epan/dissectors/packet-smb-logon.c

   1 /* packet-smb-logon.c
   2  * Routines for SMB net logon packet dissection
   3  * Copyright 2000, Jeffrey C. Foster <jfoste@woodward.com>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * Copied from packet-pop.c
  12  *
  13  * This program is free software; you can redistribute it and/or
  14  * modify it under the terms of the GNU General Public License
  15  * as published by the Free Software Foundation; either version 2
  16  * of the License, or (at your option) any later version.
  17  *
  18  * This program is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU General Public License for more details.
  22  *
  23  * You should have received a copy of the GNU General Public License
  24  * along with this program; if not, write to the Free Software
  25  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  26  */
  27
  28 #ifdef HAVE_CONFIG_H
  29 # include "config.h"
  30 #endif
  31
  32 #include <glib.h>
  33
  34 #include <epan/packet.h>
  35 #include "packet-windows-common.h"
  36 #include "packet-smb-common.h"
  37
  38 static int proto_smb_logon = -1;
  39 static int hf_command = -1;
  40 static int hf_computer_name = -1;
  41 static int hf_unicode_computer_name = -1;
  42 static int hf_server_name = -1;
  43 static int hf_user_name = -1;
  44 static int hf_domain_name = -1;
  45 static int hf_server_dns_name = -1;
  46 static int hf_forest_dns_name = -1;
  47 static int hf_domain_dns_name = -1;
  48 static int hf_mailslot_name = -1;
  49 static int hf_pdc_name = -1;
  50 static int hf_unicode_pdc_name = -1;
  51 static int hf_script_name = -1;
  52 static int hf_nt_version = -1;
  53 static int hf_lmnt_token = -1;
  54 static int hf_lm_token = -1;
  55 static int hf_major_version = -1;
  56 static int hf_minor_version = -1;
  57 static int hf_os_version = -1;
  58 static int hf_date_time = -1;
  59 static int hf_update_type = -1;
  60 static int hf_request_count = -1;
  61 static int hf_flags_autolock = -1;
  62 static int hf_flags_expire = -1;
  63 static int hf_flags_server_trust = -1;
  64 static int hf_flags_workstation_trust = -1;
  65 static int hf_flags_interdomain_trust = -1;
  66 static int hf_flags_mns_user = -1;
  67 static int hf_flags_normal_user = -1;
  68 static int hf_flags_temp_dup_user = -1;
  69 static int hf_flags_password_required = -1;
  70 static int hf_flags_homedir_required = -1;
  71 static int hf_flags_enabled = -1;
  72 static int hf_domain_sid_size = -1;
  73 static int hf_low_serial = -1;
  74 static int hf_pulse = -1;
  75 static int hf_random = -1;
  76 static int hf_db_count = -1;
  77 static int hf_db_index = -1;
  78 static int hf_large_serial = -1;
  79 static int hf_nt_date_time = -1;
  80
  81 static int hf_unknown8 = -1;
  82 static int hf_unknown32 = -1;
  83
  84 static int hf_domain_guid = -1;
  85 static int hf_server_ip = -1;
  86
  87 static int hf_server_site_name = -1;
  88 static int hf_client_site_name = -1;
  89
  90 static int ett_smb_logon = -1;
  91 static int ett_smb_account_flags = -1;
  92 static int ett_smb_db_info = -1;
  93
  94 #define ACC_FLAG_AUTO_LOCKED                    0x0400
  95 #define ACC_FLAG_EXPIRE                         0x0200
  96 #define ACC_FLAG_SERVER_TRUST                   0x0100
  97 #define ACC_FLAG_WORKSTATION_TRUST              0x0080
  98 #define ACC_FLAG_INTERDOMAIN_TRUST              0x0040
  99 #define ACC_FLAG_MNS_USER                       0x0020
 100 #define ACC_FLAG_NORMAL_USER                    0x0010
 101 #define ACC_FLAG_TEMP_DUP_USER                  0x0008
 102 #define ACC_FLAG_PASSWORD_REQUIRED              0x0004
 103 #define ACC_FLAG_HOMEDIR_REQUIRED               0x0002
 104 #define ACC_FLAG_ENABLED                        0x0001
 105
 106 static const true_false_string tfs_flags_autolock = {
 107         "User account auto-locked",
 108         "User account NOT auto-locked"
 109 };
 110 static const true_false_string tfs_flags_expire = {
 111         "User password will NOT expire",
 112         "User password will expire"
 113 };
 114 static const true_false_string tfs_flags_server_trust = {
 115         "Server Trust user account",
 116         "NOT a Server Trust user account"
 117 };
 118 static const true_false_string tfs_flags_workstation_trust = {
 119         "Workstation Trust user account",
 120         "NOT a Workstation Trust user account"
 121 };
 122 static const true_false_string tfs_flags_interdomain_trust = {
 123         "Inter-domain Trust user account",
 124         "NOT a Inter-domain Trust user account"
 125 };
 126 static const true_false_string tfs_flags_mns_user = {
 127         "MNS Logon user account",
 128         "NOT a MNS Logon user account"
 129 };
 130 static const true_false_string tfs_flags_normal_user = {
 131         "Normal user account",
 132         "NOT a normal user account"
 133 };
 134 static const true_false_string tfs_flags_temp_dup_user = {
 135         "Temp duplicate user account",
 136         "NOT a temp duplicate user account"
 137 };
 138 static const true_false_string tfs_flags_password_required = {
 139         "NO password required",
 140         "Password required"
 141 };
 142 static const true_false_string tfs_flags_homedir_required = {
 143         "NO homedir required",
 144         "Homedir required"
 145 };
 146 static const true_false_string tfs_flags_enabled = {
 147         "User account enabled",
 148         "User account disabled"
 149 };
 150
 151
 152
 153 static int
 154 dissect_account_control(tvbuff_t *tvb, proto_tree *tree, int offset)
 155 {
 156         /* display the Allowable Account control bits */
 157
 158         proto_item *ti = NULL;
 159         proto_tree *flags_tree = NULL;
 160         guint32 flags;
 161
 162         flags = tvb_get_letohl(tvb, offset);
 163
 164         if (tree) {
 165                 ti = proto_tree_add_text(tree, tvb, offset, 4,
 166                         "Account control  = 0x%04x", flags);
 167
 168                 flags_tree = proto_item_add_subtree(ti, ett_smb_account_flags);
 169         }
 170
 171         proto_tree_add_boolean(flags_tree, hf_flags_autolock, tvb, offset, 4, flags);
 172         proto_tree_add_boolean(flags_tree, hf_flags_expire, tvb, offset, 4, flags);
 173         proto_tree_add_boolean(flags_tree, hf_flags_server_trust, tvb, offset, 4, flags);
 174         proto_tree_add_boolean(flags_tree, hf_flags_workstation_trust, tvb, offset, 4, flags);
 175         proto_tree_add_boolean(flags_tree, hf_flags_interdomain_trust, tvb, offset, 4, flags);
 176         proto_tree_add_boolean(flags_tree, hf_flags_mns_user, tvb, offset, 4, flags);
 177         proto_tree_add_boolean(flags_tree, hf_flags_normal_user, tvb, offset, 4, flags);
 178         proto_tree_add_boolean(flags_tree, hf_flags_temp_dup_user, tvb, offset, 4, flags);
 179         proto_tree_add_boolean(flags_tree, hf_flags_password_required, tvb, offset, 4, flags);
 180         proto_tree_add_boolean(flags_tree, hf_flags_homedir_required, tvb, offset, 4, flags);
 181         proto_tree_add_boolean(flags_tree, hf_flags_enabled, tvb, offset, 4, flags);
 182
 183         offset += 4;
 184
 185         return offset;
 186 }
 187
 188 static int
 189 display_LM_token(tvbuff_t *tvb, int offset, proto_tree *tree)
 190 {
 191         guint16 Token;
 192
 193         Token = tvb_get_letohs(tvb, offset);
 194
 195         if (Token & 0x01) {
 196                 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
 197                         Token,
 198                         "LM20 Token: 0x%04x (LanMan 2.0 or higher)", Token);
 199         } else {
 200                 /*
 201                  * XXX - are all values with the lower bit set LM 2.0,
 202                  * and all values with it not set LM 1.0?
 203                  * What do the other bits mean, if anything?
 204                  */
 205                 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
 206                         Token,
 207                         "LM10 Token: 0x%04x (WFW Networking)", Token);
 208         }
 209
 210         offset += 2;
 211
 212         return offset;
 213 }
 214
 215 static int
 216 display_LMNT_token(tvbuff_t *tvb, int offset, proto_tree *tree)
 217 {
 218         guint16 Token;
 219
 220         Token = tvb_get_letohs(tvb, offset);
 221
 222         if (Token == 0xffff) {
 223                 proto_tree_add_uint_format(tree, hf_lmnt_token, tvb, offset, 2,
 224                         Token,
 225                         "LMNT Token: 0x%04x (Windows NT Networking)", Token);
 226         } else {
 227                 /*
 228                  * XXX - what is it if it's not 0xffff?
 229                  */
 230                 proto_tree_add_uint_format(tree, hf_lm_token, tvb, offset, 2,
 231                         Token,
 232                         "LMNT Token: 0x%04x (Unknown)", Token);
 233         }
 234
 235         offset += 2;
 236
 237         return offset;
 238 }
 239
 240 static int
 241 dissect_smb_logon_request(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 242 {
 243         /*** 0x00 (LM1.0/LM2.0 LOGON Request) ***/
 244
 245         /* computer name */
 246         offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
 247
 248         /* user name */
 249         offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
 250
 251         /* mailslot name */
 252         offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
 253
 254         /*$$$$$ here add the Mailslot to the response list (if needed) */
 255
 256         /* Request count */
 257         proto_tree_add_item(tree, hf_request_count, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 258         offset += 1;
 259
 260         /* NT version */
 261         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 262         offset += 2;
 263
 264         /* LM token */
 265         offset = display_LM_token(tvb, offset, tree);
 266
 267         return offset;
 268 }
 269
 270
 271
 272 static int
 273 dissect_smb_logon_LM10_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 274 {
 275         /*** 0x01 LanMan 1.0 Logon response ***/
 276
 277         /* user name */
 278         offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
 279
 280         /* script name */
 281         offset = display_ms_string(tvb, tree, offset, hf_script_name, NULL);
 282
 283         return offset;
 284 }
 285
 286
 287 static int
 288 dissect_smb_logon_2(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 289 {
 290         /*** 0x02  LM1.0 Query - Centralized Initialization ***/
 291         /*** 0x03  LM1.0 Query - Distributed Initialization ***/
 292         /*** 0x04  LM1.0 Query - Centralized Query Response ***/
 293         /*** 0x04  LM1.0 Query - Distributed Query Response ***/
 294
 295         /* computer name */
 296         offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
 297
 298         /* mailslot name */
 299         offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
 300
 301         /* NT version */
 302         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 303         offset += 2;
 304
 305         /* LM token */
 306         offset = display_LM_token(tvb, offset, tree);
 307
 308         return offset;
 309 }
 310
 311
 312
 313 static int
 314 dissect_smb_logon_LM20_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 315 {
 316         /*** 0x06 (LM2.0 LOGON Response)        ***/
 317
 318         /* server name */
 319         offset = display_ms_string(tvb, tree, offset, hf_server_name, NULL);
 320
 321         /* LM token */
 322         offset = display_LM_token(tvb, offset, tree);
 323
 324         return offset;
 325 }
 326
 327
 328
 329 static int
 330 dissect_smb_pdc_query(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 331 {
 332         char *name;
 333
 334         /*** 0x07 Query for Primary PDC  ***/
 335
 336         /* computer name */
 337         offset = display_ms_string(tvb, tree, offset, hf_computer_name, &name);
 338
 339         if (check_col(pinfo->cinfo, COL_INFO))
 340                 col_append_fstr(pinfo->cinfo, COL_INFO, " from %s", name);
 341
 342         /* mailslot name */
 343         offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
 344
 345         if (tvb_reported_length_remaining(tvb, offset) > 2) {
 346                 /*
 347                  * NT-style Query for PDC?
 348                  * If only 2 bytes remain, it's probably a Windows 95-style
 349                  * query, which has only an LM token after the mailslot
 350                  * name.
 351                  *
 352                  * XXX - base this on flags in the SMB header, e.g.
 353                  * the ASCII/Unicode strings flag?
 354                  */
 355                 if (offset % 2) offset++;      /* word align ... */
 356
 357                 /* Unicode computer name */
 358                 offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name, NULL);
 359
 360                 /* NT version */
 361                 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 362                 offset += 4;
 363
 364                 /* LMNT token */
 365                 offset = display_LMNT_token(tvb, offset, tree);
 366         }
 367
 368         /* LM token */
 369         offset = display_LM_token(tvb, offset, tree);
 370
 371         return offset;
 372 }
 373
 374
 375
 376 static int
 377 dissect_smb_pdc_startup(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 378 {
 379         /*** 0x08  Announce startup of PDC ***/
 380
 381         /* pdc name */
 382         offset = display_ms_string(tvb, tree, offset, hf_pdc_name, NULL);
 383
 384         /* A short Announce will not have the rest */
 385
 386         if (tvb_reported_length_remaining(tvb, offset) != 0) {
 387           char *name = NULL;
 388
 389           if (offset % 2) offset++;      /* word align ... */
 390
 391           /* pdc name */
 392           offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name, &name);
 393
 394           if (name && check_col(pinfo->cinfo, COL_INFO)) {
 395                   col_append_fstr(pinfo->cinfo, COL_INFO, ": host %s", name);
 396                   name = NULL;
 397           }
 398
 399           if (offset % 2) offset++;
 400
 401           /* domain name */
 402           offset = display_unicode_string(tvb, tree, offset, hf_domain_name, &name);
 403
 404           if (name && check_col(pinfo->cinfo, COL_INFO)) {
 405                   col_append_fstr(pinfo->cinfo, COL_INFO, ", domain %s", name);
 406                   name = NULL;
 407           }
 408
 409           /* NT version */
 410           proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 411           offset += 4;
 412
 413           /* LMNT token */
 414           offset = display_LMNT_token(tvb, offset, tree);
 415
 416           /* LM token */
 417           offset = display_LM_token(tvb, offset, tree);
 418         }
 419
 420         return offset;
 421 }
 422
 423
 424
 425 static int
 426 dissect_smb_pdc_failure(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 427 {
 428         /*** 0x09 Announce failure of the PDC ***/
 429         /*** 0x0F LM2.0 Resp. during LOGON pause ***/
 430         /*** 0x10 (LM 2.0 Unknown user response) ***/
 431
 432         /* NT version */
 433         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 434         offset += 4;
 435
 436         /* LM token */
 437         offset = display_LM_token(tvb, offset, tree);
 438
 439         return offset;
 440 }
 441
 442
 443 static int
 444 dissect_announce_change(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 445 {
 446         /*** 0x0A ( Announce change to UAS or SAM ) ***/
 447         guint32 info_count;
 448         proto_item *ti = NULL;
 449         proto_tree *info_tree = NULL;
 450         guint32 db_index;
 451         guint32 domain_sid_size;
 452
 453         /* low serial number */
 454         proto_tree_add_item(tree, hf_low_serial, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 455         offset += 4;
 456
 457         /* date/time */
 458         /* XXX - what format is this?  Neither SMB_Date/SMB_Time nor
 459            "time_t but in the local time zone" appear to be correct. */
 460         proto_tree_add_item(tree, hf_date_time, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 461         offset += 4;
 462
 463         /* pulse */
 464         proto_tree_add_item(tree, hf_pulse, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 465         offset += 4;
 466
 467         /* random */
 468         proto_tree_add_item(tree, hf_random, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 469         offset += 4;
 470
 471         /* pdc name */
 472         offset = display_ms_string(tvb, tree, offset, hf_pdc_name, NULL);
 473
 474         /* domain name */
 475         offset = display_ms_string(tvb, tree, offset, hf_domain_name, NULL);
 476
 477         if (offset % 2) offset++;      /* word align ... */
 478
 479         if (tvb_reported_length_remaining(tvb, offset) > 2) {
 480                 /*
 481                  * XXX - older protocol versions don't have this stuff?
 482                  */
 483                 /* pdc name */
 484                 offset = display_unicode_string(tvb, tree, offset, hf_unicode_pdc_name, NULL);
 485
 486                 /* domain name */
 487                 offset = display_unicode_string(tvb, tree, offset, hf_domain_name, NULL);
 488
 489                 /* DB count */
 490                 info_count = tvb_get_letohl(tvb, offset);
 491                 proto_tree_add_uint(tree, hf_db_count, tvb, offset, 4, info_count);
 492                 offset += 4;
 493
 494                 while (info_count != 0) {
 495                         db_index = tvb_get_letohl(tvb, offset);
 496                         if (tree) {
 497                                 ti = proto_tree_add_text(tree, tvb, offset, 20,
 498                                     "DBChange Info Structure: index %u", db_index);
 499                                 info_tree = proto_item_add_subtree(ti, ett_smb_db_info);
 500                         }
 501
 502                         proto_tree_add_uint(info_tree, hf_db_index, tvb, offset, 4,
 503                             db_index);
 504                         offset += 4;
 505
 506                         proto_tree_add_item(info_tree, hf_large_serial, tvb, offset, 8,
 507                             ENC_LITTLE_ENDIAN);
 508                         offset += 8;
 509
 510                         offset = dissect_nt_64bit_time(tvb, info_tree, offset,
 511                             hf_nt_date_time);
 512
 513                         info_count--;
 514                 }
 515
 516                 /* Domain SID Size */
 517                 domain_sid_size = tvb_get_letohl(tvb, offset);
 518                 proto_tree_add_uint(tree, hf_domain_sid_size, tvb, offset, 4,
 519                     domain_sid_size);
 520                 offset += 4;
 521
 522                 if (domain_sid_size != 0) {
 523                         /* Align to four-byte boundary */
 524                         offset = ((offset + 3)/4)*4;
 525
 526                         /* Domain SID */
 527                         offset = dissect_nt_sid(
 528                                 tvb, offset, tree, "Domain", NULL, -1);
 529                 }
 530
 531                 /* NT version */
 532                 proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 533                 offset += 4;
 534
 535                 /* LMNT token */
 536                 offset = display_LMNT_token(tvb, offset, tree);
 537         }
 538
 539         /* LM token */
 540         offset = display_LM_token(tvb, offset, tree);
 541
 542         return offset;
 543 }
 544
 545
 546 static int
 547 dissect_smb_sam_logon_req(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 548 {
 549         /* Netlogon command 0x12 - decode the SAM logon request from client */
 550
 551         guint32 domain_sid_size;
 552
 553         /* Request count */
 554         proto_tree_add_item(tree, hf_request_count, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 555         offset += 2;
 556
 557         /* computer name */
 558         offset = display_unicode_string(tvb, tree, offset, hf_unicode_computer_name, NULL);
 559
 560         /* user name */
 561         offset = display_unicode_string(tvb, tree, offset, hf_user_name, NULL);
 562
 563         /* mailslot name */
 564         offset = display_ms_string(tvb, tree, offset, hf_mailslot_name, NULL);
 565
 566         /* account control */
 567         offset = dissect_account_control(tvb, tree, offset);
 568
 569         /* Domain SID Size */
 570         domain_sid_size = tvb_get_letohl(tvb, offset);
 571         proto_tree_add_uint(tree, hf_domain_sid_size, tvb, offset, 4,
 572             domain_sid_size);
 573         offset += 4;
 574
 575         if (domain_sid_size != 0) {
 576                 /* Align to four-byte boundary */
 577                 offset = ((offset + 3)/4)*4;
 578
 579                 /* Domain SID */
 580                 offset = dissect_nt_sid(tvb, offset, tree, "Domain", NULL, -1);
 581         }
 582
 583         /* NT version */
 584         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 585         offset += 4;
 586
 587         /* LMNT token */
 588         offset = display_LMNT_token(tvb, offset, tree);
 589
 590         /* LM token */
 591         offset = display_LM_token(tvb, offset, tree);
 592
 593         return offset;
 594 }
 595
 596
 597
 598 static int
 599 dissect_smb_no_user(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 600 {
 601         /* 0x0B (Announce no user on machine) */
 602
 603         /* computer name */
 604         offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
 605
 606         return offset;
 607 }
 608
 609
 610
 611 static int
 612 dissect_smb_relogon_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 613 {
 614         /*** 0x0d LanMan Response to relogon request ***/
 615
 616         /* Major version */
 617         proto_tree_add_item(tree, hf_major_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 618         offset += 1;
 619
 620         /* Minor version */
 621         proto_tree_add_item(tree, hf_minor_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 622         offset += 1;
 623
 624         /* OS version */
 625         proto_tree_add_item(tree, hf_os_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 626         offset += 1;
 627
 628         /* NT version */
 629         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 630         offset += 4;
 631
 632         /* LM token */
 633         offset = display_LM_token(tvb, offset, tree);
 634
 635         return offset;
 636 }
 637
 638
 639
 640 static int
 641 dissect_smb_acc_update(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 642 {
 643         /*** 0x11  LM2.1 Announce Acc updates  ***/
 644
 645         guint32 Temp1, Temp2;
 646
 647         Temp1 = tvb_get_letohl(tvb, offset);
 648         Temp2 = tvb_get_letohl(tvb, offset + 4);
 649
 650         /* signature */
 651         proto_tree_add_text(tree, tvb, offset, 8, "Signature: 0x%08x%08x",
 652                 Temp1, Temp2);
 653         offset += 8;
 654
 655         /* date/time */
 656         /* XXX - what format is this?  Neither SMB_Date/SMB_Time nor
 657            "time_t but in the local time zone" appear to be correct. */
 658         proto_tree_add_item(tree, hf_date_time, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 659         offset += 4;
 660
 661         /* computer name */
 662         offset = display_ms_string(tvb, tree, offset, hf_computer_name, NULL);
 663
 664         /* user name */
 665         offset = display_ms_string(tvb, tree, offset, hf_user_name, NULL);
 666
 667         /* update type */
 668         proto_tree_add_item(tree, hf_update_type, tvb, offset, 2, ENC_LITTLE_ENDIAN);
 669         offset += 2;
 670
 671         /* NT version */
 672         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 673         offset += 4;
 674
 675         /* LM token */
 676         offset = display_LM_token(tvb, offset, tree);
 677
 678         return offset;
 679 }
 680
 681
 682
 683 static int
 684 dissect_smb_inter_resp(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 685 {
 686         /* 0x0e LanMan Response to interrogate request */
 687
 688         /* Major version */
 689         proto_tree_add_item(tree, hf_major_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 690         offset += 1;
 691
 692         /* Minor version */
 693         proto_tree_add_item(tree, hf_minor_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 694         offset += 1;
 695
 696         /* OS version */
 697         proto_tree_add_item(tree, hf_os_version, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 698         offset += 1;
 699
 700         /* NT version */
 701         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 702         offset += 4;
 703
 704         /* LMNT token */
 705         offset = display_LMNT_token(tvb, offset, tree);
 706
 707         /* XXX - no LM token?  Every other packet has one after the LMNT
 708            token. */
 709
 710         return offset;
 711 }
 712
 713
 714 static int
 715 dissect_smb_sam_logon_resp(tvbuff_t *tvb, packet_info *pinfo _U_,
 716         proto_tree *tree, int offset)
 717 {
 718         /* Netlogon command 0x13 - decode the SAM logon response from server */
 719         /* Netlogon command 0x15 - decode the SAM logon response from server unknown user */
 720
 721         /* server name */
 722         offset = display_unicode_string(tvb, tree, offset, hf_server_name, NULL);
 723
 724         /* user name */
 725         offset = display_unicode_string(tvb, tree, offset, hf_user_name, NULL);
 726
 727         /* domain name */
 728         offset = display_unicode_string(tvb, tree, offset, hf_domain_name, NULL);
 729
 730         /* NT version */
 731         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 732         offset += 4;
 733
 734         /* LMNT token */
 735         offset = display_LMNT_token(tvb, offset, tree);
 736
 737         /* LM token */
 738         offset = display_LM_token(tvb, offset, tree);
 739
 740         return offset;
 741 }
 742
 743 static int
 744 dissect_smb_pdc_response_ads(tvbuff_t *tvb, packet_info *pinfo _U_,
 745         proto_tree *tree, int offset)
 746 {
 747         /* Netlogon command 0x17 - decode the response from PDC ADS */
 748         /* Netlogon command 0x19 - decode the response from PDC ADS USER ?*/
 749
 750         /* Align to four-byte boundary */
 751         offset = ((offset + 3)/4)*4;
 752
 753         /* unknown uint32 type */
 754         proto_tree_add_item(tree, hf_unknown32, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 755         offset += 4;
 756
 757         /* Domain GUID */
 758         proto_tree_add_item(tree, hf_domain_guid, tvb, offset, 16, ENC_NA);
 759         offset += 16;
 760
 761         /* forest dns name */
 762         offset=dissect_ms_compressed_string(tvb, tree, offset, hf_forest_dns_name, NULL);
 763
 764         /* domain dns name */
 765         offset=dissect_ms_compressed_string(tvb, tree, offset, hf_domain_dns_name, NULL);
 766
 767         /* server dns name */
 768         offset=dissect_ms_compressed_string(tvb, tree, offset, hf_server_dns_name, NULL);
 769
 770         /* domain name */
 771         offset=dissect_ms_compressed_string(tvb, tree, offset, hf_domain_name, NULL);
 772
 773         /* server name */
 774         offset=dissect_ms_compressed_string(tvb, tree, offset, hf_server_name, NULL);
 775
 776         /* user name */
 777         offset=dissect_ms_compressed_string(tvb, tree, offset, hf_user_name, NULL);
 778
 779         /* server_site name */
 780         offset=dissect_ms_compressed_string(tvb, tree, offset, hf_server_site_name, NULL);
 781
 782         /* client_site name */
 783         offset=dissect_ms_compressed_string(tvb, tree, offset, hf_client_site_name, NULL);
 784
 785         /* unknown uint8 type */
 786         proto_tree_add_item(tree, hf_unknown8, tvb, offset, 1, ENC_LITTLE_ENDIAN);
 787         offset += 1;
 788
 789         /* unknown uint32 type */
 790         proto_tree_add_item(tree, hf_unknown32, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 791         offset += 4;
 792
 793         /* server ip */
 794         proto_tree_add_item(tree, hf_server_ip, tvb, offset, 4, ENC_BIG_ENDIAN);
 795         offset += 4;
 796
 797         /* unknown uint32 type */
 798         proto_tree_add_item(tree, hf_unknown32, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 799         offset += 4;
 800
 801         /* unknown uint32 type */
 802         proto_tree_add_item(tree, hf_unknown32, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 803         offset += 4;
 804
 805         /* NT version */
 806         proto_tree_add_item(tree, hf_nt_version, tvb, offset, 4, ENC_LITTLE_ENDIAN);
 807         offset += 4;
 808
 809         /* LMNT token */
 810         offset = display_LMNT_token(tvb, offset, tree);
 811
 812         /* LM token */
 813         offset = display_LM_token(tvb, offset, tree);
 814
 815         return offset;
 816 }
 817
 818 static int
 819 dissect_smb_unknown(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree, int offset)
 820 {
 821         /* display data as unknown */
 822
 823         proto_tree_add_text(tree, tvb, offset, -1, "Data (%u bytes)",
 824             tvb_reported_length_remaining(tvb, offset));
 825
 826         return offset+tvb_length_remaining(tvb, offset);
 827 }
 828
 829 #define LOGON_LM10_LOGON_REQUEST                0x00
 830 #define LOGON_LM10_LOGON_RESPONSE               0x01
 831 #define LOGON_LM10_QUERY_CI                     0x02
 832 #define LOGON_LM10_QUERY_DI                     0x03
 833 #define LOGON_LM10_RESPONSE_CI                  0x04
 834 #define LOGON_LM10_RESPONSE_DI                  0x05
 835 #define LOGON_LM20_LOGON_RESPONSE               0x06
 836 #define LOGON_PDC_QUERY                         0x07
 837 #define LOGON_PDC_STARTUP                       0x08
 838 #define LOGON_PDC_FAILED                        0x09
 839 #define LOGON_UAS_SAM                           0x0a
 840 #define LOGON_NO_USER                           0x0b
 841 #define LOGON_PDC_RESPONSE                      0x0c
 842 #define LOGON_RELOGON_RESPONSE                  0x0d
 843 #define LOGON_INTERROGATE_RESPONSE              0x0e
 844 #define LOGON_LM20_RESPONSE_DURING_LOGON        0x0f
 845 #define LOGON_LM20_USER_UNKNOWN                 0x10
 846 #define LOGON_LM20_ACCOUNT_UPDATE               0x11
 847 #define LOGON_SAM_LOGON_REQUEST                 0x12
 848 #define LOGON_SAM_LOGON_RESPONSE                0x13
 849 #define LOGON_SAM_RESPONSE_DURING_LOGON         0x14
 850 #define LOGON_SAM_USER_UNKNOWN                  0x15
 851 #define LOGON_SAM_INTERROGATE_RESPONSE          0x16
 852 #define LOGON_SAM_AD_USER_UNKNOWN               0x17
 853 #define LOGON_SAM_UNKNOWN_18                    0x18
 854 #define LOGON_SAM_AD_LOGON_RESPONSE             0x19
 855 #define LOGON_LAST_CMD                          0x19
 856
 857 static const value_string commands[] = {
 858         {LOGON_LM10_LOGON_REQUEST,      "LM1.0/LM2.0 LOGON Request"},
 859         {LOGON_LM10_LOGON_RESPONSE,     "LM1.0 LOGON Response"},
 860         {LOGON_LM10_QUERY_CI,           "LM1.0 Query - Centralized Initialization"},
 861         {LOGON_LM10_QUERY_DI,           "LM1.0 Query - Distributed Initialization"},
 862         {LOGON_LM10_RESPONSE_CI,        "LM1.0 Response - Centralized Query"},
 863         {LOGON_LM10_RESPONSE_DI,        "LM1.0 Response - Distributed Initialization"},
 864         {LOGON_LM20_LOGON_RESPONSE,     "LM2.0 Response to LOGON Request"},
 865         {LOGON_PDC_QUERY,               "Query for PDC"},
 866         {LOGON_PDC_STARTUP,             "Announce Startup of PDC"},
 867         {LOGON_PDC_FAILED,              "Announce Failed PDC"},
 868         {LOGON_UAS_SAM,                 "Announce Change to UAS or SAM"},
 869         {LOGON_NO_USER,                 "Announce no user on machine"},
 870         {LOGON_PDC_RESPONSE,            "Response from PDC"},
 871         {LOGON_RELOGON_RESPONSE,        "LM1.0/LM2.0 Response to re-LOGON Request"},
 872         {LOGON_INTERROGATE_RESPONSE,    "LM1.0/LM2.0 Response to Interrogate Request"},
 873         {LOGON_LM20_RESPONSE_DURING_LOGON,"LM2.0 Response during LOGON pause"},
 874         {LOGON_LM20_USER_UNKNOWN,       "LM2.0 Response - user unknown"},
 875         {LOGON_LM20_ACCOUNT_UPDATE,     "LM2.0 Announce account updates"},
 876         {LOGON_SAM_LOGON_REQUEST,       "SAM LOGON request from client"},
 877         {LOGON_SAM_LOGON_RESPONSE,      "Response to SAM LOGON request"},
 878         {LOGON_SAM_RESPONSE_DURING_LOGON,"SAM Response during LOGON pause"},
 879         {LOGON_SAM_USER_UNKNOWN,        "SAM Response - user unknown"},
 880         {LOGON_SAM_INTERROGATE_RESPONSE,"SAM Response to Interrogate Request"},
 881         {LOGON_SAM_AD_USER_UNKNOWN,     "SAM Active Directory Response - user unknown"},
 882         {LOGON_SAM_UNKNOWN_18,          "SAM unknown command 0x18"},
 883         {LOGON_SAM_AD_LOGON_RESPONSE,   "Active Directory Response to SAM LOGON request"},
 884         {0,     NULL}
 885 };
 886
 887 static int (*dissect_smb_logon_cmds[])(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, int offset) = {
 888         dissect_smb_logon_request,  /* 0x00 (LM1.0/LM2.0 LOGON Request) */
 889         dissect_smb_logon_LM10_resp,/* 0x01 (LM1.0 LOGON Response)      */
 890         dissect_smb_logon_2,        /* 0x02 (LM1.0 Query Centralized Init.)*/
 891         dissect_smb_logon_2,        /* 0x03 (LM1.0 Query Distributed Init.)*/
 892         dissect_smb_logon_2,        /* 0x04 (LM1.0 Centralized Query Resp.)*/
 893         dissect_smb_logon_2,        /* 0x05 (LM1.0 Distributed Query Resp.) */
 894         dissect_smb_logon_LM20_resp,/* 0x06 (LM2.0 LOGON Response)      */
 895         dissect_smb_pdc_query,      /* 0x07 (Query for PDC)             */
 896         dissect_smb_pdc_startup,    /* 0x08 (Announce PDC startup)      */
 897         dissect_smb_pdc_failure,    /* 0x09 (Announce Failed PDC)       */
 898         dissect_announce_change,    /* 0x0A (Announce Change to UAS or SAM)*/
 899         dissect_smb_no_user,        /* 0x0B (Announce no user on machine)*/
 900         dissect_smb_pdc_startup,    /* 0x0C (Response from PDC)         */
 901         dissect_smb_relogon_resp,   /* 0x0D (Relogon response)          */
 902         dissect_smb_inter_resp,     /* 0x0E (Interrogate response)      */
 903         dissect_smb_pdc_failure,    /* 0x0F (LM2.0 Resp. during LOGON pause*/
 904         dissect_smb_pdc_failure,    /* 0x10 (LM 2.0 Unknown user response)*/
 905         dissect_smb_acc_update,     /* 0x11 (LM2.1 Announce Acc updates)*/
 906         dissect_smb_sam_logon_req,  /* 0x12 (SAM LOGON request )        */
 907         dissect_smb_sam_logon_resp, /* 0x13 (SAM LOGON response)        */
 908         dissect_smb_unknown,        /* 0x14 (SAM Response during LOGON Pause) */
 909         dissect_smb_sam_logon_resp, /* 0x15 (SAM Response User Unknown) */
 910         dissect_smb_unknown,        /* 0x16 (SAM Response to Interrogate)*/
 911         dissect_smb_pdc_response_ads,        /* 0x17 (SAM AD response User Unknown*/
 912         dissect_smb_unknown,        /* 0x18 (Unknown command)           */
 913         dissect_smb_pdc_response_ads         /* 0x19 (SAM LOGON AD response)    */
 914 };
 915
 916
 917 static void
 918 dissect_smb_logon(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 919 {
 920         int        offset = 0;
 921         guint8     cmd;
 922         proto_tree *smb_logon_tree = NULL;
 923         proto_item *item = NULL;
 924
 925         col_set_str(pinfo->cinfo, COL_PROTOCOL, "SMB_NETLOGON");
 926         col_clear(pinfo->cinfo, COL_INFO);
 927
 928         /* get the Command field */
 929         cmd = tvb_get_guint8(tvb, offset);
 930
 931         if (check_col(pinfo->cinfo, COL_INFO))
 932                 col_add_str(pinfo->cinfo, COL_INFO, val_to_str(cmd, commands, "Unknown Command:%02x") );
 933
 934         if (tree) {
 935                 item = proto_tree_add_item(tree, proto_smb_logon, tvb,
 936                         offset, -1, ENC_NA);
 937
 938                 smb_logon_tree = proto_item_add_subtree(item, ett_smb_logon);
 939         }
 940
 941         /* command */
 942         proto_tree_add_uint(smb_logon_tree, hf_command, tvb, offset, 1, cmd);
 943         offset += 1;
 944
 945         /* skip next byte */
 946         offset += 1;
 947
 948         if (cmd<LOGON_LAST_CMD) {
 949                 offset = (dissect_smb_logon_cmds[cmd])(tvb, pinfo,
 950                     smb_logon_tree, offset);
 951         } else {
 952                 /* unknown command */
 953                 offset = dissect_smb_unknown(tvb, pinfo, smb_logon_tree,
 954                     offset);
 955         }
 956 }
 957
 958 void
 959 proto_register_smb_logon( void)
 960 {
 961         static hf_register_info hf[] = {
 962                 { &hf_command,
 963                         { "Command", "smb_netlogon.command", FT_UINT8, BASE_HEX,
 964                           VALS(commands), 0, "SMB NETLOGON Command", HFILL }},
 965
 966                 { &hf_computer_name,
 967                         { "Computer Name", "smb_netlogon.computer_name", FT_STRING, BASE_NONE,
 968                           NULL, 0, "SMB NETLOGON Computer Name", HFILL }},
 969
 970                 { &hf_unicode_computer_name,
 971                         { "Unicode Computer Name", "smb_netlogon.unicode_computer_name", FT_STRING, BASE_NONE,
 972                           NULL, 0, "SMB NETLOGON Unicode Computer Name", HFILL }},
 973
 974                 { &hf_server_name,
 975                         { "Server Name", "smb_netlogon.server_name", FT_STRING, BASE_NONE,
 976                           NULL, 0, "SMB NETLOGON Server Name", HFILL }},
 977
 978                 { &hf_server_dns_name,
 979                         { "Server DNS Name", "smb_netlogon.server_dns_name", FT_STRING, BASE_NONE,
 980                           NULL, 0, "SMB NETLOGON Server DNS Name", HFILL }},
 981
 982                 { &hf_user_name,
 983                         { "User Name", "smb_netlogon.user_name", FT_STRING, BASE_NONE,
 984                           NULL, 0, "SMB NETLOGON User Name", HFILL }},
 985
 986                 { &hf_domain_name,
 987                         { "Domain Name", "smb_netlogon.domain_name", FT_STRING, BASE_NONE,
 988                           NULL, 0, "SMB NETLOGON Domain Name", HFILL }},
 989
 990                 { &hf_domain_dns_name,
 991                         { "Domain DNS Name", "smb_netlogon.domain_dns_name", FT_STRING, BASE_NONE,
 992                           NULL, 0, "SMB NETLOGON Domain DNS Name", HFILL }},
 993
 994                 { &hf_forest_dns_name,
 995                         { "Forest DNS Name", "smb_netlogon.forest_dns_name", FT_STRING, BASE_NONE,
 996                           NULL, 0, "SMB NETLOGON Forest DNS Name", HFILL }},
 997
 998                 { &hf_mailslot_name,
 999                         { "Mailslot Name", "smb_netlogon.mailslot_name", FT_STRING, BASE_NONE,
1000                           NULL, 0, "SMB NETLOGON Mailslot Name", HFILL }},
1001
1002                 { &hf_pdc_name,
1003                         { "PDC Name", "smb_netlogon.pdc_name", FT_STRING, BASE_NONE,
1004                           NULL, 0, "SMB NETLOGON PDC Name", HFILL }},
1005
1006                 { &hf_unicode_pdc_name,
1007                         { "Unicode PDC Name", "smb_netlogon.unicode_pdc_name", FT_STRING, BASE_NONE,
1008                           NULL, 0, "SMB NETLOGON Unicode PDC Name", HFILL }},
1009
1010                 { &hf_script_name,
1011                         { "Script Name", "smb_netlogon.script_name", FT_STRING, BASE_NONE,
1012                           NULL, 0, "SMB NETLOGON Script Name", HFILL }},
1013
1014                 { &hf_nt_version,
1015                         { "NT Version", "smb_netlogon.nt_version", FT_UINT32, BASE_DEC,
1016                           NULL, 0, "SMB NETLOGON NT Version", HFILL }},
1017
1018                 /* An LMNT Token, if 0xffff, is "WindowsNT Networking";
1019                    what is it otherwise? */
1020                 { &hf_lmnt_token,
1021                         { "LMNT Token", "smb_netlogon.lmnt_token", FT_UINT16, BASE_HEX,
1022                           NULL, 0, "SMB NETLOGON LMNT Token", HFILL }},
1023
1024                 { &hf_lm_token,
1025                         { "LM Token", "smb_netlogon.lm_token", FT_UINT16, BASE_HEX,
1026                           NULL, 0, "SMB NETLOGON LM Token", HFILL }},
1027
1028                 { &hf_major_version,
1029                         { "Workstation Major Version", "smb_netlogon.major_version", FT_UINT8, BASE_DEC,
1030                           NULL, 0, "SMB NETLOGON Workstation Major Version", HFILL }},
1031
1032                 { &hf_minor_version,
1033                         { "Workstation Minor Version", "smb_netlogon.minor_version", FT_UINT8, BASE_DEC,
1034                           NULL, 0, "SMB NETLOGON Workstation Minor Version", HFILL }},
1035
1036                 { &hf_os_version,
1037                         { "Workstation OS Version", "smb_netlogon.os_version", FT_UINT8, BASE_DEC,
1038                           NULL, 0, "SMB NETLOGON Workstation OS Version", HFILL }},
1039
1040                 { &hf_date_time,
1041                         { "Date/Time", "smb_netlogon.date_time", FT_UINT32, BASE_DEC,
1042                           NULL, 0, "SMB NETLOGON Date/Time", HFILL }},
1043
1044                 { &hf_update_type,
1045                         { "Update Type", "smb_netlogon.update", FT_UINT16, BASE_DEC,
1046                           NULL, 0, "SMB NETLOGON Update Type", HFILL }},
1047
1048                 { &hf_request_count,
1049                         { "Request Count", "smb_netlogon.request_count", FT_UINT16, BASE_DEC,
1050                           NULL, 0, "SMB NETLOGON Request Count", HFILL }},
1051
1052                 { &hf_flags_autolock,
1053                         { "Autolock", "smb_netlogon.flags.autolock", FT_BOOLEAN, 32,
1054                         TFS(&tfs_flags_autolock), ACC_FLAG_AUTO_LOCKED, "SMB NETLOGON Account Autolock", HFILL}},
1055
1056                 { &hf_flags_expire,
1057                         { "Expire", "smb_netlogon.flags.expire", FT_BOOLEAN, 32,
1058                         TFS(&tfs_flags_expire), ACC_FLAG_EXPIRE, "SMB NETLOGON Will Account Expire", HFILL}},
1059
1060                 { &hf_flags_server_trust,
1061                         { "Server Trust", "smb_netlogon.flags.server", FT_BOOLEAN, 32,
1062                         TFS(&tfs_flags_server_trust), ACC_FLAG_SERVER_TRUST, "SMB NETLOGON Server Trust Account", HFILL}},
1063
1064                 { &hf_flags_workstation_trust,
1065                         { "Workstation Trust", "smb_netlogon.flags.workstation", FT_BOOLEAN, 32,
1066                         TFS(&tfs_flags_workstation_trust), ACC_FLAG_WORKSTATION_TRUST, "SMB NETLOGON Workstation Trust Account", HFILL}},
1067
1068                 { &hf_flags_interdomain_trust,
1069                         { "Interdomain Trust", "smb_netlogon.flags.interdomain", FT_BOOLEAN, 32,
1070                         TFS(&tfs_flags_interdomain_trust), ACC_FLAG_INTERDOMAIN_TRUST, "SMB NETLOGON Inter-domain Trust Account", HFILL}},
1071
1072                 { &hf_flags_mns_user,
1073                         { "MNS User", "smb_netlogon.flags.mns", FT_BOOLEAN, 32,
1074                         TFS(&tfs_flags_mns_user), ACC_FLAG_MNS_USER, "SMB NETLOGON MNS User Account", HFILL}},
1075
1076                 { &hf_flags_normal_user,
1077                         { "Normal User", "smb_netlogon.flags.normal", FT_BOOLEAN, 32,
1078                         TFS(&tfs_flags_normal_user), ACC_FLAG_NORMAL_USER, "SMB NETLOGON Normal User Account", HFILL}},
1079
1080                 { &hf_flags_temp_dup_user,
1081                         { "Temp Duplicate User", "smb_netlogon.flags.temp_dup", FT_BOOLEAN, 32,
1082                         TFS(&tfs_flags_temp_dup_user), ACC_FLAG_TEMP_DUP_USER, "SMB NETLOGON Temp Duplicate User Account", HFILL}},
1083
1084                 { &hf_flags_password_required,
1085                         { "Password", "smb_netlogon.flags.password", FT_BOOLEAN, 32,
1086                         TFS(&tfs_flags_password_required), ACC_FLAG_PASSWORD_REQUIRED, "SMB NETLOGON Password Required", HFILL}},
1087
1088                 { &hf_flags_homedir_required,
1089                         { "Homedir", "smb_netlogon.flags.homedir", FT_BOOLEAN, 32,
1090                         TFS(&tfs_flags_homedir_required), ACC_FLAG_HOMEDIR_REQUIRED, "SMB NETLOGON Homedir Required", HFILL}},
1091
1092                 { &hf_flags_enabled,
1093                         { "Enabled", "smb_netlogon.flags.enabled", FT_BOOLEAN, 32,
1094                         TFS(&tfs_flags_enabled), ACC_FLAG_ENABLED, "SMB NETLOGON Is This Account Enabled", HFILL}},
1095
1096                 { &hf_domain_sid_size,
1097                         { "Domain SID Size", "smb_netlogon.domain_sid_size", FT_UINT32, BASE_DEC,
1098                           NULL, 0, "SMB NETLOGON Domain SID Size", HFILL }},
1099
1100                 { &hf_low_serial,
1101                         { "Low Serial Number", "smb_netlogon.low_serial", FT_UINT32, BASE_DEC,
1102                           NULL, 0, "SMB NETLOGON Low Serial Number", HFILL }},
1103
1104                 { &hf_pulse,
1105                         { "Pulse", "smb_netlogon.pulse", FT_UINT32, BASE_DEC,
1106                           NULL, 0, "SMB NETLOGON Pulse", HFILL }},
1107
1108                 { &hf_random,
1109                         { "Random", "smb_netlogon.random", FT_UINT32, BASE_DEC,
1110                           NULL, 0, "SMB NETLOGON Random", HFILL }},
1111
1112                 { &hf_db_count,
1113                         { "DB Count", "smb_netlogon.db_count", FT_UINT32, BASE_DEC,
1114                           NULL, 0, "SMB NETLOGON DB Count", HFILL }},
1115
1116                 { &hf_db_index,
1117                         { "Database Index", "smb_netlogon.db_index", FT_UINT32, BASE_DEC,
1118                           NULL, 0, "SMB NETLOGON Database Index", HFILL }},
1119
1120                 { &hf_large_serial,
1121                         { "Large Serial Number", "smb_netlogon.large_serial", FT_UINT64, BASE_DEC,
1122                           NULL, 0, "SMB NETLOGON Large Serial Number", HFILL }},
1123
1124                 { &hf_nt_date_time,
1125                         { "NT Date/Time", "smb_netlogon.nt_date_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
1126                           NULL, 0, "SMB NETLOGON NT Date/Time", HFILL }},
1127
1128                 { &hf_unknown8,
1129                         { "Unknown", "smb_netlogon.unknown", FT_UINT8, BASE_HEX,
1130                           NULL, 0, NULL, HFILL }},
1131
1132                 { &hf_unknown32,
1133                         { "Unknown", "smb_netlogon.unknown", FT_UINT32, BASE_HEX,
1134                           NULL, 0, NULL, HFILL }},
1135
1136                 { &hf_domain_guid,
1137                         { "Domain GUID", "smb_netlogon.domain.guid", FT_BYTES, BASE_NONE,
1138                            NULL, 0x0, NULL, HFILL }},
1139
1140                 { &hf_server_ip, {
1141                         "Server IP", "smb_netlogon.server_ip", FT_IPv4, BASE_NONE,
1142                         NULL, 0x0, "Server IP Address", HFILL }},
1143
1144                 { &hf_server_site_name,
1145                         { "Server Site Name", "smb_netlogon.server_site_name", FT_STRING, BASE_NONE,
1146                           NULL, 0, "SMB NETLOGON Server Site Name", HFILL }},
1147
1148                 { &hf_client_site_name,
1149                         { "Client Site Name", "smb_netlogon.client_site_name", FT_STRING, BASE_NONE,
1150                           NULL, 0, "SMB NETLOGON Client Site Name", HFILL }},
1151         };
1152
1153         static gint *ett[] = {
1154                 &ett_smb_logon,
1155                 &ett_smb_account_flags,
1156                 &ett_smb_db_info
1157         };
1158
1159         proto_smb_logon = proto_register_protocol(
1160                 "Microsoft Windows Logon Protocol (Old)", "SMB_NETLOGON", "smb_netlogon");
1161
1162         proto_register_field_array(proto_smb_logon, hf, array_length(hf));
1163         proto_register_subtree_array(ett, array_length(ett));
1164
1165         register_dissector("smb_netlogon", dissect_smb_logon, proto_smb_logon);
1166 }