epan/dissectors/packet-dtpt.c

   1 /* packet-dtpt.c
   2  * Routines for Microsoft ActiveSync Desktop Pass-Through (DTPT) packet
   3  * dissection
   4  *
   5  * Uwe Girlich <uwe@planetquake.com>
   6  *      http://www.synce.org/moin/ProtocolDocumentation/DesktopPassThrough
   7  *
   8  * $Id$
   9  *
  10  * Wireshark - Network traffic analyzer
  11  * By Gerald Combs <gerald@wireshark.org>
  12  * Copyright 1998 Gerald Combs
  13  *
  14  * Copied from packet-quake.c
  15  *
  16  * This program is free software; you can redistribute it and/or
  17  * modify it under the terms of the GNU General Public License
  18  * as published by the Free Software Foundation; either version 2
  19  * of the License, or (at your option) any later version.
  20  *
  21  * This program is distributed in the hope that it will be useful,
  22  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  23  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  24  * GNU General Public License for more details.
  25  *
  26  * You should have received a copy of the GNU General Public License
  27  * along with this program; if not, write to the Free Software
  28  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  29  */
  30
  31 #ifdef HAVE_CONFIG_H
  32 # include "config.h"
  33 #endif
  34
  35 #include <string.h>
  36
  37 #include <glib.h>
  38 #include <epan/packet.h>
  39 #include <epan/conversation.h>
  40 #include <epan/prefs.h>
  41 #include <epan/aftypes.h>
  42 #include <epan/ipproto.h>
  43
  44 static int proto_dtpt = -1;
  45
  46 static int hf_dtpt_version = -1;
  47 static int hf_dtpt_message_type = -1;
  48 static int hf_dtpt_flags = -1;
  49 static int hf_dtpt_flags_deep = -1;
  50 static int hf_dtpt_flags_containers = -1;
  51 static int hf_dtpt_flags_nocontainers = -1;
  52 static int hf_dtpt_flags_nearest = -1;
  53 static int hf_dtpt_flags_return_name = -1;
  54 static int hf_dtpt_flags_return_type = -1;
  55 static int hf_dtpt_flags_return_version = -1;
  56 static int hf_dtpt_flags_return_comment = -1;
  57 static int hf_dtpt_flags_return_addr = -1;
  58 static int hf_dtpt_flags_return_blob = -1;
  59 static int hf_dtpt_flags_return_aliases = -1;
  60 static int hf_dtpt_flags_return_query_string = -1;
  61 static int hf_dtpt_flags_flushcache = -1;
  62 static int hf_dtpt_flags_flushprevious = -1;
  63 static int hf_dtpt_flags_res_service = -1;
  64 static int hf_dtpt_payload_size = -1;
  65 static int hf_dtpt_handle = -1;
  66 static int hf_dtpt_error = -1;
  67 static int hf_dtpt_buffer_size = -1;
  68 static int hf_dtpt_data_size = -1;
  69 static int hf_dtpt_queryset_rawsize = -1;
  70 static int hf_dtpt_queryset_size = -1;
  71 static int hf_dtpt_queryset_service_instance_name_pointer = -1;
  72 static int hf_dtpt_queryset_service_class_id_pointer = -1;
  73 static int hf_dtpt_queryset_version = -1;
  74 static int hf_dtpt_queryset_comment_pointer = -1;
  75 static int hf_dtpt_queryset_namespace = -1;
  76 static int hf_dtpt_queryset_provider_id_pointer = -1;
  77 static int hf_dtpt_queryset_context_pointer = -1;
  78 static int hf_dtpt_queryset_protocols_number = -1;
  79 static int hf_dtpt_queryset_protocols_pointer = -1;
  80 static int hf_dtpt_queryset_query_string_pointer = -1;
  81 static int hf_dtpt_queryset_cs_addrs_number = -1;
  82 static int hf_dtpt_queryset_cs_addrs_pointer = -1;
  83 static int hf_dtpt_queryset_output_flags = -1;
  84 static int hf_dtpt_queryset_blob_pointer = -1;
  85 static int hf_dtpt_wstring_length = -1;
  86 static int hf_dtpt_wstring_data = -1;
  87 static int hf_dtpt_guid_length = -1;
  88 static int hf_dtpt_guid_data = -1;
  89 static int hf_dtpt_service_instance_name = -1;
  90 static int hf_dtpt_service_class_id = -1;
  91 static int hf_dtpt_comment = -1;
  92 static int hf_dtpt_ns_provider_id = -1;
  93 static int hf_dtpt_context = -1;
  94 static int hf_dtpt_protocols_number = -1;
  95 static int hf_dtpt_protocols_length = -1;
  96 static int hf_dtpt_protocol_family = -1;
  97 static int hf_dtpt_protocol_protocol = -1;
  98 static int hf_dtpt_query_string = -1;
  99 static int hf_dtpt_cs_addrs_number = -1;
 100 static int hf_dtpt_cs_addrs_length1 = -1;
 101 static int hf_dtpt_cs_addr_socket_type = -1;
 102 static int hf_dtpt_cs_addr_protocol = -1;
 103 static int hf_dtpt_cs_addr_local_pointer = -1;
 104 static int hf_dtpt_cs_addr_local_length = -1;
 105 static int hf_dtpt_cs_addr_local = -1;
 106 static int hf_dtpt_cs_addr_remote_pointer = -1;
 107 static int hf_dtpt_cs_addr_remote_length = -1;
 108 static int hf_dtpt_cs_addr_remote = -1;
 109 static int hf_dtpt_sockaddr_length = -1;
 110 static int hf_dtpt_sockaddr_family = -1;
 111 static int hf_dtpt_sockaddr_port = -1;
 112 static int hf_dtpt_sockaddr_address = -1;
 113 static int hf_dtpt_blob_rawsize = -1;
 114 static int hf_dtpt_blob_size = -1;
 115 static int hf_dtpt_blob_data_pointer = -1;
 116 static int hf_dtpt_blob_data_length = -1;
 117 static int hf_dtpt_blob_data = -1;
 118 static int hf_dtpt_connect_addr = -1;
 119
 120 static gint ett_dtpt = -1;
 121 static gint ett_dtpt_flags = -1;
 122 static gint ett_dtpt_queryset = -1;
 123 static gint ett_dtpt_wstring = -1;
 124 static gint ett_dtpt_guid = -1;
 125 static gint ett_dtpt_protocols = -1;
 126 static gint ett_dtpt_protocol = -1;
 127 static gint ett_dtpt_cs_addrs = -1;
 128 static gint ett_dtpt_cs_addr1 = -1;
 129 static gint ett_dtpt_cs_addr2 = -1;
 130 static gint ett_dtpt_sockaddr = -1;
 131 static gint ett_dtpt_blobraw = -1;
 132 static gint ett_dtpt_blob = -1;
 133
 134
 135
 136 static dissector_handle_t       dtpt_conversation_handle;
 137 /** static dissector_handle_t   dtpt_data_handle;  **/
 138 static dissector_handle_t       data_handle;
 139
 140
 141 /* Server port */
 142 static unsigned int gbl_dtptServerPort=5721;
 143
 144 static const value_string names_message_type[] = {
 145 #define LookupBeginRequest 9
 146         {       LookupBeginRequest, "LookupBeginRequest" },
 147 #define LookupBeginResponse 10
 148         {       LookupBeginResponse, "LookupBeginResponse" },
 149 #define LookupNextRequest 11
 150         {       LookupNextRequest, "LookupNextRequest" },
 151 #define LookupNextResponse 12
 152         {       LookupNextResponse, "LookupNextResponse" },
 153 #define LookupEndRequest 13
 154         {       LookupEndRequest, "LookupEndRequest" },
 155 #define ConnectRequest 1
 156         {       ConnectRequest, "ConnectRequest" },
 157 #define ConnectResponseOK 0x5A
 158         {       ConnectResponseOK, "ConnectResponseOK" },
 159 #define ConnectResponseERR 0x5B
 160         {       ConnectResponseERR, "ConnectResponseERR" },
 161         { 0, NULL }
 162 };
 163
 164 static const value_string names_error[] = {
 165         {       0, "OK" },
 166         {       10014, "WSAEFAULT" },
 167         {       10060, "WSAETIMEDOUT" },
 168         {       10108, "WSASERVICE_NOT_FOUND" },
 169         {       11001, "WSAHOST_NOT_FOUND" },
 170         {       0, NULL }
 171 };
 172
 173 static const value_string names_family[] = {
 174         {       WINSOCK_AF_INET,        "AF_INET"       },
 175         {       0, NULL }
 176 };
 177
 178 /*
 179  * Winsock's SOCK_ values.  These are probably the same as they are on
 180  * other OSes, as they probably all come from 4.2BSD, but it's still
 181  * best to define them ourselves (to avoid problems if other OSes
 182  * define them differently, and to avoid having to include system
 183  * header files that might require a bunch of other includes).
 184  */
 185 #define WINSOCK_SOCK_STREAM     1
 186 #define WINSOCK_SOCK_DGRAM      2
 187 #define WINSOCK_SOCK_RAW        3
 188
 189 static const value_string names_socket_type[] = {
 190         {       WINSOCK_SOCK_STREAM,    "SOCK_STREAM"   },
 191         {       WINSOCK_SOCK_DGRAM,     "SOCK_DGRAM"    },
 192         {       WINSOCK_SOCK_RAW,       "SOCK_RAW"      },
 193         {       0, NULL }
 194 };
 195
 196 static const value_string names_protocol[] = {
 197         {       IP_PROTO_IP,    "IPPROTO_IP"    },
 198         {       IP_PROTO_TCP,   "IPPROTO_TCP"   },
 199         {       IP_PROTO_UDP,   "IPPROTP_UDP"   },
 200         {       0, NULL }
 201 };
 202
 203 #define LUP_DEEP                0x0001
 204 #define LUP_CONTAINERS          0x0002
 205 #define LUP_NOCONTAINERS        0x0004
 206 #define LUP_NEAREST             0x0008
 207 #define LUP_RETURN_NAME         0x0010
 208 #define LUP_RETURN_TYPE         0x0020
 209 #define LUP_RETURN_VERSION      0x0040
 210 #define LUP_RETURN_COMMENT      0x0080
 211 #define LUP_RETURN_ADDR         0x0100
 212 #define LUP_RETURN_BLOB         0x0200
 213 #define LUP_RETURN_ALIASES      0x0400
 214 #define LUP_RETURN_QUERY_STRING 0x0800
 215 #define LUP_FLUSHCACHE          0x1000
 216 #define LUP_FLUSHPREVIOUS       0x2000
 217 #define LUP_RES_SERVICE         0x8000
 218
 219 #define SOCKADDR_WITH_LEN       1
 220 #define SOCKADDR_CONNECT        2
 221
 222 static int
 223 dissect_dtpt_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 224 static int
 225 dissect_dtpt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree);
 226
 227
 228 static int
 229 dissect_dtpt_wstring(tvbuff_t *tvb, guint offset, proto_tree *tree, int hfindex)
 230 {
 231         guint32 wstring_length;
 232         guint32 wstring_size;
 233         char    *wstring_data = NULL;
 234         guint32 wstring_padding = 0;
 235
 236         wstring_length = tvb_get_letohl(tvb, offset);
 237         wstring_data = tvb_get_ephemeral_faked_unicode(tvb, offset+4, wstring_length, 1);
 238         wstring_size = wstring_length;
 239         if (wstring_size%4) {
 240                 wstring_padding = (4-wstring_size%4);
 241                 wstring_size += wstring_padding;
 242         }
 243         if (tree) {
 244                 proto_item      *dtpt_wstring_item = NULL;
 245                 proto_tree      *dtpt_wstring_tree = NULL;
 246                 dtpt_wstring_item = proto_tree_add_string(tree, hfindex,
 247                         tvb, offset+0, 4+wstring_size, wstring_data);
 248                 if (dtpt_wstring_item)
 249                         dtpt_wstring_tree = proto_item_add_subtree(dtpt_wstring_item, ett_dtpt_wstring);
 250                 if (dtpt_wstring_tree) {
 251                         proto_tree_add_uint(dtpt_wstring_tree, hf_dtpt_wstring_length,
 252                                 tvb, offset+0, 4, wstring_length);
 253                         if (wstring_length)
 254                                 proto_tree_add_string(dtpt_wstring_tree, hf_dtpt_wstring_data,
 255                                         tvb, offset+4, wstring_length, wstring_data);
 256                         if (wstring_padding)
 257                                 proto_tree_add_text(dtpt_wstring_tree, tvb,
 258                                         offset+4+wstring_length,wstring_padding, "Padding");
 259                 }
 260         }
 261         offset += 4+wstring_size;
 262         return offset;
 263 }
 264
 265 static int
 266 dissect_dtpt_guid(tvbuff_t *tvb, guint offset, proto_tree *tree, int hfindex)
 267 {
 268         guint32 guid_length;
 269
 270         guid_length = tvb_get_letohl(tvb, offset);
 271         if (tree) {
 272                 e_guid_t        guid;
 273                 proto_item      *dtpt_guid_item = NULL;
 274                 proto_tree      *dtpt_guid_tree = NULL;
 275                 const gchar     *guid_name = NULL;
 276
 277                 if (guid_length) {
 278                         tvb_get_guid(tvb, offset+4, &guid, 1);
 279                 }
 280                 else {
 281                         memset(&guid, 0, sizeof(guid));
 282                 }
 283                 dtpt_guid_item = proto_tree_add_guid(tree, hfindex, tvb, offset, 4 + guid_length, &guid);
 284                 if (dtpt_guid_item) {
 285                         guid_name = guids_get_guid_name(&guid);
 286                         if (guid_name != NULL)
 287                                 proto_item_set_text(dtpt_guid_item, "%s: %s (%s)",
 288                                 proto_registrar_get_name(hfindex), guid_name, guid_to_str(&guid));
 289                         dtpt_guid_tree = proto_item_add_subtree(dtpt_guid_item, ett_dtpt_guid);
 290                 }
 291                 if (dtpt_guid_tree) {
 292                         proto_item      *dtpt_guid_data_item = NULL;
 293
 294                         proto_tree_add_uint(dtpt_guid_tree, hf_dtpt_guid_length,
 295                                 tvb, offset, 4, guid_length);
 296                         if (guid_length) {
 297                                 dtpt_guid_data_item = proto_tree_add_guid(dtpt_guid_tree, hf_dtpt_guid_data,
 298                                         tvb, offset+4, guid_length, &guid);
 299                                 if (guid_name != NULL && dtpt_guid_data_item != NULL) {
 300                                         proto_item_set_text(dtpt_guid_data_item, "%s: %s (%s)",
 301                                         proto_registrar_get_name(hf_dtpt_guid_data),
 302                                         guid_name, guid_to_str(&guid));
 303                                 }
 304                         }
 305                 }
 306         }
 307         offset+=4;
 308         offset+=guid_length;
 309
 310         return offset;
 311 }
 312
 313 static int
 314 dissect_dtpt_sockaddr(tvbuff_t *tvb, guint offset, proto_tree *tree, int hfindex, int sockaddr_type)
 315 {
 316         guint32 sockaddr_length = 0;
 317         proto_item      *sockaddr_item = NULL;
 318         proto_tree      *sockaddr_tree = NULL;
 319         guint32         sockaddr_len1 = 0;
 320         guint32         sockaddr_len2 = 0;
 321
 322         switch (sockaddr_type) {
 323                 case SOCKADDR_WITH_LEN:
 324                         sockaddr_len1=4;
 325                         sockaddr_len2=16;
 326                 break;
 327                 case SOCKADDR_CONNECT:
 328                         sockaddr_len1=0;
 329                         sockaddr_len2=30;
 330                 break;
 331         }
 332
 333         if (sockaddr_type == SOCKADDR_WITH_LEN)
 334                 sockaddr_length = tvb_get_letohl(tvb, offset + 0);
 335
 336         if (tree) {
 337                 sockaddr_item = proto_tree_add_text(tree,
 338                         tvb, offset, sockaddr_len1+sockaddr_len2, "%s", proto_registrar_get_name(hfindex));
 339
 340                 if (sockaddr_item)
 341                         sockaddr_tree = proto_item_add_subtree(sockaddr_item, ett_dtpt_sockaddr);
 342                 if (sockaddr_tree) {
 343                         if (sockaddr_type == SOCKADDR_WITH_LEN)
 344                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_length,
 345                                                 tvb, offset+0, 4, sockaddr_length);
 346                 }
 347         }
 348
 349         offset += sockaddr_len1;
 350
 351         if (sockaddr_tree) {
 352                 switch (sockaddr_type) {
 353                         case SOCKADDR_WITH_LEN: {
 354                                 guint16 family;
 355
 356                                 family = tvb_get_letohs(tvb, offset);
 357                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_family,
 358                                                 tvb, offset, 2, family);
 359                                 switch (family) {
 360                                         case WINSOCK_AF_INET: {
 361                                                 guint16 port;
 362                                                 guint32 addr;
 363
 364                                                 port = tvb_get_ntohs(tvb,offset+2);
 365                                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_port,
 366                                                 tvb, offset+2,2,port);
 367                                                 addr = tvb_get_ipv4(tvb,offset+4);
 368                                                 proto_tree_add_ipv4(sockaddr_tree, hf_dtpt_sockaddr_address,
 369                                                 tvb, offset+4,4,addr);
 370                                                 proto_tree_add_text(sockaddr_tree, tvb, offset+8, 8, "Padding");
 371                                                         proto_item_append_text(sockaddr_item, ": %s:%d", ip_to_str((guint8*)&addr), port);
 372                                         }
 373                                         break;
 374                                 }
 375                         }
 376                         break;
 377                         case SOCKADDR_CONNECT: {
 378                                 guint32 family;
 379
 380                                 family = tvb_get_letohl(tvb, offset+0);
 381                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_family,
 382                                                 tvb, offset+0, 4, family);
 383                                 switch (family) {
 384                                         case WINSOCK_AF_INET: {
 385                                                 guint16 port;
 386                                                 guint32 addr;
 387
 388                                                 proto_tree_add_text(sockaddr_tree, tvb, offset+4, 4, "Padding");
 389                                                 port = tvb_get_ntohs(tvb,offset+8);
 390                                                 proto_tree_add_uint(sockaddr_tree, hf_dtpt_sockaddr_port,
 391                                                         tvb, offset+8,2,port);
 392                                                 addr = tvb_get_ipv4(tvb,offset+10);
 393                                                 proto_tree_add_ipv4(sockaddr_tree, hf_dtpt_sockaddr_address,
 394                                                         tvb, offset+10,4,addr);
 395                                                 proto_tree_add_text(sockaddr_tree, tvb, offset+14, 16, "Padding");
 396                                                 proto_item_append_text(sockaddr_item, ": %s:%d", ip_to_str((guint8*)&addr), port);
 397                                         }
 398                                         break;
 399                                 }
 400                         }
 401                         break;
 402                 }
 403
 404         }
 405         offset += sockaddr_len2;
 406         return offset;
 407 }
 408
 409 static int
 410 dissect_dtpt_conversation(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 411 {
 412         guint           offset = 0;
 413         guint           rest_length;
 414
 415         /* First try to decode it as "normal" DTPT packets. */
 416         offset = dissect_dtpt(tvb, pinfo, tree);
 417
 418         if (offset == 0) {
 419                 /* No, maybe it was a DTPT data packet. */
 420                 offset = dissect_dtpt_data(tvb, pinfo, tree);
 421         }
 422
 423         /* Handle the rest ... */
 424         rest_length = tvb_reported_length(tvb) - offset;
 425         if (rest_length > 0) {
 426                 tvbuff_t        *next_tvb;
 427                 /* ... as data. */
 428                 call_dissector(data_handle,
 429                         tvb_new_subset_remaining(tvb, offset), pinfo, tree);
 430                 next_tvb = tvb_new_subset(tvb, offset, rest_length, rest_length);
 431         }
 432         return tvb_reported_length(tvb);
 433 }
 434
 435
 436 static int
 437 dissect_dtpt_data(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 438 {
 439         proto_item      *dtpt_item = NULL;
 440         proto_tree      *dtpt_tree = NULL;
 441         proto_item      *dtpt_queryset_item = NULL;
 442         proto_tree      *dtpt_queryset_tree = NULL;
 443         guint           offset = 0;
 444         guint32         queryset_rawsize;
 445         guint32         queryset_size;
 446         guint32         num_protocols;
 447         guint32         protocols_length = 0;
 448         guint32         addrs_start;
 449         guint32         num_addrs;
 450         guint32         addrs_length1 = 0;
 451         proto_item      *dtpt_addrs_item = NULL;
 452         proto_tree      *dtpt_addrs_tree = NULL;
 453         guint32         blob_rawsize = 0;
 454         guint32         blob_size = 0;
 455         guint32         blob_data_length = 0;
 456
 457         queryset_rawsize = tvb_get_letohl(tvb, offset + 0);
 458         if (queryset_rawsize != 60) return 0;
 459         queryset_size = tvb_get_letohl(tvb, offset + 4);
 460         if (queryset_size != 60) return 0;
 461
 462         col_set_str(pinfo->cinfo, COL_PROTOCOL, "DTPT");
 463         col_set_str(pinfo->cinfo, COL_INFO, "QuerySet");
 464
 465         if (tree) {
 466                 dtpt_item = proto_tree_add_item(tree, proto_dtpt,
 467                                 tvb, 0, -1, FALSE);
 468                 if (dtpt_item)
 469                         dtpt_tree = proto_item_add_subtree(dtpt_item, ett_dtpt);
 470         }
 471
 472         if (dtpt_tree) {
 473                 proto_tree_add_uint(dtpt_tree, hf_dtpt_queryset_rawsize,
 474                         tvb, 0, 4, queryset_rawsize);
 475
 476                 dtpt_queryset_item = proto_tree_add_text(dtpt_tree,
 477                         tvb, 4, 60, "QuerySet raw");
 478                 if (dtpt_queryset_item)
 479                         dtpt_queryset_tree = proto_item_add_subtree(dtpt_queryset_item, ett_dtpt_queryset);
 480
 481                 if (dtpt_queryset_tree) {
 482                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_size,
 483                                 tvb, offset+4+0,  4, queryset_size);
 484                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_service_instance_name_pointer,
 485                                 tvb, offset+4+4,  4, tvb_get_letohl(tvb, offset+4+ 4));
 486                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_service_class_id_pointer,
 487                                 tvb, offset+4+8,  4, tvb_get_letohl(tvb, offset+4+ 8));
 488                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_version,
 489                                 tvb, offset+4+12, 4, tvb_get_letohl(tvb, offset+4+12));
 490                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_comment_pointer,
 491                                 tvb, offset+4+16, 4, tvb_get_letohl(tvb, offset+4+16));
 492                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_namespace,
 493                                 tvb, offset+4+20, 4, tvb_get_letohl(tvb, offset+4+20));
 494                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_provider_id_pointer,
 495                                 tvb, offset+4+24, 4, tvb_get_letohl(tvb, offset+4+24));
 496                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_context_pointer,
 497                                 tvb, offset+4+28, 4, tvb_get_letohl(tvb, offset+4+28));
 498                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_protocols_number,
 499                                 tvb, offset+4+32, 4, tvb_get_letohl(tvb, offset+4+32));
 500                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_protocols_pointer,
 501                                 tvb, offset+4+36, 4, tvb_get_letohl(tvb, offset+4+36));
 502                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_query_string_pointer,
 503                                 tvb, offset+4+40, 4, tvb_get_letohl(tvb, offset+4+40));
 504                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_cs_addrs_number,
 505                                 tvb, offset+4+44, 4, tvb_get_letohl(tvb, offset+4+44));
 506                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_cs_addrs_pointer,
 507                                 tvb, offset+4+48, 4, tvb_get_letohl(tvb, offset+4+48));
 508                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_output_flags,
 509                                 tvb, offset+4+52, 4, tvb_get_letohl(tvb, offset+4+52));
 510                         proto_tree_add_uint(dtpt_queryset_tree, hf_dtpt_queryset_blob_pointer,
 511                                 tvb, offset+4+56, 4, tvb_get_letohl(tvb, offset+4+56));
 512                 }
 513         }
 514
 515         offset += 4;
 516         offset += 60;
 517
 518         offset = dissect_dtpt_wstring(tvb, offset, dtpt_tree, hf_dtpt_service_instance_name);
 519         offset = dissect_dtpt_guid   (tvb, offset, dtpt_tree, hf_dtpt_service_class_id     );
 520         offset = dissect_dtpt_wstring(tvb, offset, dtpt_tree, hf_dtpt_comment              );
 521         offset = dissect_dtpt_guid   (tvb, offset, dtpt_tree, hf_dtpt_ns_provider_id       );
 522         offset = dissect_dtpt_wstring(tvb, offset, dtpt_tree, hf_dtpt_context              );
 523         num_protocols = tvb_get_letohl(tvb, offset);
 524         if (num_protocols>0) {
 525                 protocols_length = tvb_get_letohl(tvb, offset+4);
 526         }
 527         if (dtpt_tree) {
 528                 proto_item      *dtpt_protocols_item = NULL;
 529                 proto_tree      *dtpt_protocols_tree = NULL;
 530                 guint32         i;
 531
 532                 dtpt_protocols_item = proto_tree_add_text(dtpt_tree,
 533                                 tvb, offset, 4+(num_protocols>0?4:0)+num_protocols*8,
 534                                 "Protocols: %d", num_protocols);
 535                 if (dtpt_protocols_item)
 536                         dtpt_protocols_tree = proto_item_add_subtree(dtpt_protocols_item, ett_dtpt_protocols);
 537                 if (dtpt_protocols_tree) {
 538                         proto_tree_add_uint(dtpt_protocols_tree, hf_dtpt_protocols_number,
 539                                         tvb, offset, 4, num_protocols);
 540                         if (num_protocols>0)
 541                                 proto_tree_add_uint(dtpt_protocols_tree, hf_dtpt_protocols_length,
 542                                                 tvb, offset+4, 4, protocols_length);
 543                         for (i=0;i<num_protocols;i++) {
 544                                 proto_item      *dtpt_protocol_item = NULL;
 545                                 proto_tree      *dtpt_protocol_tree = NULL;
 546
 547                                 dtpt_protocol_item = proto_tree_add_text(dtpt_protocols_tree,
 548                                                 tvb, offset+4+4+i*8, 8, "Protocol[%d]", i+1);
 549                                 if (dtpt_protocol_item)
 550                                         dtpt_protocol_tree = proto_item_add_subtree(dtpt_protocol_item, ett_dtpt_protocol);
 551                                 if (dtpt_protocol_tree) {
 552                                         proto_tree_add_uint(dtpt_protocol_tree, hf_dtpt_protocol_family,
 553                                         tvb, offset+4+4+i*8, 4, tvb_get_letohl(tvb, offset+4+4+i*8));
 554                                         proto_tree_add_uint(dtpt_protocol_tree, hf_dtpt_protocol_protocol,
 555                                         tvb, offset+4+4+i*8+4, 4, tvb_get_letohl(tvb, offset+4+4+i*8+4));
 556                                 }
 557                         }
 558                 }
 559         }
 560         offset += 4 + (num_protocols>0?4:0) + num_protocols*8;
 561         offset = dissect_dtpt_wstring(tvb, offset, dtpt_tree, hf_dtpt_query_string         );
 562
 563         addrs_start = offset;
 564         num_addrs = tvb_get_letohl(tvb, offset);
 565         if (num_addrs>0) {
 566                 addrs_length1 = tvb_get_letohl(tvb, offset+4);
 567         }
 568         if (dtpt_tree) {
 569                 dtpt_addrs_item = proto_tree_add_text(dtpt_tree,
 570                         tvb, offset, -1, "Addresses");
 571                 if (dtpt_addrs_item)
 572                         dtpt_addrs_tree = proto_item_add_subtree(dtpt_addrs_item, ett_dtpt_cs_addrs);
 573                 if (dtpt_addrs_tree) {
 574                         proto_tree_add_uint(dtpt_addrs_tree, hf_dtpt_cs_addrs_number,
 575                                 tvb, offset, 4, num_addrs);
 576                         if (num_addrs>0)
 577                                 proto_tree_add_uint(dtpt_addrs_tree, hf_dtpt_cs_addrs_length1,
 578                                         tvb, offset+4, 4, addrs_length1);
 579                 }
 580         }
 581         offset += 4 + (num_addrs>0?4:0);
 582
 583         if (num_addrs>0) {
 584                 guint32 i;
 585                 guint32 offset2;
 586
 587                 offset2 = offset + 24*num_addrs;
 588
 589                 for (i=0;i<num_addrs;i++,offset+=24) {
 590                         proto_item      *dtpt_addr1_item = NULL;
 591                         proto_tree      *dtpt_addr1_tree = NULL;
 592                         proto_item      *dtpt_addr2_item = NULL;
 593                         proto_tree      *dtpt_addr2_tree = NULL;
 594                         guint32         offset2_start;
 595
 596                         if (dtpt_addrs_tree) {
 597                                 dtpt_addr1_item = proto_tree_add_text(dtpt_addrs_tree,
 598                                         tvb, offset, 24, "Address[%u] Part 1", i+1);
 599                                 if (dtpt_addr1_item)
 600                                         dtpt_addr1_tree = proto_item_add_subtree(dtpt_addr1_item,
 601                                                 ett_dtpt_cs_addr1);
 602                                 if (dtpt_addr1_tree) {
 603                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_local_pointer,
 604                                                 tvb, offset+ 0, 4, tvb_get_letohl(tvb, offset+ 0));
 605                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_local_length,
 606                                                 tvb, offset+ 4, 4, tvb_get_letohl(tvb, offset+ 4));
 607                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_remote_pointer,
 608                                                 tvb, offset+ 8, 4, tvb_get_letohl(tvb, offset+ 8));
 609                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_remote_length,
 610                                                 tvb, offset+12, 4, tvb_get_letohl(tvb, offset+12));
 611                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_socket_type,
 612                                                 tvb, offset+16, 4, tvb_get_letohl(tvb, offset+16));
 613                                         proto_tree_add_uint(dtpt_addr1_tree, hf_dtpt_cs_addr_protocol,
 614                                                 tvb, offset+20, 4, tvb_get_letohl(tvb, offset+20));
 615                                 }
 616
 617                                 dtpt_addr2_item = proto_tree_add_text(dtpt_addrs_tree,
 618                                         tvb, offset2, -1, "Address[%u] Part 2", i+1);
 619                                 if (dtpt_addr2_item)
 620                                         dtpt_addr2_tree = proto_item_add_subtree(dtpt_addr2_item,
 621                                                 ett_dtpt_cs_addr2);
 622                         }
 623
 624                         offset2_start = offset2;
 625
 626                         offset2 = dissect_dtpt_sockaddr(tvb, offset2, dtpt_addr2_tree, hf_dtpt_cs_addr_local, SOCKADDR_WITH_LEN);
 627                         offset2 = dissect_dtpt_sockaddr(tvb, offset2, dtpt_addr2_tree, hf_dtpt_cs_addr_remote, SOCKADDR_WITH_LEN);
 628
 629                         if (dtpt_addr2_item)
 630                                 proto_item_set_len(dtpt_addr2_item,
 631                                         offset2 - offset2_start);
 632                 }
 633                 offset = offset2;
 634         }
 635
 636         if (dtpt_addrs_item)
 637                 proto_item_set_len(dtpt_addrs_item, offset - addrs_start);
 638
 639         if (dtpt_item)
 640                 proto_item_set_len(dtpt_item, offset);
 641
 642         blob_rawsize = tvb_get_letohl(tvb, offset);
 643         if (blob_rawsize>=4) {
 644                 blob_size = tvb_get_letohl(tvb,offset+4+0);
 645         }
 646         if (dtpt_tree) {
 647                 proto_item      *dtpt_blobraw_item = NULL;
 648                 proto_tree      *dtpt_blobraw_tree = NULL;
 649
 650                 proto_tree_add_uint(dtpt_tree, hf_dtpt_blob_rawsize,
 651                                 tvb, offset+0, 4, blob_rawsize);
 652                 if (blob_rawsize>0) {
 653                         dtpt_blobraw_item = proto_tree_add_text(dtpt_tree,
 654                                 tvb, offset+4, blob_rawsize, "Blob raw");
 655                         if (dtpt_blobraw_item)
 656                                 dtpt_blobraw_tree = proto_item_add_subtree(dtpt_blobraw_item,
 657                                         ett_dtpt_blobraw);
 658                         if (dtpt_blobraw_tree) {
 659                                 proto_tree_add_uint(dtpt_blobraw_tree, hf_dtpt_blob_size,
 660                                         tvb, offset+4+0, 4, blob_size);
 661                                 proto_tree_add_uint(dtpt_blobraw_tree, hf_dtpt_blob_data_pointer,
 662                                         tvb, offset+4+4, 4, tvb_get_letohl(tvb,offset+4+4));
 663                         }
 664                 }
 665         }
 666
 667         offset += 4+blob_rawsize;
 668
 669         if (dtpt_item)
 670                 proto_item_set_len(dtpt_item, offset);
 671
 672         if (blob_size>0) {
 673                 proto_item      *dtpt_blob_item = NULL;
 674                 proto_tree      *dtpt_blob_tree = NULL;
 675
 676                 blob_data_length = tvb_get_letohl(tvb,offset);
 677
 678                 if (dtpt_tree) {
 679                         dtpt_blob_item = proto_tree_add_text(dtpt_tree,
 680                                 tvb, offset, 4+blob_data_length, "Blob");
 681                         if (dtpt_blob_item)
 682                                 dtpt_blob_tree = proto_item_add_subtree(dtpt_blob_item,
 683                                         ett_dtpt_blob);
 684                         if (dtpt_blob_tree) {
 685                                 proto_tree_add_uint(dtpt_blob_tree, hf_dtpt_blob_data_length,
 686                                         tvb, offset+0, 4, blob_data_length);
 687                                 proto_tree_add_bytes(dtpt_blob_tree, hf_dtpt_blob_data,
 688                                         tvb, offset+4, blob_data_length,
 689                                         tvb_get_ptr(tvb, offset+4, blob_data_length));
 690                         }
 691                 }
 692                 offset += 4+blob_data_length;
 693                 if (dtpt_item)
 694                         proto_item_set_len(dtpt_item, offset);
 695         }
 696
 697         return offset;
 698 }
 699
 700 static int
 701 dissect_dtpt(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 702 {
 703         proto_tree      *dtpt_tree = NULL;
 704         proto_item      *dtpt_item = NULL;
 705         guint8          version;
 706         guint8          message_type;
 707         guint32         flags;
 708         guint32         payload_size;
 709
 710         version = tvb_get_guint8(tvb, 0);
 711         if (version != 1) return 0;
 712         message_type = tvb_get_guint8(tvb, 1);
 713         switch (message_type) {
 714                 case LookupBeginRequest:
 715                 case LookupBeginResponse:
 716                 case LookupNextRequest:
 717                 case LookupNextResponse:
 718                 case LookupEndRequest:
 719                         if (tvb_reported_length(tvb) != 20) return 0;
 720                 break;
 721                 case ConnectRequest:
 722                 case ConnectResponseOK:
 723                 case ConnectResponseERR:
 724                         if (tvb_reported_length(tvb) != 36) return 0;
 725                 break;
 726                 default:
 727                         return 0;
 728         }
 729
 730         col_set_str(pinfo->cinfo, COL_PROTOCOL, "DTPT");
 731         if (check_col(pinfo->cinfo, COL_INFO))
 732                 col_add_str(pinfo->cinfo, COL_INFO, val_to_str(message_type, names_message_type, "Unknown (%d)"));
 733
 734         if (message_type == LookupBeginRequest) {
 735                 conversation_t *c;
 736                 c = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst, PT_TCP, pinfo->srcport,
 737                         pinfo->destport, 0);
 738                 if (c) {
 739                         conversation_set_dissector(c, dtpt_conversation_handle);
 740                 }
 741         }
 742
 743         if (tree) {
 744                 dtpt_item = proto_tree_add_item(tree, proto_dtpt,
 745                                 tvb, 0, -1, FALSE);
 746                 if (dtpt_item)
 747                         dtpt_tree = proto_item_add_subtree(dtpt_item, ett_dtpt);
 748         }
 749
 750         if (dtpt_tree) {
 751                 proto_tree_add_uint(dtpt_tree, hf_dtpt_version,
 752                         tvb, 0, 1, version);
 753                 proto_tree_add_uint(dtpt_tree, hf_dtpt_message_type,
 754                         tvb, 1, 1, message_type);
 755
 756                 switch (message_type) {
 757                         case LookupBeginRequest: {
 758                                 proto_item* flags_item = NULL;
 759                                 proto_tree*     flags_tree = NULL;
 760
 761                                 flags = tvb_get_letohl(tvb, 12);
 762
 763                                 flags_item = proto_tree_add_uint(dtpt_tree, hf_dtpt_flags,
 764                                         tvb, 12, 4, flags);
 765                                 if (flags_item) {
 766                                         flags_tree = proto_item_add_subtree(flags_item, ett_dtpt_flags);
 767                                 }
 768                                 if (flags_tree) {
 769                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_res_service,   tvb, 12, 4, flags);
 770                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_flushprevious, tvb, 12, 4, flags);
 771                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_flushcache,    tvb, 12, 4, flags);
 772                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_query_string, tvb, 12, 4, flags);
 773                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_aliases, tvb, 12, 4, flags);
 774                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_blob, tvb, 12, 4, flags);
 775                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_addr, tvb, 12, 4, flags);
 776                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_comment, tvb, 12, 4, flags);
 777                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_version, tvb, 12, 4, flags);
 778                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_type, tvb, 12, 4, flags);
 779                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_return_name, tvb, 12, 4, flags);
 780                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_nearest, tvb, 12, 4, flags);
 781                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_nocontainers, tvb, 12, 4, flags);
 782                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_containers, tvb, 12, 4, flags);
 783                                         proto_tree_add_boolean(flags_tree, hf_dtpt_flags_deep, tvb, 12, 4, flags);
 784                                 }
 785                                 payload_size = tvb_get_letohl(tvb, 16);
 786                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_payload_size,
 787                                         tvb, 16, 4, payload_size);
 788                         }
 789                         break;
 790                         case LookupBeginResponse: {
 791                                 proto_tree_add_uint64(dtpt_tree, hf_dtpt_handle,
 792                                         tvb, 4, 8, tvb_get_letoh64(tvb, 4));
 793                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 794                                         tvb, 12, 4, tvb_get_letohl(tvb, 12));
 795                         }
 796                         break;
 797                         case LookupNextRequest: {
 798                                 proto_tree_add_uint64(dtpt_tree, hf_dtpt_handle,
 799                                         tvb, 4, 8, tvb_get_letoh64(tvb, 4));
 800                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_buffer_size,
 801                                         tvb, 16, 4, tvb_get_letohl(tvb, 16));
 802                         }
 803                         break;
 804                         case LookupNextResponse: {
 805                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 806                                         tvb, 12, 4, tvb_get_letohl(tvb, 12));
 807                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_data_size,
 808                                         tvb, 16, 4, tvb_get_letohl(tvb, 16));
 809                         }
 810                         break;
 811                         case LookupEndRequest: {
 812                                 proto_tree_add_uint64(dtpt_tree, hf_dtpt_handle,
 813                                         tvb, 4, 8, tvb_get_letoh64(tvb, 4));
 814                         }
 815                         break;
 816                         case ConnectRequest: {
 817                                 dissect_dtpt_sockaddr(tvb, 2, dtpt_tree, hf_dtpt_connect_addr, SOCKADDR_CONNECT);
 818                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 819                                         tvb, 32, 4, tvb_get_letohl(tvb, 32));
 820                         }
 821                         break;
 822                         case ConnectResponseOK: {
 823                                 dissect_dtpt_sockaddr(tvb, 2, dtpt_tree, hf_dtpt_connect_addr, SOCKADDR_CONNECT);
 824                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 825                                         tvb, 32, 4, tvb_get_letohl(tvb, 32));
 826                         }
 827                         break;
 828                         case ConnectResponseERR: {
 829                                 dissect_dtpt_sockaddr(tvb, 2, dtpt_tree, hf_dtpt_connect_addr, SOCKADDR_CONNECT);
 830                                 proto_tree_add_uint(dtpt_tree, hf_dtpt_error,
 831                                         tvb, 32, 4, tvb_get_letohl(tvb, 32));
 832                         }
 833                         break;
 834                 }
 835         }
 836
 837         return tvb_length(tvb);
 838 }
 839
 840
 841 void
 842 proto_reg_handoff_dtpt(void)
 843 {
 844         static dissector_handle_t       dtpt_handle;
 845         static gboolean Initialized=FALSE;
 846         static int ServerPort;
 847
 848         if (!Initialized) {
 849                 dtpt_handle = new_create_dissector_handle(dissect_dtpt, proto_dtpt);
 850                 dtpt_conversation_handle = new_create_dissector_handle(dissect_dtpt_conversation, proto_dtpt);
 851 /**             dtpt_data_handle = new_create_dissector_handle(dissect_dtpt_data, proto_dtpt); **/
 852
 853                 data_handle = find_dissector("data");
 854                 Initialized=TRUE;
 855         } else {
 856                 dissector_delete("tcp.port", ServerPort, dtpt_handle);
 857         }
 858
 859         /* set port for future deletes */
 860         ServerPort=gbl_dtptServerPort;
 861
 862         dissector_add("tcp.port", gbl_dtptServerPort, dtpt_handle);
 863 }
 864
 865
 866 void
 867 proto_register_dtpt(void)
 868 {
 869   static hf_register_info hf[] = {
 870     { &hf_dtpt_version,
 871       { "Version", "dtpt.version",
 872         FT_UINT8, BASE_DEC, NULL, 0x0,
 873         "Protocol Version", HFILL }},
 874     { &hf_dtpt_message_type,
 875       { "Message Type", "dtpt.message_type",
 876         FT_UINT8, BASE_DEC, VALS(names_message_type), 0x0,
 877         "Packet Message Type", HFILL }},
 878     { &hf_dtpt_flags,
 879       { "ControlFlags", "dtpt.flags",
 880         FT_UINT32, BASE_HEX, NULL, 0x0,
 881         "ControlFlags as documented for WSALookupServiceBegin", HFILL }},
 882     { &hf_dtpt_flags_deep,
 883       { "DEEP", "dtpt.flags.deep",
 884         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_DEEP,
 885         NULL, HFILL }},
 886     { &hf_dtpt_flags_containers,
 887       { "CONTAINERS", "dtpt.flags.containers",
 888         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_CONTAINERS,
 889         NULL, HFILL }},
 890     { &hf_dtpt_flags_nocontainers,
 891       { "NOCONTAINERS", "dtpt.flags.nocontainers",
 892         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_NOCONTAINERS,
 893         NULL, HFILL }},
 894     { &hf_dtpt_flags_nearest,
 895       { "NEAREST", "dtpt.flags.nearest",
 896         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_NEAREST,
 897         NULL, HFILL }},
 898     { &hf_dtpt_flags_return_name,
 899       { "RETURN_NAME", "dtpt.flags.return_name",
 900         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_NAME,
 901         NULL, HFILL }},
 902     { &hf_dtpt_flags_return_type,
 903       { "RETURN_TYPE", "dtpt.flags.return_type",
 904         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_TYPE,
 905         NULL, HFILL }},
 906     { &hf_dtpt_flags_return_version,
 907       { "RETURN_VERSION", "dtpt.flags.return_version",
 908         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_VERSION,
 909         NULL, HFILL }},
 910     { &hf_dtpt_flags_return_comment,
 911       { "RETURN_COMMENT", "dtpt.flags.return_comment",
 912         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_COMMENT,
 913         NULL, HFILL }},
 914     { &hf_dtpt_flags_return_addr,
 915       { "RETURN_ADDR", "dtpt.flags.return_addr",
 916         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_ADDR,
 917         NULL, HFILL }},
 918     { &hf_dtpt_flags_return_blob,
 919       { "RETURN_BLOB", "dtpt.flags.return_blob",
 920         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_BLOB,
 921         NULL, HFILL }},
 922     { &hf_dtpt_flags_return_aliases,
 923       { "RETURN_ALIASES", "dtpt.flags.return_aliases",
 924         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_ALIASES,
 925         NULL, HFILL }},
 926     { &hf_dtpt_flags_return_query_string,
 927       { "RETURN_QUERY_STRING", "dtpt.flags.return_query_string",
 928         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RETURN_QUERY_STRING,
 929         NULL, HFILL }},
 930     { &hf_dtpt_flags_flushcache,
 931       { "FLUSHCACHE", "dtpt.flags.flushcache",
 932         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_FLUSHCACHE,
 933         NULL, HFILL }},
 934     { &hf_dtpt_flags_flushprevious,
 935       { "FLUSHPREVIOUS", "dtpt.flags.flushprevious",
 936         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_FLUSHPREVIOUS,
 937         NULL, HFILL }},
 938     { &hf_dtpt_flags_res_service,
 939       { "RES_SERVICE", "dtpt.flags.res_service",
 940         FT_BOOLEAN, 32, TFS(&tfs_set_notset), LUP_RES_SERVICE,
 941         NULL, HFILL }},
 942     { &hf_dtpt_payload_size,
 943       { "Payload Size", "dtpt.payload_size",
 944         FT_UINT32, BASE_DEC, NULL, 0x0,
 945         "Payload Size of the following packet containing a serialized WSAQUERYSET", HFILL }},
 946     { &hf_dtpt_handle,
 947       { "Handle", "dtpt.handle",
 948         FT_UINT64, BASE_HEX, NULL, 0x0,
 949         "Lookup handle", HFILL }},
 950     { &hf_dtpt_error,
 951       { "Last Error", "dtpt.error",
 952         FT_UINT32, BASE_DEC, VALS(names_error), 0x0,
 953         NULL, HFILL }},
 954     { &hf_dtpt_buffer_size,
 955       { "Buffer Size", "dtpt.buffer_size",
 956         FT_UINT32, BASE_DEC, NULL, 0x0,
 957         NULL, HFILL }},
 958     { &hf_dtpt_data_size,
 959       { "Data Size", "dtpt.data_size",
 960         FT_UINT32, BASE_DEC, NULL, 0x0,
 961         NULL, HFILL }},
 962     { &hf_dtpt_queryset_rawsize,
 963       { "QuerySet Size", "dtpt.queryset_size",
 964         FT_UINT32, BASE_DEC, NULL, 0x0,
 965         "Size of the binary WSAQUERYSET", HFILL }},
 966     { &hf_dtpt_queryset_size,
 967       { "dwSize", "dtpt.queryset.dwSize",
 968         FT_UINT32, BASE_DEC, NULL, 0x0,
 969         "dwSize field in WSAQUERYSET", HFILL }},
 970     { &hf_dtpt_queryset_service_instance_name_pointer,
 971       { "lpszServiceInstanceName", "dtpt.queryset.lpszServiceInstanceName",
 972         FT_UINT32, BASE_HEX, NULL, 0x0,
 973         "lpszServiceInstanceName field in WSAQUERYSET", HFILL }},
 974     { &hf_dtpt_queryset_service_class_id_pointer,
 975       { "lpServiceClassId", "dtpt.queryset.lpServiceClassId",
 976         FT_UINT32, BASE_HEX, NULL, 0x0,
 977         "lpServiceClassId in the WSAQUERYSET", HFILL }},
 978     { &hf_dtpt_queryset_version,
 979       { "lpVersion", "dtpt.queryset.lpVersion",
 980         FT_UINT32, BASE_DEC, NULL, 0x0,
 981         "lpVersion in WSAQUERYSET", HFILL }},
 982     { &hf_dtpt_queryset_comment_pointer,
 983       { "lpszComment", "dtpt.lpszComment",
 984         FT_UINT32, BASE_HEX, NULL, 0x0,
 985         "lpszComment field in WSAQUERYSET", HFILL }},
 986     { &hf_dtpt_queryset_namespace,
 987       { "dwNameSpace", "dtpt.queryset.dwNameSpace",
 988         FT_UINT32, BASE_DEC, NULL, 0x0,
 989         "dwNameSpace field in WSAQUERYSE", HFILL }},
 990     { &hf_dtpt_queryset_provider_id_pointer,
 991       { "lpNSProviderId", "dtpt.queryset.lpNSProviderId",
 992         FT_UINT32, BASE_HEX, NULL, 0x0,
 993         "lpNSProviderId field in WSAQUERYSET", HFILL }},
 994     { &hf_dtpt_queryset_context_pointer,
 995       { "lpszContext", "dtpt.queryset.lpszContext",
 996         FT_UINT32, BASE_HEX, NULL, 0x0,
 997         "lpszContext field in WSAQUERYSET", HFILL }},
 998     { &hf_dtpt_queryset_protocols_number,
 999       { "dwNumberOfProtocols", "dtpt.queryset.dwNumberOfProtocols",
1000         FT_UINT32, BASE_DEC, NULL, 0x0,
1001         "dwNumberOfProtocols field in WSAQUERYSET", HFILL }},
1002     { &hf_dtpt_queryset_protocols_pointer,
1003       { "lpafpProtocols", "dtpt.queryset.lpafpProtocols",
1004         FT_UINT32, BASE_HEX, NULL, 0x0,
1005         "lpafpProtocols field in WSAQUERYSET", HFILL }},
1006     { &hf_dtpt_queryset_query_string_pointer,
1007       { "lpszQueryString", "dtpt.queryset.lpszQueryString",
1008         FT_UINT32, BASE_HEX, NULL, 0x0,
1009         "lpszQueryString field in WSAQUERYSET", HFILL }},
1010     { &hf_dtpt_queryset_cs_addrs_number,
1011       { "dwNumberOfCsAddrs", "dtpt.queryset.dwNumberOfCsAddrs",
1012         FT_UINT32, BASE_DEC, NULL, 0x0,
1013         "dwNumberOfCsAddrs field in WSAQUERYSET", HFILL }},
1014     { &hf_dtpt_queryset_cs_addrs_pointer,
1015       { "lpcsaBuffer", "dtpt.queryset.lpcsaBuffer",
1016         FT_UINT32, BASE_HEX, NULL, 0x0,
1017         "lpcsaBuffer field in WSAQUERYSET", HFILL }},
1018     { &hf_dtpt_queryset_output_flags,
1019       { "dwOutputFlags", "dtpt.queryset.dwOutputFlags",
1020         FT_UINT32, BASE_HEX, NULL, 0x0,
1021         "dwOutputFlags field in WSAQUERYSET", HFILL }},
1022     { &hf_dtpt_queryset_blob_pointer,
1023       { "lpBlob", "dtpt.queryset.lpBlob",
1024         FT_UINT32, BASE_HEX, NULL, 0x0,
1025         "lpBlob field in WSAQUERYSET", HFILL }},
1026     { &hf_dtpt_wstring_length,
1027       { "Length", "dtpt.wstring.length",
1028         FT_UINT32, BASE_DEC, NULL, 0x0,
1029         "String Length", HFILL }},
1030     { &hf_dtpt_wstring_data,
1031       { "Data", "dtpt.wstring.data",
1032         FT_STRING, BASE_NONE, NULL, 0x0,
1033         "String Data", HFILL }},
1034     { &hf_dtpt_guid_length,
1035       { "Length", "dtpt.guid.length",
1036         FT_UINT32, BASE_DEC, NULL, 0x0,
1037         "GUID Length", HFILL }},
1038     { &hf_dtpt_guid_data,
1039       { "Data", "dtpt.guid.data",
1040         FT_GUID, BASE_NONE, NULL, 0x0,
1041         "GUID Data", HFILL }},
1042     { &hf_dtpt_service_instance_name,
1043       { "Service Instance Name", "dtpt.service_instance_name",
1044         FT_STRINGZ, BASE_NONE, NULL, 0x0,
1045         NULL, HFILL }},
1046     { &hf_dtpt_service_class_id,
1047       { "Service Class ID", "dtpt.service_class_id",
1048         FT_GUID, BASE_NONE, NULL, 0x0,
1049         NULL, HFILL }},
1050     { &hf_dtpt_comment,
1051       { "Comment", "dtpt.comment",
1052         FT_STRINGZ, BASE_NONE, NULL, 0x0,
1053         NULL, HFILL }},
1054     { &hf_dtpt_ns_provider_id,
1055       { "NS Provider ID", "dtpt.ns_provider_id",
1056         FT_GUID, BASE_NONE, NULL, 0x0,
1057         NULL, HFILL }},
1058     { &hf_dtpt_context,
1059       { "Context", "dtpt.context",
1060         FT_STRINGZ, BASE_NONE, NULL, 0x0,
1061         NULL, HFILL }},
1062     { &hf_dtpt_protocols_number,
1063       { "Number of Protocols", "dtpt.protocols.number",
1064         FT_UINT32, BASE_DEC, NULL, 0x0,
1065         NULL, HFILL }},
1066     { &hf_dtpt_protocols_length,
1067       { "Length of Protocols", "dtpt.protocols.length",
1068         FT_UINT32, BASE_DEC, NULL, 0x0,
1069         NULL, HFILL }},
1070     { &hf_dtpt_protocol_family,
1071       { "Family", "dtpt.protocol.family",
1072         FT_UINT32, BASE_DEC, VALS(names_family), 0x0,
1073         "Protocol Family", HFILL }},
1074     { &hf_dtpt_protocol_protocol,
1075       { "Protocol", "dtpt.protocol.protocol",
1076         FT_UINT32, BASE_DEC, VALS(names_protocol), 0x0,
1077         "Protocol Protocol", HFILL }},
1078     { &hf_dtpt_query_string,
1079       { "Query String", "dtpt.query_string",
1080         FT_STRINGZ, BASE_NONE, NULL, 0x0,
1081         NULL, HFILL }},
1082     { &hf_dtpt_cs_addrs_number,
1083       { "Number of CS Addresses", "dtpt.cs_addrs.number",
1084         FT_UINT32, BASE_DEC, NULL, 0x0,
1085         NULL, HFILL }},
1086     { &hf_dtpt_cs_addrs_length1,
1087       { "Length of CS Addresses Part 1", "dtpt.cs_addrs.length1",
1088         FT_UINT32, BASE_DEC, NULL, 0x0,
1089         NULL, HFILL }},
1090     { &hf_dtpt_cs_addr_socket_type,
1091       { "Socket Type", "dtpt.cs_addrs.socket_type",
1092         FT_UINT32, BASE_DEC, VALS(names_socket_type), 0x0,
1093         NULL, HFILL }},
1094     { &hf_dtpt_cs_addr_protocol,
1095       { "Protocol", "dtpt.cs_addrs.protocol",
1096         FT_UINT32, BASE_DEC, VALS(names_protocol), 0x0,
1097         NULL, HFILL }},
1098     { &hf_dtpt_cs_addr_local_pointer,
1099       { "Local Address Pointer", "dtpt.cs_addr.local_pointer",
1100         FT_UINT32, BASE_HEX, NULL, 0x0,
1101         NULL, HFILL }},
1102     { &hf_dtpt_cs_addr_local_length,
1103       { "Local Address Length", "dtpt.cs_addr.local_length",
1104         FT_UINT32, BASE_DEC, NULL, 0x0,
1105         "Local Address Pointer", HFILL }},
1106     { &hf_dtpt_cs_addr_local,
1107       { "Local Address", "dtpt.cs_addr.local",
1108         FT_UINT32, BASE_DEC, NULL, 0x0,
1109         NULL, HFILL }},
1110     { &hf_dtpt_cs_addr_remote_pointer,
1111       { "Remote Address Pointer", "dtpt.cs_addr.remote_pointer",
1112         FT_UINT32, BASE_HEX, NULL, 0x0,
1113         NULL, HFILL }},
1114     { &hf_dtpt_cs_addr_remote_length,
1115       { "Remote Address Length", "dtpt.cs_addr.remote_length",
1116         FT_UINT32, BASE_DEC, NULL, 0x0,
1117         "Remote Address Pointer", HFILL }},
1118     { &hf_dtpt_cs_addr_remote,
1119       { "Remote Address", "dtpt.cs_addr.remote",
1120         FT_UINT32, BASE_DEC, NULL, 0x0,
1121         NULL, HFILL }},
1122     { &hf_dtpt_sockaddr_length,
1123       { "Length", "dtpt.sockaddr.length",
1124         FT_UINT16, BASE_DEC, NULL, 0x0,
1125         "Socket Address Length", HFILL }},
1126     { &hf_dtpt_sockaddr_family,
1127       { "Family", "dtpt.sockaddr.family",
1128         FT_UINT16, BASE_DEC, VALS(names_family), 0x0,
1129         "Socket Address Family", HFILL }},
1130     { &hf_dtpt_sockaddr_port,
1131       { "Port", "dtpt.sockaddr.port",
1132         FT_UINT16, BASE_DEC, NULL, 0x0,
1133         "Socket Address Port", HFILL }},
1134     { &hf_dtpt_sockaddr_address,
1135       { "Address", "dtpt.sockaddr.address",
1136         FT_IPv4, BASE_NONE, NULL, 0x0,
1137         "Socket Address Address", HFILL }},
1138     { &hf_dtpt_blob_rawsize,
1139       { "Blob Size", "dtpt.blob_size",
1140         FT_UINT32, BASE_DEC, NULL, 0x0,
1141         "Size of the binary BLOB", HFILL }},
1142     { &hf_dtpt_blob_size,
1143       { "cbSize", "dtpt.blob.cbSize",
1144         FT_UINT32, BASE_DEC, NULL, 0x0,
1145         "cbSize field in BLOB", HFILL }},
1146     { &hf_dtpt_blob_data_pointer,
1147       { "pBlobData", "dtpt.blob.pBlobData",
1148         FT_UINT32, BASE_HEX, NULL, 0x0,
1149         "pBlobData field in BLOB", HFILL }},
1150     { &hf_dtpt_blob_data_length,
1151       { "Length", "dtpt.blob.data_length",
1152         FT_UINT32, BASE_DEC, NULL, 0x0,
1153         "Length of the Blob Data Block", HFILL }},
1154     { &hf_dtpt_blob_data,
1155       { "Data", "dtpt.blob.data",
1156         FT_BYTES, BASE_NONE, NULL, 0x0,
1157         "Blob Data Block", HFILL }},
1158     { &hf_dtpt_connect_addr,
1159       { "Address", "dtpt.blob.data",
1160         FT_UINT32, BASE_DEC, NULL, 0x0,
1161         "Connect to Address", HFILL }},
1162   };
1163         static gint *ett[] = {
1164                 &ett_dtpt,
1165                 &ett_dtpt_flags,
1166                 &ett_dtpt_queryset,
1167                 &ett_dtpt_wstring,
1168                 &ett_dtpt_guid,
1169                 &ett_dtpt_protocols,
1170                 &ett_dtpt_protocol,
1171                 &ett_dtpt_cs_addrs,
1172                 &ett_dtpt_cs_addr1,
1173                 &ett_dtpt_cs_addr2,
1174                 &ett_dtpt_sockaddr,
1175                 &ett_dtpt_blobraw,
1176                 &ett_dtpt_blob,
1177         };
1178         module_t *dtpt_module;
1179         e_guid_t guid_svcid_inet_hostaddrbyname       = {0x0002A803, 0x0000, 0x0000, {0xC0,0,0,0,0,0,0,0x46}};
1180         e_guid_t guid_svcid_inet_hostaddrbyinetstring = {0x0002A801, 0x0000, 0x0000, {0xC0,0,0,0,0,0,0,0x46}};
1181         guids_add_guid(&guid_svcid_inet_hostaddrbyname,       "SVCID_INET_HOSTADDRBYNAME");
1182         guids_add_guid(&guid_svcid_inet_hostaddrbyinetstring, "SVCID_INET_HOSTADDRBYINETSTRING");
1183
1184         proto_dtpt = proto_register_protocol("DeskTop PassThrough Protocol",
1185                                         "DTPT", "dtpt");
1186         proto_register_field_array(proto_dtpt, hf, array_length(hf));
1187         proto_register_subtree_array(ett, array_length(ett));
1188
1189         /* Register a configuration option for port */
1190         dtpt_module = prefs_register_protocol(proto_dtpt,
1191                 proto_reg_handoff_dtpt);
1192         prefs_register_uint_preference(dtpt_module, "tcp.port",
1193                                         "DTPT Server TCP Port",
1194                                         "Set the TDP port for the DTPT Server",
1195                                         10, &gbl_dtptServerPort);
1196 }