packet-dcerpc-lsa.c

   1 /* packet-dcerpc-lsa.c
   2  * Routines for SMB \PIPE\lsarpc packet disassembly
   3  * Copyright 2001,2003 Tim Potter <tpot@samba.org>
   4  *  2002  Added LSA command dissectors  Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-lsa.c,v 1.94 2004/05/19 04:52:31 tpot Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <string.h>
  33
  34 #include <epan/packet.h>
  35 #include "packet-dcerpc.h"
  36 #include "packet-dcerpc-nt.h"
  37 #include "packet-dcerpc-lsa.h"
  38 #include "packet-smb-common.h"
  39 #include "smb.h"
  40
  41 static int proto_dcerpc_lsa = -1;
  42
  43 static int hf_lsa_opnum = -1;
  44 static int hf_lsa_rc = -1;
  45 static int hf_lsa_hnd = -1;
  46 static int hf_lsa_policy_information = -1;
  47 static int hf_lsa_server = -1;
  48 static int hf_lsa_controller = -1;
  49 static int hf_lsa_obj_attr = -1;
  50 static int hf_lsa_obj_attr_len = -1;
  51 static int hf_lsa_obj_attr_name = -1;
  52 static int hf_lsa_access_mask = -1;
  53 static int hf_lsa_info_level = -1;
  54 static int hf_lsa_trusted_info_level = -1;
  55 static int hf_lsa_sd_size = -1;
  56 static int hf_lsa_qos_len = -1;
  57 static int hf_lsa_qos_impersonation_level = -1;
  58 static int hf_lsa_qos_track_context = -1;
  59 static int hf_lsa_qos_effective_only = -1;
  60 static int hf_lsa_pali_percent_full = -1;
  61 static int hf_lsa_pali_log_size = -1;
  62 static int hf_lsa_pali_retention_period = -1;
  63 static int hf_lsa_pali_time_to_shutdown = -1;
  64 static int hf_lsa_pali_shutdown_in_progress = -1;
  65 static int hf_lsa_pali_next_audit_record = -1;
  66 static int hf_lsa_paei_enabled = -1;
  67 static int hf_lsa_paei_settings = -1;
  68 static int hf_lsa_count = -1;
  69 static int hf_lsa_size = -1;
  70 static int hf_lsa_size16 = -1;
  71 static int hf_lsa_privilege_display_name_size = -1;
  72 static int hf_lsa_max_count = -1;
  73 static int hf_lsa_index = -1;
  74 static int hf_lsa_fqdomain = -1;
  75 static int hf_lsa_domain = -1;
  76 static int hf_lsa_acct = -1;
  77 static int hf_lsa_server_role = -1;
  78 static int hf_lsa_source = -1;
  79 static int hf_lsa_quota_paged_pool = -1;
  80 static int hf_lsa_quota_non_paged_pool = -1;
  81 static int hf_lsa_quota_min_wss = -1;
  82 static int hf_lsa_quota_max_wss = -1;
  83 static int hf_lsa_quota_pagefile = -1;
  84 static int hf_lsa_mod_seq_no = -1;
  85 static int hf_lsa_mod_mtime = -1;
  86 static int hf_lsa_cur_mtime = -1;
  87 static int hf_lsa_old_mtime = -1;
  88 static int hf_lsa_name = -1;
  89 static int hf_lsa_key = -1;
  90 static int hf_lsa_flat_name = -1;
  91 static int hf_lsa_forest = -1;
  92 static int hf_lsa_info_type = -1;
  93 static int hf_lsa_old_pwd = -1;
  94 static int hf_lsa_new_pwd = -1;
  95 static int hf_lsa_sid_type = -1;
  96 static int hf_lsa_rid = -1;
  97 static int hf_lsa_rid_offset = -1;
  98 static int hf_lsa_num_mapped = -1;
  99 static int hf_lsa_policy_information_class = -1;
 100 static int hf_lsa_secret = -1;
 101 static int hf_nt_luid_high = -1;
 102 static int hf_nt_luid_low = -1;
 103 static int hf_lsa_privilege_name = -1;
 104 static int hf_lsa_privilege_display_name = -1;
 105 static int hf_lsa_attr = -1;
 106 static int hf_lsa_resume_handle = -1;
 107 static int hf_lsa_trust_direction = -1;
 108 static int hf_lsa_trust_type = -1;
 109 static int hf_lsa_trust_attr = -1;
 110 static int hf_lsa_trust_attr_non_trans = -1;
 111 static int hf_lsa_trust_attr_uplevel_only = -1;
 112 static int hf_lsa_trust_attr_tree_parent = -1;
 113 static int hf_lsa_trust_attr_tree_root = -1;
 114 static int hf_lsa_auth_update = -1;
 115 static int hf_lsa_auth_type = -1;
 116 static int hf_lsa_auth_len = -1;
 117 static int hf_lsa_auth_blob = -1;
 118 static int hf_lsa_rights = -1;
 119 static int hf_lsa_remove_all = -1;
 120
 121 static int hf_lsa_unknown_hyper = -1;
 122 static int hf_lsa_unknown_long = -1;
 123 static int hf_lsa_unknown_short = -1;
 124 static int hf_lsa_unknown_char = -1;
 125 static int hf_lsa_unknown_string = -1;
 126 #ifdef LSA_UNUSED_HANDLES
 127 static int hf_lsa_unknown_time = -1;
 128 #endif
 129
 130
 131 static gint ett_dcerpc_lsa = -1;
 132 static gint ett_lsa_OBJECT_ATTRIBUTES = -1;
 133 static gint ett_LSA_SECURITY_DESCRIPTOR = -1;
 134 static gint ett_lsa_policy_info = -1;
 135 static gint ett_lsa_policy_audit_log_info = -1;
 136 static gint ett_lsa_policy_audit_events_info = -1;
 137 static gint ett_lsa_policy_primary_domain_info = -1;
 138 static gint ett_lsa_policy_primary_account_info = -1;
 139 static gint ett_lsa_policy_server_role_info = -1;
 140 static gint ett_lsa_policy_replica_source_info = -1;
 141 static gint ett_lsa_policy_default_quota_info = -1;
 142 static gint ett_lsa_policy_modification_info = -1;
 143 static gint ett_lsa_policy_audit_full_set_info = -1;
 144 static gint ett_lsa_policy_audit_full_query_info = -1;
 145 static gint ett_lsa_policy_dns_domain_info = -1;
 146 static gint ett_lsa_translated_names = -1;
 147 static gint ett_lsa_translated_name = -1;
 148 static gint ett_lsa_referenced_domain_list = -1;
 149 static gint ett_lsa_trust_information = -1;
 150 static gint ett_lsa_trust_information_ex = -1;
 151 static gint ett_LUID = -1;
 152 static gint ett_LSA_PRIVILEGES = -1;
 153 static gint ett_LSA_PRIVILEGE = -1;
 154 static gint ett_LSA_LUID_AND_ATTRIBUTES_ARRAY = -1;
 155 static gint ett_LSA_LUID_AND_ATTRIBUTES = -1;
 156 static gint ett_LSA_TRUSTED_DOMAIN_LIST = -1;
 157 static gint ett_LSA_TRUSTED_DOMAIN = -1;
 158 static gint ett_LSA_TRANSLATED_SIDS = -1;
 159 static gint ett_lsa_trusted_domain_info = -1;
 160 static gint ett_lsa_trust_attr = -1;
 161 static gint ett_lsa_trusted_domain_auth_information = -1;
 162 static gint ett_lsa_auth_information = -1;
 163
 164
 165 static int
 166 lsa_dissect_pointer_NTTIME(tvbuff_t *tvb, int offset,
 167                              packet_info *pinfo, proto_tree *tree,
 168                              guint8 *drep)
 169 {
 170         dcerpc_info *di;
 171
 172         di=pinfo->private_data;
 173         if(di->conformant_run){
 174                 /*just a run to handle conformant arrays, nothing to dissect */
 175                 return offset;
 176         }
 177
 178         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 179                 di->hf_index);
 180
 181         return offset;
 182 }
 183
 184 static int
 185 lsa_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 186                              packet_info *pinfo, proto_tree *tree,
 187                              guint8 *drep)
 188 {
 189         dcerpc_info *di;
 190
 191         di=pinfo->private_data;
 192         if(di->conformant_run){
 193                 /*just a run to handle conformant arrays, nothing to dissect */
 194                 return offset;
 195         }
 196
 197         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 198                         di->hf_index, 0);
 199         return offset;
 200 }
 201
 202 static int
 203 lsa_dissect_pointer_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 204                              packet_info *pinfo, proto_tree *tree,
 205                              guint8 *drep)
 206 {
 207         dcerpc_info *di;
 208
 209         di=pinfo->private_data;
 210         if(di->conformant_run){
 211                 /*just a run to handle conformant arrays, nothing to dissect */
 212                 return offset;
 213         }
 214
 215         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 216                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
 217                 "DOMAIN pointer: ", di->hf_index);
 218
 219         return offset;
 220 }
 221
 222 static int
 223 lsa_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 224                              packet_info *pinfo, proto_tree *tree,
 225                              guint8 *drep)
 226 {
 227         dcerpc_info *di;
 228
 229         di=pinfo->private_data;
 230         if(di->conformant_run){
 231                 /*just a run to handle conformant arrays, nothing to dissect */
 232                 return offset;
 233         }
 234
 235         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 236                         di->hf_index, 0);
 237         return offset;
 238 }
 239
 240
 241 static int
 242 lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
 243                         packet_info *pinfo, proto_tree *tree,
 244                         guint8 *drep)
 245 {
 246         guint32 len;
 247         dcerpc_info *di;
 248
 249         di=pinfo->private_data;
 250         if(di->conformant_run){
 251                 /*just a run to handle conformant arrays, nothing to dissect */
 252                 return offset;
 253         }
 254
 255         /* this is probably a varying and conformant array */
 256         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 257                                      hf_lsa_sd_size, &len);
 258         offset+=4;
 259         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 260                                      hf_lsa_sd_size, &len);
 261         proto_tree_add_item(tree, hf_lsa_secret, tvb, offset, len, FALSE);
 262         offset += len;
 263
 264         return offset;
 265 }
 266
 267 int
 268 lsa_dissect_LSA_SECRET(tvbuff_t *tvb, int offset,
 269                         packet_info *pinfo, proto_tree *parent_tree,
 270                         guint8 *drep)
 271 {
 272         proto_item *item=NULL;
 273         proto_tree *tree=NULL;
 274         int old_offset=offset;
 275
 276         if(parent_tree){
 277                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 278                         "LSA_SECRET:");
 279                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 280         }
 281
 282         /* XXX need to figure this one out */
 283         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 284                                      hf_lsa_sd_size, NULL);
 285         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 286                                      hf_lsa_sd_size, NULL);
 287         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 288                 lsa_dissect_LSA_SECRET_data, NDR_POINTER_UNIQUE,
 289                 "LSA_SECRET data: pointer", -1);
 290
 291         proto_item_set_len(item, offset-old_offset);
 292         return offset;
 293 }
 294
 295 static int
 296 lsa_dissect_LSA_SECRET_pointer(tvbuff_t *tvb, int offset,
 297                         packet_info *pinfo, proto_tree *tree,
 298                         guint8 *drep)
 299 {
 300         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 301                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
 302                 "LSA_SECRET pointer: data", -1);
 303
 304         return offset;
 305 }
 306
 307 /* Dissect LSA specific access rights */
 308
 309 static gint hf_view_local_info = -1;
 310 static gint hf_view_audit_info = -1;
 311 static gint hf_get_private_info = -1;
 312 static gint hf_trust_admin = -1;
 313 static gint hf_create_account = -1;
 314 static gint hf_create_secret = -1;
 315 static gint hf_create_priv = -1;
 316 static gint hf_set_default_quota_limits = -1;
 317 static gint hf_set_audit_requirements = -1;
 318 static gint hf_server_admin = -1;
 319 static gint hf_lookup_names = -1;
 320
 321 static void
 322 lsa_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree,
 323                     guint32 access)
 324 {
 325         proto_tree_add_boolean(
 326                 tree, hf_lookup_names, tvb, offset, 4, access);
 327
 328         proto_tree_add_boolean(
 329                 tree, hf_server_admin, tvb, offset, 4, access);
 330
 331         proto_tree_add_boolean(
 332                 tree, hf_set_audit_requirements, tvb, offset, 4, access);
 333
 334         proto_tree_add_boolean(
 335                 tree, hf_set_default_quota_limits, tvb, offset, 4, access);
 336
 337         proto_tree_add_boolean(
 338                 tree, hf_create_priv, tvb, offset, 4, access);
 339
 340         proto_tree_add_boolean(
 341                 tree, hf_create_secret, tvb, offset, 4, access);
 342
 343         proto_tree_add_boolean(
 344                 tree, hf_create_account, tvb, offset, 4, access);
 345
 346         proto_tree_add_boolean(
 347                 tree, hf_trust_admin, tvb, offset, 4, access);
 348
 349         proto_tree_add_boolean(
 350                 tree, hf_get_private_info, tvb, offset, 4, access);
 351
 352         proto_tree_add_boolean(
 353                 tree, hf_view_audit_info, tvb, offset, 4, access);
 354
 355         proto_tree_add_boolean(
 356                 tree, hf_view_local_info, tvb, offset, 4, access);
 357 }
 358
 359 struct access_mask_info lsa_access_mask_info = {
 360         "LSA",                  /* Name of specific rights */
 361         lsa_specific_rights,    /* Dissection function */
 362         NULL,                   /* Generic mapping table */
 363         NULL                    /* Standard mapping table */
 364 };
 365
 366 int
 367 lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
 368                              packet_info *pinfo, proto_tree *tree,
 369                              guint8 *drep)
 370 {
 371         guint32 len;
 372         dcerpc_info *di;
 373
 374         di=pinfo->private_data;
 375         if(di->conformant_run){
 376                 /*just a run to handle conformant arrays, nothing to dissect */
 377                 return offset;
 378         }
 379
 380         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 381                                      hf_lsa_sd_size, &len);
 382
 383         dissect_nt_sec_desc(
 384                 tvb, offset, pinfo, tree, drep, len, &lsa_access_mask_info);
 385
 386         offset += len;
 387
 388         return offset;
 389 }
 390 int
 391 lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 392                         packet_info *pinfo, proto_tree *parent_tree,
 393                         guint8 *drep)
 394 {
 395         proto_item *item=NULL;
 396         proto_tree *tree=NULL;
 397         int old_offset=offset;
 398
 399         if(parent_tree){
 400                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 401                         "LSA_SECURITY_DESCRIPTOR:");
 402                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 403         }
 404
 405         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 406                                     hf_lsa_sd_size, NULL);
 407
 408         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 409                         lsa_dissect_LSA_SECURITY_DESCRIPTOR_data, NDR_POINTER_UNIQUE,
 410                         "LSA SECURITY DESCRIPTOR data:", -1);
 411
 412         proto_item_set_len(item, offset-old_offset);
 413         return offset;
 414 }
 415
 416 static int
 417 lsa_dissect_LPSTR(tvbuff_t *tvb, int offset,
 418         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 419 {
 420         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 421                         hf_lsa_unknown_char, NULL);
 422
 423         return offset;
 424 }
 425
 426 static const value_string lsa_impersonation_level_vals[] = {
 427         {0,     "Anonymous"},
 428         {1,     "Identification"},
 429         {2,     "Impersonation"},
 430         {3,     "Delegation"},
 431         {0, NULL}
 432 };
 433
 434
 435 static int
 436 lsa_dissect_SECURITY_QUALITY_OF_SERVICE(tvbuff_t *tvb, int offset,
 437         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 438 {
 439         /* Length */
 440         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 441                         hf_lsa_qos_len, NULL);
 442
 443         /* impersonation level */
 444         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 445                         hf_lsa_qos_impersonation_level, NULL);
 446
 447         /* context tracking mode */
 448         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 449                         hf_lsa_qos_track_context, NULL);
 450
 451         /* effective only */
 452         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 453                         hf_lsa_qos_effective_only, NULL);
 454
 455         return offset;
 456 }
 457
 458 static int
 459 lsa_dissect_ACCESS_MASK(tvbuff_t *tvb, int offset,
 460         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 461 {
 462         offset = dissect_nt_access_mask(
 463                 tvb, offset, pinfo, tree, drep, hf_lsa_access_mask,
 464                 &lsa_access_mask_info, NULL);
 465
 466         return offset;
 467 }
 468
 469 static int
 470 lsa_dissect_LSA_OBJECT_ATTRIBUTES(tvbuff_t *tvb, int offset,
 471         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 472 {
 473         int old_offset=offset;
 474         proto_item *item = NULL;
 475         proto_tree *tree = NULL;
 476
 477         if(parent_tree){
 478                 item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Object Attributes");
 479                 tree = proto_item_add_subtree(item, ett_lsa_OBJECT_ATTRIBUTES);
 480         }
 481
 482         /* Length */
 483         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 484                         hf_lsa_obj_attr_len, NULL);
 485
 486         /* LPSTR */
 487         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 488                 lsa_dissect_LPSTR, NDR_POINTER_UNIQUE,
 489                 "LSPTR pointer: ", -1);
 490
 491         /* attribute name */
 492         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 493                 lsa_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
 494                 "NAME pointer: ", hf_lsa_obj_attr_name);
 495
 496         /* Attr */
 497         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 498                         hf_lsa_obj_attr, NULL);
 499
 500         /* security descriptor */
 501         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 502                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
 503                 "LSA_SECURITY_DESCRIPTOR pointer: ", -1);
 504
 505         /* security quality of service */
 506         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 507                 lsa_dissect_SECURITY_QUALITY_OF_SERVICE, NDR_POINTER_UNIQUE,
 508                 "LSA_SECURITY_QUALITY_OF_SERVICE pointer: ", -1);
 509
 510         proto_item_set_len(item, offset-old_offset);
 511         return offset;
 512 }
 513
 514 static int
 515 lsa_dissect_lsarclose_rqst(tvbuff_t *tvb, int offset,
 516         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 517 {
 518         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 519                         hf_lsa_hnd, NULL, NULL, FALSE, TRUE);
 520
 521         return offset;
 522 }
 523
 524 static int
 525 lsa_dissect_lsarclose_reply(tvbuff_t *tvb, int offset,
 526         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 527 {
 528         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 529                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
 530
 531         offset = dissect_ntstatus(
 532                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 533
 534         return offset;
 535 }
 536
 537 /* A bug in the NT IDL for lsa openpolicy only stores the first (wide)
 538    character of the server name which is always '\'.  This is fixed in lsa
 539    openpolicy2 but the function remains for backwards compatibility. */
 540
 541 static int dissect_lsa_openpolicy_server(tvbuff_t *tvb, int offset,
 542                                              packet_info *pinfo,
 543                                              proto_tree *tree, guint8 *drep)
 544 {
 545         return dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 546                                   hf_lsa_server, NULL);
 547 }
 548
 549 static int
 550 lsa_dissect_lsaropenpolicy_rqst(tvbuff_t *tvb, int offset,
 551         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 552 {
 553         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 554                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
 555                 "Server", hf_lsa_server);
 556
 557         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 558                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 559                 "OBJECT_ATTRIBUTES", -1);
 560
 561         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 562                 pinfo, tree, drep);
 563
 564         return offset;
 565 }
 566
 567 static int
 568 lsa_dissect_lsaropenpolicy_reply(tvbuff_t *tvb, int offset,
 569         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 570 {
 571         e_ctx_hnd policy_hnd;
 572         proto_item *hnd_item;
 573         guint32 status;
 574
 575         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 576                         hf_lsa_hnd, &policy_hnd, &hnd_item, TRUE, FALSE);
 577
 578         offset = dissect_ntstatus(
 579                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, &status);
 580
 581         if (status == 0) {
 582                 dcerpc_smb_store_pol_name(&policy_hnd, pinfo,
 583                                           "OpenPolicy handle");
 584
 585                 if (hnd_item != NULL)
 586                         proto_item_append_text(hnd_item, ": OpenPolicy handle");
 587         }
 588
 589         return offset;
 590 }
 591
 592 static int
 593 lsa_dissect_lsaropenpolicy2_rqst(tvbuff_t *tvb, int offset,
 594         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 595 {
 596         offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, drep,
 597                 dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Server",
 598                 hf_lsa_server, cb_wstr_postprocess,
 599                 GINT_TO_POINTER(CB_STR_COL_INFO | CB_STR_SAVE | 1));
 600
 601         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 602                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 603                 "OBJECT_ATTRIBUTES", -1);
 604
 605         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 606                 pinfo, tree, drep);
 607
 608         return offset;
 609 }
 610
 611
 612 static int
 613 lsa_dissect_lsaropenpolicy2_reply(tvbuff_t *tvb, int offset,
 614         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 615 {
 616         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 617         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 618         e_ctx_hnd policy_hnd;
 619         proto_item *hnd_item;
 620         guint32 status;
 621         char *pol_name;
 622
 623         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 624                         hf_lsa_hnd, &policy_hnd, &hnd_item, TRUE, FALSE);
 625
 626         offset = dissect_ntstatus(
 627                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, &status);
 628
 629         if (status == 0) {
 630                 if (dcv->private_data)
 631                         pol_name = g_strdup_printf(
 632                                 "OpenPolicy2(%s)", (char *)dcv->private_data);
 633                 else
 634                         pol_name = g_strdup("OpenPolicy2 handle");
 635
 636                 dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name);
 637
 638                 if (hnd_item != NULL)
 639                         proto_item_append_text(hnd_item, ": %s", pol_name);
 640
 641                 g_free(pol_name);
 642         }
 643
 644         return offset;
 645 }
 646
 647 static const value_string policy_information_class_vals[] = {
 648         {1,     "Audit Log Information"},
 649         {2,     "Audit Events Information"},
 650         {3,     "Primary Domain Information"},
 651         {4,     "Pd Account Information"},
 652         {5,     "Account Domain Information"},
 653         {6,     "Server Role Information"},
 654         {7,     "Replica Source Information"},
 655         {8,     "Default Quota Information"},
 656         {9,     "Modification Information"},
 657         {10,    "Audit Full Set Information"},
 658         {11,    "Audit Full Query Information"},
 659         {12,    "DNS Domain Information"},
 660         {0, NULL}
 661 };
 662
 663 static int
 664 lsa_dissect_lsarqueryinformationpolicy_rqst(tvbuff_t *tvb, int offset,
 665         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 666 {
 667         guint16 level;
 668
 669         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 670                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
 671
 672         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 673                 hf_lsa_policy_information_class, &level);
 674
 675         if (check_col(pinfo->cinfo, COL_INFO))
 676                 col_append_fstr(
 677                         pinfo->cinfo, COL_INFO, ", %s",
 678                         val_to_str(level, policy_information_class_vals,
 679                                    "Unknown (%d)"));
 680
 681         return offset;
 682 }
 683
 684 static int
 685 lsa_dissect_POLICY_AUDIT_LOG_INFO(tvbuff_t *tvb, int offset,
 686         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 687 {
 688         proto_item *item=NULL;
 689         proto_tree *tree=NULL;
 690         int old_offset=offset;
 691
 692         if(parent_tree){
 693                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 694                         "POLICY_AUDIT_LOG_INFO:");
 695                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_log_info);
 696         }
 697
 698         /* percent full */
 699         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 700                                      hf_lsa_pali_percent_full, NULL);
 701
 702         /* log size */
 703         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 704                                      hf_lsa_pali_log_size, NULL);
 705
 706         /* retention period */
 707         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 708                                 hf_lsa_pali_retention_period);
 709
 710         /* shutdown in progress */
 711         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 712                                      hf_lsa_pali_shutdown_in_progress, NULL);
 713
 714         /* time to shutdown */
 715         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 716                                 hf_lsa_pali_time_to_shutdown);
 717
 718         /* next audit record */
 719         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 720                                      hf_lsa_pali_next_audit_record, NULL);
 721
 722         proto_item_set_len(item, offset-old_offset);
 723         return offset;
 724 }
 725
 726 static int
 727 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings(tvbuff_t *tvb, int offset,
 728         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 729 {
 730         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 731                                      hf_lsa_paei_settings, NULL);
 732         return offset;
 733 }
 734
 735 static int
 736 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array(tvbuff_t *tvb, int offset,
 737         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 738 {
 739         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 740                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings);
 741
 742         return offset;
 743 }
 744
 745 static int
 746 lsa_dissect_POLICY_AUDIT_EVENTS_INFO(tvbuff_t *tvb, int offset,
 747         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 748 {
 749         proto_item *item=NULL;
 750         proto_tree *tree=NULL;
 751         int old_offset=offset;
 752
 753         if(parent_tree){
 754                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 755                         "POLICY_AUDIT_EVENTS_INFO:");
 756                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_events_info);
 757         }
 758
 759         /* enabled */
 760         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 761                                      hf_lsa_paei_enabled, NULL);
 762
 763         /* settings */
 764         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 765                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array, NDR_POINTER_UNIQUE,
 766                 "Settings", -1);
 767
 768         /* count */
 769         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 770                                      hf_lsa_count, NULL);
 771
 772         proto_item_set_len(item, offset-old_offset);
 773         return offset;
 774 }
 775
 776
 777 static int
 778 lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 779         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 780 {
 781         proto_item *item=NULL;
 782         proto_tree *tree=NULL;
 783         int old_offset=offset;
 784
 785         if(parent_tree){
 786                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 787                         "POLICY_PRIMARY_DOMAIN_INFO:");
 788                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_domain_info);
 789         }
 790
 791         /* domain */
 792         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 793                 hf_lsa_domain, 0);
 794
 795         /* sid */
 796         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
 797
 798         proto_item_set_len(item, offset-old_offset);
 799         return offset;
 800 }
 801
 802
 803 static int
 804 lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 805         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 806 {
 807         proto_item *item=NULL;
 808         proto_tree *tree=NULL;
 809         int old_offset=offset;
 810
 811         if(parent_tree){
 812                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 813                         "POLICY_ACCOUNT_DOMAIN_INFO:");
 814                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_account_info);
 815         }
 816
 817         /* account */
 818         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 819                 hf_lsa_domain, 0);
 820
 821         /* sid */
 822         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
 823
 824         proto_item_set_len(item, offset-old_offset);
 825         return offset;
 826 }
 827
 828
 829 static const value_string server_role_vals[] = {
 830         {0,     "Standalone"},
 831         {1,     "Domain Member"},
 832         {2,     "Backup"},
 833         {3,     "Primary"},
 834         {0, NULL}
 835 };
 836 static int
 837 lsa_dissect_POLICY_SERVER_ROLE_INFO(tvbuff_t *tvb, int offset,
 838         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 839 {
 840         proto_item *item=NULL;
 841         proto_tree *tree=NULL;
 842         int old_offset=offset;
 843
 844         if(parent_tree){
 845                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 846                         "POLICY_SERVER_ROLE_INFO:");
 847                 tree = proto_item_add_subtree(item, ett_lsa_policy_server_role_info);
 848         }
 849
 850         /* server role */
 851         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 852                                      hf_lsa_server_role, NULL);
 853
 854         proto_item_set_len(item, offset-old_offset);
 855         return offset;
 856 }
 857
 858 static int
 859 lsa_dissect_POLICY_REPLICA_SOURCE_INFO(tvbuff_t *tvb, int offset,
 860         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 861 {
 862         proto_item *item=NULL;
 863         proto_tree *tree=NULL;
 864         int old_offset=offset;
 865
 866         if(parent_tree){
 867                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 868                         "POLICY_REPLICA_SOURCE_INFO:");
 869                 tree = proto_item_add_subtree(item, ett_lsa_policy_replica_source_info);
 870         }
 871
 872         /* source */
 873         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 874                 hf_lsa_source, 0);
 875
 876         /* account */
 877         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 878                 hf_lsa_acct, 0);
 879
 880         proto_item_set_len(item, offset-old_offset);
 881         return offset;
 882 }
 883
 884
 885 static int
 886 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(tvbuff_t *tvb, int offset,
 887         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 888 {
 889         proto_item *item=NULL;
 890         proto_tree *tree=NULL;
 891         int old_offset=offset;
 892
 893         if(parent_tree){
 894                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 895                         "POLICY_DEFAULT_QUOTA_INFO:");
 896                 tree = proto_item_add_subtree(item, ett_lsa_policy_default_quota_info);
 897         }
 898
 899         /* paged pool */
 900         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 901                                      hf_lsa_quota_paged_pool, NULL);
 902
 903         /* non paged pool */
 904         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 905                                      hf_lsa_quota_non_paged_pool, NULL);
 906
 907         /* min wss */
 908         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 909                                      hf_lsa_quota_min_wss, NULL);
 910
 911         /* max wss */
 912         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 913                                      hf_lsa_quota_max_wss, NULL);
 914
 915         /* pagefile */
 916         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 917                                      hf_lsa_quota_pagefile, NULL);
 918
 919         /*  */
 920         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 921                                      hf_lsa_unknown_hyper, NULL);
 922
 923         proto_item_set_len(item, offset-old_offset);
 924         return offset;
 925 }
 926
 927
 928 static int
 929 lsa_dissect_POLICY_MODIFICATION_INFO(tvbuff_t *tvb, int offset,
 930         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 931 {
 932         proto_item *item=NULL;
 933         proto_tree *tree=NULL;
 934         int old_offset=offset;
 935
 936         if(parent_tree){
 937                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 938                         "POLICY_MODIFICATION_INFO:");
 939                 tree = proto_item_add_subtree(item, ett_lsa_policy_modification_info);
 940         }
 941
 942         /* seq no */
 943         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 944                                      hf_lsa_mod_seq_no, NULL);
 945
 946         /* mtime */
 947         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 948                                 hf_lsa_mod_mtime);
 949
 950         proto_item_set_len(item, offset-old_offset);
 951         return offset;
 952 }
 953
 954
 955 static int
 956 lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(tvbuff_t *tvb, int offset,
 957         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 958 {
 959         proto_item *item=NULL;
 960         proto_tree *tree=NULL;
 961         int old_offset=offset;
 962
 963         if(parent_tree){
 964                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 965                         "POLICY_AUDIT_FULL_SET_INFO:");
 966                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_set_info);
 967         }
 968
 969         /* unknown */
 970         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 971                         hf_lsa_unknown_char, NULL);
 972
 973         proto_item_set_len(item, offset-old_offset);
 974         return offset;
 975 }
 976
 977
 978 static int
 979 lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(tvbuff_t *tvb, int offset,
 980         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 981 {
 982         proto_item *item=NULL;
 983         proto_tree *tree=NULL;
 984         int old_offset=offset;
 985
 986         if(parent_tree){
 987                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 988                         "POLICY_AUDIT_FULL_QUERY_INFO:");
 989                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_query_info);
 990         }
 991
 992         /* unknown */
 993         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 994                         hf_lsa_unknown_char, NULL);
 995
 996         /* unknown */
 997         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 998                         hf_lsa_unknown_char, NULL);
 999
1000         proto_item_set_len(item, offset-old_offset);
1001         return offset;
1002 }
1003
1004
1005 int
1006 lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvbuff_t *tvb, int offset,
1007         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1008 {
1009         proto_item *item=NULL;
1010         proto_tree *tree=NULL;
1011         int old_offset=offset;
1012
1013         if(parent_tree){
1014                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1015                         "POLICY_DNS_DOMAIN_INFO:");
1016                 tree = proto_item_add_subtree(item, ett_lsa_policy_dns_domain_info);
1017         }
1018
1019         /* name */
1020         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1021                 hf_lsa_domain, 0);
1022
1023         /* domain */
1024         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1025                 hf_lsa_fqdomain, 0);
1026
1027         /* forest */
1028         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1029                 hf_lsa_forest, 0);
1030
1031         /* GUID */
1032         offset = dissect_nt_GUID(tvb, offset,
1033                 pinfo, tree, drep);
1034
1035         /* SID pointer */
1036         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
1037
1038         proto_item_set_len(item, offset-old_offset);
1039         return offset;
1040 }
1041
1042 static int
1043 lsa_dissect_POLICY_INFORMATION(tvbuff_t *tvb, int offset,
1044         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1045 {
1046         proto_item *item=NULL;
1047         proto_tree *tree=NULL;
1048         int old_offset=offset;
1049         guint16 level;
1050
1051         if(parent_tree){
1052                 item = proto_tree_add_item(parent_tree, hf_lsa_policy_information, tvb, offset, 0, FALSE);
1053
1054                 tree = proto_item_add_subtree(item, ett_lsa_policy_info);
1055         }
1056
1057         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1058                                      hf_lsa_info_level, &level);
1059
1060         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
1061         switch(level){
1062         case 1:
1063                 offset = lsa_dissect_POLICY_AUDIT_LOG_INFO(
1064                                 tvb, offset, pinfo, tree, drep);
1065                 break;
1066         case 2:
1067                 offset = lsa_dissect_POLICY_AUDIT_EVENTS_INFO(
1068                                 tvb, offset, pinfo, tree, drep);
1069                 break;
1070         case 3:
1071                 offset = lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(
1072                                 tvb, offset, pinfo, tree, drep);
1073                 break;
1074         case 4:
1075                 offset = dissect_ndr_counted_string(tvb, offset, pinfo,
1076                         tree, drep, hf_lsa_acct, 0);
1077                 break;
1078         case 5:
1079                 offset = lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(
1080                                 tvb, offset, pinfo, tree, drep);
1081                 break;
1082         case 6:
1083                 offset = lsa_dissect_POLICY_SERVER_ROLE_INFO(
1084                                 tvb, offset, pinfo, tree, drep);
1085                 break;
1086         case 7:
1087                 offset = lsa_dissect_POLICY_REPLICA_SOURCE_INFO(
1088                                 tvb, offset, pinfo, tree, drep);
1089                 break;
1090         case 8:
1091                 offset = lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(
1092                                 tvb, offset, pinfo, tree, drep);
1093                 break;
1094         case 9:
1095                 offset = lsa_dissect_POLICY_MODIFICATION_INFO(
1096                                 tvb, offset, pinfo, tree, drep);
1097                 break;
1098         case 10:
1099                 offset = lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(
1100                                 tvb, offset, pinfo, tree, drep);
1101                 break;
1102         case 11:
1103                 offset = lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(
1104                                 tvb, offset, pinfo, tree, drep);
1105                 break;
1106         case 12:
1107                 offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(
1108                                 tvb, offset, pinfo, tree, drep);
1109                 break;
1110         }
1111
1112         proto_item_set_len(item, offset-old_offset);
1113         return offset;
1114 }
1115
1116 static int
1117 lsa_dissect_lsarqueryinformationpolicy_reply(tvbuff_t *tvb, int offset,
1118         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1119 {
1120         /* This is really a pointer to a pointer though the first level is REF
1121           so we just ignore that one */
1122         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1123                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
1124                 "POLICY_INFORMATION pointer: info", -1);
1125
1126         offset = dissect_ntstatus(
1127                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1128
1129         return offset;
1130 }
1131
1132 static int
1133 lsa_dissect_lsardelete_rqst(tvbuff_t *tvb, int offset,
1134         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1135 {
1136         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1137                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1138
1139         return offset;
1140 }
1141
1142 static int
1143 lsa_dissect_lsardelete_reply(tvbuff_t *tvb, int offset,
1144         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1145 {
1146         offset = dissect_ntstatus(
1147                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1148
1149         return offset;
1150 }
1151
1152
1153 static int
1154 lsa_dissect_lsarquerysecurityobject_rqst(tvbuff_t *tvb, int offset,
1155         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1156 {
1157         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1158                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1159
1160         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1161                 hf_lsa_info_type, NULL);
1162
1163         return offset;
1164 }
1165
1166
1167 static int
1168 lsa_dissect_lsarquerysecurityobject_reply(tvbuff_t *tvb, int offset,
1169         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1170 {
1171         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1172                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
1173                 "LSA_SECURITY_DESCRIPTOR pointer: sec_info", -1);
1174
1175         offset = dissect_ntstatus(
1176                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1177
1178         return offset;
1179 }
1180
1181
1182 static int
1183 lsa_dissect_lsarsetsecurityobject_rqst(tvbuff_t *tvb, int offset,
1184         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1185 {
1186         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1187                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1188
1189         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1190                 hf_lsa_info_type, NULL);
1191
1192         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1193                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
1194                 "LSA_SECURITY_DESCRIPTOR: sec_info", -1);
1195
1196         return offset;
1197 }
1198
1199 static int
1200 lsa_dissect_lsarsetsecurityobject_reply(tvbuff_t *tvb, int offset,
1201         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1202 {
1203         offset = dissect_ntstatus(
1204                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1205
1206         return offset;
1207 }
1208
1209
1210 static int
1211 lsa_dissect_lsarchangepassword_rqst(tvbuff_t *tvb, int offset,
1212         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1213 {
1214         /* server */
1215         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1216                 hf_lsa_server, 0);
1217
1218         /* domain */
1219         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1220                 hf_lsa_domain, 0);
1221
1222         /* account */
1223         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1224                 hf_lsa_acct, 0);
1225
1226         /* old password */
1227         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1228                 hf_lsa_old_pwd, 0);
1229
1230         /* new password */
1231         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1232                 hf_lsa_new_pwd, 0);
1233
1234         return offset;
1235 }
1236
1237 static int
1238 lsa_dissect_lsarchangepassword_reply(tvbuff_t *tvb, int offset,
1239         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1240 {
1241         offset = dissect_ntstatus(
1242                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1243
1244         return offset;
1245 }
1246
1247 static const value_string sid_type_vals[] = {
1248         {1,     "User"},
1249         {2,     "Group"},
1250         {3,     "Domain"},
1251         {4,     "Alias"},
1252         {5,     "Well Known Group"},
1253         {6,     "Deleted Account"},
1254         {7,     "Invalid"},
1255         {8,     "Unknown"},
1256         {9,     "Computer"},
1257         {0, NULL}
1258 };
1259 static int
1260 lsa_dissect_LSA_TRANSLATED_NAME(tvbuff_t *tvb, int offset,
1261         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1262 {
1263         proto_item *item=NULL;
1264         proto_tree *tree=NULL;
1265         int old_offset=offset;
1266
1267         if(parent_tree){
1268                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1269                         "LSA_TRANSLATED_NAME:");
1270                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
1271         }
1272
1273         /* sid type */
1274         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1275                         hf_lsa_sid_type, NULL);
1276
1277         /* name */
1278         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1279                 hf_lsa_name, 0);
1280
1281         /* index */
1282         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1283                                      hf_lsa_index, NULL);
1284
1285         proto_item_set_len(item, offset-old_offset);
1286         return offset;
1287 }
1288
1289 static int
1290 lsa_dissect_LSA_TRANSLATED_NAME_array(tvbuff_t *tvb, int offset,
1291         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1292 {
1293         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1294                 lsa_dissect_LSA_TRANSLATED_NAME);
1295
1296         return offset;
1297 }
1298
1299 static int
1300 lsa_dissect_LSA_TRANSLATED_NAMES(tvbuff_t *tvb, int offset,
1301         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1302 {
1303         proto_item *item=NULL;
1304         proto_tree *tree=NULL;
1305         int old_offset=offset;
1306
1307         if(parent_tree){
1308                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1309                         "LSA_TRANSLATED_NAMES:");
1310                 tree = proto_item_add_subtree(item, ett_lsa_translated_names);
1311         }
1312
1313         /* count */
1314         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1315                                      hf_lsa_count, NULL);
1316
1317         /* settings */
1318         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1319                 lsa_dissect_LSA_TRANSLATED_NAME_array, NDR_POINTER_UNIQUE,
1320                 "TRANSLATED_NAME_ARRAY", -1);
1321
1322         proto_item_set_len(item, offset-old_offset);
1323         return offset;
1324 }
1325
1326
1327 static int
1328 lsa_dissect_lsarlookupsids_rqst(tvbuff_t *tvb, int offset,
1329         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1330 {
1331         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1332                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1333
1334         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1335                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
1336                         "PSID_ARRAY", -1);
1337
1338         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1339                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1340                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1341
1342         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1343                 hf_lsa_info_level, NULL);
1344
1345         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1346                 hf_lsa_num_mapped, NULL);
1347
1348         return offset;
1349 }
1350
1351 static int
1352 lsa_dissect_LSA_TRUST_INFORMATION(tvbuff_t *tvb, int offset,
1353         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1354 {
1355         proto_item *item=NULL;
1356         proto_tree *tree=NULL;
1357         int old_offset=offset;
1358
1359         if(parent_tree){
1360                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1361                         "TRUST INFORMATION:");
1362                 tree = proto_item_add_subtree(item, ett_lsa_trust_information);
1363         }
1364
1365         /* name */
1366         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1367                 hf_lsa_name, 0);
1368
1369         /* sid */
1370         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
1371
1372         proto_item_set_len(item, offset-old_offset);
1373         return offset;
1374 }
1375
1376 static const value_string trusted_direction_vals[] = {
1377         {0,     "Trust disabled"},
1378         {1,     "Inbound trust"},
1379         {2,     "Outbound trust"},
1380         {0,     NULL}
1381 };
1382
1383 static const value_string trusted_type_vals[] = {
1384         {1,     "Downlevel"},
1385         {2,     "Uplevel"},
1386         {3,     "MIT"},
1387         {4,     "DCE"},
1388         {0,     NULL}
1389 };
1390
1391 static const true_false_string tfs_trust_attr_non_trans = {
1392         "NON TRANSITIVE is set",
1393         "Non transitive is NOT set"
1394 };
1395 static const true_false_string tfs_trust_attr_uplevel_only = {
1396         "UPLEVEL ONLY is set",
1397         "Uplevel only is NOT set"
1398 };
1399 static const true_false_string tfs_trust_attr_tree_parent = {
1400         "TREE PARENT is set",
1401         "Tree parent is NOT set"
1402 };
1403 static const true_false_string tfs_trust_attr_tree_root = {
1404         "TREE ROOT is set",
1405         "Tree root is NOT set"
1406 };
1407 static int
1408 lsa_dissect_trust_attr(tvbuff_t *tvb, int offset, packet_info *pinfo,
1409                         proto_tree *parent_tree, guint8 *drep)
1410 {
1411         guint32 mask;
1412         proto_item *item = NULL;
1413         proto_tree *tree = NULL;
1414
1415         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
1416                         hf_lsa_trust_attr, &mask);
1417
1418         if(parent_tree){
1419                 item = proto_tree_add_uint(parent_tree, hf_lsa_trust_attr,
1420                         tvb, offset-4, 4, mask);
1421                 tree = proto_item_add_subtree(item, ett_lsa_trust_attr);
1422         }
1423
1424         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_root,
1425                 tvb, offset-4, 4, mask);
1426         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_parent,
1427                 tvb, offset-4, 4, mask);
1428         proto_tree_add_boolean(tree, hf_lsa_trust_attr_uplevel_only,
1429                 tvb, offset-4, 4, mask);
1430         proto_tree_add_boolean(tree, hf_lsa_trust_attr_non_trans,
1431                 tvb, offset-4, 4, mask);
1432
1433         return offset;
1434 }
1435
1436 static int
1437 lsa_dissect_LSA_TRUST_INFORMATION_EX(tvbuff_t *tvb, int offset,
1438         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1439 {
1440         proto_item *item=NULL;
1441         proto_tree *tree=NULL;
1442         int old_offset=offset;
1443
1444         if(parent_tree){
1445                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1446                         "TRUST INFORMATION EX:");
1447                 tree = proto_item_add_subtree(item, ett_lsa_trust_information_ex);
1448         }
1449
1450         /* name */
1451         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1452                 hf_lsa_name, 0);
1453
1454         /* flat name */
1455         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1456                 hf_lsa_flat_name, 0);
1457
1458         /* sid */
1459         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
1460
1461         /* direction */
1462         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1463                                      hf_lsa_trust_direction, NULL);
1464
1465         /* type */
1466         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1467                                      hf_lsa_trust_type, NULL);
1468
1469         /* attributes */
1470         offset = lsa_dissect_trust_attr(tvb, offset, pinfo, tree, drep);
1471
1472         proto_item_set_len(item, offset-old_offset);
1473         return offset;
1474 }
1475
1476 static int
1477 lsa_dissect_auth_info_blob(tvbuff_t *tvb, int offset,
1478         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1479 {
1480         dcerpc_info *di;
1481         guint32 len;
1482
1483         di=pinfo->private_data;
1484         if(di->conformant_run){
1485                 /*just a run to handle conformant arrays, nothing to dissect */
1486                 return offset;
1487         }
1488
1489         /* len */
1490         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1491                                      hf_lsa_auth_len, &len);
1492
1493         proto_tree_add_item(tree, hf_lsa_auth_blob, tvb, offset, len, FALSE);
1494         offset += len;
1495
1496         return offset;
1497 }
1498
1499 static int
1500 lsa_dissect_auth_info(tvbuff_t *tvb, int offset,
1501         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1502 {
1503         proto_item *item=NULL;
1504         proto_tree *tree=NULL;
1505         int old_offset=offset;
1506
1507         if(parent_tree){
1508                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1509                         "AUTH INFORMATION:");
1510                 tree = proto_item_add_subtree(item, ett_lsa_auth_information);
1511         }
1512
1513         /* update */
1514         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
1515                                      hf_lsa_auth_update, NULL);
1516
1517         /* type */
1518         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1519                                      hf_lsa_auth_type, NULL);
1520
1521         /* len */
1522         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1523                                      hf_lsa_auth_len, NULL);
1524
1525         /* auth info blob */
1526         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1527                         lsa_dissect_auth_info_blob, NDR_POINTER_UNIQUE,
1528                         "AUTH INFO blob:", -1);
1529
1530         proto_item_set_len(item, offset-old_offset);
1531         return offset;
1532 }
1533
1534 static int
1535 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvbuff_t *tvb, int offset,
1536         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1537 {
1538         proto_item *item=NULL;
1539         proto_tree *tree=NULL;
1540         int old_offset=offset;
1541
1542         if(parent_tree){
1543                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1544                         "TRUSTED DOMAIN AUTH INFORMATION:");
1545                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_auth_information);
1546         }
1547
1548         /* unknown */
1549         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1550                                      hf_lsa_unknown_long, NULL);
1551
1552         /* unknown */
1553         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1554
1555         /* unknown */
1556         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1557
1558         /* unknown */
1559         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1560                                      hf_lsa_unknown_long, NULL);
1561
1562         /* unknown */
1563         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1564
1565         /* unknown */
1566         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1567
1568         proto_item_set_len(item, offset-old_offset);
1569         return offset;
1570 }
1571
1572
1573 static int
1574 lsa_dissect_LSA_TRUST_INFORMATION_array(tvbuff_t *tvb, int offset,
1575         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1576 {
1577         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1578                 lsa_dissect_LSA_TRUST_INFORMATION);
1579
1580         return offset;
1581 }
1582
1583 static int
1584 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
1585         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1586 {
1587         proto_item *item=NULL;
1588         proto_tree *tree=NULL;
1589         int old_offset=offset;
1590
1591         if(parent_tree){
1592                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1593                         "LSA_REFERENCED_DOMAIN_LIST:");
1594                 tree = proto_item_add_subtree(item, ett_lsa_referenced_domain_list);
1595         }
1596
1597         /* count */
1598         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1599                                      hf_lsa_count, NULL);
1600
1601         /* trust information */
1602         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1603                 lsa_dissect_LSA_TRUST_INFORMATION_array, NDR_POINTER_UNIQUE,
1604                 "TRUST INFORMATION array:", -1);
1605
1606         /* max count */
1607         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1608                                      hf_lsa_max_count, NULL);
1609
1610         proto_item_set_len(item, offset-old_offset);
1611         return offset;
1612 }
1613
1614 static int
1615 lsa_dissect_lsarlookupsids_reply(tvbuff_t *tvb, int offset,
1616         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1617 {
1618         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1619                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
1620                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
1621
1622         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1623                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1624                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1625
1626         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1627                 hf_lsa_num_mapped, NULL);
1628
1629         offset = dissect_ntstatus(
1630                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1631
1632         return offset;
1633 }
1634
1635
1636 static int
1637 lsa_dissect_lsarsetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1638         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1639 {
1640         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1641                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1642
1643         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1644                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1645                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1646
1647         return offset;
1648 }
1649
1650
1651 static int
1652 lsa_dissect_lsarsetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1653         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1654 {
1655         offset = dissect_ntstatus(
1656                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1657
1658         return offset;
1659 }
1660
1661
1662 static int
1663 lsa_dissect_lsargetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1664         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1665 {
1666         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1667                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1668
1669         return offset;
1670 }
1671
1672
1673 static int
1674 lsa_dissect_lsargetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1675         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1676 {
1677         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1678                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1679                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1680
1681         offset = dissect_ntstatus(
1682                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1683
1684         return offset;
1685 }
1686
1687
1688 static int
1689 lsa_dissect_lsarsetinformationpolicy_rqst(tvbuff_t *tvb, int offset,
1690         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1691 {
1692         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1693                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1694
1695         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1696                 hf_lsa_policy_information_class, NULL);
1697
1698         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1699                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
1700                 "POLICY_INFORMATION pointer: info", -1);
1701
1702         return offset;
1703 }
1704
1705
1706 static int
1707 lsa_dissect_lsarsetinformationpolicy_reply(tvbuff_t *tvb, int offset,
1708         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1709 {
1710         offset = dissect_ntstatus(
1711                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1712
1713         return offset;
1714 }
1715
1716
1717 static int
1718 lsa_dissect_lsarclearauditlog_rqst(tvbuff_t *tvb, int offset,
1719         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1720 {
1721         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1722                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1723
1724         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
1725
1726         /* unknown */
1727         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1728                                      hf_lsa_unknown_long, NULL);
1729
1730         return offset;
1731 }
1732
1733
1734 static int
1735 lsa_dissect_lsarclearauditlog_reply(tvbuff_t *tvb, int offset,
1736         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1737 {
1738         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1739                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1740
1741         offset = dissect_ntstatus(
1742                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1743
1744         return offset;
1745 }
1746
1747 static int
1748 lsa_dissect_lsargetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1749         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1750 {
1751         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1752                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1753
1754         return offset;
1755 }
1756
1757
1758 static int
1759 lsa_dissect_lsargetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1760         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1761 {
1762         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1763                                      hf_lsa_rid, NULL);
1764
1765         offset = dissect_ntstatus(
1766                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1767
1768         return offset;
1769 }
1770
1771
1772 static int
1773 lsa_dissect_lsarsetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1774         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1775 {
1776         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1777                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1778
1779         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1780                 hf_lsa_rid, NULL);
1781
1782         return offset;
1783 }
1784
1785
1786 static int
1787 lsa_dissect_lsarsetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1788         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1789 {
1790         offset = dissect_ntstatus(
1791                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1792
1793         return offset;
1794 }
1795
1796
1797 static int
1798 lsa_dissect_lsaropentrusteddomain_rqst(tvbuff_t *tvb, int offset,
1799         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1800 {
1801         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1802                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1803
1804         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
1805
1806         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
1807                 pinfo, tree, drep);
1808
1809         return offset;
1810 }
1811
1812
1813 static int
1814 lsa_dissect_lsaropentrusteddomain_reply(tvbuff_t *tvb, int offset,
1815         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1816 {
1817         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1818                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1819
1820         offset = dissect_ntstatus(
1821                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1822
1823         return offset;
1824 }
1825
1826
1827 static int
1828 lsa_dissect_lsardeletetrusteddomain_rqst(tvbuff_t *tvb, int offset,
1829         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1830 {
1831         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1832                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1833
1834         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
1835
1836         return offset;
1837 }
1838
1839
1840 static int
1841 lsa_dissect_lsardeletetrusteddomain_reply(tvbuff_t *tvb, int offset,
1842         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1843 {
1844         offset = dissect_ntstatus(
1845                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1846
1847         return offset;
1848 }
1849
1850 int
1851 dissect_nt_LUID(tvbuff_t *tvb, int offset,
1852         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1853 {
1854         proto_item *item=NULL;
1855         proto_tree *tree=NULL;
1856         int old_offset=offset;
1857
1858         if(parent_tree){
1859                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1860                         "LUID:");
1861                 tree = proto_item_add_subtree(item, ett_LUID);
1862         }
1863
1864         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1865                 hf_nt_luid_low, NULL);
1866
1867         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1868                 hf_nt_luid_high, NULL);
1869
1870         proto_item_set_len(item, offset-old_offset);
1871         return offset;
1872 }
1873
1874 static int
1875 lsa_dissect_LSA_PRIVILEGE(tvbuff_t *tvb, int offset,
1876         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1877 {
1878         proto_item *item=NULL;
1879         proto_tree *tree=NULL;
1880         int old_offset=offset;
1881
1882         if(parent_tree){
1883                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1884                         "LSA_PRIVILEGE:");
1885                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGE);
1886         }
1887
1888         /* privilege name */
1889         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1890                         hf_lsa_privilege_name, 0);
1891
1892         /* LUID */
1893         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1894
1895         proto_item_set_len(item, offset-old_offset);
1896         return offset;
1897 }
1898
1899 static int
1900 lsa_dissect_LSA_PRIVILEGE_array(tvbuff_t *tvb, int offset,
1901         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1902 {
1903         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1904                 lsa_dissect_LSA_PRIVILEGE);
1905
1906         return offset;
1907 }
1908
1909 static int
1910 lsa_dissect_LSA_PRIVILEGES(tvbuff_t *tvb, int offset,
1911         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1912 {
1913         proto_item *item=NULL;
1914         proto_tree *tree=NULL;
1915         int old_offset=offset;
1916
1917         if(parent_tree){
1918                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1919                         "LSA_PRIVILEGES:");
1920                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGES);
1921         }
1922
1923         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1924                 hf_lsa_count, NULL);
1925
1926         /* privileges */
1927         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1928                 lsa_dissect_LSA_PRIVILEGE_array, NDR_POINTER_UNIQUE,
1929                 "LSA_PRIVILEGE array:", -1);
1930
1931         proto_item_set_len(item, offset-old_offset);
1932         return offset;
1933 }
1934
1935 static int
1936 lsa_dissect_lsarenumerateprivileges_rqst(tvbuff_t *tvb, int offset,
1937         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1938 {
1939         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1940                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1941
1942         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1943                 hf_lsa_count, NULL);
1944
1945         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1946                 hf_lsa_size, NULL);
1947
1948         return offset;
1949 }
1950
1951 static int
1952 lsa_dissect_lsarenumerateprivileges_reply(tvbuff_t *tvb, int offset,
1953         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1954 {
1955         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1956                 hf_lsa_count, NULL);
1957
1958         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1959                 lsa_dissect_LSA_PRIVILEGES, NDR_POINTER_REF,
1960                 "LSA_PRIVILEGES pointer: privs", -1);
1961
1962         offset = dissect_ntstatus(
1963                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1964
1965         return offset;
1966 }
1967
1968 static int
1969 lsa_dissect_lsarlookupprivilegevalue_rqst(tvbuff_t *tvb, int offset,
1970         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1971 {
1972         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1973                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1974
1975         /* privilege name */
1976         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1977                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1978                 "NAME pointer: ", hf_lsa_privilege_name);
1979
1980         return offset;
1981 }
1982
1983
1984 static int
1985 lsa_dissect_lsarlookupprivilegevalue_reply(tvbuff_t *tvb, int offset,
1986         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1987 {
1988
1989         /* LUID */
1990         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1991
1992         offset = dissect_ntstatus(
1993                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1994
1995         return offset;
1996 }
1997
1998
1999 static int
2000 lsa_dissect_lsarlookupprivilegename_rqst(tvbuff_t *tvb, int offset,
2001         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2002 {
2003         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2004                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2005
2006         /* LUID */
2007         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2008                 dissect_nt_LUID, NDR_POINTER_REF,
2009                 "LUID pointer: value", -1);
2010
2011         return offset;
2012 }
2013
2014
2015 static int
2016 lsa_dissect_lsarlookupprivilegename_reply(tvbuff_t *tvb, int offset,
2017         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2018 {
2019         /* [out, ref] LSA_UNICODE_STRING **name */
2020         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2021                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2022                 "PRIVILEGE NAME pointer:", hf_lsa_privilege_name);
2023
2024         offset = dissect_ntstatus(
2025                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2026
2027         return offset;
2028 }
2029
2030
2031 static int
2032 lsa_dissect_lsarenumerateprivilegesaccount_rqst(tvbuff_t *tvb, int offset,
2033         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2034 {
2035         /* [in] LSA_HANDLE hnd */
2036         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2037                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2038
2039         return offset;
2040 }
2041
2042
2043 static int
2044 lsa_dissect_LUID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
2045         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2046 {
2047         proto_item *item=NULL;
2048         proto_tree *tree=NULL;
2049         int old_offset=offset;
2050
2051         if(parent_tree){
2052                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2053                         "LUID_AND_ATTRIBUTES:");
2054                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES);
2055         }
2056
2057         /* LUID */
2058         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
2059
2060         /* attr */
2061         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
2062                                      hf_lsa_attr, NULL);
2063
2064         proto_item_set_len(item, offset-old_offset);
2065         return offset;
2066 }
2067
2068 static int
2069 lsa_dissect_LUID_AND_ATTRIBUTES_array(tvbuff_t *tvb, int offset,
2070         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2071 {
2072         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2073                 lsa_dissect_LUID_AND_ATTRIBUTES);
2074
2075         return offset;
2076 }
2077
2078 static int
2079 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
2080         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2081 {
2082         proto_item *item=NULL;
2083         proto_tree *tree=NULL;
2084         int old_offset=offset;
2085
2086         if(parent_tree){
2087                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2088                         "LUID_AND_ATTRIBUTES_ARRAY:");
2089                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES_ARRAY);
2090         }
2091
2092         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2093                 hf_lsa_count, NULL);
2094
2095         /* luid and attributes */
2096         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2097                 lsa_dissect_LUID_AND_ATTRIBUTES_array, NDR_POINTER_UNIQUE,
2098                 "LUID_AND_ATTRIBUTES array:", -1);
2099
2100         proto_item_set_len(item, offset-old_offset);
2101         return offset;
2102 }
2103
2104 static int
2105 lsa_dissect_lsarenumerateprivilegesaccount_reply(tvbuff_t *tvb, int offset,
2106         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2107 {
2108         /* [out, ref] LUID_AND_ATTRIBUTES_ARRAY * *privs */
2109         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2110                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2111                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2112
2113         offset = dissect_ntstatus(
2114                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2115
2116         return offset;
2117 }
2118
2119 static int
2120 lsa_dissect_lsaraddprivilegestoaccount_rqst(tvbuff_t *tvb, int offset,
2121         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2122 {
2123         /* [in] LSA_HANDLE hnd */
2124         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2125                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2126
2127         /* [in, ref] LUID_AND_ATTRIBUTES_ARRAY *privs */
2128         offset = lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvb, offset,
2129                 pinfo, tree, drep);
2130
2131         return offset;
2132 }
2133
2134
2135 static int
2136 lsa_dissect_lsaraddprivilegestoaccount_reply(tvbuff_t *tvb, int offset,
2137         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2138 {
2139         offset = dissect_ntstatus(
2140                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2141
2142         return offset;
2143 }
2144
2145 static int
2146 lsa_dissect_lsarremoveprivilegesfromaccount_rqst(tvbuff_t *tvb, int offset,
2147         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2148 {
2149         /* [in] LSA_HANDLE hnd */
2150         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2151                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2152
2153         /* [in] char unknown */
2154         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2155                         hf_lsa_unknown_char, NULL);
2156
2157         /* [in, unique] LUID_AND_ATTRIBUTES_ARRAY *privs */
2158         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2159                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2160                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2161
2162         return offset;
2163 }
2164
2165
2166 static int
2167 lsa_dissect_lsarremoveprivilegesfromaccount_reply(tvbuff_t *tvb, int offset,
2168         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2169 {
2170         offset = dissect_ntstatus(
2171                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2172
2173         return offset;
2174 }
2175
2176 static int
2177 lsa_dissect_lsarenumerateaccounts_rqst(tvbuff_t *tvb, int offset,
2178         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2179 {
2180         /* [in] LSA_HANDLE hnd */
2181         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2182                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2183
2184         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2185         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2186                 hf_lsa_resume_handle, NULL);
2187
2188         /* [in] ULONG pref_maxlen */
2189         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2190                 hf_lsa_max_count, NULL);
2191
2192         return offset;
2193 }
2194
2195 static int
2196 lsa_dissect_lsarenumerateaccounts_reply(tvbuff_t *tvb, int offset,
2197         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2198 {
2199         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2200         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2201                 hf_lsa_resume_handle, NULL);
2202
2203         /* [out, ref] PSID_ARRAY **accounts */
2204         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2205                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
2206                         "PSID_ARRAY", -1);
2207
2208         offset = dissect_ntstatus(
2209                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2210
2211         return offset;
2212 }
2213
2214 static int
2215 lsa_dissect_lsarcreatetrusteddomain_rqst(tvbuff_t *tvb, int offset,
2216         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2217 {
2218         /* [in] LSA_HANDLE hnd_pol */
2219         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2220                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2221
2222         /* [in, ref] LSA_TRUST_INFORMATION *domain */
2223         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2224                 lsa_dissect_LSA_TRUST_INFORMATION, NDR_POINTER_REF,
2225                 "LSA_TRUST_INFORMATION pointer: domain", -1);
2226
2227         /* [in] ACCESS_MASK access */
2228         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2229                 pinfo, tree, drep);
2230
2231         return offset;
2232 }
2233
2234 static int
2235 lsa_dissect_lsarcreatetrusteddomain_reply(tvbuff_t *tvb, int offset,
2236         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2237 {
2238         /* [out] LSA_HANDLE *hnd */
2239         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2240                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2241
2242         offset = dissect_ntstatus(
2243                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2244
2245         return offset;
2246 }
2247
2248 static int
2249 lsa_dissect_lsarenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset,
2250         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2251 {
2252         /* [in] LSA_HANDLE hnd */
2253         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2254                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2255
2256         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2257         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2258                 hf_lsa_resume_handle, NULL);
2259
2260         /* [in] ULONG pref_maxlen */
2261         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2262                 hf_lsa_max_count, NULL);
2263
2264         return offset;
2265 }
2266
2267 static int
2268 lsa_dissect_LSA_TRUSTED_DOMAIN(tvbuff_t *tvb, int offset,
2269         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2270 {
2271         proto_item *item=NULL;
2272         proto_tree *tree=NULL;
2273         int old_offset=offset;
2274
2275         if(parent_tree){
2276                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2277                         "TRUSTED_DOMAIN:");
2278                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN);
2279         }
2280
2281         /* domain */
2282         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2283                 hf_lsa_domain, 0);
2284
2285         /* sid */
2286         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
2287
2288         proto_item_set_len(item, offset-old_offset);
2289         return offset;
2290 }
2291
2292 static int
2293 lsa_dissect_LSA_TRUSTED_DOMAIN_array(tvbuff_t *tvb, int offset,
2294         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2295 {
2296         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2297                 lsa_dissect_LSA_TRUSTED_DOMAIN);
2298
2299         return offset;
2300 }
2301
2302 static int
2303 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
2304         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2305 {
2306         proto_item *item=NULL;
2307         proto_tree *tree=NULL;
2308         int old_offset=offset;
2309
2310         if(parent_tree){
2311                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2312                         "TRUSTED_DOMAIN_LIST:");
2313                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN_LIST);
2314         }
2315
2316         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2317                 hf_lsa_count, NULL);
2318
2319         /* privileges */
2320         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2321                 lsa_dissect_LSA_TRUSTED_DOMAIN_array, NDR_POINTER_UNIQUE,
2322                 "TRUSTED_DOMAIN array:", -1);
2323
2324         proto_item_set_len(item, offset-old_offset);
2325         return offset;
2326 }
2327
2328 static int
2329 lsa_dissect_lsarenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset,
2330         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2331 {
2332         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2333         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2334                 hf_lsa_resume_handle, NULL);
2335
2336         /* [out, ref] LSA_REFERENCED_DOMAIN_LIST *domains */
2337         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2338                 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST, NDR_POINTER_REF,
2339                 "LSA_TRUSTED_DOMAIN_LIST pointer: domains", -1);
2340
2341         offset = dissect_ntstatus(
2342                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2343
2344         return offset;
2345 }
2346
2347
2348 static int
2349 lsa_dissect_LSA_UNICODE_STRING_item(tvbuff_t *tvb, int offset,
2350         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2351 {
2352         dcerpc_info *di;
2353
2354         di=pinfo->private_data;
2355         if(di->conformant_run){
2356                 /*just a run to handle conformant arrays, nothing to dissect */
2357                 return offset;
2358         }
2359
2360         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2361                         di->hf_index, 0);
2362
2363         return offset;
2364 }
2365
2366 static int
2367 lsa_dissect_LSA_UNICODE_STRING_array(tvbuff_t *tvb, int offset,
2368         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2369 {
2370         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2371                 lsa_dissect_LSA_UNICODE_STRING_item);
2372
2373         return offset;
2374 }
2375
2376 static int
2377 lsa_dissect_LSA_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset,
2378         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2379 {
2380         dcerpc_info *di;
2381
2382         di=pinfo->private_data;
2383
2384         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2385                 hf_lsa_count, NULL);
2386         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2387                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2388                 "UNICODE_STRING pointer: ", di->hf_index);
2389
2390         return offset;
2391 }
2392
2393 static int
2394 lsa_dissect_LSA_TRANSLATED_SID(tvbuff_t *tvb, int offset,
2395         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2396 {
2397         /* sid type */
2398         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2399                         hf_lsa_sid_type, NULL);
2400
2401         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2402                                      hf_lsa_rid, NULL);
2403
2404         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2405                                      hf_lsa_index, NULL);
2406
2407         return offset;
2408 }
2409
2410 static int
2411 lsa_dissect_LSA_TRANSLATED_SIDS_array(tvbuff_t *tvb, int offset,
2412         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2413 {
2414         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2415                 lsa_dissect_LSA_TRANSLATED_SID);
2416
2417         return offset;
2418 }
2419
2420 static int
2421 lsa_dissect_LSA_TRANSLATED_SIDS(tvbuff_t *tvb, int offset,
2422         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2423 {
2424         proto_item *item=NULL;
2425         proto_tree *tree=NULL;
2426         int old_offset=offset;
2427
2428         if(parent_tree){
2429                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2430                         "LSA_TRANSLATED_SIDS:");
2431                 tree = proto_item_add_subtree(item, ett_LSA_TRANSLATED_SIDS);
2432         }
2433
2434         /* count */
2435         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2436                                      hf_lsa_count, NULL);
2437
2438         /* settings */
2439         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2440                 lsa_dissect_LSA_TRANSLATED_SIDS_array, NDR_POINTER_UNIQUE,
2441                 "Translated SIDS", -1);
2442
2443         proto_item_set_len(item, offset-old_offset);
2444         return offset;
2445 }
2446
2447 static int
2448 lsa_dissect_lsarlookupnames_rqst(tvbuff_t *tvb, int offset,
2449         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2450 {
2451         /* [in] LSA_HANDLE hnd */
2452         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2453                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2454
2455         /* [in] ULONG count */
2456         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2457                 hf_lsa_count, NULL);
2458
2459         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
2460         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2461                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
2462                 "Account pointer: names", hf_lsa_acct);
2463
2464         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2465         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2466                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2467                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2468
2469         /* [in] USHORT level */
2470         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2471                 hf_lsa_info_level, NULL);
2472
2473         /* [in, out, ref] ULONG *num_mapped */
2474         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2475                 hf_lsa_num_mapped, NULL);
2476
2477         return offset;
2478 }
2479
2480
2481 static int
2482 lsa_dissect_lsarlookupnames_reply(tvbuff_t *tvb, int offset,
2483         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2484 {
2485         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
2486         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2487                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
2488                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
2489
2490         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2491         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2492                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2493                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2494
2495         /* [in, out, ref] ULONG *num_mapped */
2496         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2497                 hf_lsa_num_mapped, NULL);
2498
2499         offset = dissect_ntstatus(
2500                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2501
2502         return offset;
2503 }
2504
2505 static int
2506 lsa_dissect_lsarcreatesecret_rqst(tvbuff_t *tvb, int offset,
2507         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2508 {
2509         /* [in] LSA_HANDLE hnd_pol */
2510         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2511                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2512
2513         /* [in, ref] LSA_UNICODE_STRING *name */
2514         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2515                 hf_lsa_name, 0);
2516
2517         /* [in] ACCESS_MASK access */
2518         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2519                 pinfo, tree, drep);
2520
2521         return offset;
2522 }
2523
2524 static int
2525 lsa_dissect_lsarcreatesecret_reply(tvbuff_t *tvb, int offset,
2526         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2527 {
2528
2529         /* [out] LSA_HANDLE *hnd */
2530         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2531                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2532
2533         offset = dissect_ntstatus(
2534                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2535
2536         return offset;
2537 }
2538
2539 static int
2540 lsa_dissect_lsaropenaccount_rqst(tvbuff_t *tvb, int offset,
2541         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2542 {
2543         /* [in] LSA_HANDLE hnd_pol */
2544         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2545                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2546
2547         /* [in, ref] SID *account */
2548         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
2549
2550         /* [in] ACCESS_MASK access */
2551         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2552                 pinfo, tree, drep);
2553
2554         return offset;
2555 }
2556
2557
2558 static int
2559 lsa_dissect_lsaropenaccount_reply(tvbuff_t *tvb, int offset,
2560         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2561 {
2562         /* [out] LSA_HANDLE *hnd */
2563         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2564                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2565
2566         offset = dissect_ntstatus(
2567                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2568
2569         return offset;
2570 }
2571
2572 static const value_string trusted_info_level_vals[] = {
2573         {1,     "Domain Name Information"},
2574         {2,     "Controllers Information"},
2575         {3,     "Posix Offset Information"},
2576         {4,     "Password Information"},
2577         {5,     "Domain Information Basic"},
2578         {6,     "Domain Information Ex"},
2579         {7,     "Domain Auth Information"},
2580         {8,     "Domain Full Information"},
2581         {9,     "Domain Security Descriptor"},
2582         {10,    "Domain Private Information"},
2583         {0,     NULL}
2584 };
2585
2586 static int
2587 lsa_dissect_TRUSTED_DOMAIN_INFORMATION(tvbuff_t *tvb, int offset,
2588         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2589 {
2590         proto_item *item=NULL;
2591         proto_tree *tree=NULL;
2592         int old_offset=offset;
2593         guint16 level;
2594
2595         if(parent_tree){
2596                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2597                         "TRUSTED_DOMAIN_INFO:");
2598                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_info);
2599         }
2600
2601         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2602                                      hf_lsa_trusted_info_level, &level);
2603
2604         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
2605         switch(level){
2606         case 1:
2607                 offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2608                         hf_lsa_domain, 0);
2609                 break;
2610         case 2:
2611                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2612                         hf_lsa_count, NULL);
2613                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2614                         lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2615                         "Controllers pointer: ", hf_lsa_controller);
2616                 break;
2617         case 3:
2618                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2619                         hf_lsa_rid_offset, NULL);
2620                 break;
2621         case 4:
2622                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2623                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2624                 break;
2625         case 5:
2626                 offset = lsa_dissect_LSA_TRUST_INFORMATION(tvb, offset,
2627                         pinfo, tree, drep);
2628                 break;
2629         case 6:
2630                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2631                         pinfo, tree, drep);
2632                 break;
2633         case 7:
2634                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2635                 break;
2636         case 8:
2637                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2638                         pinfo, tree, drep);
2639                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2640                         hf_lsa_rid_offset, NULL);
2641                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2642                 break;
2643         case 9:
2644                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2645                 break;
2646         case 10:
2647                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2648                         pinfo, tree, drep);
2649                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2650                         hf_lsa_rid_offset, NULL);
2651                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2652                 break;
2653         }
2654
2655         proto_item_set_len(item, offset-old_offset);
2656         return offset;
2657 }
2658
2659 static int
2660 lsa_dissect_lsarqueryinfotrusteddomain_rqst(tvbuff_t *tvb, int offset,
2661         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2662 {
2663         /* [in] LSA_HANDLE hnd */
2664         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2665                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2666
2667         /* [in] TRUSTED_INFORMATION_CLASS level */
2668         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2669                 hf_lsa_trusted_info_level, NULL);
2670
2671         return offset;
2672 }
2673
2674
2675 static int
2676 lsa_dissect_lsarqueryinfotrusteddomain_reply(tvbuff_t *tvb, int offset,
2677         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2678 {
2679         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info */
2680         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2681                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2682                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2683
2684         offset = dissect_ntstatus(
2685                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2686
2687         return offset;
2688 }
2689
2690 static int
2691 lsa_dissect_lsarsetinformationtrusteddomain_rqst(tvbuff_t *tvb, int offset,
2692         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2693 {
2694         /* [in] LSA_HANDLE hnd */
2695         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2696                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2697
2698         /* [in] TRUSTED_INFORMATION_CLASS level */
2699         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2700                 hf_lsa_trusted_info_level, NULL);
2701
2702         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info */
2703         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2704                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2705                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2706
2707         return offset;
2708 }
2709
2710
2711 static int
2712 lsa_dissect_lsarsetinformationtrusteddomain_reply(tvbuff_t *tvb, int offset,
2713         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2714 {
2715         offset = dissect_ntstatus(
2716                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2717
2718         return offset;
2719 }
2720
2721 static int
2722 lsa_dissect_lsaropensecret_rqst(tvbuff_t *tvb, int offset,
2723         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2724 {
2725         /* [in] LSA_HANDLE hnd_pol */
2726         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2727                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2728
2729         /* [in, ref] LSA_UNICODE_STRING *name */
2730         offset = dissect_ndr_counted_string_cb(
2731                 tvb, offset, pinfo, tree, drep, hf_lsa_name,
2732                 cb_wstr_postprocess,
2733                 GINT_TO_POINTER(CB_STR_COL_INFO | 1));
2734
2735         /* [in] ACCESS_MASK access */
2736         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2737                 pinfo, tree, drep);
2738
2739         return offset;
2740 }
2741
2742
2743 static int
2744 lsa_dissect_lsaropensecret_reply(tvbuff_t *tvb, int offset,
2745         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2746 {
2747         /* [out] LSA_HANDLE *hnd */
2748         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2749                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2750
2751         offset = dissect_ntstatus(
2752                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2753
2754         return offset;
2755 }
2756
2757 static int
2758 lsa_dissect_lsarsetsecret_rqst(tvbuff_t *tvb, int offset,
2759         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2760 {
2761         /* [in] LSA_HANDLE hnd */
2762         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2763                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2764
2765         /* [in, unique] LSA_SECRET *new_val */
2766         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2767                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2768                 "LSA_SECRET pointer: new_val", -1);
2769
2770         /* [in, unique] LSA_SECRET *old_val */
2771         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2772                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2773                 "LSA_SECRET pointer: old_val", -1);
2774
2775         return offset;
2776 }
2777
2778
2779 static int
2780 lsa_dissect_lsarsetsecret_reply(tvbuff_t *tvb, int offset,
2781         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2782 {
2783         offset = dissect_ntstatus(
2784                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2785
2786         return offset;
2787 }
2788
2789 static int
2790 lsa_dissect_lsarquerysecret_rqst(tvbuff_t *tvb, int offset,
2791         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2792 {
2793         /* [in] LSA_HANDLE hnd */
2794         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2795                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2796
2797         /* [in, out, unique] LSA_SECRET **curr_val */
2798         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2799                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2800                 "LSA_SECRET pointer: curr_val", -1);
2801
2802         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2803         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2804                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2805                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2806
2807         /* [in, out, unique] LSA_SECRET **old_val */
2808         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2809                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2810                 "LSA_SECRET pointer: old_val", -1);
2811
2812         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2813         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2814                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2815                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2816
2817         return offset;
2818 }
2819
2820
2821 static int
2822 lsa_dissect_lsarquerysecret_reply(tvbuff_t *tvb, int offset,
2823         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2824 {
2825         /* [in, out, unique] LSA_SECRET **curr_val */
2826         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2827                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2828                 "LSA_SECRET pointer: curr_val", -1);
2829
2830         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2831         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2832                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2833                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2834
2835         /* [in, out, unique] LSA_SECRET **old_val */
2836         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2837                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2838                 "LSA_SECRET pointer: old_val", -1);
2839
2840         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2841         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2842                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2843                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2844
2845         offset = dissect_ntstatus(
2846                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2847
2848         return offset;
2849 }
2850
2851 static int
2852 lsa_dissect_lsardeleteobject_rqst(tvbuff_t *tvb, int offset,
2853         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2854 {
2855         /* [in] LSA_HANDLE hnd */
2856         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2857                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2858
2859         return offset;
2860 }
2861
2862
2863 static int
2864 lsa_dissect_lsardeleteobject_reply(tvbuff_t *tvb, int offset,
2865         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2866 {
2867         offset = dissect_ntstatus(
2868                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2869
2870         return offset;
2871 }
2872
2873 static int
2874 lsa_dissect_lsarenumerateaccountswithuserright_rqst(tvbuff_t *tvb, int offset,
2875         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2876 {
2877         /* [in] LSA_HANDLE hnd */
2878         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2879                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2880
2881         /* [in, unique] LSA_UNICODE_STRING *rights */
2882         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2883                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2884                 "LSA_UNICODE_STRING pointer: rights", hf_lsa_rights);
2885
2886         return offset;
2887 }
2888
2889 static int
2890 lsa_dissect_lsarenumerateaccountswithuserright_reply(tvbuff_t *tvb, int offset,
2891         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2892 {
2893         /* [out, ref] LSA_UNICODE_STRING_ARRAY *accounts */
2894         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2895                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2896                 "Account pointer: names", hf_lsa_acct);
2897
2898         offset = dissect_ntstatus(
2899                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2900
2901         return offset;
2902 }
2903
2904 static int
2905 lsa_dissect_lsarenumerateaccountrights_rqst(tvbuff_t *tvb, int offset,
2906         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2907 {
2908         /* [in] LSA_HANDLE hnd */
2909         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2910                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2911
2912         /* [in, ref] SID *account */
2913         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
2914
2915         return offset;
2916 }
2917
2918
2919 static int
2920 lsa_dissect_lsarenumerateaccountrights_reply(tvbuff_t *tvb, int offset,
2921         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2922 {
2923         /* [out, ref] LSA_UNICODE_STRING_ARRAY *rights */
2924         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2925                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2926                 "Account pointer: rights", hf_lsa_rights);
2927
2928         offset = dissect_ntstatus(
2929                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2930
2931         return offset;
2932 }
2933
2934 static int
2935 lsa_dissect_lsaraddaccountrights_rqst(tvbuff_t *tvb, int offset,
2936         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2937 {
2938         /* [in] LSA_HANDLE hnd */
2939         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2940                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2941
2942         /* [in, ref] SID *account */
2943         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
2944
2945         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2946         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2947                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2948                 "Account pointer: rights", hf_lsa_rights);
2949
2950         return offset;
2951 }
2952
2953
2954 static int
2955 lsa_dissect_lsaraddaccountrights_reply(tvbuff_t *tvb, int offset,
2956         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2957 {
2958         offset = dissect_ntstatus(
2959                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2960
2961         return offset;
2962 }
2963
2964 static int
2965 lsa_dissect_lsarremoveaccountrights_rqst(tvbuff_t *tvb, int offset,
2966         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2967 {
2968         /* [in] LSA_HANDLE hnd */
2969         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2970                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2971
2972         /* [in, ref] SID *account */
2973         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
2974
2975         /* remove all */
2976         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2977                         hf_lsa_remove_all, NULL);
2978
2979         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2980         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2981                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2982                 "Account pointer: rights", hf_lsa_rights);
2983
2984         return offset;
2985 }
2986
2987
2988 static int
2989 lsa_dissect_lsarremoveaccountrights_reply(tvbuff_t *tvb, int offset,
2990         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2991 {
2992         offset = dissect_ntstatus(
2993                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2994
2995         return offset;
2996 }
2997
2998
2999 static int
3000 lsa_dissect_lsarquerytrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3001         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3002 {
3003         /* [in] LSA_HANDLE handle */
3004         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3005                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3006
3007         /* [in, ref] LSA_UNICODE_STRING *name */
3008         /* domain */
3009         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3010                 hf_lsa_domain, 0);
3011
3012         /* [in] TRUSTED_INFORMATION_CLASS level */
3013         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3014                                      hf_lsa_trusted_info_level, NULL);
3015
3016         return offset;
3017 }
3018
3019
3020 static int
3021 lsa_dissect_lsarquerytrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3022         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3023 {
3024         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3025         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3026                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3027                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3028
3029         offset = dissect_ntstatus(
3030                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3031
3032         return offset;
3033 }
3034
3035
3036 static int
3037 lsa_dissect_lsarsettrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3038         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3039 {
3040         /* [in] LSA_HANDLE handle */
3041         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3042                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3043
3044         /* [in, ref] LSA_UNICODE_STRING *name */
3045         /* domain */
3046         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3047                 hf_lsa_domain, 0);
3048
3049         /* [in] TRUSTED_INFORMATION_CLASS level */
3050         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3051                                      hf_lsa_trusted_info_level, NULL);
3052
3053         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3054         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3055                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3056                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3057
3058         return offset;
3059 }
3060
3061
3062 static int
3063 lsa_dissect_lsarsettrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3064         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3065 {
3066         offset = dissect_ntstatus(
3067                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3068
3069         return offset;
3070 }
3071
3072 static int
3073 lsa_dissect_lsarquerytrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3074         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3075 {
3076         /* [in] LSA_HANDLE handle */
3077         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3078                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3079
3080         /* [in, ref] SID *sid */
3081         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
3082
3083         /* [in] TRUSTED_INFORMATION_CLASS level */
3084         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3085                                      hf_lsa_trusted_info_level, NULL);
3086
3087         return offset;
3088 }
3089
3090 static int
3091 lsa_dissect_lsaropentrusteddomainbyname_rqst(tvbuff_t *tvb, int offset,
3092         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3093 {
3094         /* [in] LSA_HANDLE handle */
3095         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3096                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3097
3098         /* [in, ref] LSA_UNICODE_STRING *name */
3099         /* domain */
3100         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3101                 hf_lsa_domain, 0);
3102
3103         /* [in] ACCESS_MASK access */
3104         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3105                 pinfo, tree, drep);
3106
3107         return offset;
3108 }
3109
3110
3111 static int
3112 lsa_dissect_lsaropentrusteddomainbyname_reply(tvbuff_t *tvb, int offset,
3113         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3114 {
3115         /* [out] LSA_HANDLE handle */
3116         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3117                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3118
3119         offset = dissect_ntstatus(
3120                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3121
3122         return offset;
3123 }
3124
3125
3126
3127 static int
3128 lsa_dissect_lsarquerytrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3129         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3130 {
3131         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3132         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3133                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3134                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3135
3136         offset = dissect_ntstatus(
3137                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3138
3139         return offset;
3140 }
3141
3142 static int
3143 lsa_dissect_lsarsettrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3144         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3145 {
3146         /* [in] LSA_HANDLE handle */
3147         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3148                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3149
3150         /* [in, ref] SID *sid */
3151         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
3152
3153         /* [in] TRUSTED_INFORMATION_CLASS level */
3154         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3155                                      hf_lsa_trusted_info_level, NULL);
3156
3157         /* [ref, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3158         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3159                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3160                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3161
3162         return offset;
3163 }
3164
3165
3166 static int
3167 lsa_dissect_lsarsettrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3168         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3169 {
3170         offset = dissect_ntstatus(
3171                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3172
3173         return offset;
3174 }
3175
3176 static int
3177 lsa_dissect_lsarqueryinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3178         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3179 {
3180         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3181                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3182
3183         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3184                 hf_lsa_policy_information_class, NULL);
3185
3186         return offset;
3187 }
3188
3189 static int
3190 lsa_dissect_lsarqueryinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3191         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3192 {
3193         /* This is really a pointer to a pointer though the first level is REF
3194           so we just ignore that one */
3195         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3196                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
3197                 "POLICY_INFORMATION pointer: info", -1);
3198
3199         offset = dissect_ntstatus(
3200                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3201
3202         return offset;
3203 }
3204
3205 static int
3206 lsa_dissect_lsarsetinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3207         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3208 {
3209         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3210                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3211
3212         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3213                 hf_lsa_policy_information_class, NULL);
3214
3215         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3216                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3217                 "POLICY_INFORMATION pointer: info", -1);
3218
3219         return offset;
3220 }
3221
3222 static int
3223 lsa_dissect_lsarsetinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3224         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3225 {
3226         offset = dissect_ntstatus(
3227                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3228
3229         return offset;
3230 }
3231
3232 static int
3233 lsa_dissect_lsarquerydomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3234         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3235 {
3236         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3237                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3238
3239         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3240                 hf_lsa_policy_information_class, NULL);
3241
3242         return offset;
3243 }
3244
3245 static int
3246 lsa_dissect_lsarquerydomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3247         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3248 {
3249         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3250                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3251                 "POLICY_INFORMATION pointer: info", -1);
3252
3253         offset = dissect_ntstatus(
3254                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3255
3256         return offset;
3257 }
3258
3259 static int
3260 lsa_dissect_lsarsetdomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3261         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3262 {
3263         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3264                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3265
3266         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3267                 hf_lsa_policy_information_class, NULL);
3268
3269         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3270                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3271                 "POLICY_INFORMATION pointer: info", -1);
3272
3273         return offset;
3274 }
3275
3276 static int
3277 lsa_dissect_lsarsetdomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3278         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3279 {
3280         offset = dissect_ntstatus(
3281                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3282
3283         return offset;
3284 }
3285
3286 static int
3287 lsa_dissect_lsarlookupnames2_rqst(tvbuff_t *tvb, int offset,
3288         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3289 {
3290         /* [in] LSA_HANDLE hnd */
3291         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3292                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3293
3294         /* [in] ULONG count */
3295         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3296                 hf_lsa_count, NULL);
3297
3298         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
3299         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3300                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
3301                 "Account pointer: names", hf_lsa_acct);
3302
3303         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3304         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3305                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3306                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3307
3308         /* [in] USHORT level */
3309         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3310                 hf_lsa_info_level, NULL);
3311
3312         /* [in, out, ref] ULONG *num_mapped */
3313         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3314                 hf_lsa_num_mapped, NULL);
3315
3316         /* unknown */
3317         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3318                                      hf_lsa_unknown_long, NULL);
3319
3320         /* unknown */
3321         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3322                                      hf_lsa_unknown_long, NULL);
3323
3324         return offset;
3325 }
3326
3327
3328 static int
3329 lsa_dissect_lsarlookupnames2_reply(tvbuff_t *tvb, int offset,
3330         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3331 {
3332         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
3333         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3334                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3335                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3336
3337         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3338         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3339                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3340                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3341
3342         /* [in, out, ref] ULONG *num_mapped */
3343         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3344                 hf_lsa_num_mapped, NULL);
3345
3346         offset = dissect_ntstatus(
3347                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3348
3349         return offset;
3350 }
3351
3352
3353 static int
3354 lsa_dissect_lsarcreateaccount_rqst(tvbuff_t *tvb, int offset,
3355         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3356 {
3357         /* [in] LSA_HANDLE hnd */
3358         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3359                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3360
3361         offset = dissect_ndr_nt_SID(tvb, offset, pinfo, tree, drep);
3362
3363         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3364                 pinfo, tree, drep);
3365
3366         return offset;
3367 }
3368
3369 static int
3370 lsa_dissect_lsarcreateaccount_reply(tvbuff_t *tvb, int offset,
3371         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3372 {
3373         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3374                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3375
3376         offset = dissect_ntstatus(
3377                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3378
3379         return offset;
3380 }
3381
3382 static int
3383 lsa_dissect_lsarlookupprivilegedisplayname_rqst(tvbuff_t *tvb, int offset,
3384         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3385 {
3386         /* [in] LSA_HANDLE hnd */
3387         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3388                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3389
3390         /* [in, ref] LSA_UNICODE_STRING *name */
3391         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3392                 hf_lsa_privilege_name, 0);
3393
3394         /* [in, ref] long *size */
3395         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3396                 hf_lsa_privilege_display_name_size, NULL);
3397
3398         return offset;
3399 }
3400
3401
3402 static int
3403 lsa_dissect_lsarlookupprivilegedisplayname_reply(tvbuff_t *tvb, int offset,
3404         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3405 {
3406         /* [out, ref] LSA_UNICODE_STRING **disp_name */
3407         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3408                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3409                 "NAME pointer: ", hf_lsa_privilege_display_name);
3410
3411         /* [out, ref] long *size */
3412         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3413                 hf_lsa_privilege_display_name_size, NULL);
3414
3415         offset = dissect_ntstatus(
3416                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3417
3418         return offset;
3419 }
3420
3421 static int
3422 lsa_dissect_lsarstoreprivatedata_rqst(tvbuff_t *tvb, int offset,
3423         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3424 {
3425         /* [in] LSA_HANDLE hnd */
3426         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3427                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3428
3429         /* [in, ref] LSA_UNICODE_STRING *key */
3430         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3431                 hf_lsa_key, 0);
3432
3433         /* [in, unique] LSA_SECRET **data */
3434         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3435                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
3436                 "LSA_SECRET* pointer: data", -1);
3437
3438         return offset;
3439 }
3440
3441
3442 static int
3443 lsa_dissect_lsarstoreprivatedata_reply(tvbuff_t *tvb, int offset,
3444         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3445 {
3446         offset = dissect_ntstatus(
3447                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3448
3449         return offset;
3450 }
3451
3452 static int
3453 lsa_dissect_lsarretrieveprivatedata_rqst(tvbuff_t *tvb, int offset,
3454         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3455 {
3456         /* [in] LSA_HANDLE hnd */
3457         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3458                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3459
3460         /* [in, ref] LSA_UNICODE_STRING *key */
3461         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3462                 hf_lsa_key, 0);
3463
3464         /* [in, out, ref] LSA_SECRET **data */
3465         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3466                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3467                 "LSA_SECRET* pointer: data", -1);
3468
3469         return offset;
3470 }
3471
3472
3473 static int
3474 lsa_dissect_lsarretrieveprivatedata_reply(tvbuff_t *tvb, int offset,
3475         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3476 {
3477         /* [in, out, ref] LSA_SECRET **data */
3478         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3479                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3480                 "LSA_SECRET* pointer: data", -1);
3481
3482         offset = dissect_ntstatus(
3483                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3484
3485         return offset;
3486 }
3487
3488 static int
3489 lsa_dissect_lsarclosetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3490         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3491 {
3492
3493         /* [in, out] LSA_HANDLE *tdHnd */
3494         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3495                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3496
3497         return offset;
3498 }
3499
3500
3501 static int
3502 lsa_dissect_lsarclosetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3503         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3504 {
3505
3506         /* [in, out] LSA_HANDLE *tdHnd */
3507         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3508                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3509
3510         offset = dissect_ntstatus(
3511                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3512
3513         return offset;
3514 }
3515
3516 static int
3517 lsa_dissect_LSA_TRANSLATED_NAME_EX(tvbuff_t *tvb, int offset,
3518         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
3519 {
3520         proto_item *item=NULL;
3521         proto_tree *tree=NULL;
3522         int old_offset=offset;
3523
3524         if(parent_tree){
3525                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3526                         "LSA_TRANSLATED_NAME:");
3527                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
3528         }
3529
3530         /* sid type */
3531         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3532                         hf_lsa_sid_type, NULL);
3533
3534         /* name */
3535         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3536                 hf_lsa_name, 0);
3537
3538         /* index */
3539         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3540                                      hf_lsa_index, NULL);
3541
3542         /* unknown */
3543         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3544                                      hf_lsa_unknown_long, NULL);
3545
3546         proto_item_set_len(item, offset-old_offset);
3547         return offset;
3548 }
3549
3550 static int
3551 lsa_dissect_LSA_TRANSLATED_NAME_EX_array(tvbuff_t *tvb, int offset,
3552         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3553 {
3554         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3555                 lsa_dissect_LSA_TRANSLATED_NAME_EX);
3556
3557         return offset;
3558 }
3559 static int
3560 lsa_dissect_LSA_TRANSLATED_NAMES_EX(tvbuff_t *tvb, int offset,
3561         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3562 {
3563         /* count */
3564         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3565                                      hf_lsa_count, NULL);
3566
3567         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3568                         lsa_dissect_LSA_TRANSLATED_NAME_EX_array, NDR_POINTER_UNIQUE,
3569                         "LSA_TRANSLATED_NAME_EX: pointer", -1);
3570
3571         return offset;
3572 }
3573
3574
3575 static int
3576 lsa_dissect_lsarlookupsids2_rqst(tvbuff_t *tvb, int offset,
3577         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3578 {
3579         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3580                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3581
3582         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3583                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
3584                         "PSID_ARRAY", -1);
3585
3586         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3587                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3588                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3589
3590         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3591                 hf_lsa_info_level, NULL);
3592
3593         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3594                 hf_lsa_num_mapped, NULL);
3595
3596         /* unknown */
3597         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3598                                      hf_lsa_unknown_long, NULL);
3599
3600         /* unknown */
3601         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3602                                      hf_lsa_unknown_long, NULL);
3603
3604         return offset;
3605 }
3606
3607 static int
3608 lsa_dissect_lsarlookupsids2_reply(tvbuff_t *tvb, int offset,
3609         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3610 {
3611         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3612                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3613                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3614
3615         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3616                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3617                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3618
3619         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3620                 hf_lsa_num_mapped, NULL);
3621
3622         offset = dissect_ntstatus(
3623                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3624
3625         return offset;
3626 }
3627
3628 static int
3629 lsa_dissect_lsargetusername_rqst(tvbuff_t *tvb, int offset,
3630         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3631 {
3632
3633         /* [in, unique, string] WCHAR *server */
3634         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3635                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
3636                 "Server:", hf_lsa_server);
3637
3638         /* [in, out, ref] LSA_UNICODE_STRING **user */
3639         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3640                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3641                 "ACCOUNT pointer: ", hf_lsa_acct);
3642
3643         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3644         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3645                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3646                 "DOMAIN pointer: ", hf_lsa_domain);
3647
3648         return offset;
3649 }
3650
3651
3652 static int
3653 lsa_dissect_lsargetusername_reply(tvbuff_t *tvb, int offset,
3654         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3655 {
3656         /* [in, out, ref] LSA_UNICODE_STRING **user */
3657         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3658                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3659                 "ACCOUNT pointer: ", hf_lsa_acct);
3660
3661         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3662         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3663                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3664                 "DOMAIN pointer: ", hf_lsa_domain);
3665
3666         offset = dissect_ntstatus(
3667                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3668
3669         return offset;
3670 }
3671
3672 static int
3673 lsa_dissect_lsarcreatetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3674         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3675 {
3676         /* [in] LSA_HANDLE hnd */
3677         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3678                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3679
3680         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3681         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3682                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3683                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3684
3685         /* [in, ref] TRUSTED_DOMAIN_AUTH_INFORMATION *auth */
3686         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3687                 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION, NDR_POINTER_REF,
3688                 "TRUSTED_DOMAIN_AUTH_INFORMATION pointer: auth", -1);
3689
3690         /* [in] ACCESS_MASK mask */
3691         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3692                 pinfo, tree, drep);
3693
3694         return offset;
3695 }
3696
3697
3698 static int
3699 lsa_dissect_lsarcreatetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3700         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3701 {
3702         /* [out] LSA_HANDLE *tdHnd) */
3703         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3704                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3705
3706         offset = dissect_ntstatus(
3707                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3708
3709         return offset;
3710 }
3711
3712 static int
3713 lsa_dissect_lsarenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset,
3714         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3715 {
3716         /* [in] LSA_HANDLE hnd */
3717         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3718                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3719
3720         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3721         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3722                 hf_lsa_resume_handle, NULL);
3723
3724         /* [in] ULONG pref_maxlen */
3725         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3726                 hf_lsa_max_count, NULL);
3727
3728         return offset;
3729 }
3730
3731
3732 static int
3733 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array(tvbuff_t *tvb, int offset,
3734         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3735 {
3736         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3737                 lsa_dissect_LSA_TRUST_INFORMATION_EX);
3738
3739         return offset;
3740 }
3741
3742 static int
3743 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX(tvbuff_t *tvb, int offset,
3744         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3745 {
3746         /* count */
3747         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3748                                      hf_lsa_count, NULL);
3749
3750         /* trust information */
3751         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3752                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array, NDR_POINTER_UNIQUE,
3753                 "TRUST INFORMATION array:", -1);
3754
3755         /* max count */
3756         /* The original code here was wrong. It now handles these correctly */
3757         /*offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3758                                      hf_lsa_max_count, NULL);
3759         */
3760
3761         return offset;
3762 }
3763
3764 static int
3765 lsa_dissect_lsarenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset,
3766         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3767 {
3768         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3769         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3770                 hf_lsa_resume_handle, NULL);
3771
3772         /* [out, ref] TRUSTED_DOMAIN_INFORMATION_LIST_EX *domains */
3773         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3774                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX, NDR_POINTER_REF,
3775                 "TRUSTED_DOMAIN_INFORMATION_LIST_EX pointer: domains", -1);
3776
3777         offset = dissect_ntstatus(
3778                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3779
3780         return offset;
3781 }
3782
3783 static int
3784 lsa_dissect_lsartestcall_rqst(tvbuff_t *tvb, int offset,
3785         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3786 {
3787         /* [in] LSA_HANDLE handle */
3788         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3789                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3790
3791         /* [in] USHORT flag */
3792         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3793                 hf_lsa_unknown_short, NULL);
3794
3795         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3796         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3797                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3798                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3799
3800         return offset;
3801 }
3802
3803
3804 static int
3805 lsa_dissect_lsartestcall_reply(tvbuff_t *tvb, int offset,
3806         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3807 {
3808         /* [out, ref] LSA_SECURITY_DESCRIPTOR **psd) */
3809         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3810                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
3811                 "LSA_SECURITY_DESCRIPTOR pointer: psd)", -1);
3812
3813         offset = dissect_ntstatus(
3814                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3815
3816         return offset;
3817 }
3818
3819 static int
3820 lsa_dissect_lsarcreatetrusteddomainex2_rqst(tvbuff_t *tvb, int offset,
3821         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3822 {
3823         /* [in] LSA_HANDLE hnd */
3824         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3825                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3826
3827         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3828         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3829                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3830                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3831
3832         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3833         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3834                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3835                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3836
3837         /* [in] ULONG unknown */
3838         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3839                 hf_lsa_unknown_long, NULL);
3840
3841         return offset;
3842 }
3843
3844
3845 static int
3846 lsa_dissect_lsarcreatetrusteddomainex2_reply(tvbuff_t *tvb, int offset,
3847         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3848 {
3849         /* [out] LSA_HANDLE *h2) */
3850         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3851                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3852
3853         offset = dissect_ntstatus(
3854                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3855
3856         return offset;
3857 }
3858
3859
3860 static dcerpc_sub_dissector dcerpc_lsa_dissectors[] = {
3861         { LSA_LSARCLOSE, "LsarClose",
3862                 lsa_dissect_lsarclose_rqst,
3863                 lsa_dissect_lsarclose_reply },
3864         { LSA_LSARDELETE, "LsarDelete",
3865                 lsa_dissect_lsardelete_rqst,
3866                 lsa_dissect_lsardelete_reply },
3867         { LSA_LSARENUMERATEPRIVILEGES, "LsarEnumeratePrivileges",
3868                 lsa_dissect_lsarenumerateprivileges_rqst,
3869                 lsa_dissect_lsarenumerateprivileges_reply },
3870         { LSA_LSARQUERYSECURITYOBJECT, "LsarQuerySecurityObject",
3871                 lsa_dissect_lsarquerysecurityobject_rqst,
3872                 lsa_dissect_lsarquerysecurityobject_reply },
3873         { LSA_LSARSETSECURITYOBJECT, "LsarSetSecurityObject",
3874                 lsa_dissect_lsarsetsecurityobject_rqst,
3875                 lsa_dissect_lsarsetsecurityobject_reply },
3876         { LSA_LSARCHANGEPASSWORD, "LsarChangePassword",
3877                 lsa_dissect_lsarchangepassword_rqst,
3878                 lsa_dissect_lsarchangepassword_reply },
3879         { LSA_LSAROPENPOLICY, "LsarOpenPolicy",
3880                 lsa_dissect_lsaropenpolicy_rqst,
3881                 lsa_dissect_lsaropenpolicy_reply },
3882         { LSA_LSARQUERYINFORMATIONPOLICY, "LsarQueryInformationPolicy",
3883                 lsa_dissect_lsarqueryinformationpolicy_rqst,
3884                 lsa_dissect_lsarqueryinformationpolicy_reply },
3885         { LSA_LSARSETINFORMATIONPOLICY, "LsarSetInformationPolicy",
3886                 lsa_dissect_lsarsetinformationpolicy_rqst,
3887                 lsa_dissect_lsarsetinformationpolicy_reply },
3888         { LSA_LSARCLEARAUDITLOG, "LsarClearAuditLog",
3889                 lsa_dissect_lsarclearauditlog_rqst,
3890                 lsa_dissect_lsarclearauditlog_reply },
3891         { LSA_LSARCREATEACCOUNT, "LsarCreateAccount",
3892                 lsa_dissect_lsarcreateaccount_rqst,
3893                 lsa_dissect_lsarcreateaccount_reply },
3894         { LSA_LSARENUMERATEACCOUNTS, "LsarEnumerateAccounts",
3895                 lsa_dissect_lsarenumerateaccounts_rqst,
3896                 lsa_dissect_lsarenumerateaccounts_reply },
3897         { LSA_LSARCREATETRUSTEDDOMAIN, "LsarCreateTrustedDomain",
3898                 lsa_dissect_lsarcreatetrusteddomain_rqst,
3899                 lsa_dissect_lsarcreatetrusteddomain_reply },
3900         { LSA_LSARENUMERATETRUSTEDDOMAINS, "LsarEnumerateTrustedDomains",
3901                 lsa_dissect_lsarenumeratetrusteddomains_rqst,
3902                 lsa_dissect_lsarenumeratetrusteddomains_reply },
3903         { LSA_LSARLOOKUPNAMES, "LsarLookupNames",
3904                 lsa_dissect_lsarlookupnames_rqst,
3905                 lsa_dissect_lsarlookupnames_reply },
3906         { LSA_LSARLOOKUPSIDS, "LsarLookupSids",
3907                 lsa_dissect_lsarlookupsids_rqst,
3908                 lsa_dissect_lsarlookupsids_reply },
3909         { LSA_LSARCREATESECRET, "LsarCreateSecret",
3910                 lsa_dissect_lsarcreatesecret_rqst,
3911                 lsa_dissect_lsarcreatesecret_reply },
3912         { LSA_LSAROPENACCOUNT, "LsarOpenAccount",
3913                 lsa_dissect_lsaropenaccount_rqst,
3914                 lsa_dissect_lsaropenaccount_reply },
3915         { LSA_LSARENUMERATEPRIVILEGESACCOUNT, "LsarEnumeratePrivilegesAccount",
3916                 lsa_dissect_lsarenumerateprivilegesaccount_rqst,
3917                 lsa_dissect_lsarenumerateprivilegesaccount_reply },
3918         { LSA_LSARADDPRIVILEGESTOACCOUNT, "LsarAddPrivilegesToAccount",
3919                 lsa_dissect_lsaraddprivilegestoaccount_rqst,
3920                 lsa_dissect_lsaraddprivilegestoaccount_reply },
3921         { LSA_LSARREMOVEPRIVILEGESFROMACCOUNT, "LsarRemovePrivilegesFromAccount",
3922                 lsa_dissect_lsarremoveprivilegesfromaccount_rqst,
3923                 lsa_dissect_lsarremoveprivilegesfromaccount_reply },
3924         { LSA_LSARGETQUOTASFORACCOUNT, "LsarGetQuotasForAccount",
3925                 lsa_dissect_lsargetquotasforaccount_rqst,
3926                 lsa_dissect_lsargetquotasforaccount_reply },
3927         { LSA_LSARSETQUOTASFORACCOUNT, "LsarSetQuotasForAccount",
3928                 lsa_dissect_lsarsetquotasforaccount_rqst,
3929                 lsa_dissect_lsarsetquotasforaccount_reply },
3930         { LSA_LSARGETSYSTEMACCESSACCOUNT, "LsarGetSystemAccessAccount",
3931                 lsa_dissect_lsargetsystemaccessaccount_rqst,
3932                 lsa_dissect_lsargetsystemaccessaccount_reply },
3933         { LSA_LSARSETSYSTEMACCESSACCOUNT, "LsarSetSystemAccessAccount",
3934                 lsa_dissect_lsarsetsystemaccessaccount_rqst,
3935                 lsa_dissect_lsarsetsystemaccessaccount_reply },
3936         { LSA_LSAROPENTRUSTEDDOMAIN, "LsarOpenTrustedDomain",
3937                 lsa_dissect_lsaropentrusteddomain_rqst,
3938                 lsa_dissect_lsaropentrusteddomain_reply },
3939         { LSA_LSARQUERYINFOTRUSTEDDOMAIN, "LsarQueryInfoTrustedDomain",
3940                 lsa_dissect_lsarqueryinfotrusteddomain_rqst,
3941                 lsa_dissect_lsarqueryinfotrusteddomain_reply },
3942         { LSA_LSARSETINFORMATIONTRUSTEDDOMAIN, "LsarSetInformationTrustedDomain",
3943                 lsa_dissect_lsarsetinformationtrusteddomain_rqst,
3944                 lsa_dissect_lsarsetinformationtrusteddomain_reply },
3945         { LSA_LSAROPENSECRET, "LsarOpenSecret",
3946                 lsa_dissect_lsaropensecret_rqst,
3947                 lsa_dissect_lsaropensecret_reply },
3948         { LSA_LSARSETSECRET, "LsarSetSecret",
3949                 lsa_dissect_lsarsetsecret_rqst,
3950                 lsa_dissect_lsarsetsecret_reply },
3951         { LSA_LSARQUERYSECRET, "LsarQuerySecret",
3952                 lsa_dissect_lsarquerysecret_rqst,
3953                 lsa_dissect_lsarquerysecret_reply },
3954         { LSA_LSARLOOKUPPRIVILEGEVALUE, "LsarLookupPrivilegeValue",
3955                 lsa_dissect_lsarlookupprivilegevalue_rqst,
3956                 lsa_dissect_lsarlookupprivilegevalue_reply },
3957         { LSA_LSARLOOKUPPRIVILEGENAME, "LsarLookupPrivilegeName",
3958                 lsa_dissect_lsarlookupprivilegename_rqst,
3959                 lsa_dissect_lsarlookupprivilegename_reply },
3960         { LSA_LSARLOOKUPPRIVILEGEDISPLAYNAME, "LsarLookupPrivilegeDisplayName",
3961                 lsa_dissect_lsarlookupprivilegedisplayname_rqst,
3962                 lsa_dissect_lsarlookupprivilegedisplayname_reply },
3963         { LSA_LSARDELETEOBJECT, "LsarDeleteObject",
3964                 lsa_dissect_lsardeleteobject_rqst,
3965                 lsa_dissect_lsardeleteobject_reply },
3966         { LSA_LSARENUMERATEACCOUNTSWITHUSERRIGHT, "LsarEnumerateAccountsWithUserRight",
3967                 lsa_dissect_lsarenumerateaccountswithuserright_rqst,
3968                 lsa_dissect_lsarenumerateaccountswithuserright_reply },
3969         { LSA_LSARENUMERATEACCOUNTRIGHTS, "LsarEnumerateAccountRights",
3970                 lsa_dissect_lsarenumerateaccountrights_rqst,
3971                 lsa_dissect_lsarenumerateaccountrights_reply },
3972         { LSA_LSARADDACCOUNTRIGHTS, "LsarAddAccountRights",
3973                 lsa_dissect_lsaraddaccountrights_rqst,
3974                 lsa_dissect_lsaraddaccountrights_reply },
3975         { LSA_LSARREMOVEACCOUNTRIGHTS, "LsarRemoveAccountRights",
3976                 lsa_dissect_lsarremoveaccountrights_rqst,
3977                 lsa_dissect_lsarremoveaccountrights_reply },
3978         { LSA_LSARQUERYTRUSTEDDOMAININFO, "LsarQueryTrustedDomainInfo",
3979                 lsa_dissect_lsarquerytrusteddomaininfo_rqst,
3980                 lsa_dissect_lsarquerytrusteddomaininfo_reply },
3981         { LSA_LSARSETTRUSTEDDOMAININFO, "LsarSetTrustedDomainInfo",
3982                 lsa_dissect_lsarsettrusteddomaininfo_rqst,
3983                 lsa_dissect_lsarsettrusteddomaininfo_reply },
3984         { LSA_LSARDELETETRUSTEDDOMAIN, "LsarDeleteTrustedDomain",
3985                 lsa_dissect_lsardeletetrusteddomain_rqst,
3986                 lsa_dissect_lsardeletetrusteddomain_reply },
3987         { LSA_LSARSTOREPRIVATEDATA, "LsarStorePrivateData",
3988                 lsa_dissect_lsarstoreprivatedata_rqst,
3989                 lsa_dissect_lsarstoreprivatedata_reply },
3990         { LSA_LSARRETRIEVEPRIVATEDATA, "LsarRetrievePrivateData",
3991                 lsa_dissect_lsarretrieveprivatedata_rqst,
3992                 lsa_dissect_lsarretrieveprivatedata_reply },
3993         { LSA_LSAROPENPOLICY2, "LsarOpenPolicy2",
3994                 lsa_dissect_lsaropenpolicy2_rqst,
3995                 lsa_dissect_lsaropenpolicy2_reply },
3996         { LSA_LSARGETUSERNAME, "LsarGetUserName",
3997                 lsa_dissect_lsargetusername_rqst,
3998                 lsa_dissect_lsargetusername_reply },
3999         { LSA_LSARQUERYINFORMATIONPOLICY2, "LsarQueryInformationPolicy2",
4000                 lsa_dissect_lsarqueryinformationpolicy2_rqst,
4001                 lsa_dissect_lsarqueryinformationpolicy2_reply },
4002         { LSA_LSARSETINFORMATIONPOLICY2, "LsarSetInformationPolicy2",
4003                 lsa_dissect_lsarsetinformationpolicy2_rqst,
4004                 lsa_dissect_lsarsetinformationpolicy2_reply },
4005         { LSA_LSARQUERYTRUSTEDDOMAININFOBYNAME, "LsarQueryTrustedDomainInfoByName",
4006                 lsa_dissect_lsarquerytrusteddomaininfobyname_rqst,
4007                 lsa_dissect_lsarquerytrusteddomaininfobyname_reply },
4008         { LSA_LSARSETTRUSTEDDOMAININFOBYNAME, "LsarSetTrustedDomainInfoByName",
4009                 lsa_dissect_lsarsettrusteddomaininfobyname_rqst,
4010                 lsa_dissect_lsarsettrusteddomaininfobyname_reply },
4011         { LSA_LSARENUMERATETRUSTEDDOMAINSEX, "LsarEnumerateTrustedDomainsEx",
4012                 lsa_dissect_lsarenumeratetrusteddomainsex_rqst,
4013                 lsa_dissect_lsarenumeratetrusteddomainsex_reply },
4014         { LSA_LSARCREATETRUSTEDDOMAINEX, "LsarCreateTrustedDomainEx",
4015                 lsa_dissect_lsarcreatetrusteddomainex_rqst,
4016                 lsa_dissect_lsarcreatetrusteddomainex_reply },
4017         { LSA_LSARCLOSETRUSTEDDOMAINEX, "LsarCloseTrustedDomainEx",
4018                 lsa_dissect_lsarclosetrusteddomainex_rqst,
4019                 lsa_dissect_lsarclosetrusteddomainex_reply },
4020         { LSA_LSARQUERYDOMAININFORMATIONPOLICY, "LsarQueryDomainInformationPolicy",
4021                 lsa_dissect_lsarquerydomaininformationpolicy_rqst,
4022                 lsa_dissect_lsarquerydomaininformationpolicy_reply },
4023         { LSA_LSARSETDOMAININFORMATIONPOLICY, "LsarSetDomainInformationPolicy",
4024                 lsa_dissect_lsarsetdomaininformationpolicy_rqst,
4025                 lsa_dissect_lsarsetdomaininformationpolicy_reply },
4026         { LSA_LSAROPENTRUSTEDDOMAINBYNAME, "LsarOpenTrustedDomainByName",
4027                 lsa_dissect_lsaropentrusteddomainbyname_rqst,
4028                 lsa_dissect_lsaropentrusteddomainbyname_reply },
4029         { LSA_LSARTESTCALL, "LsarTestCall",
4030                 lsa_dissect_lsartestcall_rqst,
4031                 lsa_dissect_lsartestcall_reply },
4032         { LSA_LSARLOOKUPSIDS2, "LsarLookupSids2",
4033                 lsa_dissect_lsarlookupsids2_rqst,
4034                 lsa_dissect_lsarlookupsids2_reply },
4035         { LSA_LSARLOOKUPNAMES2, "LsarLookupNames2",
4036                 lsa_dissect_lsarlookupnames2_rqst,
4037                 lsa_dissect_lsarlookupnames2_reply },
4038         { LSA_LSARCREATETRUSTEDDOMAINEX2, "LsarCreateTrustedDomainEx2",
4039                 lsa_dissect_lsarcreatetrusteddomainex2_rqst,
4040                 lsa_dissect_lsarcreatetrusteddomainex2_reply },
4041         { LSA_CREDRWRITE, "CredrWrite", NULL, NULL },
4042         { LSA_CREDRREAD, "CredrRead", NULL, NULL },
4043         { LSA_CREDRENUMERATE, "CredrEnumerate", NULL, NULL },
4044         { LSA_CREDRWRITEDOMAINCREDENTIALS, "CredrWriteDomainCredentials",
4045           NULL, NULL },
4046         { LSA_CREDRREADDOMAINCREDENTIALS, "CredrReadDomainCredentials",
4047           NULL, NULL },
4048         { LSA_CREDRDELETE, "CredrDelete", NULL, NULL },
4049         { LSA_CREDRGETTARGETINFO, "CredrGetTargetInfo", NULL, NULL },
4050         { LSA_CREDRPROFILELOADED, "CredrProfileLoaded", NULL, NULL },
4051         { LSA_LSARLOOKUPNAMES3, "LsarLookupNames3", NULL, NULL },
4052         { LSA_CREDRGETSESSIONTYPES, "CredrGetSessionTypes", NULL, NULL },
4053         { LSA_LSARREGISTERAUDITEVENT, "LsarRegisterAuditEvent", NULL, NULL },
4054         { LSA_LSARGENAUDITEVENT, "LsarGenAuditEvent", NULL, NULL },
4055         { LSA_LSARUNREGISTERAUDITEVENT, "LsarUnregisterAuditEvent", NULL, NULL},
4056         { LSA_LSARQUERYFORESTTRUSTINFORMATION,
4057           "LsarQueryForestTrustInformation", NULL, NULL },
4058         { LSA_LSARSETFORESTTRUSTINFORMATION, "LsarSetForestTrustInformation",
4059           NULL, NULL },
4060         { LSA_CREDRRENAME, "CredrRename", NULL, NULL },
4061         { LSA_LSARLOOKUPSIDS3, "LsarLookupSids3", NULL, NULL },
4062         { LSA_LSARLOOKUPNAMES4, "LsarLookupNames4", NULL, NULL },
4063         { LSA_LSAROPENPOLICYSCE, "LsarOpenPolicySce", NULL, NULL },
4064         { LSA_LSARADTREGISTERSECURITYEVENTSOURCE,
4065             "LsarAdtRegisterSecurityEventSource", NULL, NULL },
4066         { LSA_LSARADTUNREGISTERSECURITYEVENTSOURCE,
4067            "LsarAdtUnregisterSecurityEventSource", NULL, NULL },
4068         { LSA_LSARADTREPORTSECURITYEVENT, "LsarAdtReportSecurityEvent",
4069           NULL, NULL },
4070         {0, NULL, NULL, NULL}
4071 };
4072
4073 void
4074 proto_register_dcerpc_lsa(void)
4075 {
4076         static hf_register_info hf[] = {
4077
4078         { &hf_lsa_opnum,
4079           { "Operation", "lsa.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "Operation", HFILL }},
4080
4081         { &hf_lsa_unknown_string,
4082                 { "Unknown string", "lsa.unknown_string", FT_STRING, BASE_NONE,
4083                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
4084
4085         { &hf_lsa_hnd,
4086                 { "Context Handle", "lsa.hnd", FT_BYTES, BASE_NONE,
4087                 NULL, 0x0, "LSA policy handle", HFILL }},
4088
4089         { &hf_lsa_server,
4090                 { "Server", "lsa.server", FT_STRING, BASE_NONE,
4091                 NULL, 0, "Name of Server", HFILL }},
4092
4093         { &hf_lsa_controller,
4094                 { "Controller", "lsa.controller", FT_STRING, BASE_NONE,
4095                 NULL, 0, "Name of Domain Controller", HFILL }},
4096
4097         { &hf_lsa_unknown_hyper,
4098                 { "Unknown hyper", "lsa.unknown.hyper", FT_UINT64, BASE_HEX,
4099                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
4100
4101         { &hf_lsa_unknown_long,
4102                 { "Unknown long", "lsa.unknown.long", FT_UINT32, BASE_HEX,
4103                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
4104
4105         { &hf_lsa_unknown_short,
4106                 { "Unknown short", "lsa.unknown.short", FT_UINT16, BASE_HEX,
4107                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
4108
4109         { &hf_lsa_unknown_char,
4110                 { "Unknown char", "lsa.unknown.char", FT_UINT8, BASE_HEX,
4111                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
4112
4113         { &hf_lsa_rc,
4114                 { "Return code", "lsa.rc", FT_UINT32, BASE_HEX,
4115                 VALS (NT_errors), 0x0, "LSA return status code", HFILL }},
4116
4117         { &hf_lsa_obj_attr,
4118                 { "Attributes", "lsa.obj_attr", FT_UINT32, BASE_HEX,
4119                 NULL, 0x0, "LSA Attributes", HFILL }},
4120
4121         { &hf_lsa_obj_attr_len,
4122                 { "Length", "lsa.obj_attr.len", FT_UINT32, BASE_DEC,
4123                 NULL, 0x0, "Length of object attribute structure", HFILL }},
4124
4125         { &hf_lsa_obj_attr_name,
4126                 { "Name", "lsa.obj_attr.name", FT_STRING, BASE_NONE,
4127                 NULL, 0x0, "Name of object attribute", HFILL }},
4128
4129         { &hf_lsa_access_mask,
4130                 { "Access Mask", "lsa.access_mask", FT_UINT32, BASE_HEX,
4131                 NULL, 0x0, "LSA Access Mask", HFILL }},
4132
4133         { &hf_lsa_info_level,
4134                 { "Level", "lsa.info.level", FT_UINT16, BASE_DEC,
4135                 NULL, 0x0, "Information level of requested data", HFILL }},
4136
4137         { &hf_lsa_trusted_info_level,
4138                 { "Info Level", "lsa.trusted.info_level", FT_UINT16, BASE_DEC,
4139                 VALS(trusted_info_level_vals), 0x0, "Information level of requested Trusted Domain Information", HFILL }},
4140
4141         { &hf_lsa_sd_size,
4142                 { "Size", "lsa.sd_size", FT_UINT32, BASE_DEC,
4143                 NULL, 0x0, "Size of lsa security descriptor", HFILL }},
4144
4145         { &hf_lsa_qos_len,
4146                 { "Length", "lsa.qos.len", FT_UINT32, BASE_DEC,
4147                 NULL, 0x0, "Length of quality of service structure", HFILL }},
4148
4149         { &hf_lsa_qos_impersonation_level,
4150                 { "Impersonation level", "lsa.qos.imp_lev", FT_UINT16, BASE_DEC,
4151                 VALS(lsa_impersonation_level_vals), 0x0, "QOS Impersonation Level", HFILL }},
4152
4153         { &hf_lsa_qos_track_context,
4154                 { "Context Tracking", "lsa.qos.track_ctx", FT_UINT8, BASE_DEC,
4155                 NULL, 0x0, "QOS Context Tracking Mode", HFILL }},
4156
4157         { &hf_lsa_qos_effective_only,
4158                 { "Effective only", "lsa.qos.effective_only", FT_UINT8, BASE_DEC,
4159                 NULL, 0x0, "QOS Flag whether this is Effective Only or not", HFILL }},
4160
4161         { &hf_lsa_pali_percent_full,
4162                 { "Percent Full", "lsa.pali.percent_full", FT_UINT32, BASE_DEC,
4163                 NULL, 0x0, "How full audit log is in percentage", HFILL }},
4164
4165         { &hf_lsa_pali_log_size,
4166                 { "Log Size", "lsa.pali.log_size", FT_UINT32, BASE_DEC,
4167                 NULL, 0x0, "Size of audit log", HFILL }},
4168
4169         { &hf_lsa_pali_retention_period,
4170                 { "Retention Period", "lsa.pali.retention_period", FT_RELATIVE_TIME, BASE_NONE,
4171                 NULL, 0x0, "", HFILL }},
4172
4173         { &hf_lsa_pali_time_to_shutdown,
4174                 { "Time to shutdown", "lsa.pali.time_to_shutdown", FT_RELATIVE_TIME, BASE_NONE,
4175                 NULL, 0x0, "Time to shutdown", HFILL }},
4176
4177         { &hf_lsa_pali_shutdown_in_progress,
4178                 { "Shutdown in progress", "lsa.pali.shutdown_in_progress", FT_UINT8, BASE_DEC,
4179                 NULL, 0x0, "Flag whether shutdown is in progress or not", HFILL }},
4180
4181         { &hf_lsa_pali_next_audit_record,
4182                 { "Next Audit Record", "lsa.pali.next_audit_record", FT_UINT32, BASE_HEX,
4183                 NULL, 0x0, "Next audit record", HFILL }},
4184
4185         { &hf_lsa_paei_enabled,
4186                 { "Enabled", "lsa.paei.enabled", FT_UINT8, BASE_DEC,
4187                 NULL, 0x0, "If Audit Events Information is Enabled or not", HFILL }},
4188
4189         { &hf_lsa_paei_settings,
4190                 { "Settings", "lsa.paei.settings", FT_UINT32, BASE_HEX,
4191                 NULL, 0x0, "Audit Events Information settings", HFILL }},
4192
4193         { &hf_lsa_count,
4194                 { "Count", "lsa.count", FT_UINT32, BASE_DEC,
4195                 NULL, 0x0, "Count of objects", HFILL }},
4196
4197         { &hf_lsa_max_count,
4198                 { "Max Count", "lsa.max_count", FT_UINT32, BASE_DEC,
4199                 NULL, 0x0, "", HFILL }},
4200
4201         { &hf_lsa_fqdomain,
4202                 { "FQDN", "lsa.fqdn_domain", FT_STRING, BASE_NONE,
4203                 NULL, 0x0, "Fully Qualified Domain Name", HFILL }},
4204
4205         { &hf_lsa_domain,
4206                 { "Domain", "lsa.domain", FT_STRING, BASE_NONE,
4207                 NULL, 0x0, "Domain", HFILL }},
4208
4209         { &hf_lsa_acct,
4210                 { "Account", "lsa.acct", FT_STRING, BASE_NONE,
4211                 NULL, 0x0, "Account", HFILL }},
4212
4213         { &hf_lsa_source,
4214                 { "Source", "lsa.source", FT_STRING, BASE_NONE,
4215                 NULL, 0x0, "Replica Source", HFILL }},
4216
4217         { &hf_lsa_server_role,
4218                 { "Role", "lsa.server_role", FT_UINT16, BASE_DEC,
4219                 VALS(server_role_vals), 0x0, "LSA Server Role", HFILL }},
4220
4221         { &hf_lsa_quota_paged_pool,
4222                 { "Paged Pool", "lsa.quota.paged_pool", FT_UINT32, BASE_DEC,
4223                 NULL, 0x0, "Size of Quota Paged Pool", HFILL }},
4224
4225         { &hf_lsa_quota_non_paged_pool,
4226                 { "Non Paged Pool", "lsa.quota.non_paged_pool", FT_UINT32, BASE_DEC,
4227                 NULL, 0x0, "Size of Quota non-Paged Pool", HFILL }},
4228
4229         { &hf_lsa_quota_min_wss,
4230                 { "Min WSS", "lsa.quota.min_wss", FT_UINT32, BASE_DEC,
4231                 NULL, 0x0, "Size of Quota Min WSS", HFILL }},
4232
4233         { &hf_lsa_quota_max_wss,
4234                 { "Max WSS", "lsa.quota.max_wss", FT_UINT32, BASE_DEC,
4235                 NULL, 0x0, "Size of Quota Max WSS", HFILL }},
4236
4237         { &hf_lsa_quota_pagefile,
4238                 { "Pagefile", "lsa.quota.pagefile", FT_UINT32, BASE_DEC,
4239                 NULL, 0x0, "Size of quota pagefile usage", HFILL }},
4240
4241         { &hf_lsa_mod_seq_no,
4242                 { "Seq No", "lsa.mod.seq_no", FT_UINT64, BASE_DEC,
4243                 NULL, 0x0, "Sequence number for this modification", HFILL }},
4244
4245         { &hf_lsa_mod_mtime,
4246                 { "MTime", "lsa.mod.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4247                 NULL, 0x0, "Time when this modification occured", HFILL }},
4248
4249         { &hf_lsa_cur_mtime,
4250                 { "Current MTime", "lsa.cur.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4251                 NULL, 0x0, "Current MTime to set", HFILL }},
4252
4253         { &hf_lsa_old_mtime,
4254                 { "Old MTime", "lsa.old.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4255                 NULL, 0x0, "Old MTime for this object", HFILL }},
4256
4257         { &hf_lsa_name,
4258                 { "Name", "lsa.name", FT_STRING, BASE_NONE,
4259                 NULL, 0x0, "", HFILL }},
4260
4261         { &hf_lsa_key,
4262                 { "Key", "lsa.key", FT_STRING, BASE_NONE,
4263                 NULL, 0x0, "", HFILL }},
4264
4265         { &hf_lsa_flat_name,
4266                 { "Flat Name", "lsa.flat_name", FT_STRING, BASE_NONE,
4267                 NULL, 0x0, "", HFILL }},
4268
4269         { &hf_lsa_forest,
4270                 { "Forest", "lsa.forest", FT_STRING, BASE_NONE,
4271                 NULL, 0x0, "", HFILL }},
4272
4273         { &hf_lsa_info_type,
4274                 { "Info Type", "lsa.info_type", FT_UINT32, BASE_DEC,
4275                 NULL, 0x0, "", HFILL }},
4276
4277         { &hf_lsa_new_pwd,
4278                 { "New Password", "lsa.new_pwd", FT_BYTES, BASE_HEX,
4279                 NULL, 0x0, "New password", HFILL }},
4280
4281         { &hf_lsa_old_pwd,
4282                 { "Old Password", "lsa.old_pwd", FT_BYTES, BASE_HEX,
4283                 NULL, 0x0, "Old password", HFILL }},
4284
4285         { &hf_lsa_sid_type,
4286                 { "SID Type", "lsa.sid_type", FT_UINT16, BASE_DEC,
4287                 VALS(sid_type_vals), 0x0, "Type of SID", HFILL }},
4288
4289         { &hf_lsa_rid,
4290                 { "RID", "lsa.rid", FT_UINT32, BASE_HEX,
4291                 NULL, 0x0, "RID", HFILL }},
4292
4293         { &hf_lsa_rid_offset,
4294                 { "RID Offset", "lsa.rid.offset", FT_UINT32, BASE_HEX,
4295                 NULL, 0x0, "RID Offset", HFILL }},
4296
4297         { &hf_lsa_index,
4298                 { "Index", "lsa.index", FT_UINT32, BASE_DEC,
4299                 NULL, 0x0, "", HFILL }},
4300
4301         { &hf_lsa_num_mapped,
4302                 { "Num Mapped", "lsa.num_mapped", FT_UINT32, BASE_DEC,
4303                 NULL, 0x0, "", HFILL }},
4304
4305         { &hf_lsa_policy_information_class,
4306                 { "Info Class", "lsa.policy.info", FT_UINT16, BASE_DEC,
4307                 VALS(policy_information_class_vals), 0x0, "Policy information class", HFILL }},
4308
4309         { &hf_lsa_secret,
4310                 { "LSA Secret", "lsa.secret", FT_BYTES, BASE_HEX,
4311                 NULL, 0, "", HFILL }},
4312
4313         { &hf_lsa_auth_blob,
4314                 { "Auth blob", "lsa.auth.blob", FT_BYTES, BASE_HEX,
4315                 NULL, 0, "", HFILL }},
4316
4317         { &hf_nt_luid_high,
4318                 { "High", "nt.luid.high", FT_UINT32, BASE_HEX,
4319                 NULL, 0x0, "LUID High component", HFILL }},
4320
4321         { &hf_nt_luid_low,
4322                 { "Low", "nt.luid.low", FT_UINT32, BASE_HEX,
4323                 NULL, 0x0, "LUID Low component", HFILL }},
4324
4325         { &hf_lsa_size,
4326                 { "Size", "lsa.size", FT_UINT32, BASE_DEC,
4327                 NULL, 0x0, "", HFILL }},
4328
4329         { &hf_lsa_size16,
4330                 { "Size", "lsa.size", FT_UINT16, BASE_DEC,
4331                 NULL, 0x0, "", HFILL }},
4332
4333         { &hf_lsa_privilege_display_name_size,
4334                 { "Size Needed", "lsa.privilege.display__name.size", FT_UINT32, BASE_DEC,
4335                 NULL, 0x0, "Number of characters in the privilege display name", HFILL }},
4336
4337         { &hf_lsa_privilege_name,
4338                 { "Name", "lsa.privilege.name", FT_STRING, BASE_NONE,
4339                 NULL, 0x0, "LSA Privilege Name", HFILL }},
4340
4341         { &hf_lsa_privilege_display_name,
4342                 { "Display Name", "lsa.privilege.display_name", FT_STRING, BASE_NONE,
4343                 NULL, 0x0, "LSA Privilege Display Name", HFILL }},
4344
4345         { &hf_lsa_rights,
4346                 { "Rights", "lsa.rights", FT_STRING, BASE_NONE,
4347                 NULL, 0x0, "Account Rights", HFILL }},
4348
4349         { &hf_lsa_policy_information,
4350                 { "POLICY INFO", "lsa.policy_information", FT_NONE, BASE_NONE,
4351                 NULL, 0x0, "Policy Information union", HFILL }},
4352
4353         { &hf_lsa_attr,
4354                 { "Attr", "lsa.attr", FT_UINT64, BASE_HEX,
4355                 NULL, 0x0, "LSA Attributes", HFILL }},
4356
4357         { &hf_lsa_auth_update,
4358                 { "Update", "lsa.auth.update", FT_UINT64, BASE_HEX,
4359                 NULL, 0x0, "LSA Auth Info update", HFILL }},
4360
4361         { &hf_lsa_resume_handle,
4362                 { "Resume Handle", "lsa.resume_handle", FT_UINT32, BASE_DEC,
4363                 NULL, 0x0, "Resume Handle", HFILL }},
4364
4365         { &hf_lsa_trust_direction,
4366                 { "Trust Direction", "lsa.trust.direction", FT_UINT32, BASE_DEC,
4367                 VALS(trusted_direction_vals), 0x0, "Trust direction", HFILL }},
4368
4369         { &hf_lsa_trust_type,
4370                 { "Trust Type", "lsa.trust.type", FT_UINT32, BASE_DEC,
4371                 VALS(trusted_type_vals), 0x0, "Trust type", HFILL }},
4372
4373         { &hf_lsa_trust_attr,
4374                 { "Trust Attr", "lsa.trust.attr", FT_UINT32, BASE_HEX,
4375                 NULL, 0x0, "Trust attributes", HFILL }},
4376
4377         { &hf_lsa_trust_attr_non_trans,
4378                 { "Non Transitive", "lsa.trust.attr.non_trans", FT_BOOLEAN, 32,
4379                 TFS(&tfs_trust_attr_non_trans), 0x00000001, "Non Transitive trust", HFILL }},
4380
4381         { &hf_lsa_trust_attr_uplevel_only,
4382                 { "Upleve only", "lsa.trust.attr.uplevel_only", FT_BOOLEAN, 32,
4383                 TFS(&tfs_trust_attr_uplevel_only), 0x00000002, "Uplevel only trust", HFILL }},
4384
4385         { &hf_lsa_trust_attr_tree_parent,
4386                 { "Tree Parent", "lsa.trust.attr.tree_parent", FT_BOOLEAN, 32,
4387                 TFS(&tfs_trust_attr_tree_parent), 0x00400000, "Tree Parent trust", HFILL }},
4388
4389         { &hf_lsa_trust_attr_tree_root,
4390                 { "Tree Root", "lsa.trust.attr.tree_root", FT_BOOLEAN, 32,
4391                 TFS(&tfs_trust_attr_tree_root), 0x00800000, "Tree Root trust", HFILL }},
4392
4393         { &hf_lsa_auth_type,
4394                 { "Auth Type", "lsa.auth.type", FT_UINT32, BASE_DEC,
4395                 NULL, 0x0, "Auth Info type", HFILL }},
4396
4397         { &hf_lsa_auth_len,
4398                 { "Auth Len", "lsa.auth.len", FT_UINT32, BASE_DEC,
4399                 NULL, 0x0, "Auth Info len", HFILL }},
4400
4401         { &hf_lsa_remove_all,
4402                 { "Remove All", "lsa.remove_all", FT_UINT8, BASE_DEC,
4403                 NULL, 0x0, "Flag whether all rights should be removed or only the specified ones", HFILL }},
4404
4405         { &hf_view_local_info,
4406                 { "View local info", "lsa.access_mask.view_local_info",
4407                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_LOCAL_INFORMATION,
4408                   "View local info", HFILL }},
4409
4410         { &hf_view_audit_info,
4411                 { "View audit info", "lsa.access_mask.view_audit_info",
4412                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_AUDIT_INFORMATION,
4413                   "View audit info", HFILL }},
4414
4415         { &hf_get_private_info,
4416                 { "Get private info", "lsa.access_mask.get_privateinfo",
4417                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_GET_PRIVATE_INFORMATION,
4418                   "Get private info", HFILL }},
4419
4420         { &hf_trust_admin,
4421                 { "Trust admin", "lsa.access_mask.trust_admin",
4422                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_TRUST_ADMIN,
4423                   "Trust admin", HFILL }},
4424
4425         { &hf_create_account,
4426                 { "Create account", "lsa.access_mask.create_account",
4427                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_ACCOUNT,
4428                   "Create account", HFILL }},
4429
4430         { &hf_create_secret,
4431                 { "Create secret", "lsa.access_mask.create_secret",
4432                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_SECRET,
4433                   "Create secret", HFILL }},
4434
4435         { &hf_create_priv,
4436                 { "Create privilege", "lsa.access_mask.create_priv",
4437                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_PRIVILEGE,
4438                   "Create privilege", HFILL }},
4439
4440         { &hf_set_default_quota_limits,
4441                 { "Set default quota limits", "lsa.access_mask.set_default_quota_limits",
4442                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_DEFAULT_QUOTA_LIMITS,
4443                   "Set default quota limits", HFILL }},
4444
4445         { &hf_set_audit_requirements,
4446                 { "Set audit requirements", "lsa.access_mask.set_audit_requirements",
4447                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_AUDIT_REQUIREMENTS,
4448                   "Set audit requirements", HFILL }},
4449
4450         { &hf_server_admin,
4451                 { "Server admin", "lsa.access_mask.server_admin",
4452                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SERVER_ADMIN,
4453                   "Server admin", HFILL }},
4454
4455         { &hf_lookup_names,
4456                 { "Lookup names", "lsa.access_mask.lookup_names",
4457                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_LOOKUP_NAMES,
4458                   "Lookup names", HFILL }}
4459 };
4460
4461         static gint *ett[] = {
4462                 &ett_dcerpc_lsa,
4463                 &ett_lsa_OBJECT_ATTRIBUTES,
4464                 &ett_LSA_SECURITY_DESCRIPTOR,
4465                 &ett_lsa_policy_info,
4466                 &ett_lsa_policy_audit_log_info,
4467                 &ett_lsa_policy_audit_events_info,
4468                 &ett_lsa_policy_primary_domain_info,
4469                 &ett_lsa_policy_primary_account_info,
4470                 &ett_lsa_policy_server_role_info,
4471                 &ett_lsa_policy_replica_source_info,
4472                 &ett_lsa_policy_default_quota_info,
4473                 &ett_lsa_policy_modification_info,
4474                 &ett_lsa_policy_audit_full_set_info,
4475                 &ett_lsa_policy_audit_full_query_info,
4476                 &ett_lsa_policy_dns_domain_info,
4477                 &ett_lsa_translated_names,
4478                 &ett_lsa_translated_name,
4479                 &ett_lsa_referenced_domain_list,
4480                 &ett_lsa_trust_information,
4481                 &ett_lsa_trust_information_ex,
4482                 &ett_LUID,
4483                 &ett_LSA_PRIVILEGES,
4484                 &ett_LSA_PRIVILEGE,
4485                 &ett_LSA_LUID_AND_ATTRIBUTES_ARRAY,
4486                 &ett_LSA_LUID_AND_ATTRIBUTES,
4487                 &ett_LSA_TRUSTED_DOMAIN_LIST,
4488                 &ett_LSA_TRUSTED_DOMAIN,
4489                 &ett_LSA_TRANSLATED_SIDS,
4490                 &ett_lsa_trusted_domain_info,
4491                 &ett_lsa_trust_attr,
4492                 &ett_lsa_trusted_domain_auth_information,
4493                 &ett_lsa_auth_information
4494         };
4495
4496         proto_dcerpc_lsa = proto_register_protocol(
4497                 "Microsoft Local Security Architecture", "LSA", "lsa");
4498
4499         proto_register_field_array (proto_dcerpc_lsa, hf, array_length (hf));
4500         proto_register_subtree_array(ett, array_length(ett));
4501 }
4502
4503 /* Protocol handoff */
4504
4505 static e_uuid_t uuid_dcerpc_lsa = {
4506         0x12345778, 0x1234, 0xabcd,
4507         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab}
4508 };
4509
4510 static guint16 ver_dcerpc_lsa = 0;
4511
4512 void
4513 proto_reg_handoff_dcerpc_lsa(void)
4514 {
4515         /* Register protocol as dcerpc */
4516
4517         dcerpc_init_uuid(proto_dcerpc_lsa, ett_dcerpc_lsa, &uuid_dcerpc_lsa,
4518                          ver_dcerpc_lsa, dcerpc_lsa_dissectors, hf_lsa_opnum);
4519 }