerpc_info *di;
+ nstime_t ts;
+
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect */
+ return offset;
+ }
+
offset = netlogon_dissect_CREDENTIAL(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_timestamp, NULL);
+ /*
+ * XXX - this appears to be a UNIX time_t in some credentials, but
+ * appears to be random junk in other credentials.
+ * For example, it looks like a UNIX time_t in "credential"
+ * AUTHENTICATORs, but like random junk in "return_authenticator"
+ * AUTHENTICATORs.
+ */
+ ALIGN_TO_4_BYTES;
+ ts.secs = tvb_get_letohl(tvb, offset);
+ ts.nsecs = 0;
+ proto_tree_add_time(tree, hf_netlogon_timestamp, tvb, offset, 4, &ts);
+ offset+= 4;
return offset;
}
-/*
+/*
* IDL typedef struct {
* IDL long user_id;
* IDL long attributes;
static int
netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
}
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
+ hf_netlogon_group_rid, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_attrs, NULL);
static int
netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
netlogon_dissect_GROUP_MEMBERSHIP);
static int
netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep _U_)
+ guint8 *drep _U_)
{
dcerpc_info *di;
static int
netlogon_dissect_VALIDATION_SAM_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
int i;
offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
hf_netlogon_pwd_must_change_time);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_acct_name, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_full_name, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_script, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_profile_path, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_home_dir, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dir_drive, 0);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
- "GROUP_MEMBERSHIP_ARRAY", -1, 0);
+ "GROUP_MEMBERSHIP_ARRAY", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_user_flags, NULL);
offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_srv, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_dom, 0);
offset = dissect_ndr_nt_PSID(tvb, offset,
- pinfo, tree, drep);
+ pinfo, tree, drep, -1);
for(i=0;i<10;i++){
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
* IDL long sidcount;
* IDL [unique] SID_AND_ATTRIBS;
* IDL } VALIDATION_SAM_INFO2;
- */
+ */
static int
netlogon_dissect_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
int i;
offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
hf_netlogon_pwd_must_change_time);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_acct_name, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_full_name, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_script, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_profile_path, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_home_dir, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dir_drive, 0);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
- "GROUP_MEMBERSHIP_ARRAY", -1, 0);
+ "GROUP_MEMBERSHIP_ARRAY", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_user_flags, NULL);
offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_srv, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_dom, 0);
offset = dissect_ndr_nt_PSID(tvb, offset,
+ pinfo, tree, drep, -1);
+
+ for(i=0;i<10;i++){
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
+ }
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_num_other_groups, NULL);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
+ "SID_AND_ATTRIBUTES_ARRAY:", -1);
+
+ return offset;
+}
+
+
+
+
+
+/*
+ * IDL typedef struct {
+ * IDL uint64 LogonTime;
+ * IDL uint64 LogoffTime;
+ * IDL uint64 KickOffTime;
+ * IDL uint64 PasswdLastSet;
+ * IDL uint64 PasswdCanChange;
+ * IDL uint64 PasswdMustChange;
+ * IDL unicodestring effectivename;
+ * IDL unicodestring fullname;
+ * IDL unicodestring logonscript;
+ * IDL unicodestring profilepath;
+ * IDL unicodestring homedirectory;
+ * IDL unicodestring homedirectorydrive;
+ * IDL short LogonCount;
+ * IDL short BadPasswdCount;
+ * IDL long userid;
+ * IDL long primarygroup;
+ * IDL long groupcount;
+ * IDL [unique] GROUP_MEMBERSHIP *groupids;
+ * IDL long userflags;
+ * IDL USER_SESSION_KEY key;
+ * IDL unicodestring logonserver;
+ * IDL unicodestring domainname;
+ * IDL [unique] SID logondomainid;
+ * IDL long expansionroom[10];
+ * IDL long sidcount;
+ * IDL [unique] SID_AND_ATTRIBS;
+ * IDL [unique] SID resourcegroupdomainsid;
+ * IDL long resourcegroupcount;
+qqq
+ * IDL } PAC_LOGON_INFO;
+ */
+int
+netlogon_dissect_PAC_LOGON_INFO(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
+{
+ int i;
+ guint32 rgc;
+
+ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_logon_time);
+
+ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_logoff_time);
+
+ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_kickoff_time);
+
+ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_pwd_last_set_time);
+
+ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_pwd_can_change_time);
+
+ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_pwd_must_change_time);
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_acct_name, 0);
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_full_name, 0);
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_logon_script, 0);
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_profile_path, 0);
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_home_dir, 0);
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_dir_drive, 0);
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_logon_count16, NULL);
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_bad_pw_count16, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_group_rid, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_num_rids, NULL);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
+ "GROUP_MEMBERSHIP_ARRAY", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_flags, NULL);
+
+ offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
pinfo, tree, drep);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_logon_srv, 0);
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_logon_dom, 0);
+
+ offset = dissect_ndr_nt_PSID(tvb, offset,
+ pinfo, tree, drep, -1);
+
for(i=0;i<10;i++){
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
- "SID_AND_ATTRIBUTES_ARRAY:", -1, 0);
+ "SID_AND_ATTRIBUTES_ARRAY:", -1);
+
+ offset = dissect_ndr_nt_PSID(tvb, offset,
+ pinfo, tree, drep, hf_netlogon_resourcegroupdomainsid);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_resourcegroupcount, &rgc);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
+ "ResourceGroupIDs", -1);
return offset;
}
static int
netlogon_dissect_PAC(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep _U_)
+ guint8 *drep _U_)
{
dcerpc_info *di;
guint32 pac_size;
static int
netlogon_dissect_AUTH(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep _U_)
+ guint8 *drep _U_)
{
dcerpc_info *di;
guint32 auth_size;
static int
netlogon_dissect_VALIDATION_PAC_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
int i;
hf_netlogon_pac_size, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_PAC, NDR_POINTER_UNIQUE,
- "PAC:", -1, 0);
+ netlogon_dissect_PAC, NDR_POINTER_UNIQUE, "PAC:", -1);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_dom, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_srv, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_principal, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_auth_size, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTH, NDR_POINTER_UNIQUE,
- "AUTH:", -1, 0);
+ netlogon_dissect_AUTH, NDR_POINTER_UNIQUE, "AUTH:", -1);
offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
pinfo, tree, drep);
hf_netlogon_unknown_long, NULL);
}
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
return offset;
static int
netlogon_dissect_VALIDATION(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
guint16 level;
case 2:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_VALIDATION_SAM_INFO, NDR_POINTER_UNIQUE,
- "VALIDATION_SAM_INFO:", -1, 0);
+ "VALIDATION_SAM_INFO:", -1);
break;
case 3:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE,
- "VALIDATION_SAM_INFO2:", -1, 0);
+ "VALIDATION_SAM_INFO2:", -1);
break;
case 4:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_VALIDATION_PAC_INFO, NDR_POINTER_UNIQUE,
- "VALIDATION_PAC_INFO:", -1, 0);
+ "VALIDATION_PAC_INFO:", -1);
break;
case 5:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_VALIDATION_PAC_INFO, NDR_POINTER_UNIQUE,
- "VALIDATION_PAC_INFO:", -1, 0);
+ "VALIDATION_PAC_INFO:", -1);
break;
}
/*
- * IDL long NetLogonSamLogon(
+ * IDL long NetrLogonSamLogon(
* IDL [in][unique][string] wchar_t *ServerName,
* IDL [in][unique][string] wchar_t *Workstation,
* IDL [in][unique] AUTHENTICATOR *credential,
* IDL );
*/
static int
-netlogon_dissect_netlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- if (check_col(pinfo->cinfo, COL_INFO))
- col_set_str(pinfo->cinfo, COL_INFO, "SamLogon request");
-
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Computer Name",
+ hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_netlogon_level16, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_LEVEL, NDR_POINTER_REF,
- "LEVEL: LogonLevel", -1, 0);
+ "LEVEL: LogonLevel", -1);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_netlogon_validation_level, NULL);
}
static int
-netlogon_dissect_netlogonsamlogon_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsamlogon_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- if (check_col(pinfo->cinfo, COL_INFO))
- col_set_str(pinfo->cinfo, COL_INFO, "SamLogon response");
-
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_VALIDATION, NDR_POINTER_REF,
- "VALIDATION:", -1, 0);
+ "VALIDATION:", -1);
offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
hf_netlogon_authoritative, NULL);
/*
- * IDL long NetLogonSamLogoff(
+ * IDL long NetrLogonSamLogoff(
* IDL [in][unique][string] wchar_t *ServerName,
* IDL [in][unique][string] wchar_t *ComputerName,
* IDL [in][unique] AUTHENTICATOR credential,
* IDL );
*/
static int
-netlogon_dissect_netlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Computer Name",
+ hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_netlogon_level16, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_LEVEL, NDR_POINTER_REF,
- "LEVEL: logoninformation", -1, 0);
+ "LEVEL: logoninformation", -1);
return offset;
}
static int
-netlogon_dissect_netlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
/*
- * IDL long NetServerReqChallenge(
+ * IDL long NetrServerReqChallenge(
* IDL [in][unique][string] wchar_t *ServerName,
* IDL [in][ref][string] wchar_t *ComputerName,
* IDL [in][ref] CREDENTIAL client_credential,
* IDL );
*/
static int
-netlogon_dissect_netserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- if (check_col(pinfo->cinfo, COL_INFO))
- col_set_str(pinfo->cinfo, COL_INFO,
- "RequestChallenge request");
-
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_pointer_cb(
+ tvb, offset, pinfo, tree, drep,
+ dissect_ndr_wchar_cvstring, NDR_POINTER_REF,
+ "Computer Name", hf_netlogon_computer_name,
+ cb_wstr_postprocess,
+ GINT_TO_POINTER(CB_STR_COL_INFO | 1));
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
- "CREDENTIAL: client challenge", -1, 0);
+ "CREDENTIAL: client challenge", -1);
return offset;
}
static int
-netlogon_dissect_netserverreqchallenge_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverreqchallenge_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- if (check_col(pinfo->cinfo, COL_INFO))
- col_set_str(pinfo->cinfo, COL_INFO,
- "RequestChallenge response");
-
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
- "CREDENTIAL: server credential", -1, 0);
+ "CREDENTIAL: server credential", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
static int
netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_netlogon_secure_channel_type, NULL);
/*
- * IDL long NetServerAuthenticate(
+ * IDL long NetrServerAuthenticate(
* IDL [in][unique][string] wchar_t *ServerName,
* IDL [in][ref][string] wchar_t *UserName,
* IDL [in] short secure_challenge_type,
* IDL );
*/
static int
-netlogon_dissect_netserverauthenticate_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverauthenticate_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "User Name", hf_netlogon_acct_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "User Name", hf_netlogon_acct_name, 0);
offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
- "CREDENTIAL: client challenge", -1, 0);
+ "CREDENTIAL: client challenge", -1);
return offset;
}
static int
-netlogon_dissect_netserverauthenticate_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverauthenticate_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
- "CREDENTIAL: server challenge", -1, 0);
+ "CREDENTIAL: server challenge", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
static int
netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep _U_)
+ guint8 *drep _U_)
{
dcerpc_info *di;
}
/*
- * IDL long NetServerPasswordSet(
+ * IDL long NetrServerPasswordSet(
* IDL [in][unique][string] wchar_t *ServerName,
* IDL [in][ref][string] wchar_t *UserName,
* IDL [in] short secure_challenge_type,
* IDL );
*/
static int
-netlogon_dissect_netserverpasswordset_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverpasswordset_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "User Name", hf_netlogon_acct_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "User Name", hf_netlogon_acct_name, 0);
offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF,
- "ENCRYPTED_LM_OWF_PASSWORD: hashed_pwd", -1, 0);
+ "ENCRYPTED_LM_OWF_PASSWORD: hashed_pwd", -1);
return offset;
}
static int
-netlogon_dissect_netserverpasswordset_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverpasswordset_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
static int
netlogon_dissect_DELTA_DELETE_USER(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Account Name", hf_netlogon_acct_name, -1);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Account Name", hf_netlogon_acct_name, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_SENSITIVE_DATA(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
dcerpc_info *di;
guint32 data_len;
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_sensitive_data_len, &data_len);
- proto_tree_add_item(tree, hf_netlogon_sensitive_data, tvb, offset,
+ proto_tree_add_item(tree, hf_netlogon_sensitive_data, tvb, offset,
data_len, FALSE);
offset += data_len;
static int
netlogon_dissect_USER_PRIVATE_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
hf_netlogon_sensitive_data_flag, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_SENSITIVE_DATA, NDR_POINTER_UNIQUE,
- "SENSITIVE_DATA", -1, 0);
+ "SENSITIVE_DATA", -1);
return offset;
}
static int
netlogon_dissect_DELTA_USER(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_acct_name, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_acct_name, 3);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_full_name, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_group_rid, NULL);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_home_dir, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dir_drive, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_logon_script, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_acct_desc, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_workstations, 0);
offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
hf_netlogon_pwd_expired, NULL);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_comment, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_parameters, 0);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_DELTA_DOMAIN(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_domain_name, 1);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_domain_name, 3);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_oem_info, 0);
offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_DELTA_GROUP(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_group_name, 1);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_group_name, 3);
offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_group_desc, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_DELTA_RENAME(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
dcerpc_info *di;
di=pinfo->private_data;
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- di->hf_index, 1);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ di->hf_index, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- di->hf_index, 1);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ di->hf_index, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
-netlogon_dissect_RID(tvbuff_t *tvb, int offset,
+netlogon_dissect_RID(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_user_rid, NULL);
}
static int
-netlogon_dissect_RID_array(tvbuff_t *tvb, int offset,
+netlogon_dissect_RID_array(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
netlogon_dissect_RID);
}
static int
-netlogon_dissect_ATTRIB(tvbuff_t *tvb, int offset,
+netlogon_dissect_ATTRIB(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_attrs, NULL);
}
static int
-netlogon_dissect_ATTRIB_array(tvbuff_t *tvb, int offset,
+netlogon_dissect_ATTRIB_array(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
netlogon_dissect_ATTRIB);
static int
netlogon_dissect_DELTA_GROUP_MEMBER(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_RID_array, NDR_POINTER_UNIQUE,
- "RIDs:", -1, 0);
+ "RIDs:", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_ATTRIB_array, NDR_POINTER_UNIQUE,
- "Attribs:", -1, 0);
+ "Attribs:", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_num_rids, NULL);
static int
netlogon_dissect_DELTA_ALIAS(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_alias_name, 1);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_alias_name, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_alias_rid, NULL);
offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_DELTA_ALIAS_MEMBER(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, drep);
static int
netlogon_dissect_EVENT_AUDIT_OPTION(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_event_audit_option, NULL);
static int
netlogon_dissect_EVENT_AUDIT_OPTIONS_ARRAY(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
netlogon_dissect_EVENT_AUDIT_OPTION);
static int
netlogon_dissect_QUOTA_LIMITS(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
static int
netlogon_dissect_DELTA_POLICY(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_max_log_size, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_EVENT_AUDIT_OPTIONS_ARRAY, NDR_POINTER_UNIQUE,
- "Event Audit Options:", -1, 0);
+ "Event Audit Options:", -1);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_domain_name, 0);
offset = dissect_ndr_nt_PSID(tvb, offset,
- pinfo, tree, drep);
+ pinfo, tree, drep, -1);
offset = netlogon_dissect_QUOTA_LIMITS(tvb, offset,
pinfo, tree, drep);
offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_CONTROLLER(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_dc_name, 1);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_dc_name, 0);
return offset;
}
static int
netlogon_dissect_CONTROLLER_ARRAY(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CONTROLLER);
static int
netlogon_dissect_DELTA_TRUSTED_DOMAINS(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_domain_name, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CONTROLLER_ARRAY, NDR_POINTER_UNIQUE,
- "Domain Controllers:", -1, 0);
+ "Domain Controllers:", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_security_information, NULL);
offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_PRIV_ATTR(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_attrs, NULL);
static int
netlogon_dissect_PRIV_ATTR_ARRAY(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
netlogon_dissect_PRIV_ATTR);
static int
netlogon_dissect_PRIV_NAME(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_privilege_name, 1);
return offset;
static int
netlogon_dissect_PRIV_NAME_ARRAY(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
netlogon_dissect_PRIV_NAME);
static int
netlogon_dissect_DELTA_ACCOUNTS(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_privilege_entries, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_PRIV_ATTR_ARRAY, NDR_POINTER_UNIQUE,
- "PRIV_ATTR_ARRAY:", -1, 0);
+ "PRIV_ATTR_ARRAY:", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_PRIV_NAME_ARRAY, NDR_POINTER_UNIQUE,
- "PRIV_NAME_ARRAY:", -1, 0);
+ "PRIV_NAME_ARRAY:", -1);
offset = netlogon_dissect_QUOTA_LIMITS(tvb, offset,
pinfo, tree, drep);
offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_CIPHER_VALUE_DATA(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
dcerpc_info *di;
guint32 data_len;
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_netlogon_cipher_len, &data_len);
- proto_tree_add_item(tree, di->hf_index, tvb, offset,
+ proto_tree_add_item(tree, di->hf_index, tvb, offset,
data_len, FALSE);
offset += data_len;
static int
netlogon_dissect_CIPHER_VALUE(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep, char *name, int hf_index)
+ guint8 *drep, char *name, int hf_index)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CIPHER_VALUE_DATA, NDR_POINTER_UNIQUE,
- name, hf_index, 0);
+ name, hf_index);
proto_item_set_len(item, offset-old_offset);
return offset;
static int
netlogon_dissect_DELTA_SECRET(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = netlogon_dissect_CIPHER_VALUE(tvb, offset,
- pinfo, tree, drep,
+ pinfo, tree, drep,
"CIPHER_VALUE: current cipher value",
hf_netlogon_cipher_current_data);
hf_netlogon_cipher_current_set_time);
offset = netlogon_dissect_CIPHER_VALUE(tvb, offset,
- pinfo, tree, drep,
+ pinfo, tree, drep,
"CIPHER_VALUE: old cipher value",
hf_netlogon_cipher_old_data);
offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_netlogon_dummy, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_MODIFIED_COUNT(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
hf_netlogon_modify_count, NULL);
static int
netlogon_dissect_DELTA_UNION(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
case 1:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_DOMAIN, NDR_POINTER_UNIQUE,
- "DELTA_DOMAIN:", -1, 0);
+ "DELTA_DOMAIN:", -1);
break;
case 2:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_GROUP, NDR_POINTER_UNIQUE,
- "DELTA_GROUP:", -1, 0);
+ "DELTA_GROUP:", -1);
break;
case 4:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
- "DELTA_RENAME_GROUP:", hf_netlogon_group_name, 0);
+ "DELTA_RENAME_GROUP:", hf_netlogon_group_name);
break;
case 5:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_USER, NDR_POINTER_UNIQUE,
- "DELTA_USER:", -1, 0);
+ "DELTA_USER:", -1);
break;
case 7:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
- "DELTA_RENAME_USER:", hf_netlogon_acct_name, 0);
+ "DELTA_RENAME_USER:", hf_netlogon_acct_name);
break;
case 8:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_GROUP_MEMBER, NDR_POINTER_UNIQUE,
- "DELTA_GROUP_MEMBER:", -1, 0);
+ "DELTA_GROUP_MEMBER:", -1);
break;
case 9:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_ALIAS, NDR_POINTER_UNIQUE,
- "DELTA_ALIAS:", -1, 0);
+ "DELTA_ALIAS:", -1);
break;
case 11:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
- "DELTA_RENAME_ALIAS:", hf_netlogon_alias_name, 0);
+ "DELTA_RENAME_ALIAS:", hf_netlogon_alias_name);
break;
case 12:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_ALIAS_MEMBER, NDR_POINTER_UNIQUE,
- "DELTA_ALIAS_MEMBER:", -1, 0);
+ "DELTA_ALIAS_MEMBER:", -1);
break;
case 13:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_POLICY, NDR_POINTER_UNIQUE,
- "DELTA_POLICY:", -1, 0);
+ "DELTA_POLICY:", -1);
break;
case 14:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_TRUSTED_DOMAINS, NDR_POINTER_UNIQUE,
- "DELTA_TRUSTED_DOMAINS:", -1, 0);
+ "DELTA_TRUSTED_DOMAINS:", -1);
break;
case 16:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_ACCOUNTS, NDR_POINTER_UNIQUE,
- "DELTA_ACCOUNTS:", -1, 0);
+ "DELTA_ACCOUNTS:", -1);
break;
case 18:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_SECRET, NDR_POINTER_UNIQUE,
- "DELTA_SECRET:", -1, 0);
+ "DELTA_SECRET:", -1);
break;
case 20:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
- "DELTA_DELETE_GROUP:", -1, 0);
+ "DELTA_DELETE_GROUP:", -1);
break;
case 21:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
- "DELTA_DELETE_USER:", -1, 0);
+ "DELTA_DELETE_USER:", -1);
break;
case 22:
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_UNIQUE,
- "MODIFIED_COUNT:", -1, 0);
+ "MODIFIED_COUNT:", -1);
break;
}
* IDL [case(10)] long rid;
* IDL [case(11)] long rid;
* IDL [case(12)] long rid;
- * IDL [case(13)] [unique] SID *sid;
- * IDL [case(14)] [unique] SID *sid;
- * IDL [case(15)] [unique] SID *sid;
- * IDL [case(16)] [unique] SID *sid;
- * IDL [case(17)] [unique] SID *sid;
- * IDL [case(18)] [unique][string] wchar_t *Name ;
- * IDL [case(19)] [unique][string] wchar_t *Name ;
+ * IDL [case(13)] [unique] SID *sid;
+ * IDL [case(14)] [unique] SID *sid;
+ * IDL [case(15)] [unique] SID *sid;
+ * IDL [case(16)] [unique] SID *sid;
+ * IDL [case(17)] [unique] SID *sid;
+ * IDL [case(18)] [unique][string] wchar_t *Name ;
+ * IDL [case(19)] [unique][string] wchar_t *Name ;
* IDL [case(20)] long rid;
* IDL [case(21)] long rid;
* IDL } DELTA_ID_UNION;
static int
netlogon_dissect_DELTA_ID_UNION(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
}
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level16, &level);
+ hf_netlogon_delta_type, &level);
ALIGN_TO_4_BYTES;
switch(level){
case 1:
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
+ hf_netlogon_group_rid, NULL);
break;
case 2:
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
break;
case 13:
offset = dissect_ndr_nt_PSID(tvb, offset,
- pinfo, tree, drep);
+ pinfo, tree, drep, -1);
break;
case 14:
offset = dissect_ndr_nt_PSID(tvb, offset,
- pinfo, tree, drep);
+ pinfo, tree, drep, -1);
break;
case 15:
offset = dissect_ndr_nt_PSID(tvb, offset,
- pinfo, tree, drep);
+ pinfo, tree, drep, -1);
break;
case 16:
offset = dissect_ndr_nt_PSID(tvb, offset,
- pinfo, tree, drep);
+ pinfo, tree, drep, -1);
break;
case 17:
offset = dissect_ndr_nt_PSID(tvb, offset,
- pinfo, tree, drep);
+ pinfo, tree, drep, -1);
break;
case 18:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
+ tree, drep, NDR_POINTER_UNIQUE, "unknown",
+ hf_netlogon_unknown_string, 0);
break;
case 19:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
+ tree, drep, NDR_POINTER_UNIQUE, "unknown",
+ hf_netlogon_unknown_string, 0);
break;
case 20:
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
static int
netlogon_dissect_DELTA_ENUM(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
+ guint16 type;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
}
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_netlogon_delta_type, NULL);
+ hf_netlogon_delta_type, &type);
+
+ proto_item_append_text(item, val_to_str(
+ type, delta_type_vals, "Unknown"));
offset = netlogon_dissect_DELTA_ID_UNION(tvb, offset,
pinfo, tree, drep);
static int
netlogon_dissect_DELTA_ENUM_array(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_ENUM);
return offset;
}
-/*
+/*
* IDL typedef struct {
* IDL long num_deltas;
* IDL [unique][size_is(num_deltas)] DELTA_ENUM *delta_enum;
static int
netlogon_dissect_DELTA_ENUM_ARRAY(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_num_deltas, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_ENUM_array, NDR_POINTER_UNIQUE,
- "DELTA_ENUM: deltas", -1, 0);
+ "DELTA_ENUM: deltas", -1);
return offset;
}
/*
- * IDL long NetDatabaseDeltas(
+ * IDL long NetrDatabaseDeltas(
* IDL [in][string][ref] wchar_t *logonserver, # REF!!!
* IDL [in][string][ref] wchar_t *computername,
* IDL [in][ref] AUTHENTICATOR credential,
* IDL );
*/
static int
-netlogon_dissect_netsamdeltas_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrdatabasedeltas_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Server Handle", hf_netlogon_logonsrv_handle, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_database_id, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_REF,
- "MODIFIED_COUNT: domain modified count", -1, 0);
+ "MODIFIED_COUNT: domain modified count", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_max_size, NULL);
return offset;
}
static int
-netlogon_dissect_netsamdeltas_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrdatabasedeltas_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_REF,
- "MODIFIED_COUNT: domain modified count", -1, 0);
+ "MODIFIED_COUNT: domain modified count", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
- "DELTA_ENUM_ARRAY: deltas", -1, 0);
+ "DELTA_ENUM_ARRAY: deltas", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
/*
- * IDL long NetDatabaseSync(
+ * IDL long NetrDatabaseSync(
* IDL [in][string][ref] wchar_t *logonserver, # REF!!!
* IDL [in][string][ref] wchar_t *computername,
* IDL [in][ref] AUTHENTICATOR credential,
* IDL );
*/
static int
-netlogon_dissect_netlogondatabasesync_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrdatabasesync_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Server Handle", hf_netlogon_logonsrv_handle, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_database_id, NULL);
static int
-netlogon_dissect_netlogondatabasesync_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrdatabasesync_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_sync_context, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
- "DELTA_ENUM_ARRAY: deltas", -1, 0);
+ "DELTA_ENUM_ARRAY: deltas", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
return offset;
}
+/*
+ * IDL typedef struct {
+ * IDL char computer_name[16];
+ * IDL long timecreated;
+ * IDL long serial_number;
+ * IDL } UAS_INFO_0;
+ */
+static int
+netlogon_dissect_UAS_INFO_0(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
+{
+ dcerpc_info *di;
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect */
+ return offset;
+ }
+ proto_tree_add_item(tree, hf_netlogon_computer_name, tvb, offset, 16, FALSE);
+ offset += 16;
+ proto_tree_add_text(tree, tvb, offset, 4, "Time Created: unknown time format");
+ offset+= 4;
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_serial_number, NULL);
-
-/*qqq*/
-/* Updated above this line */
-
-
-
-
+ return offset;
+}
static int
-netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- dcerpc_info *di;
+ offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_char, NULL);
- di=pinfo->private_data;
- offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
- di->hf_index, NULL);
return offset;
}
static int
-netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- dcerpc_info *di;
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_BYTE_byte);
- di=pinfo->private_data;
- offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
- di->hf_index, NULL);
return offset;
}
+/*
+ * IDL long NetrAccountDeltas(
+ * IDL [in][string][unique] wchar_t *logonserver,
+ * IDL [in][string][ref] wchar_t *computername,
+ * IDL [in][ref] AUTHENTICATOR credential,
+ * IDL [in][out][ref] AUTHENTICATOR return_authenticator,
+ * IDL [out][ref][size_is(count_returned)] char *Buffer,
+ * IDL [out][ref] long count_returned,
+ * IDL [out][ref] long total_entries,
+ * IDL [in][out][ref] UAS_INFO_0 recordid,
+ * IDL [in][long] count,
+ * IDL [in][long] level,
+ * IDL [in][long] buffersize,
+ * IDL );
+ */
static int
-netlogon_dissect_UNICODE_STRING(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep, int type, int hf_index, int levels)
+netlogon_dissect_netraccountdeltas_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
- dcerpc_info *di;
- char *name;
-
- di=pinfo->private_data;
- if(di->conformant_run){
- /*just a run to handle conformant arrays, nothing to dissect */
- return offset;
- }
+ offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
+ pinfo, tree, drep);
- name = proto_registrar_get_name(hf_index);
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, -1,
- "%s", name);
- tree = proto_item_add_subtree(item, ett_nt_unicode_string);
- }
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, type,
- name, hf_index, levels);
-
- proto_item_set_len(item, offset-old_offset);
- return offset;
-}
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: credential", -1);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
-static int
-netlogon_dissect_WCHAR_ptr(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
-{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown string", hf_netlogon_unknown_string, -1);
+ netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
+ "UAS_INFO_0: RecordID", -1);
- return offset;
-}
-
-static int
-netlogon_dissect_TYPE_36(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
-{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
- int i;
-
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_36:");
- tree = proto_item_add_subtree(item, ett_TYPE_36);
- }
-
- for(i=0;i<16;i++){
- offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_char, NULL);
- }
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_count, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_level, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_max_size, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
-
static int
-netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netraccountdeltas_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "NETLOGON_INFO_1:");
- tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_1);
- }
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_BYTE_array, NDR_POINTER_REF,
+ "BYTE_array: Buffer", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_flags, NULL);
+ hf_netlogon_count, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_status, NULL);
+ hf_netlogon_entries, NULL);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
+ "UAS_INFO_0: RecordID", -1);
+
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
+
+/*
+ * IDL long NetrAccountSync(
+ * IDL [in][string][unique] wchar_t *logonserver,
+ * IDL [in][string][ref] wchar_t *computername,
+ * IDL [in][ref] AUTHENTICATOR credential,
+ * IDL [in][out][ref] AUTHENTICATOR return_authenticator,
+ * IDL [out][ref][size_is(count_returned)] char *Buffer,
+ * IDL [out][ref] long count_returned,
+ * IDL [out][ref] long total_entries,
+ * IDL [out][ref] long next_reference,
+ * IDL [in][long] reference,
+ * IDL [in][long] level,
+ * IDL [in][long] buffersize,
+ * IDL [in][out][ref] UAS_INFO_0 recordid,
+ * IDL );
+ */
static int
-netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netraccountsync_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
+ offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
+ pinfo, tree, drep);
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "NETLOGON_INFO_2:");
- tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_2);
- }
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: credential", -1);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_reference, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_level, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_max_size, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
-
static int
-netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netraccountsync_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
-
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "NETLOGON_INFO_3:");
- tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_3);
- }
-
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_flags, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_logon_attempts, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_BYTE_array, NDR_POINTER_REF,
+ "BYTE_array: Buffer", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_count, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_entries, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_next_reference, NULL);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF,
+ "UAS_INFO_0: RecordID", -1);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
+
+/*
+ * IDL long NetrGetDcName(
+ * IDL [in][ref][string] wchar_t *logon_server,
+ * IDL [in][unique][string] wchar_t *domainname,
+ * IDL [out][unique][string] wchar_t *dcname,
+ * IDL };
+ */
static int
-netlogon_dissect_NETLOGON_INFO_4(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netrgetdcname_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
-
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "NETLOGON_INFO_4:");
- tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_4);
- }
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_trusted_dc_name, -1);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_trusted_domain_name, -1);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
-
static int
-netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_netrgetdcname_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_char, NULL);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Domain", hf_netlogon_dc_name, 0);
+
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
return offset;
}
+
+
+/*
+ * IDL typedef struct {
+ * IDL long flags;
+ * IDL long pdc_connection_status;
+ * IDL } NETLOGON_INFO_1;
+ */
static int
-netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
+netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_UNICODE_MULTI_byte);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_flags, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_pdc_connection_status, NULL);
return offset;
}
+
+/*
+ * IDL typedef struct {
+ * IDL long flags;
+ * IDL long pdc_connection_status;
+ * IDL [unique][string] wchar_t trusted_dc_name;
+ * IDL long tc_connection_status;
+ * IDL } NETLOGON_INFO_2;
+ */
static int
-netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
+netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_char, NULL);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_flags, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_pdc_connection_status, NULL);
+
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Trusted DC Name",
+ hf_netlogon_trusted_dc_name, 0);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_tc_connection_status, NULL);
return offset;
}
+
+/*
+ * IDL typedef struct {
+ * IDL long flags;
+ * IDL long logon_attempts;
+ * IDL long reserved;
+ * IDL long reserved;
+ * IDL long reserved;
+ * IDL long reserved;
+ * IDL long reserved;
+ * IDL } NETLOGON_INFO_3;
+ */
static int
-netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
+netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_byte);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_flags, NULL);
- return offset;
-}
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_logon_attempts, NULL);
-static int
-netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
-{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_reserved, NULL);
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "UNICODE_MULTI:");
- tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
- }
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_reserved, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_len, NULL);
+ hf_netlogon_reserved, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_reserved, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_reserved, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
-int
-dissect_nt_GUID(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
-{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
- int i;
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "GUID:");
- tree = proto_item_add_subtree(item, ett_GUID);
- }
+/*
+ * IDL typedef [switch_type(long)] union {
+ * IDL [case(1)] [unique] NETLOGON_INFO_1 *i1;
+ * IDL [case(2)] [unique] NETLOGON_INFO_2 *i2;
+ * IDL [case(3)] [unique] NETLOGON_INFO_3 *i3;
+ * IDL } CONTROL_QUERY_INFORMATION;
+ */
+static int
+netlogon_dissect_CONTROL_QUERY_INFORMATION(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
+{
+ guint32 level;
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
-
- offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_short, NULL);
-
- offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_short, NULL);
+ hf_netlogon_level, &level);
- for(i=0;i<8;i++){
- offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_char, NULL);
+ ALIGN_TO_4_BYTES;
+ switch(level){
+ case 1:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_UNIQUE,
+ "NETLOGON_INFO_1:", -1);
+ break;
+ case 2:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_UNIQUE,
+ "NETLOGON_INFO_2:", -1);
+ break;
+ case 3:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_UNIQUE,
+ "NETLOGON_INFO_3:", -1);
+ break;
}
- proto_item_set_len(item, offset-old_offset);
return offset;
}
+
+/*
+ * IDL long NetrLogonControl(
+ * IDL [in][string][unique] wchar_t *logonserver,
+ * IDL [in] long function_code,
+ * IDL [in] long level,
+ * IDL [out][ref] CONTROL_QUERY_INFORMATION
+ * IDL );
+ */
static int
-netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netrlogoncontrol_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
+ offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
+ pinfo, tree, drep);
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "DOMAIN_CONTROLLER_INFO:");
- tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
- }
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_code, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_dc_name, -1);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_level, NULL);
+ return offset;
+}
+static int
+netlogon_dissect_netrlogoncontrol_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_dc_address, -1);
+ netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
+ "CONTROL_QUERY_INFORMATION:", -1);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_dc_address_type, NULL);
-
- offset = dissect_nt_GUID(tvb, offset,
- pinfo, tree, drep);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_logon_dom, -1);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_dns_forest_name, -1);
-
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_flags, NULL);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_dc_site_name, -1);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_client_site_name, -1);
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
+
+/*
+ * IDL long NetrGetAnyDCName(
+ * IDL [in][unique][string] wchar_t *logon_server,
+ * IDL [in][unique][string] wchar_t *domainname,
+ * IDL [out][unique][string] wchar_t *dcname,
+ * IDL };
+ */
static int
-netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_netrgetanydcname_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_PTR,
- "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Server Handle",
+ hf_netlogon_logonsrv_handle, 0);
+
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0);
return offset;
}
-
static int
-netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_netrgetanydcname_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_PTR,
- "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Domain", hf_netlogon_dc_name, 0);
+
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
return offset;
}
+
+/*
+ * IDL typedef [switch_type(long)] union {
+ * IDL [case(5)] [unique][string] wchar_t *unknown;
+ * IDL [case(6)] [unique][string] wchar_t *unknown;
+ * IDL [case(0xfffe)] long unknown;
+ * IDL [case(7)] [unique][string] wchar_t *unknown;
+ * IDL } CONTROL_DATA_INFORMATION;
+ */
+/* XXX
+ * According to muddle this is what CONTROL_DATA_INFORMATION is supposed
+ * to look like. However NetMon does not recognize any such informationlevels.
+ *
+ * Ill leave it as CONTROL_DATA_INFORMATION with no informationlevels
+ * until someone has any source of better authority to call upon.
+ */
static int
-netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
+netlogon_dissect_CONTROL_DATA_INFORMATION(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- guint32 len;
- dcerpc_info *di;
-
- di=pinfo->private_data;
- if(di->conformant_run){
- /*just a run to handle conformant arrays, nothing to dissect.*/
- return offset;
- }
+ guint32 level;
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_blob_size, &len);
+ hf_netlogon_level, &level);
- proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
- FALSE);
- offset += len;
+ ALIGN_TO_4_BYTES;
+ switch(level){
+ case 5:
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
+ tree, drep, NDR_POINTER_UNIQUE, "unknown",
+ hf_netlogon_unknown_string, 0);
+ break;
+ case 6:
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
+ tree, drep, NDR_POINTER_UNIQUE, "unknown",
+ hf_netlogon_unknown_string, 0);
+ break;
+ case 0xfffe:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
+ break;
+ case 8:
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
+ tree, drep, NDR_POINTER_UNIQUE, "unknown",
+ hf_netlogon_unknown_string, 0);
+ break;
+ }
return offset;
}
+
+/*
+ * IDL long NetrLogonControl2(
+ * IDL [in][string][unique] wchar_t *logonserver,
+ * IDL [in] long function_code,
+ * IDL [in] long level,
+ * IDL [in][ref] CONTROL_DATA_INFORMATION *data,
+ * IDL [out][ref] CONTROL_QUERY_INFORMATION *query
+ * IDL );
+ */
static int
-netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netrlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
+ offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
+ pinfo, tree, drep);
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "BLOB:");
- tree = proto_item_add_subtree(item, ett_BLOB);
- }
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_code, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_blob_size, NULL);
+ hf_netlogon_level, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BLOB_array, NDR_POINTER_PTR,
- "BLOB:", -1, 0);
+ netlogon_dissect_CONTROL_DATA_INFORMATION, NDR_POINTER_REF,
+ "CONTROL_DATA_INFORMATION: ", -1);
return offset;
}
static int
-netlogon_dissect_TYPE_46(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netrlogoncontrol2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
-
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_46:");
- tree = proto_item_add_subtree(item, ett_TYPE_46);
- }
-
- offset = netlogon_dissect_BLOB(tvb, offset,
- pinfo, tree, drep);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_workstation_fqdn, -1);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_workstation_site_name, -1);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_workstation_os, -1);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
-
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
+ netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
+ "CONTROL_QUERY_INFORMATION:", -1);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ return offset;
+}
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+/*
+ * IDL long NetrServerAuthenticate2(
+ * IDL [in][string][unique] wchar_t *logonserver,
+ * IDL [in][ref][string] wchar_t *username,
+ * IDL [in] short secure_channel_type,
+ * IDL [in][ref][string] wchar_t *computername,
+ * IDL [in][ref] CREDENTIAL *client_chal,
+ * IDL [out][ref] CREDENTIAL *server_chal,
+ * IDL [in][out][ref] long *negotiate_flags,
+ * IDL );
+ */
+static int
+netlogon_dissect_netrserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+ offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
+ pinfo, tree, drep);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_pointer_cb(
+ tvb, offset, pinfo, tree, drep,
+ dissect_ndr_wchar_cvstring, NDR_POINTER_REF,
+ "User Name", hf_netlogon_acct_name,
+ cb_wstr_postprocess, GINT_TO_POINTER(CB_STR_COL_INFO | 1));
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
+ pinfo, tree, drep);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
+ "CREDENTIAL: client_chal", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_neg_flags, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
-netlogon_dissect_TYPE_48(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netrserverauthenticate2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
+ "CREDENTIAL: server_chal", -1);
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_48:");
- tree = proto_item_add_subtree(item, ett_TYPE_48);
- }
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_neg_flags, NULL);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ return offset;
+}
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
- offset = dissect_nt_GUID(tvb, offset,
- pinfo, tree, drep);
+/*
+ * IDL long NetrDatabaseSync2(
+ * IDL [in][string][ref] wchar_t *logonserver, # REF!!!
+ * IDL [in][string][ref] wchar_t *computername,
+ * IDL [in][ref] AUTHENTICATOR credential,
+ * IDL [in][out][ref] AUTHENTICATOR return_authenticator,
+ * IDL [in] long database_id,
+ * IDL [in] short restart_state,
+ * IDL [in][out][ref] long *sync_context,
+ * IDL [in] long preferredmaximumlength,
+ * IDL [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
+ * IDL );
+ */
+static int
+netlogon_dissect_netrdatabasesync2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
- offset = dissect_ndr_nt_PSID(tvb, offset,
- pinfo, tree, drep);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: credential", -1);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_database_id, NULL);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_restart_state, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_sync_context, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_max_size, NULL);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ return offset;
+}
+
+static int
+netlogon_dissect_netrdatabasesync2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_sync_context, NULL);
- offset = netlogon_dissect_BLOB(tvb, offset,
- pinfo, tree, drep);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
+ "DELTA_ENUM_ARRAY: deltas", -1);
- offset = netlogon_dissect_BLOB(tvb, offset,
- pinfo, tree, drep);
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ return offset;
+}
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+/*
+ * IDL long NetrDatabaseRedo(
+ * IDL [in][string][ref] wchar_t *logonserver, # REF!!!
+ * IDL [in][string][ref] wchar_t *computername,
+ * IDL [in][ref] AUTHENTICATOR credential,
+ * IDL [in][out][ref] AUTHENTICATOR return_authenticator,
+ * IDL [in][ref][size_is(change_log_entry_size)] char *change_log_entry,
+ * IDL [in] long change_log_entry_size,
+ * IDL [out][unique] DELTA_ENUM_ARRAY *delta_enum_array
+ * IDL );
+ */
+static int
+netlogon_dissect_netrdatabaseredo_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0);
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: credential", -1);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_BYTE_array, NDR_POINTER_REF,
+ "Change log entry: ", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ hf_netlogon_max_log_size, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
-netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_netrdatabaseredo_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
- int i;
-
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "UNICODE_STRING_512:");
- tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
- }
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
- for(i=0;i<512;i++){
- offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_short, NULL);
- }
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
+ "DELTA_ENUM_ARRAY: deltas", -1);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
+
+/*
+ * IDL long NetrLogonControl2Ex(
+ * IDL [in][string][unique] wchar_t *logonserver,
+ * IDL [in] long function_code,
+ * IDL [in] long level,
+ * IDL [in][ref] CONTROL_DATA_INFORMATION *data,
+ * IDL [out][ref] CONTROL_QUERY_INFORMATION *query
+ * IDL );
+ */
static int
-netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_netrlogoncontrol2ex_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_char, NULL);
+ offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_code, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_level, NULL);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_CONTROL_DATA_INFORMATION, NDR_POINTER_REF,
+ "CONTROL_DATA_INFORMATION: ", -1);
return offset;
}
-
static int
-netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_netrlogoncontrol2ex_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_element_844_byte);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF,
+ "CONTROL_QUERY_INFORMATION:", -1);
+
+ offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_rc, NULL);
return offset;
}
+
+
+
+static const value_string trust_type_vals[] = {
+ { 1, "DOWNLEVEL" },
+ { 2, "UPLEVEL" },
+ { 3, "MIT" },
+ { 4, "DCE" },
+ { 0, NULL }
+};
+
+#define DS_INET_ADDRESS 1
+#define DS_NETBIOS_ADDRESS 2
+static const value_string dc_address_types[] = {
+ { DS_INET_ADDRESS, "IP/DNS name" },
+ { DS_NETBIOS_ADDRESS, "NetBIOS name" },
+ { 0, NULL}
+};
+
+
+#define DS_DOMAIN_IN_FOREST 0x0001
+#define DS_DOMAIN_DIRECT_OUTBOUND 0x0002
+#define DS_DOMAIN_TREE_ROOT 0x0004
+#define DS_DOMAIN_PRIMARY 0x0008
+#define DS_DOMAIN_NATIVE_MODE 0x0010
+#define DS_DOMAIN_DIRECT_INBOUND 0x0020
+static const true_false_string trust_inbound = {
+ "There is a DIRECT INBOUND trust for the servers domain",
+ "There is NO direct inbound trust for the servers domain"
+};
+static const true_false_string trust_outbound = {
+ "There is a DIRECT OUTBOUND trust for this domain",
+ "There is NO direct outbound trust for this domain"
+};
+static const true_false_string trust_in_forest = {
+ "The domain is a member IN the same FOREST as the queried server",
+ "The domain is NOT a member of the queried servers domain"
+};
+static const true_false_string trust_native_mode = {
+ "The primary domain is a NATIVE MODE w2k domain",
+ "The primary is NOT a native mode w2k domain"
+};
+static const true_false_string trust_primary = {
+ "The domain is the PRIMARY domain of the queried server",
+ "The domain is NOT the primary domain of the queried server"
+};
+static const true_false_string trust_tree_root = {
+ "The domain is the ROOT of a domain TREE",
+ "The domain is NOT a root of a domain tree"
+};
static int
-netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_DOMAIN_TRUST_FLAGS(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
+ guint32 mask;
+ proto_item *item = NULL;
+ proto_tree *tree = NULL;
+ dcerpc_info *di;
+
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect */
+ return offset;
+ }
+
+ offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
+ hf_netlogon_trust_flags, &mask);
if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_50:");
- tree = proto_item_add_subtree(item, ett_TYPE_50);
+ item = proto_tree_add_uint(parent_tree, hf_netlogon_trust_flags,
+ tvb, offset-4, 4, mask);
+ tree = proto_item_add_subtree(item, ett_trust_flags);
}
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ proto_tree_add_boolean(tree, hf_netlogon_trust_flags_inbound,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_trust_flags_native_mode,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_trust_flags_primary,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_trust_flags_tree_root,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_trust_flags_outbound,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_trust_flags_in_forest,
+ tvb, offset-4, 4, mask);
+
+ return offset;
+}
+
+
+#define DS_FORCE_REDISCOVERY 0x00000001
+#define DS_DIRECTORY_SERVICE_REQUIRED 0x00000010
+#define DS_DIRECTORY_SERVICE_PREFERRED 0x00000020
+#define DS_GC_SERVER_REQUIRED 0x00000040
+#define DS_PDC_REQUIRED 0x00000080
+#define DS_BACKGROUND_ONLY 0x00000100
+#define DS_IP_REQUIRED 0x00000200
+#define DS_KDC_REQUIRED 0x00000400
+#define DS_TIMESERV_REQUIRED 0x00000800
+#define DS_WRITABLE_REQUIRED 0x00001000
+#define DS_GOOD_TIMESERV_PREFERRED 0x00002000
+#define DS_AVOID_SELF 0x00004000
+#define DS_ONLY_LDAP_NEEDED 0x00008000
+#define DS_IS_FLAT_NAME 0x00010000
+#define DS_IS_DNS_NAME 0x00020000
+#define DS_RETURN_DNS_NAME 0x40000000
+#define DS_RETURN_FLAT_NAME 0x80000000
+static const true_false_string get_dcname_request_flags_force_rediscovery = {
+ "FORCE REDISCOVERY of any cached data",
+ "You may return cached data"
+};
+static const true_false_string get_dcname_request_flags_directory_service_required = {
+ "DIRECRTORY SERVICE is REQUIRED on the server",
+ "We do NOT require directory service servers"
+};
+static const true_false_string get_dcname_request_flags_directory_service_preferred = {
+ "DIRECTORY SERVICE servers are PREFERRED",
+ "We do NOT have a preference for directory service servers"
+};
+static const true_false_string get_dcname_request_flags_gc_server_required = {
+ "GC SERVER is REQUIRED",
+ "gc server is NOT required"
+};
+static const true_false_string get_dcname_request_flags_pdc_required = {
+ "PDC SERVER is REQUIRED",
+ "pdc server is NOT required"
+};
+static const true_false_string get_dcname_request_flags_background_only = {
+ "Only returned cahced data, even if it has expired",
+ "Return cached data unless it has expired"
+};
+static const true_false_string get_dcname_request_flags_ip_required = {
+ "IP address is REQUIRED",
+ "ip address is NOT required"
+};
+static const true_false_string get_dcname_request_flags_kdc_required = {
+ "KDC server is REQUIRED",
+ "kdc server is NOT required"
+};
+static const true_false_string get_dcname_request_flags_timeserv_required = {
+ "TIMESERV service is REQUIRED",
+ "timeserv service is NOT required"
+};
+static const true_false_string get_dcname_request_flags_writable_required = {
+ "the requrned dc MUST be WRITEABLE",
+ "a read-only dc may be returned"
+};
+static const true_false_string get_dcname_request_flags_good_timeserv_preferred = {
+ "GOOD TIMESERV servers are PREFERRED",
+ "we do NOT have a preference for good timeserv servers"
+};
+static const true_false_string get_dcname_request_flags_avoid_self = {
+ "do NOT return self as dc, return someone else",
+ "you may return yourSELF as the dc"
+};
+static const true_false_string get_dcname_request_flags_only_ldap_needed = {
+ "we ONLY NEED LDAP, you dont have to return a dc",
+ "we need a normal dc, an ldap only server will not do"
+};
+static const true_false_string get_dcname_request_flags_is_flat_name = {
+ "the name we specify is a NetBIOS name",
+ "the name we specify is NOT a NetBIOS name"
+};
+static const true_false_string get_dcname_request_flags_is_dns_name = {
+ "the name we specify is a DNS name",
+ "ther name we specify is NOT a dns name"
+};
+static const true_false_string get_dcname_request_flags_return_dns_name = {
+ "return a DNS name",
+ "you may return a NON-dns name"
+};
+static const true_false_string get_dcname_request_flags_return_flat_name = {
+ "return a NetBIOS name",
+ "you may return a NON-NetBIOS name"
+};
+static int
+netlogon_dissect_GET_DCNAME_REQUEST_FLAGS(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
+{
+ guint32 mask;
+ proto_item *item = NULL;
+ proto_tree *tree = NULL;
+ dcerpc_info *di;
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
- "unknown", hf_netlogon_unknown_string, 0);
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect */
+ return offset;
+ }
- proto_item_set_len(item, offset-old_offset);
- return offset;
-}
+ offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
+ hf_netlogon_get_dcname_request_flags, &mask);
-static int
-netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
-{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_50, NDR_POINTER_PTR,
- "TYPE_50 pointer: unknown_TYPE_50", -1, 0);
-
- return offset;
-}
+ if(parent_tree){
+ item = proto_tree_add_uint(parent_tree, hf_netlogon_get_dcname_request_flags,
+ tvb, offset-4, 4, mask);
+ tree = proto_item_add_subtree(item, ett_get_dcname_request_flags);
+ }
-static int
-netlogon_dissect_TYPE_50_ptr_ptr(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
-{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_50_ptr, NDR_POINTER_PTR,
- "TYPE_50* pointer: unknown_TYPE_50", -1, 0);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_return_flat_name,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_return_dns_name,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_is_flat_name,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_is_dns_name,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_only_ldap_needed,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_avoid_self,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_good_timeserv_preferred,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_writable_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_timeserv_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_kdc_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_ip_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_background_only,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_pdc_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_gc_server_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_directory_service_preferred,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_directory_service_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_force_rediscovery,
+ tvb, offset-4, 4, mask);
return offset;
}
-static int
-netlogon_dissect_element_861_byte(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
-{
- offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_char, NULL);
- return offset;
-}
+#define DS_PDC_FLAG 0x00000001
+#define DS_GC_FLAG 0x00000004
+#define DS_LDAP_FLAG 0x00000008
+#define DS_DS_FLAG 0x00000010
+#define DS_KDC_FLAG 0x00000020
+#define DS_TIMESERV_FLAG 0x00000040
+#define DS_CLOSEST_FLAG 0x00000080
+#define DS_WRITABLE_FLAG 0x00000100
+#define DS_GOOD_TIMESERV_FLAG 0x00000200
+#define DS_NDNC_FLAG 0x00000400
+#define DS_DNS_CONTROLLER_FLAG 0x20000000
+#define DS_DNS_DOMAIN_FLAG 0x40000000
+#define DS_DNS_FOREST_FLAG 0x80000000
+static const true_false_string dc_flags_pdc_flag = {
+ "this is the PDC of the domain",
+ "this is NOT the pdc of the domain"
+};
+static const true_false_string dc_flags_gc_flag = {
+ "this is the GC of the forest",
+ "this is NOT the gc of the forest"
+};
+static const true_false_string dc_flags_ldap_flag = {
+ "this is an LDAP server",
+ "this is NOT an ldap server"
+};
+static const true_false_string dc_flags_ds_flag = {
+ "this is a DS server",
+ "this is NOT a ds server"
+};
+static const true_false_string dc_flags_kdc_flag = {
+ "this is a KDC server",
+ "this is NOT a kdc server"
+};
+static const true_false_string dc_flags_timeserv_flag = {
+ "this is a TIMESERV server",
+ "this is NOT a timeserv server"
+};
+static const true_false_string dc_flags_closest_flag = {
+ "this is the CLOSEST server",
+ "this is NOT the closest server"
+};
+static const true_false_string dc_flags_writable_flag = {
+ "this server has a WRITABLE ds database",
+ "this server has a READ-ONLY ds database"
+};
+static const true_false_string dc_flags_good_timeserv_flag = {
+ "this server is a GOOD TIMESERV server",
+ "this is NOT a good timeserv server"
+};
+static const true_false_string dc_flags_ndnc_flag = {
+ "NDNC is set",
+ "ndnc is NOT set"
+};
+static const true_false_string dc_flags_dns_controller_flag = {
+ "DomainControllerName is a DNS name",
+ "DomainControllerName is NOT a dns name"
+};
+static const true_false_string dc_flags_dns_domain_flag = {
+ "DomainName is a DNS name",
+ "DomainName is NOT a dns name"
+};
+static const true_false_string dc_flags_dns_forest_flag = {
+ "DnsForestName is a DNS name",
+ "DnsForestName is NOT a dns name"
+};
static int
-netlogon_dissect_element_861_array(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_DC_FLAGS(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
{
- offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_element_861_byte);
+ guint32 mask;
+ proto_item *item = NULL;
+ proto_tree *tree = NULL;
+ dcerpc_info *di;
- return offset;
-}
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect */
+ return offset;
+ }
-static int
-netlogon_dissect_TYPE_51(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
-{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
+ offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
+ hf_netlogon_dc_flags, &mask);
if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_51:");
- tree = proto_item_add_subtree(item, ett_TYPE_51);
+ item = proto_tree_add_uint_format(parent_tree, hf_netlogon_dc_flags,
+ tvb, offset-4, 4, mask, "Domain Controller Flags: 0x%08x%s", mask, (mask==0x0000ffff)?" PING (mask==0x0000ffff)":"");
+ tree = proto_item_add_subtree(item, ett_dc_flags);
}
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_element_861_array, NDR_POINTER_UNIQUE,
- "unknown", hf_netlogon_unknown_string, 0);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_dns_forest_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_dns_domain_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_dns_controller_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_ndnc_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_good_timeserv_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_writable_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_closest_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_timeserv_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_kdc_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_ds_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_ldap_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_gc_flag,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_dc_flags_pdc_flag,
+ tvb, offset-4, 4, mask);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
+
+
static int
-netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_char, NULL);
+ dcerpc_info *di;
+ di=pinfo->private_data;
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ di->hf_index, NULL);
return offset;
}
static int
-netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
+netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_element_865_byte);
+ dcerpc_info *di;
+ di=pinfo->private_data;
+ offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
+ di->hf_index, NULL);
return offset;
}
static int
-netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
+netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_char, NULL);
}
static int
-netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
+netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_element_866_byte);
+ netlogon_dissect_UNICODE_MULTI_byte);
return offset;
}
static int
-netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
+netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_52:");
- tree = proto_item_add_subtree(item, ett_TYPE_52);
+ "UNICODE_MULTI:");
+ tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
}
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
- "unknown", hf_netlogon_unknown_string, 0);
+ hf_netlogon_len, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
- "unknown", hf_netlogon_unknown_string, 0);
+ netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_UNIQUE,
+ "unknown", hf_netlogon_unknown_string);
proto_item_set_len(item, offset-old_offset);
return offset;
}
-static int
-netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
+int
+dissect_nt_GUID(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
- char *drep)
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_52, NDR_POINTER_PTR,
- "TYPE_52 pointer: unknown_TYPE_52", -1, 0);
- return offset;
-}
+ offset=dissect_ndr_uuid_t(tvb, offset, pinfo, tree, drep, hf_netlogon_guid, NULL);
-static int
-netlogon_dissect_TYPE_52_ptr_ptr(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
- char *drep)
-{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_52_ptr, NDR_POINTER_PTR,
- "TYPE_52* pointer: unknown_TYPE_52", -1, 0);
return offset;
}
-
static int
-netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO(tvbuff_t *tvb, int offset,
+netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
- guint32 level;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "NETLOGON_CONTROL_QUERY_INFO:");
- tree = proto_item_add_subtree(item, ett_NETLOGON_CONTROL_QUERY_INFO);
+ "DOMAIN_CONTROLLER_INFO:");
+ tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
}
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level, &level);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "DC Name", hf_netlogon_dc_name, 0);
- ALIGN_TO_4_BYTES;
- switch(level){
- case 5:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
- break;
- case 6:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
- break;
- case 0xfffe:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
- break;
- case 8:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown", hf_netlogon_unknown_string, -1);
- break;
- }
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "DC Address", hf_netlogon_dc_address, 0);
- proto_item_set_len(item, offset-old_offset);
- return offset;
-}
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_dc_address_type, NULL);
+ offset = dissect_nt_GUID(tvb, offset,
+ pinfo, tree, drep);
-static int
-netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
-{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
- guint32 level;
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Logon Domain", hf_netlogon_logon_dom, 0);
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_44:");
- tree = proto_item_add_subtree(item, ett_TYPE_44);
- }
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "DNS Forest", hf_netlogon_dns_forest_name, 0);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level, &level);
+ offset = netlogon_dissect_DC_FLAGS(tvb, offset, pinfo, tree, drep);
- ALIGN_TO_4_BYTES;
- switch(level){
- case 1:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
- break;
- }
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "DC Site", hf_netlogon_dc_site_name, 0);
+
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Client Site",
+ hf_netlogon_client_site_name, 0);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
-netlogon_dissect_NETLOGON_INFO(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
- guint32 level;
+ guint32 len;
+ dcerpc_info *di;
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "NETLOGON_INFO:");
- tree = proto_item_add_subtree(item, ett_NETLOGON_INFO);
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect.*/
+ return offset;
}
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level, &level);
+ hf_netlogon_blob_size, &len);
- ALIGN_TO_4_BYTES;
- switch(level){
- case 1:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_PTR,
- "NETLOGON_INFO_1 pointer:", -1, 0);
- break;
- case 2:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_PTR,
- "NETLOGON_INFO_2 pointer:", -1, 0);
- break;
- case 3:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_PTR,
- "NETLOGON_INFO_3 pointer:", -1, 0);
- break;
- case 4:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_INFO_4, NDR_POINTER_PTR,
- "NETLOGON_INFO_4 pointer:", -1, 0);
- break;
- }
+ proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
+ FALSE);
+ offset += len;
- proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
-netlogon_dissect_TYPE_45(tvbuff_t *tvb, int offset,
+netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
- int old_offset=offset;
- guint32 level;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_45:");
- tree = proto_item_add_subtree(item, ett_TYPE_45);
+ "BLOB:");
+ tree = proto_item_add_subtree(item, ett_BLOB);
}
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level, &level);
+ hf_netlogon_blob_size, NULL);
- ALIGN_TO_4_BYTES;
- switch(level){
- case 1:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
- "TYPE_46 pointer:", -1, 0);
- break;
- case 2:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
- "TYPE_46 pointer:", -1, 0);
- break;
- }
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_BLOB_array, NDR_POINTER_UNIQUE,
+ "BLOB:", -1);
- proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
-netlogon_dissect_TYPE_47(tvbuff_t *tvb, int offset,
+netlogon_dissect_DOMAIN_TRUST_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree,
- char *drep)
+ guint8 *drep)
{
proto_item *item=NULL;
proto_tree *tree=NULL;
int old_offset=offset;
- guint32 level;
if(parent_tree){
item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "TYPE_47:");
- tree = proto_item_add_subtree(item, ett_TYPE_47);
- }
-
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level, &level);
-
- ALIGN_TO_4_BYTES;
- switch(level){
- case 1:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_48, NDR_POINTER_PTR,
- "TYPE_48 pointer:", -1, 0);
- break;
- case 2:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_UNICODE_MULTI, NDR_POINTER_PTR,
- "UNICODE_MULTI pointer:", -1, 0);
- break;
+ "DOMAIN_TRUST_INFO:");
+ tree = proto_item_add_subtree(item, ett_DOMAIN_TRUST_INFO);
}
- proto_item_set_len(item, offset-old_offset);
- return offset;
-}
+ offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvb, offset, pinfo, tree, drep);
-static int
-netlogon_dissect_netlogonaccountdeltas_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
-{
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
+ /* Guesses at best. */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_36, NDR_POINTER_REF,
- "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
+
+ proto_item_set_len(item, offset-old_offset);
return offset;
}
+static int
+netlogon_dissect_DOMAIN_TRUST_INFO_ARRAY(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
+{
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DOMAIN_TRUST_INFO);
+
+ return offset;
+}
static int
-netlogon_dissect_netlogonaccountdeltas_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_DOMAIN_QUERY_1(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ offset = netlogon_dissect_BLOB(tvb, offset,
+ pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_array, NDR_POINTER_REF,
- "BYTE_array pointer: unknown_BYTE", -1, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Workstation FQDN",
+ hf_netlogon_workstation_fqdn, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Workstation Site",
+ hf_netlogon_workstation_site_name, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown", hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_36, NDR_POINTER_REF,
- "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown", hf_netlogon_unknown_string, 0);
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown", hf_netlogon_unknown_string, 0);
- return offset;
-}
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown", hf_netlogon_unknown_string, 0);
-static int
-netlogon_dissect_netlogonaccountsync_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
-{
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_workstation_os, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
return offset;
}
-
static int
-netlogon_dissect_netlogonaccountsync_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_DOMAIN_INFO_1(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_array, NDR_POINTER_REF,
- "BYTE_array pointer: unknown_BYTE", -1, 0);
+ offset = netlogon_dissect_DOMAIN_TRUST_INFO(tvb, offset, pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_num_trusts, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_36, NDR_POINTER_REF,
- "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DOMAIN_TRUST_INFO_ARRAY, NDR_POINTER_UNIQUE,
+ "DOMAIN_TRUST_ARRAY: Trusts", -1);
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_num_trusts, NULL);
- return offset;
-}
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DOMAIN_TRUST_INFO_ARRAY, NDR_POINTER_UNIQUE,
+ "DOMAIN_TRUST_ARRAY:", -1);
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_dns_domain_name, 0);
-static int
-netlogon_dissect_netlogongetdcname_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
-{
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
- "WCHAR* pointer: unknown string", -1, 0);
- return offset;
-}
+ /* These four integers appear to mirror the last four in the query. */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
-static int
-netlogon_dissect_netlogongetdcname_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
-{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
- "WCHAR* pointer: unknown string", -1, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
return offset;
}
+
static int
-netlogon_dissect_netlogoncontrol_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
+ guint32 level;
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_code, NULL);
+ hf_netlogon_level, &level);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level, NULL);
+ ALIGN_TO_4_BYTES;
+ switch(level){
+ case 1:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DOMAIN_INFO_1, NDR_POINTER_UNIQUE,
+ "DOMAIN_INFO_1:", -1);
+ break;
+ }
return offset;
}
-
static int
-netlogon_dissect_netlogoncontrol_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree,
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
- "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+ int i;
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+ "UNICODE_STRING_512:");
+ tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
+ }
+
+ for(i=0;i<512;i++){
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_short, NULL);
+ }
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
+ proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
-netlogon_dissect_netlogongetanydcname_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_char, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
- "WCHAR* pointer: unknown string", -1, 0);
return offset;
}
-
static int
-netlogon_dissect_netlogongetanydcname_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
- "WCHAR* pointer: unknown string", -1, 0);
-
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_element_844_byte);
return offset;
}
static int
-netlogon_dissect_netlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree,
+ guint8 *drep)
{
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_code, NULL);
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+ "TYPE_50:");
+ tree = proto_item_add_subtree(item, ett_TYPE_50);
+ }
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level, NULL);
+ hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
- "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
+ netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
+ "unknown", hf_netlogon_unknown_string);
+ proto_item_set_len(item, offset-old_offset);
return offset;
}
-
static int
-netlogon_dissect_netlogoncontrol2_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
- "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
-
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+ netlogon_dissect_TYPE_50, NDR_POINTER_UNIQUE,
+ "TYPE_50 pointer: unknown_TYPE_50", -1);
return offset;
}
static int
-netlogon_dissect_netserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_DS_DOMAIN_TRUSTS(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
{
- if (check_col(pinfo->cinfo, COL_INFO))
- col_set_str(pinfo->cinfo, COL_INFO, "Auth2 request");
-
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "User Name", hf_netlogon_acct_name, 0);
+ guint32 tmp;
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
- offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
- pinfo, tree, drep);
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+ "DS_DOMAIN_TRUSTS");
+ tree = proto_item_add_subtree(item, ett_DS_DOMAIN_TRUSTS);
+ }
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
- "Computer Name", hf_netlogon_computer_name, 0);
+ /* name */
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "NetBIOS Name",
+ hf_netlogon_downlevel_domain_name, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
- "CREDENTIAL pointer: client_chal", -1, 0);
+ /* domain */
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "DNS Domain Name",
+ hf_netlogon_dns_domain_name, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
- return offset;
-}
+ offset = netlogon_dissect_DOMAIN_TRUST_FLAGS(tvb, offset, pinfo, tree, drep);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_trust_parent_index, &tmp);
-static int
-netlogon_dissect_netserverauthenticate2_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
-{
- if (check_col(pinfo->cinfo, COL_INFO))
- col_set_str(pinfo->cinfo, COL_INFO, "Auth2 response");
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_trust_type, &tmp);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
- "CREDENTIAL pointer: server_chal", -1, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_trust_attribs, &tmp);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
+ /* SID pointer */
+ offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep, -1);
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+ /* GUID */
+ offset = dissect_nt_GUID(tvb, offset, pinfo, tree, drep);
+ proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
-netlogon_dissect_netdatabasesync2_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
-
- offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DS_DOMAIN_TRUSTS);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ return offset;
+}
- offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_short, NULL);
+static int
+netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
+{
+ offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_char, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ return offset;
+}
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+static int
+netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
+{
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_element_865_byte);
return offset;
}
-
static int
-netlogon_dissect_netdatabasesync2_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_REF,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_char, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
- "DELTA_ENUM_ARRAY: deltas", -1, 0);
+ return offset;
+}
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+static int
+netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
+{
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_element_866_byte);
return offset;
}
static int
-netlogon_dissect_netlogondatabaseredo_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree,
+ guint8 *drep)
{
- offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
- offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+ "TYPE_52:");
+ tree = proto_item_add_subtree(item, ett_TYPE_52);
+ }
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
+ "unknown", hf_netlogon_unknown_string);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_array, NDR_POINTER_REF,
- "BYTE pointer: unknown_BYTE", -1, 0);
-
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
+ "unknown", hf_netlogon_unknown_string);
+ proto_item_set_len(item, offset-old_offset);
return offset;
}
-
static int
-netlogon_dissect_netlogondatabaseredo_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE,
- "DELTA_ENUM_ARRAY: deltas", -1, 0);
-
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
-
+ netlogon_dissect_TYPE_52, NDR_POINTER_UNIQUE,
+ "TYPE_52 pointer: unknown_TYPE_52", -1);
return offset;
}
+
static int
-netlogon_dissect_function_12_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree,
+ guint8 *drep)
{
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+ guint32 level;
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+ "TYPE_44:");
+ tree = proto_item_add_subtree(item, ett_TYPE_44);
+ }
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_level, NULL);
+ hf_netlogon_level, &level);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
- "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
+ ALIGN_TO_4_BYTES;
+ switch(level){
+ case 1:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_unknown_long, NULL);
+ break;
+ }
+ proto_item_set_len(item, offset-old_offset);
return offset;
}
-
static int
-netlogon_dissect_function_12_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_DOMAIN_QUERY(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
- "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
+ guint32 level;
- offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
- hf_netlogon_rc, NULL);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_level, &level);
+
+ ALIGN_TO_4_BYTES;
+ switch(level){
+ case 1:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DOMAIN_QUERY_1, NDR_POINTER_UNIQUE,
+ "DOMAIN_QUERY_1:", -1);
+ break;
+ case 2:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DOMAIN_QUERY_1, NDR_POINTER_UNIQUE,
+ "DOMAIN_QUERY_1:", -1);
+ break;
+ }
return offset;
}
static int
-netlogon_dissect_nettrusteddomainlist_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
static int
-netlogon_dissect_nettrusteddomainlist_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF,
- "UNICODE_MULTI pointer: trust_dom_name_list", -1, 0);
+ "UNICODE_MULTI pointer: trust_dom_name_list", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_dsrgetdcname2_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Domain", hf_netlogon_logon_dom, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_nt_GUID, NDR_POINTER_UNIQUE,
- "GUID pointer: domain_guid", -1, 0);
+ "GUID pointer: domain_guid", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_nt_GUID, NDR_POINTER_UNIQUE,
- "GUID pointer: site_guid", -1, 0);
+ "GUID pointer: site_guid", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_flags, NULL);
static int
-netlogon_dissect_dsrgetdcname2_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
- "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
+ netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
+ "DOMAIN_CONTROLLER_INFO:", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_15_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogondummyroutine1_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_PTR,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
static int
-netlogon_dissect_function_15_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogondummyroutine1_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_PTR,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_44, NDR_POINTER_PTR,
- "TYPE_44 pointer: unknown_TYPE_44", -1, 0);
+ netlogon_dissect_TYPE_44, NDR_POINTER_UNIQUE,
+ "TYPE_44 pointer: unknown_TYPE_44", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_16_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsetservicebits_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
static int
-netlogon_dissect_function_16_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsetservicebits_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
return offset;
}
+
static int
-netlogon_dissect_function_17_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogongettrustrid_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
return offset;
}
static int
-netlogon_dissect_function_17_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogongettrustrid_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_PTR,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
+ "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
return offset;
}
+
static int
-netlogon_dissect_function_18_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogoncomputeserverdigest_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
- "BYTE pointer: unknown_BYTE", -1, 0);
+ netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
+ "BYTE pointer: unknown_BYTE", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
static int
netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
int i;
}
static int
-netlogon_dissect_function_18_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogoncomputeserverdigest_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
- "BYTE pointer: unknown_BYTE", -1, 0);
+ netlogon_dissect_BYTE_16_array, NDR_POINTER_UNIQUE,
+ "BYTE pointer: unknown_BYTE", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_19_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogoncomputeclientdigest_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
- "BYTE pointer: unknown_BYTE", -1, 0);
+ netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
+ "BYTE pointer: unknown_BYTE", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
static int
-netlogon_dissect_function_19_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogoncomputeclientdigest_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
- "BYTE pointer: unknown_BYTE", -1, 0);
+ netlogon_dissect_BYTE_16_array, NDR_POINTER_UNIQUE,
+ "BYTE pointer: unknown_BYTE", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_netserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Acct Name", hf_netlogon_acct_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Acct Name", hf_netlogon_acct_name, 0);
offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
- "CREDENTIAL pointer: authenticator", -1, 0);
+ "CREDENTIAL: authenticator", -1);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_PTR,
- "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_neg_flags, NULL);
return offset;
}
static int
-netlogon_dissect_netserverauthenticate3_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverauthenticate3_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_CREDENTIAL, NDR_POINTER_REF,
- "CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1, 0);
+ "CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_PTR,
- "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_neg_flags, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_PTR,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ netlogon_dissect_pointer_long, NDR_POINTER_REF,
+ "ULONG: unknown_ULONG", hf_netlogon_unknown_long);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsrgetdcnameex_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Domain", hf_netlogon_logon_dom, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_nt_GUID, NDR_POINTER_UNIQUE,
- "GUID pointer: domain_guid", -1, 0);
+ "GUID pointer: domain_guid", -1);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Site Name", hf_netlogon_site_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Site Name", hf_netlogon_site_name, 0);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_flags, NULL);
+ offset = netlogon_dissect_GET_DCNAME_REQUEST_FLAGS(tvb, offset, pinfo, tree, drep);
return offset;
}
static int
-netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsrgetdcnameex_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
- "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
+ netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
+ "DOMAIN_CONTROLLER_INFO:", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
static int
netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
static int
netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- NDR_POINTER_REF, hf_netlogon_site_name, 0);
+ /* XXX hmmm this does not really look like a UNIQUE pointer but
+ will do for now. I think it is really a 32bit integer followed by
+ a REF pointer to a unicode string */
+ offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, drep,
+ dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Site Name",
+ hf_netlogon_site_name, cb_wstr_postprocess,
+ GINT_TO_POINTER(CB_STR_COL_INFO | 1));
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_1d_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogongetdomaininfo_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
- pinfo, tree, drep);
+ /* Unlike the other NETLOGON RPCs, this is not a unique pointer. */
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "Server Handle", hf_netlogon_computer_name, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Computer Name",
+ hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
-
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_PTR,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
- offset = netlogon_dissect_TYPE_45(tvb, offset,
- pinfo, tree, drep);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DOMAIN_QUERY, NDR_POINTER_REF,
+ "DOMAIN_QUERY: ", -1);
return offset;
}
static int
-netlogon_dissect_function_1d_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogongetdomaininfo_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_PTR,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_47, NDR_POINTER_PTR,
- "TYPE_47 pointer: unknown_TYPE_47", -1, 0);
+ netlogon_dissect_DOMAIN_INFO, NDR_POINTER_REF,
+ "DOMAIN_INFO: ", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_1e_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_short, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset,
pinfo, tree, drep);
static int
-netlogon_dissect_function_1e_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverpasswordset2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_PTR,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_netserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverpasswordget_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Acct Name", hf_netlogon_acct_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Acct Name", hf_netlogon_acct_name, 0);
offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Computer Name", hf_netlogon_computer_name, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Computer Name",
+ hf_netlogon_computer_name, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
return offset;
}
static int
-netlogon_dissect_netserverpasswordset2_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrserverpasswordget_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF,
- "LM_OWF_PASSWORD pointer: server_pwd", -1, 0);
+ "LM_OWF_PASSWORD pointer: server_pwd", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_20_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsendtosam_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown string", hf_netlogon_unknown_string, -1);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF,
- "AUTHENTICATOR: credential", -1, 0);
+ "AUTHENTICATOR: credential", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
- "BYTE pointer: unknown_BYTE", -1, 0);
+ netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
+ "BYTE pointer: unknown_BYTE", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
static int
-netlogon_dissect_function_20_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsendtosam_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_AUTHENTICATOR, NDR_POINTER_PTR,
- "AUTHENTICATOR: return_authenticator", -1, 0);
+ netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE,
+ "AUTHENTICATOR: return_authenticator", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_21_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsraddresstositenamesw_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
- "BYTE pointer: unknown_BYTE", -1, 0);
+ netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
+ "BYTE pointer: unknown_BYTE", -1);
return offset;
}
static int
-netlogon_dissect_function_21_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsraddresstositenamesw_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
- "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
+ netlogon_dissect_TYPE_50_ptr, NDR_POINTER_UNIQUE,
+ "TYPE_50** pointer: unknown_TYPE_50", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_22_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsrgetdcnameex2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_nt_GUID, NDR_POINTER_UNIQUE,
- "GUID pointer: unknown_GUID", -1, 0);
+ "GUID pointer: unknown_GUID", -1);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_long, NULL);
static int
-netlogon_dissect_function_22_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsrgetdcnameex2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr, NDR_POINTER_REF,
- "DOMAIN_CONTROLLER_INFO** pointer: unknown_DOMAIN_CONTROLLER_INFO", -1, 0);
+ netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE,
+ "DOMAIN_CONTROLLER_INFO:", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_23_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogongettimeserviceparentdomain_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
static int
-netlogon_dissect_function_23_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogongettimeserviceparentdomain_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "unknown string", hf_netlogon_unknown_string, -1);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_PTR,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
+ "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_24_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
return offset;
}
-
static int
-netlogon_dissect_function_24_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_entries, NULL);
+
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
- "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
+ netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY, NDR_POINTER_UNIQUE,
+ "DS_DOMAIN_TRUSTS_ARRAY:", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_25_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsraddresstositenamesexw_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
hf_netlogon_unknown_long, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
- "BYTE pointer: unknown_BYTE", -1, 0);
+ netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE,
+ "BYTE pointer: unknown_BYTE", -1);
return offset;
}
static int
-netlogon_dissect_function_25_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsraddresstositenamesexw_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_52_ptr_ptr, NDR_POINTER_REF,
- "TYPE_52** pointer: unknown_TYPE_52", -1, 0);
+ netlogon_dissect_TYPE_52_ptr, NDR_POINTER_UNIQUE,
+ "TYPE_52 pointer: unknown_TYPE_52", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
static int
-netlogon_dissect_function_26_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_site_name_item(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_counted_string_cb(
+ tvb, offset, pinfo, tree, drep, hf_netlogon_site_name,
+ cb_wstr_postprocess,
+ GINT_TO_POINTER(CB_STR_COL_INFO | 1));
return offset;
}
+static int
+netlogon_dissect_site_name_array(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_site_name_item);
+ return offset;
+}
static int
-netlogon_dissect_function_26_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_site_names(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
- "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_count, NULL);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_site_name_array, NDR_POINTER_UNIQUE,
+ "Site name array", -1);
+
+ return offset;
+}
+
+static int
+netlogon_dissect_dsrgetdcsitecoveragew_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+ offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ return offset;
+}
+
+
+static int
+netlogon_dissect_dsrgetdcsitecoveragew_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_site_names, NDR_POINTER_UNIQUE,
+ "Site names", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
}
static int
-netlogon_dissect_function_27_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsamlogonex_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "unknown string", hf_netlogon_unknown_string, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "unknown string",
+ hf_netlogon_unknown_string, 0);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_short, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_LEVEL, NDR_POINTER_PTR,
- "LEVEL pointer: unknown_NETLOGON_LEVEL", -1, 0);
+ netlogon_dissect_LEVEL, NDR_POINTER_UNIQUE,
+ "LEVEL pointer: unknown_NETLOGON_LEVEL", -1);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_netlogon_unknown_short, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_PTR,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
+ "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long);
return offset;
}
static int
-netlogon_dissect_function_27_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_netrlogonsamlogonex_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_VALIDATION, NDR_POINTER_PTR,
- "VALIDATION: unknown_NETLOGON_VALIDATION", -1, 0);
+ netlogon_dissect_VALIDATION, NDR_POINTER_UNIQUE,
+ "VALIDATION: unknown_NETLOGON_VALIDATION", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_char, NDR_POINTER_PTR,
- "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char, 0);
+ netlogon_dissect_pointer_char, NDR_POINTER_UNIQUE,
+ "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_pointer_long, NDR_POINTER_PTR,
- "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
+ netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE,
+ "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
return offset;
}
+
static int
-netlogon_dissect_dsrrolegetprimarydomaininformation_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsrenumeratedomaintrusts_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_unknown_long, NULL);
+ offset = netlogon_dissect_DOMAIN_TRUST_FLAGS(tvb, offset, pinfo, tree, drep);
return offset;
}
static int
-netlogon_dissect_dsrrolegetprimarydomaininformation_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+netlogon_dissect_dsrenumeratedomaintrusts_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_entries, NULL);
+
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
- "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
+ netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY, NDR_POINTER_UNIQUE,
+ "DS_DOMAIN_TRUSTS_ARRAY:", -1);
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
static int
netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
pinfo, tree, drep);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Domain", hf_netlogon_logon_dom, 0);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_nt_GUID, NDR_POINTER_UNIQUE,
- "GUID pointer: domain_guid", -1, 0);
+ "GUID pointer: domain_guid", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_nt_GUID, NDR_POINTER_UNIQUE,
- "GUID pointer: dsa_guid", -1, 0);
+ "GUID pointer: dsa_guid", -1);
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
- "dns_host", hf_netlogon_dns_host, -1);
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, drep,
+ NDR_POINTER_REF, "dns_host", hf_netlogon_dns_host, 0);
return offset;
}
static int
netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree, char *drep)
+ packet_info *pinfo, proto_tree *tree, guint8 *drep)
{
offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
hf_netlogon_rc, NULL);
return offset;
}
+/* Dissect secure channel stuff */
+
+static int hf_netlogon_secchan_bind_unknown1 = -1;
+static int hf_netlogon_secchan_bind_unknown2 = -1;
+static int hf_netlogon_secchan_domain = -1;
+static int hf_netlogon_secchan_host = -1;
+static int hf_netlogon_secchan_bind_ack_unknown1 = -1;
+static int hf_netlogon_secchan_bind_ack_unknown2 = -1;
+static int hf_netlogon_secchan_bind_ack_unknown3 = -1;
+
+static gint ett_secchan_verf = -1;
+static gint ett_secchan_bind_creds = -1;
+static gint ett_secchan_bind_ack_creds = -1;
+
+static int dissect_secchan_bind_creds(tvbuff_t *tvb, int offset,
+ packet_info *pinfo,
+ proto_tree *tree, guint8 *drep)
+{
+ proto_item *item = NULL;
+ proto_tree *subtree = NULL;
+ int len;
+
+ if (tree) {
+ item = proto_tree_add_text(
+ tree, tvb, offset, -1,
+ "Secure Channel Bind Credentials");
+ subtree = proto_item_add_subtree(
+ item, ett_secchan_bind_creds);
+ }
+
+ /* We can't use the NDR routines as the DCERPC call data hasn't
+ been initialised since we haven't made a DCERPC call yet, just
+ a bind request. */
+
+ offset = dissect_dcerpc_uint32(
+ tvb, offset, pinfo, subtree, drep,
+ hf_netlogon_secchan_bind_unknown1, NULL);
+
+ offset = dissect_dcerpc_uint32(
+ tvb, offset, pinfo, subtree, drep,
+ hf_netlogon_secchan_bind_unknown2, NULL);
+
+ len = tvb_strsize(tvb, offset);
+
+ proto_tree_add_item(
+ subtree, hf_netlogon_secchan_domain, tvb, offset, len, FALSE);
+
+ offset += len;
+
+ len = tvb_strsize(tvb, offset);
+
+ proto_tree_add_item(
+ subtree, hf_netlogon_secchan_host, tvb, offset, len, FALSE);
+
+ offset += len;
+
+ return offset;
+}
+
+static int dissect_secchan_bind_ack_creds(tvbuff_t *tvb, int offset,
+ packet_info *pinfo,
+ proto_tree *tree, guint8 *drep)
+{
+ proto_item *item = NULL;
+ proto_tree *subtree = NULL;
+
+ if (tree) {
+ item = proto_tree_add_text(
+ tree, tvb, offset, -1,
+ "Secure Channel Bind ACK Credentials");
+ subtree = proto_item_add_subtree(
+ item, ett_secchan_bind_ack_creds);
+ }
+
+ /* Don't use NDR routines here */
+
+ offset = dissect_dcerpc_uint32(
+ tvb, offset, pinfo, subtree, drep,
+ hf_netlogon_secchan_bind_ack_unknown1, NULL);
+
+ offset = dissect_dcerpc_uint32(
+ tvb, offset, pinfo, subtree, drep,
+ hf_netlogon_secchan_bind_ack_unknown2, NULL);
+ offset = dissect_dcerpc_uint32(
+ tvb, offset, pinfo, subtree, drep,
+ hf_netlogon_secchan_bind_ack_unknown3, NULL);
+
+ return offset;
+}
+
+/* Subdissectors */
static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = {
- { NETLOGON_UASLOGON, "UasLogon",
- netlogon_dissect_netlogonuaslogon_rqst,
- netlogon_dissect_netlogonuaslogon_reply },
- { NETLOGON_UASLOGOFF, "UasLogoff",
- netlogon_dissect_netlogonuaslogoff_rqst,
- netlogon_dissect_netlogonuaslogoff_reply },
- { NETLOGON_NETLOGONSAMLOGON, "SamLogon",
- netlogon_dissect_netlogonsamlogon_rqst,
- netlogon_dissect_netlogonsamlogon_reply },
- { NETLOGON_NETLOGONSAMLOGOFF, "SamLogoff",
- netlogon_dissect_netlogonsamlogoff_rqst,
- netlogon_dissect_netlogonsamlogoff_reply },
- { NETLOGON_NETSERVERREQCHALLENGE, "ServerReqChallenge",
- netlogon_dissect_netserverreqchallenge_rqst,
- netlogon_dissect_netserverreqchallenge_reply },
- { NETLOGON_NETSERVERAUTHENTICATE, "ServerAuthenticate",
- netlogon_dissect_netserverauthenticate_rqst,
- netlogon_dissect_netserverauthenticate_reply },
- { NETLOGON_NETSERVERPASSWORDSET, "ServerPasswdSet",
- netlogon_dissect_netserverpasswordset_rqst,
- netlogon_dissect_netserverpasswordset_reply },
- { NETLOGON_NETSAMDELTAS, "DatabaseDeltas",
- netlogon_dissect_netsamdeltas_rqst,
- netlogon_dissect_netsamdeltas_reply },
- { NETLOGON_DATABASESYNC, "DatabaseSync",
- netlogon_dissect_netlogondatabasesync_rqst,
- netlogon_dissect_netlogondatabasesync_reply },
- { NETLOGON_ACCOUNTDELTAS, "AccountDeltas",
- netlogon_dissect_netlogonaccountdeltas_rqst,
- netlogon_dissect_netlogonaccountdeltas_reply },
- { NETLOGON_ACCOUNTSYNC, "AccountSync",
- netlogon_dissect_netlogonaccountsync_rqst,
- netlogon_dissect_netlogonaccountsync_reply },
- { NETLOGON_GETDCNAME, "GetDCName",
- netlogon_dissect_netlogongetdcname_rqst,
- netlogon_dissect_netlogongetdcname_reply },
- { NETLOGON_NETLOGONCONTROL, "NETLOGONCONTROL",
- netlogon_dissect_netlogoncontrol_rqst,
- netlogon_dissect_netlogoncontrol_reply },
- { NETLOGON_GETANYDCNAME, "GetAnyDCName",
- netlogon_dissect_netlogongetanydcname_rqst,
- netlogon_dissect_netlogongetanydcname_reply },
- { NETLOGON_NETLOGONCONTROL2, "NETLOGONCONTROL2",
- netlogon_dissect_netlogoncontrol2_rqst,
- netlogon_dissect_netlogoncontrol2_reply },
- { NETLOGON_NETSERVERAUTHENTICATE2, "NETSERVERAUTHENTICATE2",
- netlogon_dissect_netserverauthenticate2_rqst,
- netlogon_dissect_netserverauthenticate2_reply },
- { NETLOGON_NETDATABASESYNC2, "NETDATABASESYNC2",
- netlogon_dissect_netdatabasesync2_rqst,
- netlogon_dissect_netdatabasesync2_reply },
- { NETLOGON_DATABASEREDO, "DatabaseRedo",
- netlogon_dissect_netlogondatabaseredo_rqst,
- netlogon_dissect_netlogondatabaseredo_reply },
- { NETLOGON_FUNCTION_12, "FUNCTION_12",
- netlogon_dissect_function_12_rqst,
- netlogon_dissect_function_12_reply },
- { NETLOGON_NETTRUSTEDDOMAINLIST, "NETTRUSTEDDOMAINLIST",
- netlogon_dissect_nettrusteddomainlist_rqst,
- netlogon_dissect_nettrusteddomainlist_reply },
- { NETLOGON_DSRGETDCNAME2, "DSRGETDCNAME2",
- netlogon_dissect_dsrgetdcname2_rqst,
- netlogon_dissect_dsrgetdcname2_reply },
- { NETLOGON_FUNCTION_15, "FUNCTION_15",
- netlogon_dissect_function_15_rqst,
- netlogon_dissect_function_15_reply },
- { NETLOGON_FUNCTION_16, "FUNCTION_16",
- netlogon_dissect_function_16_rqst,
- netlogon_dissect_function_16_reply },
- { NETLOGON_FUNCTION_17, "FUNCTION_17",
- netlogon_dissect_function_17_rqst,
- netlogon_dissect_function_17_reply },
- { NETLOGON_FUNCTION_18, "FUNCTION_18",
- netlogon_dissect_function_18_rqst,
- netlogon_dissect_function_18_reply },
- { NETLOGON_FUNCTION_19, "FUNCTION_19",
- netlogon_dissect_function_19_rqst,
- netlogon_dissect_function_19_reply },
- { NETLOGON_NETSERVERAUTHENTICATE3, "NETSERVERAUTHENTICATE3",
- netlogon_dissect_netserverauthenticate3_rqst,
- netlogon_dissect_netserverauthenticate3_reply },
- { NETLOGON_DSRGETDCNAME, "DSRGETDCNAME",
+ { NETLOGON_NETRLOGONUASLOGON, "NetrLogonUasLogon",
+ netlogon_dissect_netrlogonuaslogon_rqst,
+ netlogon_dissect_netrlogonuaslogon_reply },
+ { NETLOGON_NETRLOGONUASLOGOFF, "NetrLogonUasLogoff",
+ netlogon_dissect_netrlogonuaslogoff_rqst,
+ netlogon_dissect_netrlogonuaslogoff_reply },
+ { NETLOGON_NETRLOGONSAMLOGON, "NetrLogonSamLogon",
+ netlogon_dissect_netrlogonsamlogon_rqst,
+ netlogon_dissect_netrlogonsamlogon_reply },
+ { NETLOGON_NETRLOGONSAMLOGOFF, "NetrLogonSamLogoff",
+ netlogon_dissect_netrlogonsamlogoff_rqst,
+ netlogon_dissect_netrlogonsamlogoff_reply },
+ { NETLOGON_NETRSERVERREQCHALLENGE, "NetrServerReqChallenge",
+ netlogon_dissect_netrserverreqchallenge_rqst,
+ netlogon_dissect_netrserverreqchallenge_reply },
+ { NETLOGON_NETRSERVERAUTHENTICATE, "NetrServerAuthenticate",
+ netlogon_dissect_netrserverauthenticate_rqst,
+ netlogon_dissect_netrserverauthenticate_reply },
+ { NETLOGON_NETRSERVERPASSWORDSET, "NetrServerPasswordSet",
+ netlogon_dissect_netrserverpasswordset_rqst,
+ netlogon_dissect_netrserverpasswordset_reply },
+ { NETLOGON_NETRDATABASEDELTAS, "NetrDatabaseDeltas",
+ netlogon_dissect_netrdatabasedeltas_rqst,
+ netlogon_dissect_netrdatabasedeltas_reply },
+ { NETLOGON_NETRDATABASESYNC, "NetrDatabaseSync",
+ netlogon_dissect_netrdatabasesync_rqst,
+ netlogon_dissect_netrdatabasesync_reply },
+ { NETLOGON_NETRACCOUNTDELTAS, "NetrAccountDeltas",
+ netlogon_dissect_netraccountdeltas_rqst,
+ netlogon_dissect_netraccountdeltas_reply },
+ { NETLOGON_NETRACCOUNTSYNC, "NetrAccountSync",
+ netlogon_dissect_netraccountsync_rqst,
+ netlogon_dissect_netraccountsync_reply },
+ { NETLOGON_NETRGETDCNAME, "NetrGetDCName",
+ netlogon_dissect_netrgetdcname_rqst,
+ netlogon_dissect_netrgetdcname_reply },
+ { NETLOGON_NETRLOGONCONTROL, "NetrLogonControl",
+ netlogon_dissect_netrlogoncontrol_rqst,
+ netlogon_dissect_netrlogoncontrol_reply },
+ { NETLOGON_NETRGETANYDCNAME, "NetrGetAnyDCName",
+ netlogon_dissect_netrgetanydcname_rqst,
+ netlogon_dissect_netrgetanydcname_reply },
+ { NETLOGON_NETRLOGONCONTROL2, "NetrLogonControl2",
+ netlogon_dissect_netrlogoncontrol2_rqst,
+ netlogon_dissect_netrlogoncontrol2_reply },
+ { NETLOGON_NETRSERVERAUTHENTICATE2, "NetrServerAuthenticate2",
+ netlogon_dissect_netrserverauthenticate2_rqst,
+ netlogon_dissect_netrserverauthenticate2_reply },
+ { NETLOGON_NETRDATABASESYNC2, "NetrDatabaseSync2",
+ netlogon_dissect_netrdatabasesync2_rqst,
+ netlogon_dissect_netrdatabasesync2_reply },
+ { NETLOGON_NETRDATABASEREDO, "NetrDatabaseRedo",
+ netlogon_dissect_netrdatabaseredo_rqst,
+ netlogon_dissect_netrdatabaseredo_reply },
+ { NETLOGON_NETRLOGONCONTROL2EX, "NetrLogonControl2Ex",
+ netlogon_dissect_netrlogoncontrol2ex_rqst,
+ netlogon_dissect_netrlogoncontrol2ex_reply },
+ { NETLOGON_NETRENUMERATETRUSTEDDOMAINS, "NetrEnumerateTrustedDomains",
+ netlogon_dissect_netrenumeratetrusteddomains_rqst,
+ netlogon_dissect_netrenumeratetrusteddomains_reply },
+ { NETLOGON_DSRGETDCNAME, "DsrGetDcName",
netlogon_dissect_dsrgetdcname_rqst,
netlogon_dissect_dsrgetdcname_reply },
- { NETLOGON_DSRGETSITENAME, "DSRGETSITENAME",
+ { NETLOGON_NETRLOGONDUMMYROUTINE1, "NetrLogonDummyRoutine1",
+ netlogon_dissect_netrlogondummyroutine1_rqst,
+ netlogon_dissect_netrlogondummyroutine1_reply },
+ { NETLOGON_NETRLOGONSETSERVICEBITS, "NetrLogonSetServiceBits",
+ netlogon_dissect_netrlogonsetservicebits_rqst,
+ netlogon_dissect_netrlogonsetservicebits_reply },
+ { NETLOGON_NETRLOGONGETTRUSTRID, "NetrLogonGetTrustRid",
+ netlogon_dissect_netrlogongettrustrid_rqst,
+ netlogon_dissect_netrlogongettrustrid_reply },
+ { NETLOGON_NETRLOGONCOMPUTESERVERDIGEST, "NetrLogonComputeServerDigest",
+ netlogon_dissect_netrlogoncomputeserverdigest_rqst,
+ netlogon_dissect_netrlogoncomputeserverdigest_reply },
+ { NETLOGON_NETRLOGONCOMPUTECLIENTDIGEST, "NetrLogonComputeClientDigest",
+ netlogon_dissect_netrlogoncomputeclientdigest_rqst,
+ netlogon_dissect_netrlogoncomputeclientdigest_reply },
+ { NETLOGON_NETRSERVERAUTHENTICATE3, "NetrServerAuthenticate3",
+ netlogon_dissect_netrserverauthenticate3_rqst,
+ netlogon_dissect_netrserverauthenticate3_reply },
+ { NETLOGON_DSRGETDCNAMEX, "DsrGetDcNameEx",
+ netlogon_dissect_dsrgetdcnameex_rqst,
+ netlogon_dissect_dsrgetdcnameex_reply },
+ { NETLOGON_DSRGETSITENAME, "DsrGetSiteName",
netlogon_dissect_dsrgetsitename_rqst,
netlogon_dissect_dsrgetsitename_reply },
- { NETLOGON_FUNCTION_1D, "FUNCTION_1D",
- netlogon_dissect_function_1d_rqst,
- netlogon_dissect_function_1d_reply },
- { NETLOGON_FUNCTION_1E, "FUNCTION_1E",
- netlogon_dissect_function_1e_rqst,
- netlogon_dissect_function_1e_reply },
- { NETLOGON_NETSERVERPASSWORDSET2, "NETSERVERPASSWORDSET2",
- netlogon_dissect_netserverpasswordset2_rqst,
- netlogon_dissect_netserverpasswordset2_reply },
- { NETLOGON_FUNCTION_20, "FUNCTION_20",
- netlogon_dissect_function_20_rqst,
- netlogon_dissect_function_20_reply },
- { NETLOGON_FUNCTION_21, "FUNCTION_21",
- netlogon_dissect_function_21_rqst,
- netlogon_dissect_function_21_reply },
- { NETLOGON_FUNCTION_22, "FUNCTION_22",
- netlogon_dissect_function_22_rqst,
- netlogon_dissect_function_22_reply },
- { NETLOGON_FUNCTION_23, "FUNCTION_23",
- netlogon_dissect_function_23_rqst,
- netlogon_dissect_function_23_reply },
- { NETLOGON_FUNCTION_24, "FUNCTION_24",
- netlogon_dissect_function_24_rqst,
- netlogon_dissect_function_24_reply },
- { NETLOGON_FUNCTION_25, "FUNCTION_25",
- netlogon_dissect_function_25_rqst,
- netlogon_dissect_function_25_reply },
- { NETLOGON_FUNCTION_26, "FUNCTION_26",
- netlogon_dissect_function_26_rqst,
- netlogon_dissect_function_26_reply },
- { NETLOGON_FUNCTION_27, "FUNCTION_27",
- netlogon_dissect_function_27_rqst,
- netlogon_dissect_function_27_reply },
- { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DSRROLEGETPRIMARYDOMAININFORMATION",
- netlogon_dissect_dsrrolegetprimarydomaininformation_rqst,
- netlogon_dissect_dsrrolegetprimarydomaininformation_reply },
- { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DSRDEREGISTERDNSHOSTRECORDS",
+ { NETLOGON_NETRLOGONGETDOMAININFO, "NetrLogonGetDomainInfo",
+ netlogon_dissect_netrlogongetdomaininfo_rqst,
+ netlogon_dissect_netrlogongetdomaininfo_reply },
+ { NETLOGON_NETRSERVERPASSWORDSET2, "NetrServerPasswordSet2",
+ netlogon_dissect_netrserverpasswordset2_rqst,
+ netlogon_dissect_netrserverpasswordset2_reply },
+ { NETLOGON_NETRSERVERPASSWORDGET, "NetrServerPasswordGet",
+ netlogon_dissect_netrserverpasswordget_rqst,
+ netlogon_dissect_netrserverpasswordget_reply },
+ { NETLOGON_NETRLOGONSENDTOSAM, "NetrLogonSendToSam",
+ netlogon_dissect_netrlogonsendtosam_rqst,
+ netlogon_dissect_netrlogonsendtosam_reply },
+ { NETLOGON_DSRADDRESSTOSITENAMESW, "DsrAddressToSiteNamesW",
+ netlogon_dissect_dsraddresstositenamesw_rqst,
+ netlogon_dissect_dsraddresstositenamesw_reply },
+ { NETLOGON_DSRGETDCNAMEEX2, "DsrGetDcNameEx2",
+ netlogon_dissect_dsrgetdcnameex2_rqst,
+ netlogon_dissect_dsrgetdcnameex2_reply },
+ { NETLOGON_NETRLOGONGETTIMESERVICEPARENTDOMAIN,
+ "NetrLogonGetTimeServiceParentDomain",
+ netlogon_dissect_netrlogongettimeserviceparentdomain_rqst,
+ netlogon_dissect_netrlogongettimeserviceparentdomain_reply },
+ { NETLOGON_NETRENUMERATETRUSTEDDOMAINSEX, "NetrEnumerateTrustedDomainsEx",
+ netlogon_dissect_netrenumeratetrusteddomainsex_rqst,
+ netlogon_dissect_netrenumeratetrusteddomainsex_reply },
+ { NETLOGON_DSRADDRESSTOSITENAMESEXW, "DsrAddressToSiteNamesExW",
+ netlogon_dissect_dsraddresstositenamesexw_rqst,
+ netlogon_dissect_dsraddresstositenamesexw_reply },
+ { NETLOGON_DSRGETDCSITECOVERAGEW, "DsrGetDcSiteCoverageW",
+ netlogon_dissect_dsrgetdcsitecoveragew_rqst,
+ netlogon_dissect_dsrgetdcsitecoveragew_reply },
+ { NETLOGON_NETRLOGONSAMLOGONEX, "NetrLogonSamLogonEx",
+ netlogon_dissect_netrlogonsamlogonex_rqst,
+ netlogon_dissect_netrlogonsamlogonex_reply },
+ { NETLOGON_DSRENUMERATEDOMAINTRUSTS, "DsrEnumerateDomainTrusts",
+ netlogon_dissect_dsrenumeratedomaintrusts_rqst,
+ netlogon_dissect_dsrenumeratedomaintrusts_reply },
+ { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DsrDeregisterDnsHostRecords",
netlogon_dissect_dsrderegisterdnshostrecords_rqst,
netlogon_dissect_dsrderegisterdnshostrecords_reply },
+ { NETLOGON_NETRSERVERTRUSTPASSWORDSGET, "NetrServerTrustPasswordsGet",
+ NULL, NULL },
+ { NETLOGON_DSRGETFORESTTRUSTINFORMATION, "DsrGetForestTrustInformation",
+ NULL, NULL },
+ { NETLOGON_NETRGETFORESTTRUSTINFORMATION, "NetrGetForestTrustInformation",
+ NULL, NULL },
+ { NETLOGON_NETRLOGONSAMLOGONWITHFLAGS, "NetrLogonSamLogonWithFlags",
+ NULL, NULL },
+ { NETLOGON_NETRSERVERGETTRUSTINFO, "NetrServerGetTrustInfo",
+ NULL, NULL },
{0, NULL, NULL, NULL }
};
-static const value_string netlogon_opnum_vals[] = {
- { NETLOGON_UASLOGON, "UasLogon" },
- { NETLOGON_UASLOGOFF, "UasLogoff" },
- { NETLOGON_NETLOGONSAMLOGON, "SamLogon" },
- { NETLOGON_NETLOGONSAMLOGOFF, "SamLogoff" },
- { NETLOGON_NETSERVERREQCHALLENGE, "ServerReqChallenge" },
- { NETLOGON_NETSERVERAUTHENTICATE, "ServerAuthenticate" },
- { NETLOGON_NETSERVERPASSWORDSET, "ServerPasswdSet" },
- { NETLOGON_NETSAMDELTAS, "DatabaseDeltas" },
- { NETLOGON_DATABASESYNC, "DatabaseSync" },
- { NETLOGON_ACCOUNTDELTAS, "AccountDeltas" },
- { NETLOGON_ACCOUNTSYNC, "AccountSync" },
- { NETLOGON_GETDCNAME, "GetDCName" },
- { NETLOGON_NETLOGONCONTROL, "NETLOGONCONTROL" },
- { NETLOGON_GETANYDCNAME, "GetAnyDCName" },
- { NETLOGON_NETLOGONCONTROL2, "NETLOGONCONTROL2" },
- { NETLOGON_NETSERVERAUTHENTICATE2, "NETSERVERAUTHENTICATE2" },
- { NETLOGON_NETDATABASESYNC2, "NETDATABASESYNC2" },
- { NETLOGON_DATABASEREDO, "DatabaseRedo" },
- { NETLOGON_FUNCTION_12, "FUNCTION_12" },
- { NETLOGON_NETTRUSTEDDOMAINLIST, "NETTRUSTEDDOMAINLIST" },
- { NETLOGON_DSRGETDCNAME2, "DSRGETDCNAME2" },
- { NETLOGON_FUNCTION_15, "FUNCTION_15" },
- { NETLOGON_FUNCTION_16, "FUNCTION_16" },
- { NETLOGON_FUNCTION_17, "FUNCTION_17" },
- { NETLOGON_FUNCTION_18, "FUNCTION_18" },
- { NETLOGON_FUNCTION_19, "FUNCTION_19" },
- { NETLOGON_NETSERVERAUTHENTICATE3, "NETSERVERAUTHENTICATE3" },
- { NETLOGON_DSRGETDCNAME, "DSRGETDCNAME" },
- { NETLOGON_DSRGETSITENAME, "DSRGETSITENAME" },
- { NETLOGON_FUNCTION_1D, "FUNCTION_1D" },
- { NETLOGON_FUNCTION_1E, "FUNCTION_1E" },
- { NETLOGON_NETSERVERPASSWORDSET2, "NETSERVERPASSWORDSET2" },
- { NETLOGON_FUNCTION_20, "FUNCTION_20" },
- { NETLOGON_FUNCTION_21, "FUNCTION_21" },
- { NETLOGON_FUNCTION_22, "FUNCTION_22" },
- { NETLOGON_FUNCTION_23, "FUNCTION_23" },
- { NETLOGON_FUNCTION_24, "FUNCTION_24" },
- { NETLOGON_FUNCTION_25, "FUNCTION_25" },
- { NETLOGON_FUNCTION_26, "FUNCTION_26" },
- { NETLOGON_FUNCTION_27, "FUNCTION_27" },
- { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DSRROLEGETPRIMARYDOMAININFORMATION" },
- { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DSRDEREGISTERDNSHOSTRECORDS" },
+static int hf_netlogon_secchan_verf = -1;
+static int hf_netlogon_secchan_verf_sig = -1;
+static int hf_netlogon_secchan_verf_unk = -1;
+static int hf_netlogon_secchan_verf_seq = -1;
+static int hf_netlogon_secchan_verf_nonce = -1;
+
+static int
+dissect_secchan_verf(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
+ proto_tree *tree, guint8 *drep _U_)
+{
+ proto_item *vf = NULL;
+ proto_tree *subtree = NULL;
+
+ /*
+ * Create a new tree, and split into 4 components ...
+ */
+ vf = proto_tree_add_item(tree, hf_netlogon_secchan_verf, tvb,
+ offset, -1, FALSE);
+ subtree = proto_item_add_subtree(vf, ett_secchan_verf);
+
+ proto_tree_add_item(subtree, hf_netlogon_secchan_verf_sig, tvb,
+ offset, 8, FALSE);
+ offset += 8;
+
+ proto_tree_add_item(subtree, hf_netlogon_secchan_verf_unk, tvb,
+ offset, 8, FALSE);
+ offset += 8;
+
+ proto_tree_add_item(subtree, hf_netlogon_secchan_verf_seq, tvb,
+ offset, 8, FALSE);
+ offset += 8;
+
+ /* In some cases the nonce isn't present although it isn't clear
+ why this is so. */
+
+ if (tvb_bytes_exist(tvb, offset, 8)) {
+ proto_tree_add_item(subtree, hf_netlogon_secchan_verf_nonce,
+ tvb, offset, 8, FALSE);
+ offset += 8;
+ }
+
+ return offset;
+}
+
+/* Secure channel types */
+
+static const value_string sec_chan_type_vals[] = {
+ { SEC_CHAN_WKSTA, "Workstation" },
+ { SEC_CHAN_DOMAIN, "Domain trust" },
+ { SEC_CHAN_BDC, "Backup domain controller" },
{ 0, NULL }
};
-void
+void
proto_register_dcerpc_netlogon(void)
{
static hf_register_info hf[] = {
{ &hf_netlogon_opnum,
{ "Operation", "netlogon.opnum", FT_UINT16, BASE_DEC,
- VALS(netlogon_opnum_vals), 0x0, "Operation", HFILL }},
+ NULL, 0x0, "Operation", HFILL }},
- { &hf_netlogon_rc, {
- "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
+ { &hf_netlogon_rc, {
+ "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
VALS(NT_errors), 0x0, "Netlogon return code", HFILL }},
- { &hf_netlogon_param_ctrl, {
- "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
+ { &hf_netlogon_param_ctrl, {
+ "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
NULL, 0x0, "Param ctrl", HFILL }},
- { &hf_netlogon_logon_id, {
- "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
+ { &hf_netlogon_logon_id, {
+ "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
NULL, 0x0, "Logon ID", HFILL }},
- { &hf_netlogon_modify_count, {
- "Modify Count", "netlogon.modify_count", FT_UINT64, BASE_DEC,
+ { &hf_netlogon_modify_count, {
+ "Modify Count", "netlogon.modify_count", FT_UINT64, BASE_DEC,
NULL, 0x0, "How many times the object has been modified", HFILL }},
- { &hf_netlogon_security_information, {
- "Security Information", "netlogon.security_information", FT_UINT32, BASE_DEC,
+ { &hf_netlogon_security_information, {
+ "Security Information", "netlogon.security_information", FT_UINT32, BASE_DEC,
NULL, 0x0, "Security Information", HFILL }},
- { &hf_netlogon_count, {
- "Count", "netlogon.count", FT_UINT16, BASE_DEC,
+ { &hf_netlogon_count, {
+ "Count", "netlogon.count", FT_UINT32, BASE_DEC,
+ NULL, 0x0, "", HFILL }},
+
+ { &hf_netlogon_entries, {
+ "Entries", "netlogon.entries", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
- { &hf_netlogon_credential, {
- "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
- NULL, 0x0, "Netlogon credential", HFILL }},
+ { &hf_netlogon_credential, {
+ "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
+ NULL, 0x0, "Netlogon Credential", HFILL }},
- { &hf_netlogon_challenge, {
- "Challenge", "netlogon.challenge", FT_BYTES, BASE_HEX,
+ { &hf_netlogon_challenge, {
+ "Challenge", "netlogon.challenge", FT_BYTES, BASE_HEX,
NULL, 0x0, "Netlogon challenge", HFILL }},
- { &hf_netlogon_lm_owf_password, {
- "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
+ { &hf_netlogon_lm_owf_password, {
+ "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
NULL, 0x0, "LanManager OWF Password", HFILL }},
- { &hf_netlogon_user_session_key, {
- "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
+ { &hf_netlogon_user_session_key, {
+ "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
NULL, 0x0, "User Session Key", HFILL }},
- { &hf_netlogon_encrypted_lm_owf_password, {
- "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
+ { &hf_netlogon_encrypted_lm_owf_password, {
+ "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }},
- { &hf_netlogon_nt_owf_password, {
- "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
+ { &hf_netlogon_nt_owf_password, {
+ "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
NULL, 0x0, "NT OWF Password", HFILL }},
- { &hf_netlogon_blob, {
- "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
+ { &hf_netlogon_blob, {
+ "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
NULL, 0x0, "BLOB", HFILL }},
{ &hf_netlogon_len, {
"Privilege Name", "netlogon.privilege_name", FT_STRING, BASE_HEX,
NULL, 0, "", HFILL }},
- { &hf_netlogon_status, {
- "Status", "netlogon.status", FT_UINT32, BASE_DEC,
- NULL, 0, "Status", HFILL }},
+ { &hf_netlogon_pdc_connection_status, {
+ "PDC Connection Status", "netlogon.pdc_connection_status", FT_UINT32, BASE_DEC,
+ NULL, 0, "PDC Connection Status", HFILL }},
+
+ { &hf_netlogon_tc_connection_status, {
+ "TC Connection Status", "netlogon.tc_connection_status", FT_UINT32, BASE_DEC,
+ NULL, 0, "TC Connection Status", HFILL }},
{ &hf_netlogon_attrs, {
"Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX,
{ "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE,
NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
{ &hf_netlogon_unknown_long,
- { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
+ { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
{ &hf_netlogon_reserved,
- { "Reserved", "netlogon.reserved", FT_UINT32, BASE_HEX,
+ { "Reserved", "netlogon.reserved", FT_UINT32, BASE_HEX,
NULL, 0x0, "Reserved", HFILL }},
{ &hf_netlogon_unknown_short,
- { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
+ { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
{ &hf_netlogon_unknown_char,
- { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
+ { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
- { &hf_netlogon_unknown_time,
- { "Unknown time", "netlogon.unknown.time", FT_ABSOLUTE_TIME, BASE_NONE,
- NULL, 0x0, "Unknown time. If you know what this is, contact ethereal developers.", HFILL }},
-
{ &hf_netlogon_acct_expiry_time,
- { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
+ { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
NULL, 0x0, "When this account will expire", HFILL }},
{ &hf_netlogon_nt_pwd_present,
- { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
+ { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
NULL, 0x0, "Is NT password present for this account?", HFILL }},
{ &hf_netlogon_lm_pwd_present,
- { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
+ { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
NULL, 0x0, "Is LanManager password present for this account?", HFILL }},
{ &hf_netlogon_pwd_expired,
- { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
+ { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
NULL, 0x0, "Whether this password has expired or not", HFILL }},
- { &hf_netlogon_num_pwd_pairs,
- { "Num PWD Pairs", "netlogon.num_pwd_pairs", FT_UINT8, BASE_DEC,
- NULL, 0x0, "Number of password pairs. Password history length?", HFILL }},
-
{ &hf_netlogon_authoritative,
- { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
+ { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_sensitive_data_flag,
- { "Sensitive Data", "netlogon.sensitive_data_flag", FT_UINT8, BASE_DEC,
+ { "Sensitive Data", "netlogon.sensitive_data_flag", FT_UINT8, BASE_DEC,
NULL, 0x0, "Sensitive data flag", HFILL }},
{ &hf_netlogon_auditing_mode,
- { "Auditing Mode", "netlogon.auditing_mode", FT_UINT8, BASE_DEC,
+ { "Auditing Mode", "netlogon.auditing_mode", FT_UINT8, BASE_DEC,
NULL, 0x0, "Auditing Mode", HFILL }},
{ &hf_netlogon_max_audit_event_count,
- { "Max Audit Event Count", "netlogon.max_audit_event_count", FT_UINT32, BASE_DEC,
+ { "Max Audit Event Count", "netlogon.max_audit_event_count", FT_UINT32, BASE_DEC,
NULL, 0x0, "Max audit event count", HFILL }},
{ &hf_netlogon_event_audit_option,
- { "Event Audit Option", "netlogon.event_audit_option", FT_UINT32, BASE_HEX,
+ { "Event Audit Option", "netlogon.event_audit_option", FT_UINT32, BASE_HEX,
NULL, 0x0, "Event audit option", HFILL }},
{ &hf_netlogon_sensitive_data_len,
- { "Length", "netlogon.sensitive_data_len", FT_UINT32, BASE_DEC,
+ { "Length", "netlogon.sensitive_data_len", FT_UINT32, BASE_DEC,
NULL, 0x0, "Length of sensitive data", HFILL }},
{ &hf_netlogon_nt_chal_resp,
{ "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
NULL, 0, "Domain", HFILL }},
+ { &hf_netlogon_resourcegroupdomainsid,
+ { "ResourceGroupDomainSID", "netlogon.resourcegroupdomainsid", FT_STRING, BASE_NONE,
+ NULL, 0, "Resource Group Domain SID", HFILL }},
+
+ { &hf_netlogon_resourcegroupcount,
+ { "ResourceGroup count", "netlogon.resourcegroupcount", FT_UINT32, BASE_DEC,
+ NULL, 0, "Number of Resource Groups", HFILL }},
+
{ &hf_netlogon_computer_name,
{ "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
NULL, 0, "Computer Name", HFILL }},
{ &hf_netlogon_dc_address_type,
{ "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC,
- NULL, 0, "DC Address Type", HFILL }},
-
- { &hf_netlogon_client_name,
- { "Client Name", "netlogon.client.name", FT_STRING, BASE_NONE,
- NULL, 0, "Client Name", HFILL }},
+ VALS(dc_address_types), 0, "DC Address Type", HFILL }},
{ &hf_netlogon_client_site_name,
{ "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE,
{ "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE,
NULL, 0, "DNS Host", HFILL }},
- { &hf_netlogon_trusted_domain_name,
- { "Trusted Domain", "netlogon.trusted_domain", FT_STRING, BASE_NONE,
- NULL, 0, "Trusted Domain Name", HFILL }},
+ { &hf_netlogon_downlevel_domain_name,
+ { "Downlevel Domain", "netlogon.downlevel_domain", FT_STRING, BASE_NONE,
+ NULL, 0, "Downlevel Domain Name", HFILL }},
+
+ { &hf_netlogon_dns_domain_name,
+ { "DNS Domain", "netlogon.dns_domain", FT_STRING, BASE_NONE,
+ NULL, 0, "DNS Domain Name", HFILL }},
{ &hf_netlogon_domain_name,
{ "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
NULL, 0, "Dummy string", HFILL }},
{ &hf_netlogon_logon_count16,
- { "Logon Count", "netlogon.logon_count16", FT_UINT16, BASE_DEC,
+ { "Logon Count", "netlogon.logon_count16", FT_UINT16, BASE_DEC,
NULL, 0x0, "Number of successful logins", HFILL }},
{ &hf_netlogon_logon_count,
- { "Logon Count", "netlogon.logon_count", FT_UINT32, BASE_DEC,
+ { "Logon Count", "netlogon.logon_count", FT_UINT32, BASE_DEC,
NULL, 0x0, "Number of successful logins", HFILL }},
- { &hf_netlogon_last_logon,
- { "Last Logon", "netlogon.last_logon", FT_UINT32, BASE_DEC,
- NULL, 0x0, "Last Logon", HFILL }},
-
- { &hf_netlogon_last_logoff,
- { "Last Logoff", "netlogon.last_logoff", FT_UINT32, BASE_DEC,
- NULL, 0x0, "Last Logoff", HFILL }},
-
{ &hf_netlogon_bad_pw_count16,
- { "Bad PW Count", "netlogon.bad_pw_count16", FT_UINT16, BASE_DEC,
+ { "Bad PW Count", "netlogon.bad_pw_count16", FT_UINT16, BASE_DEC,
NULL, 0x0, "Number of failed logins", HFILL }},
{ &hf_netlogon_bad_pw_count,
- { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT32, BASE_DEC,
+ { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT32, BASE_DEC,
NULL, 0x0, "Number of failed logins", HFILL }},
{ &hf_netlogon_country,
- { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
+ { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
VALS(ms_country_codes), 0x0, "Country setting for this account", HFILL }},
{ &hf_netlogon_codepage,
- { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
+ { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
NULL, 0x0, "Codepage setting for this account", HFILL }},
{ &hf_netlogon_level16,
- { "Level", "netlogon.level16", FT_UINT16, BASE_DEC,
+ { "Level", "netlogon.level16", FT_UINT16, BASE_DEC,
NULL, 0x0, "Which option of the union is represented here", HFILL }},
{ &hf_netlogon_validation_level,
- { "Validation Level", "netlogon.validation_level", FT_UINT16, BASE_DEC,
+ { "Validation Level", "netlogon.validation_level", FT_UINT16, BASE_DEC,
NULL, 0x0, "Requested level of validation", HFILL }},
{ &hf_netlogon_minpasswdlen,
- { "Min Password Len", "netlogon.min_passwd_len", FT_UINT16, BASE_DEC,
+ { "Min Password Len", "netlogon.min_passwd_len", FT_UINT16, BASE_DEC,
NULL, 0x0, "Minimum length of password", HFILL }},
{ &hf_netlogon_passwdhistorylen,
- { "Passwd History Len", "netlogon.passwd_history_len", FT_UINT16, BASE_DEC,
+ { "Passwd History Len", "netlogon.passwd_history_len", FT_UINT16, BASE_DEC,
NULL, 0x0, "Length of password history", HFILL }},
{ &hf_netlogon_secure_channel_type,
- { "Sec Chn Type", "netlogon.sec_chn_type", FT_UINT16, BASE_DEC,
- NULL, 0x0, "Secure Channel Type", HFILL }},
+ { "Sec Chan Type", "netlogon.sec_chan_type", FT_UINT16, BASE_DEC,
+ VALS(sec_chan_type_vals), 0x0, "Secure Channel Type", HFILL }},
+
+ { &hf_netlogon_restart_state,
+ { "Restart State", "netlogon.restart_state", FT_UINT16, BASE_DEC,
+ NULL, 0x0, "Restart State", HFILL }},
{ &hf_netlogon_delta_type,
- { "Delta Type", "netlogon.delta_type", FT_UINT16, BASE_DEC,
+ { "Delta Type", "netlogon.delta_type", FT_UINT16, BASE_DEC,
VALS(delta_type_vals), 0x0, "Delta Type", HFILL }},
{ &hf_netlogon_blob_size,
- { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
+ { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size in bytes of BLOB", HFILL }},
{ &hf_netlogon_code,
- { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
+ { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
NULL, 0x0, "Code", HFILL }},
{ &hf_netlogon_level,
- { "Level", "netlogon.level", FT_UINT32, BASE_DEC,
+ { "Level", "netlogon.level", FT_UINT32, BASE_DEC,
NULL, 0x0, "Which option of the union is represented here", HFILL }},
+ { &hf_netlogon_reference,
+ { "Reference", "netlogon.reference", FT_UINT32, BASE_DEC,
+ NULL, 0x0, "", HFILL }},
+
+ { &hf_netlogon_next_reference,
+ { "Next Reference", "netlogon.next_reference", FT_UINT32, BASE_DEC,
+ NULL, 0x0, "", HFILL }},
+
{ &hf_netlogon_timestamp,
- { "Timestamp", "netlogon.timestamp", FT_UINT32, BASE_HEX,
- NULL, 0x0, "Some sort of timestamp", HFILL }},
+ { "Timestamp", "netlogon.timestamp", FT_ABSOLUTE_TIME, BASE_NONE,
+ NULL, 0, "", HFILL }},
{ &hf_netlogon_user_rid,
- { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
+ { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_alias_rid,
- { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
+ { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_group_rid,
- { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
+ { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_num_rids,
- { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
+ { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
NULL, 0x0, "Number of RIDs", HFILL }},
{ &hf_netlogon_num_controllers,
- { "Num DCs", "netlogon.num_dc", FT_UINT32, BASE_DEC,
+ { "Num DCs", "netlogon.num_dc", FT_UINT32, BASE_DEC,
NULL, 0x0, "Number of domain controllers", HFILL }},
{ &hf_netlogon_num_other_groups,
- { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
+ { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_flags,
- { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
+ { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_user_flags,
- { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
+ { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_auth_flags,
- { "Auth Flags", "netlogon.auth_flags", FT_UINT32, BASE_HEX,
+ { "Auth Flags", "netlogon.auth_flags", FT_UINT32, BASE_HEX,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_systemflags,
- { "System Flags", "netlogon.system_flags", FT_UINT32, BASE_HEX,
+ { "System Flags", "netlogon.system_flags", FT_UINT32, BASE_HEX,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_database_id,
- { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
+ { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
NULL, 0x0, "Database Id", HFILL }},
{ &hf_netlogon_sync_context,
- { "Sync Context", "netlogon.sync_context", FT_UINT32, BASE_DEC,
+ { "Sync Context", "netlogon.sync_context", FT_UINT32, BASE_DEC,
NULL, 0x0, "Sync Context", HFILL }},
{ &hf_netlogon_max_size,
- { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
+ { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Max Size of database", HFILL }},
{ &hf_netlogon_max_log_size,
- { "Max Log Size", "netlogon.max_log_size", FT_UINT32, BASE_DEC,
+ { "Max Log Size", "netlogon.max_log_size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Max Size of log", HFILL }},
{ &hf_netlogon_pac_size,
- { "Pac Size", "netlogon.pac.size", FT_UINT32, BASE_DEC,
+ { "Pac Size", "netlogon.pac.size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of PacData in bytes", HFILL }},
{ &hf_netlogon_auth_size,
- { "Auth Size", "netlogon.auth.size", FT_UINT32, BASE_DEC,
+ { "Auth Size", "netlogon.auth.size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of AuthData in bytes", HFILL }},
{ &hf_netlogon_num_deltas,
- { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
+ { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
NULL, 0x0, "Number of SAM Deltas in array", HFILL }},
+ { &hf_netlogon_num_trusts,
+ { "Num Trusts", "netlogon.num_trusts", FT_UINT32, BASE_DEC,
+ NULL, 0x0, "", HFILL }},
+
{ &hf_netlogon_logon_attempts,
- { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
+ { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
NULL, 0x0, "Number of logon attempts", HFILL }},
{ &hf_netlogon_pagefilelimit,
- { "Page File Limit", "netlogon.page_file_limit", FT_UINT32, BASE_DEC,
+ { "Page File Limit", "netlogon.page_file_limit", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_pagedpoollimit,
- { "Paged Pool Limit", "netlogon.paged_pool_limit", FT_UINT32, BASE_DEC,
+ { "Paged Pool Limit", "netlogon.paged_pool_limit", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_nonpagedpoollimit,
- { "Non-Paged Pool Limit", "netlogon.nonpaged_pool_limit", FT_UINT32, BASE_DEC,
+ { "Non-Paged Pool Limit", "netlogon.nonpaged_pool_limit", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_minworkingsetsize,
- { "Min Working Set Size", "netlogon.min_working_set_size", FT_UINT32, BASE_DEC,
+ { "Min Working Set Size", "netlogon.min_working_set_size", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_netlogon_maxworkingsetsize,
- { "Max Working Set Size", "netlogon.max_working_set_size", FT_UINT32, BASE_DEC,
+ { "Max Working Set Size", "netlogon.max_working_set_size", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
+ { &hf_netlogon_serial_number,
+ { "Serial Number", "netlogon.serial_number", FT_UINT32, BASE_DEC,
+ NULL, 0x0, "", HFILL }},
+
+ { &hf_netlogon_neg_flags,
+ { "Neg Flags", "netlogon.neg_flags", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "Negotiation Flags", HFILL }},
+
+ { &hf_netlogon_dc_flags,
+ { "Flags", "netlogon.dc.flags", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "Domain Controller Flags", HFILL }},
+
+ { &hf_netlogon_dc_flags_pdc_flag,
+ { "PDC", "netlogon.dc.flags.pdc",
+ FT_BOOLEAN, 32, TFS(&dc_flags_pdc_flag), DS_PDC_FLAG,
+ "If this server is a PDC", HFILL }},
+
+ { &hf_netlogon_dc_flags_gc_flag,
+ { "GC", "netlogon.dc.flags.gc",
+ FT_BOOLEAN, 32, TFS(&dc_flags_gc_flag), DS_GC_FLAG,
+ "If this server is a GC", HFILL }},
+
+ { &hf_netlogon_dc_flags_ldap_flag,
+ { "LDAP", "netlogon.dc.flags.ldap",
+ FT_BOOLEAN, 32, TFS(&dc_flags_ldap_flag), DS_LDAP_FLAG,
+ "If this is an LDAP server", HFILL }},
+
+ { &hf_netlogon_dc_flags_ds_flag,
+ { "DS", "netlogon.dc.flags.ds",
+ FT_BOOLEAN, 32, TFS(&dc_flags_ds_flag), DS_DS_FLAG,
+ "If this server is a DS", HFILL }},
+
+ { &hf_netlogon_dc_flags_kdc_flag,
+ { "KDC", "netlogon.dc.flags.kdc",
+ FT_BOOLEAN, 32, TFS(&dc_flags_kdc_flag), DS_KDC_FLAG,
+ "If this is a KDC", HFILL }},
+
+ { &hf_netlogon_dc_flags_timeserv_flag,
+ { "Timeserv", "netlogon.dc.flags.timeserv",
+ FT_BOOLEAN, 32, TFS(&dc_flags_timeserv_flag), DS_TIMESERV_FLAG,
+ "If this server is a TimeServer", HFILL }},
+
+ { &hf_netlogon_dc_flags_closest_flag,
+ { "Closest", "netlogon.dc.flags.closest",
+ FT_BOOLEAN, 32, TFS(&dc_flags_closest_flag), DS_CLOSEST_FLAG,
+ "If this is the closest server", HFILL }},
+
+ { &hf_netlogon_dc_flags_writable_flag,
+ { "Writable", "netlogon.dc.flags.writable",
+ FT_BOOLEAN, 32, TFS(&dc_flags_writable_flag), DS_WRITABLE_FLAG,
+ "If this server can do updates to the database", HFILL }},
+
+ { &hf_netlogon_dc_flags_good_timeserv_flag,
+ { "Good Timeserv", "netlogon.dc.flags.good_timeserv",
+ FT_BOOLEAN, 32, TFS(&dc_flags_good_timeserv_flag), DS_GOOD_TIMESERV_FLAG,
+ "If this is a Good TimeServer", HFILL }},
+
+ { &hf_netlogon_dc_flags_ndnc_flag,
+ { "NDNC", "netlogon.dc.flags.ndnc",
+ FT_BOOLEAN, 32, TFS(&dc_flags_ndnc_flag), DS_NDNC_FLAG,
+ "If this is an NDNC server", HFILL }},
+
+ { &hf_netlogon_dc_flags_dns_controller_flag,
+ { "DNS Controller", "netlogon.dc.flags.dns_controller",
+ FT_BOOLEAN, 32, TFS(&dc_flags_dns_controller_flag), DS_DNS_CONTROLLER_FLAG,
+ "If this server is a DNS Controller", HFILL }},
+
+ { &hf_netlogon_dc_flags_dns_domain_flag,
+ { "DNS Domain", "netlogon.dc.flags.dns_domain",
+ FT_BOOLEAN, 32, TFS(&dc_flags_dns_domain_flag), DS_DNS_DOMAIN_FLAG,
+ "", HFILL }},
+
+ { &hf_netlogon_dc_flags_dns_forest_flag,
+ { "DNS Forest", "netlogon.dc.flags.dns_forest",
+ FT_BOOLEAN, 32, TFS(&dc_flags_dns_forest_flag), DS_DNS_FOREST_FLAG,
+ "", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags,
+ { "Flags", "netlogon.get_dcname.request.flags", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "Flags for DSGetDCName request", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_force_rediscovery,
+ { "Force Rediscovery", "netlogon.get_dcname.request.flags.force_rediscovery",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_force_rediscovery), DS_FORCE_REDISCOVERY,
+ "Whether to allow the server to returned cached information or not", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_directory_service_required,
+ { "DS Required", "netlogon.get_dcname.request.flags.ds_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_required), DS_DIRECTORY_SERVICE_REQUIRED,
+ "Whether we require that the returned DC supports w2k or not", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_directory_service_preferred,
+ { "DS Preferred", "netlogon.get_dcname.request.flags.ds_preferred",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_preferred), DS_DIRECTORY_SERVICE_PREFERRED,
+ "Whether we prefer the call to return a w2k server (if available)", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_gc_server_required,
+ { "GC Required", "netlogon.get_dcname.request.flags.gc_server_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_gc_server_required), DS_GC_SERVER_REQUIRED,
+ "Whether we require that the returned DC is a Global Catalog server", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_pdc_required,
+ { "PDC Required", "netlogon.get_dcname.request.flags.pdc_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_pdc_required), DS_PDC_REQUIRED,
+ "Whether we require the returned DC to be the PDC", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_background_only,
+ { "Background Only", "netlogon.get_dcname.request.flags.background_only",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_background_only), DS_BACKGROUND_ONLY,
+ "If we want cached data, even if it may have expired", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_ip_required,
+ { "IP Required", "netlogon.get_dcname.request.flags.ip_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_ip_required), DS_IP_REQUIRED,
+ "If we requre the IP of the DC in the reply", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_kdc_required,
+ { "KDC Required", "netlogon.get_dcname.request.flags.kdc_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_kdc_required), DS_KDC_REQUIRED,
+ "If we require that the returned server is a KDC", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_timeserv_required,
+ { "Timeserv Required", "netlogon.get_dcname.request.flags.timeserv_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_timeserv_required), DS_TIMESERV_REQUIRED,
+ "If we require the retruned server to be a NTP serveruns WindowsTimeServicer", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_writable_required,
+ { "Writable Required", "netlogon.get_dcname.request.flags.writable_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_writable_required), DS_WRITABLE_REQUIRED,
+ "If we require that the return server is writable", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_good_timeserv_preferred,
+ { "Timeserv Preferred", "netlogon.get_dcname.request.flags.good_timeserv_preferred",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_good_timeserv_preferred), DS_GOOD_TIMESERV_PREFERRED,
+ "If we prefer Windows Time Servers", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_avoid_self,
+ { "Avoid Self", "netlogon.get_dcname.request.flags.avoid_self",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_avoid_self), DS_AVOID_SELF,
+ "Return another DC than the one we ask", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_only_ldap_needed,
+ { "Only LDAP Needed", "netlogon.get_dcname.request.flags.only_ldap_needed",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_only_ldap_needed), DS_ONLY_LDAP_NEEDED,
+ "We just want an LDAP server, it does not have to be a DC", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_is_flat_name,
+ { "Is Flat Name", "netlogon.get_dcname.request.flags.is_flat_name",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_flat_name), DS_IS_FLAT_NAME,
+ "If the specified domain name is a NetBIOS name", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_is_dns_name,
+ { "Is DNS Name", "netlogon.get_dcname.request.flags.is_dns_name",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_dns_name), DS_IS_DNS_NAME,
+ "If the specified domain name is a DNS name", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_return_dns_name,
+ { "Return DNS Name", "netlogon.get_dcname.request.flags.return_dns_name",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_dns_name), DS_RETURN_DNS_NAME,
+ "Only return a DNS name (or an error)", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_return_flat_name,
+ { "Return Flat Name", "netlogon.get_dcname.request.flags.return_flat_name",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_flat_name), DS_RETURN_FLAT_NAME,
+ "Only return a NetBIOS name (or an error)", HFILL }},
+
+ { &hf_netlogon_trust_attribs,
+ { "Trust Attributes", "netlogon.trust_attribs", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "Trust Attributes", HFILL }},
+
+ { &hf_netlogon_trust_type,
+ { "Trust Type", "netlogon.trust_type", FT_UINT32, BASE_DEC,
+ VALS(trust_type_vals), 0x0, "Trust Type", HFILL }},
+
+ { &hf_netlogon_trust_flags,
+ { "Trust Flags", "netlogon.trust_flags", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "Trust Flags", HFILL }},
+
+ { &hf_netlogon_trust_flags_inbound,
+ { "Inbound Trust", "netlogon.trust.flags.inbound",
+ FT_BOOLEAN, 32, TFS(&trust_inbound), DS_DOMAIN_DIRECT_INBOUND,
+ "Inbound trust. Whether the domain directly trusts the queried servers domain", HFILL }},
+
+ { &hf_netlogon_trust_flags_outbound,
+ { "Outbound Trust", "netlogon.trust.flags.outbound",
+ FT_BOOLEAN, 32, TFS(&trust_outbound), DS_DOMAIN_DIRECT_OUTBOUND,
+ "Outbound Trust. Whether the domain is directly trusted by the servers domain", HFILL }},
+
+ { &hf_netlogon_trust_flags_in_forest,
+ { "In Forest", "netlogon.trust.flags.in_forest",
+ FT_BOOLEAN, 32, TFS(&trust_in_forest), DS_DOMAIN_IN_FOREST,
+ "Whether this domain is a member of the same forest as the servers domain", HFILL }},
+
+ { &hf_netlogon_trust_flags_native_mode,
+ { "Native Mode", "netlogon.trust.flags.native_mode",
+ FT_BOOLEAN, 32, TFS(&trust_native_mode), DS_DOMAIN_NATIVE_MODE,
+ "Whether the domain is a w2k native mode domain or not", HFILL }},
+
+ { &hf_netlogon_trust_flags_primary,
+ { "Primary", "netlogon.trust.flags.primary",
+ FT_BOOLEAN, 32, TFS(&trust_primary), DS_DOMAIN_PRIMARY,
+ "Whether the domain is the primary domain for the queried server or not", HFILL }},
+
+ { &hf_netlogon_trust_flags_tree_root,
+ { "Tree Root", "netlogon.trust.flags.tree_root",
+ FT_BOOLEAN, 32, TFS(&trust_tree_root), DS_DOMAIN_TREE_ROOT,
+ "Whether the domain is the root of the tree for the queried server", HFILL }},
+
+ { &hf_netlogon_trust_parent_index,
+ { "Parent Index", "netlogon.parent_index", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "Parent Index", HFILL }},
+
{ &hf_netlogon_logon_time,
{ "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
NULL, 0, "Time for last time this user logged on", HFILL }},
{ "Audit Retention Period", "netlogon.audit_retention_period", FT_RELATIVE_TIME, BASE_NONE,
NULL, 0, "Audit retention period", HFILL }},
+ { &hf_netlogon_guid,
+ { "GUID", "netlogon.guid", FT_STRING, BASE_NONE,
+ NULL, 0x0, "GUID (uuid for groups?)", HFILL }},
+
{ &hf_netlogon_timelimit,
{ "Time Limit", "netlogon.time_limit", FT_RELATIVE_TIME, BASE_NONE,
- NULL, 0, "", HFILL }}
+ NULL, 0, "", HFILL }},
+
+ /* Secure channel dissection */
+
+ { &hf_netlogon_secchan_bind_unknown1,
+ { "Unknown1", "netlogon.secchan.bind.unknown1", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "", HFILL }},
+
+ { &hf_netlogon_secchan_bind_unknown2,
+ { "Unknown2", "netlogon.secchan.bind.unknown2", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "", HFILL }},
+
+ { &hf_netlogon_secchan_domain,
+ { "Domain", "netlogon.secchan.domain", FT_STRING, BASE_NONE,
+ NULL, 0, "", HFILL }},
+
+ { &hf_netlogon_secchan_host,
+ { "Host", "netlogon.secchan.host", FT_STRING, BASE_NONE,
+ NULL, 0, "", HFILL }},
+
+ { &hf_netlogon_secchan_bind_ack_unknown1,
+ { "Unknown1", "netlogon.secchan.bind_ack.unknown1", FT_UINT32,
+ BASE_HEX, NULL, 0x0, "", HFILL }},
+
+ { &hf_netlogon_secchan_bind_ack_unknown2,
+ { "Unknown2", "netlogon.secchan.bind_ack.unknown2", FT_UINT32,
+ BASE_HEX, NULL, 0x0, "", HFILL }},
+ { &hf_netlogon_secchan_bind_ack_unknown3,
+ { "Unknown3", "netlogon.secchan.bind_ack.unknown3", FT_UINT32,
+ BASE_HEX, NULL, 0x0, "", HFILL }},
+
+ { &hf_netlogon_secchan_verf,
+ { "Secure Channel Verifier", "netlogon.secchan.verifier", FT_NONE, BASE_NONE,
+ NULL, 0x0, "Verifier", HFILL }},
+
+ { &hf_netlogon_secchan_verf_sig,
+ { "Signature", "netlogon.secchan.sig", FT_BYTES, BASE_HEX, NULL,
+ 0x0, "Signature", HFILL }},
+
+ { &hf_netlogon_secchan_verf_unk,
+ { "Unknown", "netlogon.secchan.unk", FT_BYTES, BASE_HEX, NULL,
+ 0x0, "Unknown", HFILL }},
+
+ { &hf_netlogon_secchan_verf_seq,
+ { "Sequence No", "netlogon.secchan.seq", FT_BYTES, BASE_HEX, NULL,
+ 0x0, "Sequence No", HFILL }},
+
+ { &hf_netlogon_secchan_verf_nonce,
+ { "Nonce", "netlogon.secchan.nonce", FT_BYTES, BASE_HEX, NULL,
+ 0x0, "Nonce", HFILL }},
};
static gint *ett[] = {
&ett_QUOTA_LIMITS,
&ett_IDENTITY_INFO,
&ett_DELTA_ENUM,
- &ett_TYPE_36,
- &ett_NETLOGON_INFO_1,
- &ett_NETLOGON_INFO_2,
- &ett_NETLOGON_INFO_3,
- &ett_NETLOGON_INFO_4,
&ett_UNICODE_MULTI,
&ett_DOMAIN_CONTROLLER_INFO,
- &ett_TYPE_46,
- &ett_TYPE_48,
&ett_UNICODE_STRING_512,
&ett_TYPE_50,
- &ett_TYPE_51,
&ett_TYPE_52,
&ett_DELTA_ID_UNION,
- &ett_NETLOGON_CONTROL_QUERY_INFO,
&ett_TYPE_44,
&ett_DELTA_UNION,
- &ett_NETLOGON_INFO,
- &ett_TYPE_45,
- &ett_TYPE_47,
- &ett_GUID,
&ett_LM_OWF_PASSWORD,
&ett_NT_OWF_PASSWORD,
&ett_GROUP_MEMBERSHIP,
- &ett_BLOB
+ &ett_DS_DOMAIN_TRUSTS,
+ &ett_BLOB,
+ &ett_DOMAIN_TRUST_INFO,
+ &ett_trust_flags,
+ &ett_get_dcname_request_flags,
+ &ett_dc_flags,
+ &ett_secchan_bind_creds,
+ &ett_secchan_bind_ack_creds,
+ &ett_secchan_verf
};
proto_dcerpc_netlogon = proto_register_protocol(
- "Microsoft Network Logon", "NETLOGON", "rpc_netlogon");
+ "Microsoft Network Logon", "RPC_NETLOGON", "rpc_netlogon");
- proto_register_field_array(proto_dcerpc_netlogon, hf,
+ proto_register_field_array(proto_dcerpc_netlogon, hf,
array_length(hf));
proto_register_subtree_array(ett, array_length(ett));
}
+static dcerpc_auth_subdissector_fns secchan_auth_fns = {
+ dissect_secchan_bind_creds, /* Bind */
+ dissect_secchan_bind_ack_creds, /* Bind ACK */
+ NULL, /* AUTH3 */
+ dissect_secchan_verf, /* Request verifier */
+ dissect_secchan_verf, /* Response verifier */
+ NULL, /* Request data */
+ NULL /* Response data */
+};
+
void
proto_reg_handoff_dcerpc_netlogon(void)
{
/* Register protocol as dcerpc */
- dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
- &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
+ dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
+ &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
dcerpc_netlogon_dissectors, hf_netlogon_opnum);
+
+ register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT_INTEGRITY,
+ DCE_C_RPC_AUTHN_PROTOCOL_SEC_CHAN,
+ &secchan_auth_fns);
+ register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT_PRIVACY,
+ DCE_C_RPC_AUTHN_PROTOCOL_SEC_CHAN,
+ &secchan_auth_fns);
}
git.samba.org / obnox / wireshark / wip.git / blobdiff