packet-dcerpc-lsa.c

   1 /* packet-dcerpc-lsa.c
   2  * Routines for SMB \PIPE\lsarpc packet disassembly
   3  * Copyright 2001,2003 Tim Potter <tpot@samba.org>
   4  *  2002  Added LSA command dissectors  Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-lsa.c,v 1.92 2004/01/19 20:10:33 jmayer Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <string.h>
  33
  34 #include <epan/packet.h>
  35 #include "packet-dcerpc.h"
  36 #include "packet-dcerpc-nt.h"
  37 #include "packet-dcerpc-lsa.h"
  38 #include "packet-smb-common.h"
  39 #include "smb.h"
  40
  41 static int proto_dcerpc_lsa = -1;
  42
  43 static int hf_lsa_opnum = -1;
  44 static int hf_lsa_rc = -1;
  45 static int hf_lsa_hnd = -1;
  46 static int hf_lsa_policy_information = -1;
  47 static int hf_lsa_server = -1;
  48 static int hf_lsa_controller = -1;
  49 static int hf_lsa_obj_attr = -1;
  50 static int hf_lsa_obj_attr_len = -1;
  51 static int hf_lsa_obj_attr_name = -1;
  52 static int hf_lsa_access_mask = -1;
  53 static int hf_lsa_info_level = -1;
  54 static int hf_lsa_trusted_info_level = -1;
  55 static int hf_lsa_sd_size = -1;
  56 static int hf_lsa_qos_len = -1;
  57 static int hf_lsa_qos_impersonation_level = -1;
  58 static int hf_lsa_qos_track_context = -1;
  59 static int hf_lsa_qos_effective_only = -1;
  60 static int hf_lsa_pali_percent_full = -1;
  61 static int hf_lsa_pali_log_size = -1;
  62 static int hf_lsa_pali_retention_period = -1;
  63 static int hf_lsa_pali_time_to_shutdown = -1;
  64 static int hf_lsa_pali_shutdown_in_progress = -1;
  65 static int hf_lsa_pali_next_audit_record = -1;
  66 static int hf_lsa_paei_enabled = -1;
  67 static int hf_lsa_paei_settings = -1;
  68 static int hf_lsa_count = -1;
  69 static int hf_lsa_size = -1;
  70 static int hf_lsa_size16 = -1;
  71 static int hf_lsa_privilege_display_name_size = -1;
  72 static int hf_lsa_max_count = -1;
  73 static int hf_lsa_index = -1;
  74 static int hf_lsa_fqdomain = -1;
  75 static int hf_lsa_domain = -1;
  76 static int hf_lsa_domain_sid = -1;
  77 static int hf_lsa_acct = -1;
  78 static int hf_lsa_server_role = -1;
  79 static int hf_lsa_source = -1;
  80 static int hf_lsa_quota_paged_pool = -1;
  81 static int hf_lsa_quota_non_paged_pool = -1;
  82 static int hf_lsa_quota_min_wss = -1;
  83 static int hf_lsa_quota_max_wss = -1;
  84 static int hf_lsa_quota_pagefile = -1;
  85 static int hf_lsa_mod_seq_no = -1;
  86 static int hf_lsa_mod_mtime = -1;
  87 static int hf_lsa_cur_mtime = -1;
  88 static int hf_lsa_old_mtime = -1;
  89 static int hf_lsa_name = -1;
  90 static int hf_lsa_key = -1;
  91 static int hf_lsa_flat_name = -1;
  92 static int hf_lsa_forest = -1;
  93 static int hf_lsa_info_type = -1;
  94 static int hf_lsa_old_pwd = -1;
  95 static int hf_lsa_new_pwd = -1;
  96 static int hf_lsa_sid_type = -1;
  97 static int hf_lsa_rid = -1;
  98 static int hf_lsa_rid_offset = -1;
  99 static int hf_lsa_num_mapped = -1;
 100 static int hf_lsa_policy_information_class = -1;
 101 static int hf_lsa_secret = -1;
 102 static int hf_nt_luid_high = -1;
 103 static int hf_nt_luid_low = -1;
 104 static int hf_lsa_privilege_name = -1;
 105 static int hf_lsa_privilege_display_name = -1;
 106 static int hf_lsa_attr = -1;
 107 static int hf_lsa_resume_handle = -1;
 108 static int hf_lsa_trust_direction = -1;
 109 static int hf_lsa_trust_type = -1;
 110 static int hf_lsa_trust_attr = -1;
 111 static int hf_lsa_trust_attr_non_trans = -1;
 112 static int hf_lsa_trust_attr_uplevel_only = -1;
 113 static int hf_lsa_trust_attr_tree_parent = -1;
 114 static int hf_lsa_trust_attr_tree_root = -1;
 115 static int hf_lsa_auth_update = -1;
 116 static int hf_lsa_auth_type = -1;
 117 static int hf_lsa_auth_len = -1;
 118 static int hf_lsa_auth_blob = -1;
 119 static int hf_lsa_rights = -1;
 120 static int hf_lsa_remove_all = -1;
 121
 122 static int hf_lsa_unknown_hyper = -1;
 123 static int hf_lsa_unknown_long = -1;
 124 static int hf_lsa_unknown_short = -1;
 125 static int hf_lsa_unknown_char = -1;
 126 static int hf_lsa_unknown_string = -1;
 127 #ifdef LSA_UNUSED_HANDLES
 128 static int hf_lsa_unknown_time = -1;
 129 #endif
 130
 131
 132 static gint ett_dcerpc_lsa = -1;
 133 static gint ett_lsa_OBJECT_ATTRIBUTES = -1;
 134 static gint ett_LSA_SECURITY_DESCRIPTOR = -1;
 135 static gint ett_lsa_policy_info = -1;
 136 static gint ett_lsa_policy_audit_log_info = -1;
 137 static gint ett_lsa_policy_audit_events_info = -1;
 138 static gint ett_lsa_policy_primary_domain_info = -1;
 139 static gint ett_lsa_policy_primary_account_info = -1;
 140 static gint ett_lsa_policy_server_role_info = -1;
 141 static gint ett_lsa_policy_replica_source_info = -1;
 142 static gint ett_lsa_policy_default_quota_info = -1;
 143 static gint ett_lsa_policy_modification_info = -1;
 144 static gint ett_lsa_policy_audit_full_set_info = -1;
 145 static gint ett_lsa_policy_audit_full_query_info = -1;
 146 static gint ett_lsa_policy_dns_domain_info = -1;
 147 static gint ett_lsa_translated_names = -1;
 148 static gint ett_lsa_translated_name = -1;
 149 static gint ett_lsa_referenced_domain_list = -1;
 150 static gint ett_lsa_trust_information = -1;
 151 static gint ett_lsa_trust_information_ex = -1;
 152 static gint ett_LUID = -1;
 153 static gint ett_LSA_PRIVILEGES = -1;
 154 static gint ett_LSA_PRIVILEGE = -1;
 155 static gint ett_LSA_LUID_AND_ATTRIBUTES_ARRAY = -1;
 156 static gint ett_LSA_LUID_AND_ATTRIBUTES = -1;
 157 static gint ett_LSA_TRUSTED_DOMAIN_LIST = -1;
 158 static gint ett_LSA_TRUSTED_DOMAIN = -1;
 159 static gint ett_LSA_TRANSLATED_SIDS = -1;
 160 static gint ett_lsa_trusted_domain_info = -1;
 161 static gint ett_lsa_trust_attr = -1;
 162 static gint ett_lsa_trusted_domain_auth_information = -1;
 163 static gint ett_lsa_auth_information = -1;
 164
 165
 166 static int
 167 lsa_dissect_pointer_NTTIME(tvbuff_t *tvb, int offset,
 168                              packet_info *pinfo, proto_tree *tree,
 169                              guint8 *drep)
 170 {
 171         dcerpc_info *di;
 172
 173         di=pinfo->private_data;
 174         if(di->conformant_run){
 175                 /*just a run to handle conformant arrays, nothing to dissect */
 176                 return offset;
 177         }
 178
 179         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 180                 di->hf_index);
 181
 182         return offset;
 183 }
 184
 185 static int
 186 lsa_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 187                              packet_info *pinfo, proto_tree *tree,
 188                              guint8 *drep)
 189 {
 190         dcerpc_info *di;
 191
 192         di=pinfo->private_data;
 193         if(di->conformant_run){
 194                 /*just a run to handle conformant arrays, nothing to dissect */
 195                 return offset;
 196         }
 197
 198         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 199                         di->hf_index, 0);
 200         return offset;
 201 }
 202
 203 static int
 204 lsa_dissect_pointer_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
 205                              packet_info *pinfo, proto_tree *tree,
 206                              guint8 *drep)
 207 {
 208         dcerpc_info *di;
 209
 210         di=pinfo->private_data;
 211         if(di->conformant_run){
 212                 /*just a run to handle conformant arrays, nothing to dissect */
 213                 return offset;
 214         }
 215
 216         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 217                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
 218                 "DOMAIN pointer: ", di->hf_index);
 219
 220         return offset;
 221 }
 222
 223 static int
 224 lsa_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 225                              packet_info *pinfo, proto_tree *tree,
 226                              guint8 *drep)
 227 {
 228         dcerpc_info *di;
 229
 230         di=pinfo->private_data;
 231         if(di->conformant_run){
 232                 /*just a run to handle conformant arrays, nothing to dissect */
 233                 return offset;
 234         }
 235
 236         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 237                         di->hf_index, 0);
 238         return offset;
 239 }
 240
 241
 242 static int
 243 lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
 244                         packet_info *pinfo, proto_tree *tree,
 245                         guint8 *drep)
 246 {
 247         guint32 len;
 248         dcerpc_info *di;
 249
 250         di=pinfo->private_data;
 251         if(di->conformant_run){
 252                 /*just a run to handle conformant arrays, nothing to dissect */
 253                 return offset;
 254         }
 255
 256         /* this is probably a varying and conformant array */
 257         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 258                                      hf_lsa_sd_size, &len);
 259         offset+=4;
 260         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 261                                      hf_lsa_sd_size, &len);
 262         proto_tree_add_item(tree, hf_lsa_secret, tvb, offset, len, FALSE);
 263         offset += len;
 264
 265         return offset;
 266 }
 267
 268 int
 269 lsa_dissect_LSA_SECRET(tvbuff_t *tvb, int offset,
 270                         packet_info *pinfo, proto_tree *parent_tree,
 271                         guint8 *drep)
 272 {
 273         proto_item *item=NULL;
 274         proto_tree *tree=NULL;
 275         int old_offset=offset;
 276
 277         if(parent_tree){
 278                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 279                         "LSA_SECRET:");
 280                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 281         }
 282
 283         /* XXX need to figure this one out */
 284         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 285                                      hf_lsa_sd_size, NULL);
 286         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 287                                      hf_lsa_sd_size, NULL);
 288         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 289                 lsa_dissect_LSA_SECRET_data, NDR_POINTER_UNIQUE,
 290                 "LSA_SECRET data: pointer", -1);
 291
 292         proto_item_set_len(item, offset-old_offset);
 293         return offset;
 294 }
 295
 296 static int
 297 lsa_dissect_LSA_SECRET_pointer(tvbuff_t *tvb, int offset,
 298                         packet_info *pinfo, proto_tree *tree,
 299                         guint8 *drep)
 300 {
 301         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 302                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
 303                 "LSA_SECRET pointer: data", -1);
 304
 305         return offset;
 306 }
 307
 308 /* Dissect LSA specific access rights */
 309
 310 static gint hf_view_local_info = -1;
 311 static gint hf_view_audit_info = -1;
 312 static gint hf_get_private_info = -1;
 313 static gint hf_trust_admin = -1;
 314 static gint hf_create_account = -1;
 315 static gint hf_create_secret = -1;
 316 static gint hf_create_priv = -1;
 317 static gint hf_set_default_quota_limits = -1;
 318 static gint hf_set_audit_requirements = -1;
 319 static gint hf_server_admin = -1;
 320 static gint hf_lookup_names = -1;
 321
 322 static void
 323 lsa_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree,
 324                     guint32 access)
 325 {
 326         proto_tree_add_boolean(
 327                 tree, hf_lookup_names, tvb, offset, 4, access);
 328
 329         proto_tree_add_boolean(
 330                 tree, hf_server_admin, tvb, offset, 4, access);
 331
 332         proto_tree_add_boolean(
 333                 tree, hf_set_audit_requirements, tvb, offset, 4, access);
 334
 335         proto_tree_add_boolean(
 336                 tree, hf_set_default_quota_limits, tvb, offset, 4, access);
 337
 338         proto_tree_add_boolean(
 339                 tree, hf_create_priv, tvb, offset, 4, access);
 340
 341         proto_tree_add_boolean(
 342                 tree, hf_create_secret, tvb, offset, 4, access);
 343
 344         proto_tree_add_boolean(
 345                 tree, hf_create_account, tvb, offset, 4, access);
 346
 347         proto_tree_add_boolean(
 348                 tree, hf_trust_admin, tvb, offset, 4, access);
 349
 350         proto_tree_add_boolean(
 351                 tree, hf_get_private_info, tvb, offset, 4, access);
 352
 353         proto_tree_add_boolean(
 354                 tree, hf_view_audit_info, tvb, offset, 4, access);
 355
 356         proto_tree_add_boolean(
 357                 tree, hf_view_local_info, tvb, offset, 4, access);
 358 }
 359
 360 struct access_mask_info lsa_access_mask_info = {
 361         "LSA",                  /* Name of specific rights */
 362         lsa_specific_rights,    /* Dissection function */
 363         NULL,                   /* Generic mapping table */
 364         NULL                    /* Standard mapping table */
 365 };
 366
 367 int
 368 lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
 369                              packet_info *pinfo, proto_tree *tree,
 370                              guint8 *drep)
 371 {
 372         guint32 len;
 373         dcerpc_info *di;
 374
 375         di=pinfo->private_data;
 376         if(di->conformant_run){
 377                 /*just a run to handle conformant arrays, nothing to dissect */
 378                 return offset;
 379         }
 380
 381         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 382                                      hf_lsa_sd_size, &len);
 383
 384         dissect_nt_sec_desc(
 385                 tvb, offset, pinfo, tree, drep, len, &lsa_access_mask_info);
 386
 387         offset += len;
 388
 389         return offset;
 390 }
 391 int
 392 lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 393                         packet_info *pinfo, proto_tree *parent_tree,
 394                         guint8 *drep)
 395 {
 396         proto_item *item=NULL;
 397         proto_tree *tree=NULL;
 398         int old_offset=offset;
 399
 400         if(parent_tree){
 401                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 402                         "LSA_SECURITY_DESCRIPTOR:");
 403                 tree = proto_item_add_subtree(item, ett_LSA_SECURITY_DESCRIPTOR);
 404         }
 405
 406         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 407                                     hf_lsa_sd_size, NULL);
 408
 409         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 410                         lsa_dissect_LSA_SECURITY_DESCRIPTOR_data, NDR_POINTER_UNIQUE,
 411                         "LSA SECURITY DESCRIPTOR data:", -1);
 412
 413         proto_item_set_len(item, offset-old_offset);
 414         return offset;
 415 }
 416
 417 static int
 418 lsa_dissect_LPSTR(tvbuff_t *tvb, int offset,
 419         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 420 {
 421         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 422                         hf_lsa_unknown_char, NULL);
 423
 424         return offset;
 425 }
 426
 427 static const value_string lsa_impersonation_level_vals[] = {
 428         {0,     "Anonymous"},
 429         {1,     "Identification"},
 430         {2,     "Impersonation"},
 431         {3,     "Delegation"},
 432         {0, NULL}
 433 };
 434
 435
 436 static int
 437 lsa_dissect_SECURITY_QUALITY_OF_SERVICE(tvbuff_t *tvb, int offset,
 438         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 439 {
 440         /* Length */
 441         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 442                         hf_lsa_qos_len, NULL);
 443
 444         /* impersonation level */
 445         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 446                         hf_lsa_qos_impersonation_level, NULL);
 447
 448         /* context tracking mode */
 449         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 450                         hf_lsa_qos_track_context, NULL);
 451
 452         /* effective only */
 453         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 454                         hf_lsa_qos_effective_only, NULL);
 455
 456         return offset;
 457 }
 458
 459 static int
 460 lsa_dissect_ACCESS_MASK(tvbuff_t *tvb, int offset,
 461         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 462 {
 463         offset = dissect_nt_access_mask(
 464                 tvb, offset, pinfo, tree, drep, hf_lsa_access_mask,
 465                 &lsa_access_mask_info);
 466
 467         return offset;
 468 }
 469
 470 static int
 471 lsa_dissect_LSA_OBJECT_ATTRIBUTES(tvbuff_t *tvb, int offset,
 472         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 473 {
 474         int old_offset=offset;
 475         proto_item *item = NULL;
 476         proto_tree *tree = NULL;
 477
 478         if(parent_tree){
 479                 item = proto_tree_add_text(parent_tree, tvb, offset, -1, "Object Attributes");
 480                 tree = proto_item_add_subtree(item, ett_lsa_OBJECT_ATTRIBUTES);
 481         }
 482
 483         /* Length */
 484         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 485                         hf_lsa_obj_attr_len, NULL);
 486
 487         /* LPSTR */
 488         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 489                 lsa_dissect_LPSTR, NDR_POINTER_UNIQUE,
 490                 "LSPTR pointer: ", -1);
 491
 492         /* attribute name */
 493         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 494                 lsa_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
 495                 "NAME pointer: ", hf_lsa_obj_attr_name);
 496
 497         /* Attr */
 498         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 499                         hf_lsa_obj_attr, NULL);
 500
 501         /* security descriptor */
 502         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 503                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
 504                 "LSA_SECURITY_DESCRIPTOR pointer: ", -1);
 505
 506         /* security quality of service */
 507         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 508                 lsa_dissect_SECURITY_QUALITY_OF_SERVICE, NDR_POINTER_UNIQUE,
 509                 "LSA_SECURITY_QUALITY_OF_SERVICE pointer: ", -1);
 510
 511         proto_item_set_len(item, offset-old_offset);
 512         return offset;
 513 }
 514
 515 static int
 516 lsa_dissect_lsarclose_rqst(tvbuff_t *tvb, int offset,
 517         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 518 {
 519         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 520                         hf_lsa_hnd, NULL, NULL, FALSE, TRUE);
 521
 522         return offset;
 523 }
 524
 525 static int
 526 lsa_dissect_lsarclose_reply(tvbuff_t *tvb, int offset,
 527         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 528 {
 529         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 530                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
 531
 532         offset = dissect_ntstatus(
 533                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
 534
 535         return offset;
 536 }
 537
 538 /* A bug in the NT IDL for lsa openpolicy only stores the first (wide)
 539    character of the server name which is always '\'.  This is fixed in lsa
 540    openpolicy2 but the function remains for backwards compatibility. */
 541
 542 static int dissect_lsa_openpolicy_server(tvbuff_t *tvb, int offset,
 543                                              packet_info *pinfo,
 544                                              proto_tree *tree, guint8 *drep)
 545 {
 546         return dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 547                                   hf_lsa_server, NULL);
 548 }
 549
 550 static int
 551 lsa_dissect_lsaropenpolicy_rqst(tvbuff_t *tvb, int offset,
 552         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 553 {
 554         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 555                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
 556                 "Server", hf_lsa_server);
 557
 558         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 559                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 560                 "OBJECT_ATTRIBUTES", -1);
 561
 562         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 563                 pinfo, tree, drep);
 564
 565         return offset;
 566 }
 567
 568 static int
 569 lsa_dissect_lsaropenpolicy_reply(tvbuff_t *tvb, int offset,
 570         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 571 {
 572         e_ctx_hnd policy_hnd;
 573         proto_item *hnd_item;
 574         guint32 status;
 575
 576         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 577                         hf_lsa_hnd, &policy_hnd, &hnd_item, TRUE, FALSE);
 578
 579         offset = dissect_ntstatus(
 580                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, &status);
 581
 582         if (status == 0) {
 583                 dcerpc_smb_store_pol_name(&policy_hnd, pinfo,
 584                                           "OpenPolicy handle");
 585
 586                 if (hnd_item != NULL)
 587                         proto_item_append_text(hnd_item, ": OpenPolicy handle");
 588         }
 589
 590         return offset;
 591 }
 592
 593 static int
 594 lsa_dissect_lsaropenpolicy2_rqst(tvbuff_t *tvb, int offset,
 595         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 596 {
 597         offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, drep,
 598                 dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Server",
 599                 hf_lsa_server, cb_wstr_postprocess,
 600                 GINT_TO_POINTER(CB_STR_COL_INFO | CB_STR_SAVE | 1));
 601
 602         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 603                 lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
 604                 "OBJECT_ATTRIBUTES", -1);
 605
 606         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
 607                 pinfo, tree, drep);
 608
 609         return offset;
 610 }
 611
 612
 613 static int
 614 lsa_dissect_lsaropenpolicy2_reply(tvbuff_t *tvb, int offset,
 615         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 616 {
 617         dcerpc_info *di = (dcerpc_info *)pinfo->private_data;
 618         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 619         e_ctx_hnd policy_hnd;
 620         proto_item *hnd_item;
 621         guint32 status;
 622         char *pol_name;
 623
 624         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 625                         hf_lsa_hnd, &policy_hnd, &hnd_item, TRUE, FALSE);
 626
 627         offset = dissect_ntstatus(
 628                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, &status);
 629
 630         if (status == 0) {
 631                 if (dcv->private_data)
 632                         pol_name = g_strdup_printf(
 633                                 "OpenPolicy2(%s)", (char *)dcv->private_data);
 634                 else
 635                         pol_name = g_strdup("OpenPolicy2 handle");
 636
 637                 dcerpc_smb_store_pol_name(&policy_hnd, pinfo, pol_name);
 638
 639                 if (hnd_item != NULL)
 640                         proto_item_append_text(hnd_item, ": %s", pol_name);
 641
 642                 g_free(pol_name);
 643         }
 644
 645         return offset;
 646 }
 647
 648 static const value_string policy_information_class_vals[] = {
 649         {1,     "Audit Log Information"},
 650         {2,     "Audit Events Information"},
 651         {3,     "Primary Domain Information"},
 652         {4,     "Pd Account Information"},
 653         {5,     "Account Domain Information"},
 654         {6,     "Server Role Information"},
 655         {7,     "Replica Source Information"},
 656         {8,     "Default Quota Information"},
 657         {9,     "Modification Information"},
 658         {10,    "Audit Full Set Information"},
 659         {11,    "Audit Full Query Information"},
 660         {12,    "DNS Domain Information"},
 661         {0, NULL}
 662 };
 663
 664 static int
 665 lsa_dissect_lsarqueryinformationpolicy_rqst(tvbuff_t *tvb, int offset,
 666         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 667 {
 668         guint16 level;
 669
 670         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
 671                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
 672
 673         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 674                 hf_lsa_policy_information_class, &level);
 675
 676         if (check_col(pinfo->cinfo, COL_INFO))
 677                 col_append_fstr(
 678                         pinfo->cinfo, COL_INFO, ", %s",
 679                         val_to_str(level, policy_information_class_vals,
 680                                    "Unknown (%d)"));
 681
 682         return offset;
 683 }
 684
 685 static int
 686 lsa_dissect_POLICY_AUDIT_LOG_INFO(tvbuff_t *tvb, int offset,
 687         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 688 {
 689         proto_item *item=NULL;
 690         proto_tree *tree=NULL;
 691         int old_offset=offset;
 692
 693         if(parent_tree){
 694                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 695                         "POLICY_AUDIT_LOG_INFO:");
 696                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_log_info);
 697         }
 698
 699         /* percent full */
 700         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 701                                      hf_lsa_pali_percent_full, NULL);
 702
 703         /* log size */
 704         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 705                                      hf_lsa_pali_log_size, NULL);
 706
 707         /* retention period */
 708         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 709                                 hf_lsa_pali_retention_period);
 710
 711         /* shutdown in progress */
 712         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 713                                      hf_lsa_pali_shutdown_in_progress, NULL);
 714
 715         /* time to shutdown */
 716         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 717                                 hf_lsa_pali_time_to_shutdown);
 718
 719         /* next audit record */
 720         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 721                                      hf_lsa_pali_next_audit_record, NULL);
 722
 723         proto_item_set_len(item, offset-old_offset);
 724         return offset;
 725 }
 726
 727 static int
 728 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings(tvbuff_t *tvb, int offset,
 729         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 730 {
 731         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 732                                      hf_lsa_paei_settings, NULL);
 733         return offset;
 734 }
 735
 736 static int
 737 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array(tvbuff_t *tvb, int offset,
 738         packet_info *pinfo, proto_tree *tree, guint8 *drep)
 739 {
 740         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 741                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings);
 742
 743         return offset;
 744 }
 745
 746 static int
 747 lsa_dissect_POLICY_AUDIT_EVENTS_INFO(tvbuff_t *tvb, int offset,
 748         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 749 {
 750         proto_item *item=NULL;
 751         proto_tree *tree=NULL;
 752         int old_offset=offset;
 753
 754         if(parent_tree){
 755                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 756                         "POLICY_AUDIT_EVENTS_INFO:");
 757                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_events_info);
 758         }
 759
 760         /* enabled */
 761         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 762                                      hf_lsa_paei_enabled, NULL);
 763
 764         /* settings */
 765         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 766                 lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array, NDR_POINTER_UNIQUE,
 767                 "Settings", -1);
 768
 769         /* count */
 770         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 771                                      hf_lsa_count, NULL);
 772
 773         proto_item_set_len(item, offset-old_offset);
 774         return offset;
 775 }
 776
 777
 778 static int
 779 lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 780         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 781 {
 782         proto_item *item=NULL;
 783         proto_tree *tree=NULL;
 784         int old_offset=offset;
 785
 786         if(parent_tree){
 787                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 788                         "POLICY_PRIMARY_DOMAIN_INFO:");
 789                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_domain_info);
 790         }
 791
 792         /* domain */
 793         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 794                 hf_lsa_domain, 0);
 795
 796         /* sid */
 797         offset = dissect_ndr_nt_PSID(tvb, offset,
 798                 pinfo, tree, drep, hf_lsa_domain_sid);
 799
 800         proto_item_set_len(item, offset-old_offset);
 801         return offset;
 802 }
 803
 804
 805 static int
 806 lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 807         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 808 {
 809         proto_item *item=NULL;
 810         proto_tree *tree=NULL;
 811         int old_offset=offset;
 812
 813         if(parent_tree){
 814                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 815                         "POLICY_ACCOUNT_DOMAIN_INFO:");
 816                 tree = proto_item_add_subtree(item, ett_lsa_policy_primary_account_info);
 817         }
 818
 819         /* account */
 820         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 821                 hf_lsa_domain, 0);
 822
 823         /* sid */
 824         offset = dissect_ndr_nt_PSID(tvb, offset,
 825                 pinfo, tree, drep, hf_lsa_domain_sid);
 826
 827         proto_item_set_len(item, offset-old_offset);
 828         return offset;
 829 }
 830
 831
 832 static const value_string server_role_vals[] = {
 833         {0,     "Standalone"},
 834         {1,     "Domain Member"},
 835         {2,     "Backup"},
 836         {3,     "Primary"},
 837         {0, NULL}
 838 };
 839 static int
 840 lsa_dissect_POLICY_SERVER_ROLE_INFO(tvbuff_t *tvb, int offset,
 841         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 842 {
 843         proto_item *item=NULL;
 844         proto_tree *tree=NULL;
 845         int old_offset=offset;
 846
 847         if(parent_tree){
 848                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 849                         "POLICY_SERVER_ROLE_INFO:");
 850                 tree = proto_item_add_subtree(item, ett_lsa_policy_server_role_info);
 851         }
 852
 853         /* server role */
 854         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
 855                                      hf_lsa_server_role, NULL);
 856
 857         proto_item_set_len(item, offset-old_offset);
 858         return offset;
 859 }
 860
 861 static int
 862 lsa_dissect_POLICY_REPLICA_SOURCE_INFO(tvbuff_t *tvb, int offset,
 863         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 864 {
 865         proto_item *item=NULL;
 866         proto_tree *tree=NULL;
 867         int old_offset=offset;
 868
 869         if(parent_tree){
 870                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 871                         "POLICY_REPLICA_SOURCE_INFO:");
 872                 tree = proto_item_add_subtree(item, ett_lsa_policy_replica_source_info);
 873         }
 874
 875         /* source */
 876         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 877                 hf_lsa_source, 0);
 878
 879         /* account */
 880         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
 881                 hf_lsa_acct, 0);
 882
 883         proto_item_set_len(item, offset-old_offset);
 884         return offset;
 885 }
 886
 887
 888 static int
 889 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(tvbuff_t *tvb, int offset,
 890         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 891 {
 892         proto_item *item=NULL;
 893         proto_tree *tree=NULL;
 894         int old_offset=offset;
 895
 896         if(parent_tree){
 897                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 898                         "POLICY_DEFAULT_QUOTA_INFO:");
 899                 tree = proto_item_add_subtree(item, ett_lsa_policy_default_quota_info);
 900         }
 901
 902         /* paged pool */
 903         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 904                                      hf_lsa_quota_paged_pool, NULL);
 905
 906         /* non paged pool */
 907         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 908                                      hf_lsa_quota_non_paged_pool, NULL);
 909
 910         /* min wss */
 911         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 912                                      hf_lsa_quota_min_wss, NULL);
 913
 914         /* max wss */
 915         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 916                                      hf_lsa_quota_max_wss, NULL);
 917
 918         /* pagefile */
 919         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 920                                      hf_lsa_quota_pagefile, NULL);
 921
 922         /*  */
 923         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 924                                      hf_lsa_unknown_hyper, NULL);
 925
 926         proto_item_set_len(item, offset-old_offset);
 927         return offset;
 928 }
 929
 930
 931 static int
 932 lsa_dissect_POLICY_MODIFICATION_INFO(tvbuff_t *tvb, int offset,
 933         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 934 {
 935         proto_item *item=NULL;
 936         proto_tree *tree=NULL;
 937         int old_offset=offset;
 938
 939         if(parent_tree){
 940                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 941                         "POLICY_MODIFICATION_INFO:");
 942                 tree = proto_item_add_subtree(item, ett_lsa_policy_modification_info);
 943         }
 944
 945         /* seq no */
 946         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
 947                                      hf_lsa_mod_seq_no, NULL);
 948
 949         /* mtime */
 950         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 951                                 hf_lsa_mod_mtime);
 952
 953         proto_item_set_len(item, offset-old_offset);
 954         return offset;
 955 }
 956
 957
 958 static int
 959 lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(tvbuff_t *tvb, int offset,
 960         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 961 {
 962         proto_item *item=NULL;
 963         proto_tree *tree=NULL;
 964         int old_offset=offset;
 965
 966         if(parent_tree){
 967                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 968                         "POLICY_AUDIT_FULL_SET_INFO:");
 969                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_set_info);
 970         }
 971
 972         /* unknown */
 973         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 974                         hf_lsa_unknown_char, NULL);
 975
 976         proto_item_set_len(item, offset-old_offset);
 977         return offset;
 978 }
 979
 980
 981 static int
 982 lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(tvbuff_t *tvb, int offset,
 983         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
 984 {
 985         proto_item *item=NULL;
 986         proto_tree *tree=NULL;
 987         int old_offset=offset;
 988
 989         if(parent_tree){
 990                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 991                         "POLICY_AUDIT_FULL_QUERY_INFO:");
 992                 tree = proto_item_add_subtree(item, ett_lsa_policy_audit_full_query_info);
 993         }
 994
 995         /* unknown */
 996         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
 997                         hf_lsa_unknown_char, NULL);
 998
 999         /* unknown */
1000         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
1001                         hf_lsa_unknown_char, NULL);
1002
1003         proto_item_set_len(item, offset-old_offset);
1004         return offset;
1005 }
1006
1007
1008 int
1009 lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvbuff_t *tvb, int offset,
1010         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1011 {
1012         proto_item *item=NULL;
1013         proto_tree *tree=NULL;
1014         int old_offset=offset;
1015
1016         if(parent_tree){
1017                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1018                         "POLICY_DNS_DOMAIN_INFO:");
1019                 tree = proto_item_add_subtree(item, ett_lsa_policy_dns_domain_info);
1020         }
1021
1022         /* name */
1023         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1024                 hf_lsa_domain, 0);
1025
1026         /* domain */
1027         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1028                 hf_lsa_fqdomain, 0);
1029
1030         /* forest */
1031         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1032                 hf_lsa_forest, 0);
1033
1034         /* GUID */
1035         offset = dissect_nt_GUID(tvb, offset,
1036                 pinfo, tree, drep);
1037
1038         /* SID pointer */
1039         offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep, hf_lsa_domain_sid);
1040
1041         proto_item_set_len(item, offset-old_offset);
1042         return offset;
1043 }
1044
1045 static int
1046 lsa_dissect_POLICY_INFORMATION(tvbuff_t *tvb, int offset,
1047         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1048 {
1049         proto_item *item=NULL;
1050         proto_tree *tree=NULL;
1051         int old_offset=offset;
1052         guint16 level;
1053
1054         if(parent_tree){
1055                 item = proto_tree_add_item(parent_tree, hf_lsa_policy_information, tvb, offset, 0, FALSE);
1056
1057                 tree = proto_item_add_subtree(item, ett_lsa_policy_info);
1058         }
1059
1060         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1061                                      hf_lsa_info_level, &level);
1062
1063         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
1064         switch(level){
1065         case 1:
1066                 offset = lsa_dissect_POLICY_AUDIT_LOG_INFO(
1067                                 tvb, offset, pinfo, tree, drep);
1068                 break;
1069         case 2:
1070                 offset = lsa_dissect_POLICY_AUDIT_EVENTS_INFO(
1071                                 tvb, offset, pinfo, tree, drep);
1072                 break;
1073         case 3:
1074                 offset = lsa_dissect_POLICY_PRIMARY_DOMAIN_INFO(
1075                                 tvb, offset, pinfo, tree, drep);
1076                 break;
1077         case 4:
1078                 offset = dissect_ndr_counted_string(tvb, offset, pinfo,
1079                         tree, drep, hf_lsa_acct, 0);
1080                 break;
1081         case 5:
1082                 offset = lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(
1083                                 tvb, offset, pinfo, tree, drep);
1084                 break;
1085         case 6:
1086                 offset = lsa_dissect_POLICY_SERVER_ROLE_INFO(
1087                                 tvb, offset, pinfo, tree, drep);
1088                 break;
1089         case 7:
1090                 offset = lsa_dissect_POLICY_REPLICA_SOURCE_INFO(
1091                                 tvb, offset, pinfo, tree, drep);
1092                 break;
1093         case 8:
1094                 offset = lsa_dissect_POLICY_DEFAULT_QUOTA_INFO(
1095                                 tvb, offset, pinfo, tree, drep);
1096                 break;
1097         case 9:
1098                 offset = lsa_dissect_POLICY_MODIFICATION_INFO(
1099                                 tvb, offset, pinfo, tree, drep);
1100                 break;
1101         case 10:
1102                 offset = lsa_dissect_POLICY_AUDIT_FULL_SET_INFO(
1103                                 tvb, offset, pinfo, tree, drep);
1104                 break;
1105         case 11:
1106                 offset = lsa_dissect_POLICY_AUDIT_FULL_QUERY_INFO(
1107                                 tvb, offset, pinfo, tree, drep);
1108                 break;
1109         case 12:
1110                 offset = lsa_dissect_POLICY_DNS_DOMAIN_INFO(
1111                                 tvb, offset, pinfo, tree, drep);
1112                 break;
1113         }
1114
1115         proto_item_set_len(item, offset-old_offset);
1116         return offset;
1117 }
1118
1119 static int
1120 lsa_dissect_lsarqueryinformationpolicy_reply(tvbuff_t *tvb, int offset,
1121         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1122 {
1123         /* This is really a pointer to a pointer though the first level is REF
1124           so we just ignore that one */
1125         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1126                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
1127                 "POLICY_INFORMATION pointer: info", -1);
1128
1129         offset = dissect_ntstatus(
1130                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1131
1132         return offset;
1133 }
1134
1135 static int
1136 lsa_dissect_lsardelete_rqst(tvbuff_t *tvb, int offset,
1137         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1138 {
1139         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1140                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1141
1142         return offset;
1143 }
1144
1145 static int
1146 lsa_dissect_lsardelete_reply(tvbuff_t *tvb, int offset,
1147         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1148 {
1149         offset = dissect_ntstatus(
1150                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1151
1152         return offset;
1153 }
1154
1155
1156 static int
1157 lsa_dissect_lsarquerysecurityobject_rqst(tvbuff_t *tvb, int offset,
1158         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1159 {
1160         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1161                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1162
1163         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1164                 hf_lsa_info_type, NULL);
1165
1166         return offset;
1167 }
1168
1169
1170 static int
1171 lsa_dissect_lsarquerysecurityobject_reply(tvbuff_t *tvb, int offset,
1172         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1173 {
1174         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1175                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
1176                 "LSA_SECURITY_DESCRIPTOR pointer: sec_info", -1);
1177
1178         offset = dissect_ntstatus(
1179                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1180
1181         return offset;
1182 }
1183
1184
1185 static int
1186 lsa_dissect_lsarsetsecurityobject_rqst(tvbuff_t *tvb, int offset,
1187         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1188 {
1189         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1190                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1191
1192         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1193                 hf_lsa_info_type, NULL);
1194
1195         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1196                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
1197                 "LSA_SECURITY_DESCRIPTOR: sec_info", -1);
1198
1199         return offset;
1200 }
1201
1202 static int
1203 lsa_dissect_lsarsetsecurityobject_reply(tvbuff_t *tvb, int offset,
1204         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1205 {
1206         offset = dissect_ntstatus(
1207                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1208
1209         return offset;
1210 }
1211
1212
1213 static int
1214 lsa_dissect_lsarchangepassword_rqst(tvbuff_t *tvb, int offset,
1215         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1216 {
1217         /* server */
1218         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1219                 hf_lsa_server, 0);
1220
1221         /* domain */
1222         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1223                 hf_lsa_domain, 0);
1224
1225         /* account */
1226         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1227                 hf_lsa_acct, 0);
1228
1229         /* old password */
1230         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1231                 hf_lsa_old_pwd, 0);
1232
1233         /* new password */
1234         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1235                 hf_lsa_new_pwd, 0);
1236
1237         return offset;
1238 }
1239
1240 static int
1241 lsa_dissect_lsarchangepassword_reply(tvbuff_t *tvb, int offset,
1242         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1243 {
1244         offset = dissect_ntstatus(
1245                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1246
1247         return offset;
1248 }
1249
1250 static const value_string sid_type_vals[] = {
1251         {1,     "User"},
1252         {2,     "Group"},
1253         {3,     "Domain"},
1254         {4,     "Alias"},
1255         {5,     "Well Known Group"},
1256         {6,     "Deleted Account"},
1257         {7,     "Invalid"},
1258         {8,     "Unknown"},
1259         {9,     "Computer"},
1260         {0, NULL}
1261 };
1262 static int
1263 lsa_dissect_LSA_TRANSLATED_NAME(tvbuff_t *tvb, int offset,
1264         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1265 {
1266         proto_item *item=NULL;
1267         proto_tree *tree=NULL;
1268         int old_offset=offset;
1269
1270         if(parent_tree){
1271                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1272                         "LSA_TRANSLATED_NAME:");
1273                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
1274         }
1275
1276         /* sid type */
1277         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
1278                         hf_lsa_sid_type, NULL);
1279
1280         /* name */
1281         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1282                 hf_lsa_name, 0);
1283
1284         /* index */
1285         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1286                                      hf_lsa_index, NULL);
1287
1288         proto_item_set_len(item, offset-old_offset);
1289         return offset;
1290 }
1291
1292 static int
1293 lsa_dissect_LSA_TRANSLATED_NAME_array(tvbuff_t *tvb, int offset,
1294         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1295 {
1296         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1297                 lsa_dissect_LSA_TRANSLATED_NAME);
1298
1299         return offset;
1300 }
1301
1302 static int
1303 lsa_dissect_LSA_TRANSLATED_NAMES(tvbuff_t *tvb, int offset,
1304         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1305 {
1306         proto_item *item=NULL;
1307         proto_tree *tree=NULL;
1308         int old_offset=offset;
1309
1310         if(parent_tree){
1311                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1312                         "LSA_TRANSLATED_NAMES:");
1313                 tree = proto_item_add_subtree(item, ett_lsa_translated_names);
1314         }
1315
1316         /* count */
1317         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1318                                      hf_lsa_count, NULL);
1319
1320         /* settings */
1321         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1322                 lsa_dissect_LSA_TRANSLATED_NAME_array, NDR_POINTER_UNIQUE,
1323                 "TRANSLATED_NAME_ARRAY", -1);
1324
1325         proto_item_set_len(item, offset-old_offset);
1326         return offset;
1327 }
1328
1329
1330 static int
1331 lsa_dissect_lsarlookupsids_rqst(tvbuff_t *tvb, int offset,
1332         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1333 {
1334         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1335                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1336
1337         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1338                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
1339                         "PSID_ARRAY", -1);
1340
1341         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1342                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1343                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1344
1345         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1346                 hf_lsa_info_level, NULL);
1347
1348         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1349                 hf_lsa_num_mapped, NULL);
1350
1351         return offset;
1352 }
1353
1354 static int
1355 lsa_dissect_LSA_TRUST_INFORMATION(tvbuff_t *tvb, int offset,
1356         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1357 {
1358         proto_item *item=NULL;
1359         proto_tree *tree=NULL;
1360         int old_offset=offset;
1361
1362         if(parent_tree){
1363                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1364                         "TRUST INFORMATION:");
1365                 tree = proto_item_add_subtree(item, ett_lsa_trust_information);
1366         }
1367
1368         /* name */
1369         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1370                 hf_lsa_name, 0);
1371
1372         /* sid */
1373         offset = dissect_ndr_nt_PSID(tvb, offset,
1374                 pinfo, tree, drep, -1);
1375
1376         proto_item_set_len(item, offset-old_offset);
1377         return offset;
1378 }
1379
1380 static const value_string trusted_direction_vals[] = {
1381         {0,     "Trust disabled"},
1382         {1,     "Inbound trust"},
1383         {2,     "Outbound trust"},
1384         {0,     NULL}
1385 };
1386
1387 static const value_string trusted_type_vals[] = {
1388         {1,     "Downlevel"},
1389         {2,     "Uplevel"},
1390         {3,     "MIT"},
1391         {4,     "DCE"},
1392         {0,     NULL}
1393 };
1394
1395 static const true_false_string tfs_trust_attr_non_trans = {
1396         "NON TRANSITIVE is set",
1397         "Non transitive is NOT set"
1398 };
1399 static const true_false_string tfs_trust_attr_uplevel_only = {
1400         "UPLEVEL ONLY is set",
1401         "Uplevel only is NOT set"
1402 };
1403 static const true_false_string tfs_trust_attr_tree_parent = {
1404         "TREE PARENT is set",
1405         "Tree parent is NOT set"
1406 };
1407 static const true_false_string tfs_trust_attr_tree_root = {
1408         "TREE ROOT is set",
1409         "Tree root is NOT set"
1410 };
1411 static int
1412 lsa_dissect_trust_attr(tvbuff_t *tvb, int offset, packet_info *pinfo,
1413                         proto_tree *parent_tree, guint8 *drep)
1414 {
1415         guint32 mask;
1416         proto_item *item = NULL;
1417         proto_tree *tree = NULL;
1418
1419         offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
1420                         hf_lsa_trust_attr, &mask);
1421
1422         if(parent_tree){
1423                 item = proto_tree_add_uint(parent_tree, hf_lsa_trust_attr,
1424                         tvb, offset-4, 4, mask);
1425                 tree = proto_item_add_subtree(item, ett_lsa_trust_attr);
1426         }
1427
1428         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_root,
1429                 tvb, offset-4, 4, mask);
1430         proto_tree_add_boolean(tree, hf_lsa_trust_attr_tree_parent,
1431                 tvb, offset-4, 4, mask);
1432         proto_tree_add_boolean(tree, hf_lsa_trust_attr_uplevel_only,
1433                 tvb, offset-4, 4, mask);
1434         proto_tree_add_boolean(tree, hf_lsa_trust_attr_non_trans,
1435                 tvb, offset-4, 4, mask);
1436
1437         return offset;
1438 }
1439
1440 static int
1441 lsa_dissect_LSA_TRUST_INFORMATION_EX(tvbuff_t *tvb, int offset,
1442         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1443 {
1444         proto_item *item=NULL;
1445         proto_tree *tree=NULL;
1446         int old_offset=offset;
1447
1448         if(parent_tree){
1449                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1450                         "TRUST INFORMATION EX:");
1451                 tree = proto_item_add_subtree(item, ett_lsa_trust_information_ex);
1452         }
1453
1454         /* name */
1455         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1456                 hf_lsa_name, 0);
1457
1458         /* flat name */
1459         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1460                 hf_lsa_flat_name, 0);
1461
1462         /* sid */
1463         offset = dissect_ndr_nt_PSID(tvb, offset,
1464                 pinfo, tree, drep, -1);
1465
1466         /* direction */
1467         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1468                                      hf_lsa_trust_direction, NULL);
1469
1470         /* type */
1471         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1472                                      hf_lsa_trust_type, NULL);
1473
1474         /* attributes */
1475         offset = lsa_dissect_trust_attr(tvb, offset, pinfo, tree, drep);
1476
1477         proto_item_set_len(item, offset-old_offset);
1478         return offset;
1479 }
1480
1481 static int
1482 lsa_dissect_auth_info_blob(tvbuff_t *tvb, int offset,
1483         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1484 {
1485         dcerpc_info *di;
1486         guint32 len;
1487
1488         di=pinfo->private_data;
1489         if(di->conformant_run){
1490                 /*just a run to handle conformant arrays, nothing to dissect */
1491                 return offset;
1492         }
1493
1494         /* len */
1495         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1496                                      hf_lsa_auth_len, &len);
1497
1498         proto_tree_add_item(tree, hf_lsa_auth_blob, tvb, offset, len, FALSE);
1499         offset += len;
1500
1501         return offset;
1502 }
1503
1504 static int
1505 lsa_dissect_auth_info(tvbuff_t *tvb, int offset,
1506         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1507 {
1508         proto_item *item=NULL;
1509         proto_tree *tree=NULL;
1510         int old_offset=offset;
1511
1512         if(parent_tree){
1513                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1514                         "AUTH INFORMATION:");
1515                 tree = proto_item_add_subtree(item, ett_lsa_auth_information);
1516         }
1517
1518         /* update */
1519         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
1520                                      hf_lsa_auth_update, NULL);
1521
1522         /* type */
1523         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1524                                      hf_lsa_auth_type, NULL);
1525
1526         /* len */
1527         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1528                                      hf_lsa_auth_len, NULL);
1529
1530         /* auth info blob */
1531         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1532                         lsa_dissect_auth_info_blob, NDR_POINTER_UNIQUE,
1533                         "AUTH INFO blob:", -1);
1534
1535         proto_item_set_len(item, offset-old_offset);
1536         return offset;
1537 }
1538
1539 static int
1540 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvbuff_t *tvb, int offset,
1541         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1542 {
1543         proto_item *item=NULL;
1544         proto_tree *tree=NULL;
1545         int old_offset=offset;
1546
1547         if(parent_tree){
1548                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1549                         "TRUSTED DOMAIN AUTH INFORMATION:");
1550                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_auth_information);
1551         }
1552
1553         /* unknown */
1554         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1555                                      hf_lsa_unknown_long, NULL);
1556
1557         /* unknown */
1558         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1559
1560         /* unknown */
1561         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1562
1563         /* unknown */
1564         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1565                                      hf_lsa_unknown_long, NULL);
1566
1567         /* unknown */
1568         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1569
1570         /* unknown */
1571         offset = lsa_dissect_auth_info(tvb, offset, pinfo, tree, drep);
1572
1573         proto_item_set_len(item, offset-old_offset);
1574         return offset;
1575 }
1576
1577
1578 static int
1579 lsa_dissect_LSA_TRUST_INFORMATION_array(tvbuff_t *tvb, int offset,
1580         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1581 {
1582         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1583                 lsa_dissect_LSA_TRUST_INFORMATION);
1584
1585         return offset;
1586 }
1587
1588 static int
1589 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
1590         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1591 {
1592         proto_item *item=NULL;
1593         proto_tree *tree=NULL;
1594         int old_offset=offset;
1595
1596         if(parent_tree){
1597                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
1598                         "LSA_REFERENCED_DOMAIN_LIST:");
1599                 tree = proto_item_add_subtree(item, ett_lsa_referenced_domain_list);
1600         }
1601
1602         /* count */
1603         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1604                                      hf_lsa_count, NULL);
1605
1606         /* trust information */
1607         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1608                 lsa_dissect_LSA_TRUST_INFORMATION_array, NDR_POINTER_UNIQUE,
1609                 "TRUST INFORMATION array:", -1);
1610
1611         /* max count */
1612         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1613                                      hf_lsa_max_count, NULL);
1614
1615         proto_item_set_len(item, offset-old_offset);
1616         return offset;
1617 }
1618
1619 static int
1620 lsa_dissect_lsarlookupsids_reply(tvbuff_t *tvb, int offset,
1621         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1622 {
1623         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1624                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
1625                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
1626
1627         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1628                 lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
1629                 "LSA_TRANSLATED_NAMES pointer: names", -1);
1630
1631         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1632                 hf_lsa_num_mapped, NULL);
1633
1634         offset = dissect_ntstatus(
1635                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1636
1637         return offset;
1638 }
1639
1640
1641 static int
1642 lsa_dissect_lsarsetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1643         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1644 {
1645         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1646                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1647
1648         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1649                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1650                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1651
1652         return offset;
1653 }
1654
1655
1656 static int
1657 lsa_dissect_lsarsetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1658         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1659 {
1660         offset = dissect_ntstatus(
1661                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1662
1663         return offset;
1664 }
1665
1666
1667 static int
1668 lsa_dissect_lsargetquotasforaccount_rqst(tvbuff_t *tvb, int offset,
1669         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1670 {
1671         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1672                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1673
1674         return offset;
1675 }
1676
1677
1678 static int
1679 lsa_dissect_lsargetquotasforaccount_reply(tvbuff_t *tvb, int offset,
1680         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1681 {
1682         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1683                 lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
1684                 "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
1685
1686         offset = dissect_ntstatus(
1687                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1688
1689         return offset;
1690 }
1691
1692
1693 static int
1694 lsa_dissect_lsarsetinformationpolicy_rqst(tvbuff_t *tvb, int offset,
1695         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1696 {
1697         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1698                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1699
1700         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1701                 hf_lsa_policy_information_class, NULL);
1702
1703         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1704                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
1705                 "POLICY_INFORMATION pointer: info", -1);
1706
1707         return offset;
1708 }
1709
1710
1711 static int
1712 lsa_dissect_lsarsetinformationpolicy_reply(tvbuff_t *tvb, int offset,
1713         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1714 {
1715         offset = dissect_ntstatus(
1716                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1717
1718         return offset;
1719 }
1720
1721
1722 static int
1723 lsa_dissect_lsarclearauditlog_rqst(tvbuff_t *tvb, int offset,
1724         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1725 {
1726         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1727                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1728
1729         offset = dissect_ndr_nt_SID(tvb, offset,
1730                 pinfo, tree, drep, -1);
1731
1732         /* unknown */
1733         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1734                                      hf_lsa_unknown_long, NULL);
1735
1736         return offset;
1737 }
1738
1739
1740 static int
1741 lsa_dissect_lsarclearauditlog_reply(tvbuff_t *tvb, int offset,
1742         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1743 {
1744         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1745                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1746
1747         offset = dissect_ntstatus(
1748                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1749
1750         return offset;
1751 }
1752
1753 static int
1754 lsa_dissect_lsargetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1755         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1756 {
1757         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1758                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1759
1760         return offset;
1761 }
1762
1763
1764 static int
1765 lsa_dissect_lsargetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1766         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1767 {
1768         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
1769                                      hf_lsa_rid, NULL);
1770
1771         offset = dissect_ntstatus(
1772                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1773
1774         return offset;
1775 }
1776
1777
1778 static int
1779 lsa_dissect_lsarsetsystemaccessaccount_rqst(tvbuff_t *tvb, int offset,
1780         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1781 {
1782         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1783                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1784
1785         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1786                 hf_lsa_rid, NULL);
1787
1788         return offset;
1789 }
1790
1791
1792 static int
1793 lsa_dissect_lsarsetsystemaccessaccount_reply(tvbuff_t *tvb, int offset,
1794         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1795 {
1796         offset = dissect_ntstatus(
1797                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1798
1799         return offset;
1800 }
1801
1802
1803 static int
1804 lsa_dissect_lsaropentrusteddomain_rqst(tvbuff_t *tvb, int offset,
1805         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1806 {
1807         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1808                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1809
1810         offset = dissect_ndr_nt_SID(tvb, offset,
1811                 pinfo, tree, drep, -1);
1812
1813         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
1814                 pinfo, tree, drep);
1815
1816         return offset;
1817 }
1818
1819
1820 static int
1821 lsa_dissect_lsaropentrusteddomain_reply(tvbuff_t *tvb, int offset,
1822         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1823 {
1824         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1825                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1826
1827         offset = dissect_ntstatus(
1828                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1829
1830         return offset;
1831 }
1832
1833
1834 static int
1835 lsa_dissect_lsardeletetrusteddomain_rqst(tvbuff_t *tvb, int offset,
1836         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1837 {
1838         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1839                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1840
1841         offset = dissect_ndr_nt_SID(tvb, offset,
1842                 pinfo, tree, drep, -1);
1843
1844         return offset;
1845 }
1846
1847
1848 static int
1849 lsa_dissect_lsardeletetrusteddomain_reply(tvbuff_t *tvb, int offset,
1850         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1851 {
1852         offset = dissect_ntstatus(
1853                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1854
1855         return offset;
1856 }
1857
1858 int
1859 dissect_nt_LUID(tvbuff_t *tvb, int offset,
1860         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1861 {
1862         proto_item *item=NULL;
1863         proto_tree *tree=NULL;
1864         int old_offset=offset;
1865
1866         if(parent_tree){
1867                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1868                         "LUID:");
1869                 tree = proto_item_add_subtree(item, ett_LUID);
1870         }
1871
1872         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1873                 hf_nt_luid_low, NULL);
1874
1875         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1876                 hf_nt_luid_high, NULL);
1877
1878         proto_item_set_len(item, offset-old_offset);
1879         return offset;
1880 }
1881
1882 static int
1883 lsa_dissect_LSA_PRIVILEGE(tvbuff_t *tvb, int offset,
1884         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1885 {
1886         proto_item *item=NULL;
1887         proto_tree *tree=NULL;
1888         int old_offset=offset;
1889
1890         if(parent_tree){
1891                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1892                         "LSA_PRIVILEGE:");
1893                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGE);
1894         }
1895
1896         /* privilege name */
1897         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
1898                         hf_lsa_privilege_name, 0);
1899
1900         /* LUID */
1901         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1902
1903         proto_item_set_len(item, offset-old_offset);
1904         return offset;
1905 }
1906
1907 static int
1908 lsa_dissect_LSA_PRIVILEGE_array(tvbuff_t *tvb, int offset,
1909         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1910 {
1911         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1912                 lsa_dissect_LSA_PRIVILEGE);
1913
1914         return offset;
1915 }
1916
1917 static int
1918 lsa_dissect_LSA_PRIVILEGES(tvbuff_t *tvb, int offset,
1919         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
1920 {
1921         proto_item *item=NULL;
1922         proto_tree *tree=NULL;
1923         int old_offset=offset;
1924
1925         if(parent_tree){
1926                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1927                         "LSA_PRIVILEGES:");
1928                 tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGES);
1929         }
1930
1931         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1932                 hf_lsa_count, NULL);
1933
1934         /* privileges */
1935         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1936                 lsa_dissect_LSA_PRIVILEGE_array, NDR_POINTER_UNIQUE,
1937                 "LSA_PRIVILEGE array:", -1);
1938
1939         proto_item_set_len(item, offset-old_offset);
1940         return offset;
1941 }
1942
1943 static int
1944 lsa_dissect_lsarenumerateprivileges_rqst(tvbuff_t *tvb, int offset,
1945         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1946 {
1947         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1948                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1949
1950         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1951                 hf_lsa_count, NULL);
1952
1953         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1954                 hf_lsa_size, NULL);
1955
1956         return offset;
1957 }
1958
1959 static int
1960 lsa_dissect_lsarenumerateprivileges_reply(tvbuff_t *tvb, int offset,
1961         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1962 {
1963         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1964                 hf_lsa_count, NULL);
1965
1966         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1967                 lsa_dissect_LSA_PRIVILEGES, NDR_POINTER_REF,
1968                 "LSA_PRIVILEGES pointer: privs", -1);
1969
1970         offset = dissect_ntstatus(
1971                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
1972
1973         return offset;
1974 }
1975
1976 static int
1977 lsa_dissect_lsarlookupprivilegevalue_rqst(tvbuff_t *tvb, int offset,
1978         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1979 {
1980         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
1981                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
1982
1983         /* privilege name */
1984         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1985                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
1986                 "NAME pointer: ", hf_lsa_privilege_name);
1987
1988         return offset;
1989 }
1990
1991
1992 static int
1993 lsa_dissect_lsarlookupprivilegevalue_reply(tvbuff_t *tvb, int offset,
1994         packet_info *pinfo, proto_tree *tree, guint8 *drep)
1995 {
1996
1997         /* LUID */
1998         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
1999
2000         offset = dissect_ntstatus(
2001                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2002
2003         return offset;
2004 }
2005
2006
2007 static int
2008 lsa_dissect_lsarlookupprivilegename_rqst(tvbuff_t *tvb, int offset,
2009         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2010 {
2011         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2012                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2013
2014         /* LUID */
2015         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2016                 dissect_nt_LUID, NDR_POINTER_REF,
2017                 "LUID pointer: value", -1);
2018
2019         return offset;
2020 }
2021
2022
2023 static int
2024 lsa_dissect_lsarlookupprivilegename_reply(tvbuff_t *tvb, int offset,
2025         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2026 {
2027         /* [out, ref] LSA_UNICODE_STRING **name */
2028         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2029                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2030                 "PRIVILEGE NAME pointer:", hf_lsa_privilege_name);
2031
2032         offset = dissect_ntstatus(
2033                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2034
2035         return offset;
2036 }
2037
2038
2039 static int
2040 lsa_dissect_lsarenumerateprivilegesaccount_rqst(tvbuff_t *tvb, int offset,
2041         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2042 {
2043         /* [in] LSA_HANDLE hnd */
2044         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2045                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2046
2047         return offset;
2048 }
2049
2050
2051 static int
2052 lsa_dissect_LUID_AND_ATTRIBUTES(tvbuff_t *tvb, int offset,
2053         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2054 {
2055         proto_item *item=NULL;
2056         proto_tree *tree=NULL;
2057         int old_offset=offset;
2058
2059         if(parent_tree){
2060                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2061                         "LUID_AND_ATTRIBUTES:");
2062                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES);
2063         }
2064
2065         /* LUID */
2066         offset = dissect_nt_LUID(tvb, offset, pinfo, tree, drep);
2067
2068         /* attr */
2069         offset = dissect_ndr_uint64 (tvb, offset, pinfo, tree, drep,
2070                                      hf_lsa_attr, NULL);
2071
2072         proto_item_set_len(item, offset-old_offset);
2073         return offset;
2074 }
2075
2076 static int
2077 lsa_dissect_LUID_AND_ATTRIBUTES_array(tvbuff_t *tvb, int offset,
2078         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2079 {
2080         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2081                 lsa_dissect_LUID_AND_ATTRIBUTES);
2082
2083         return offset;
2084 }
2085
2086 static int
2087 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvbuff_t *tvb, int offset,
2088         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2089 {
2090         proto_item *item=NULL;
2091         proto_tree *tree=NULL;
2092         int old_offset=offset;
2093
2094         if(parent_tree){
2095                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2096                         "LUID_AND_ATTRIBUTES_ARRAY:");
2097                 tree = proto_item_add_subtree(item, ett_LSA_LUID_AND_ATTRIBUTES_ARRAY);
2098         }
2099
2100         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2101                 hf_lsa_count, NULL);
2102
2103         /* luid and attributes */
2104         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2105                 lsa_dissect_LUID_AND_ATTRIBUTES_array, NDR_POINTER_UNIQUE,
2106                 "LUID_AND_ATTRIBUTES array:", -1);
2107
2108         proto_item_set_len(item, offset-old_offset);
2109         return offset;
2110 }
2111
2112 static int
2113 lsa_dissect_lsarenumerateprivilegesaccount_reply(tvbuff_t *tvb, int offset,
2114         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2115 {
2116         /* [out, ref] LUID_AND_ATTRIBUTES_ARRAY * *privs */
2117         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2118                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2119                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2120
2121         offset = dissect_ntstatus(
2122                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2123
2124         return offset;
2125 }
2126
2127 static int
2128 lsa_dissect_lsaraddprivilegestoaccount_rqst(tvbuff_t *tvb, int offset,
2129         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2130 {
2131         /* [in] LSA_HANDLE hnd */
2132         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2133                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2134
2135         /* [in, ref] LUID_AND_ATTRIBUTES_ARRAY *privs */
2136         offset = lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY(tvb, offset,
2137                 pinfo, tree, drep);
2138
2139         return offset;
2140 }
2141
2142
2143 static int
2144 lsa_dissect_lsaraddprivilegestoaccount_reply(tvbuff_t *tvb, int offset,
2145         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2146 {
2147         offset = dissect_ntstatus(
2148                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2149
2150         return offset;
2151 }
2152
2153 static int
2154 lsa_dissect_lsarremoveprivilegesfromaccount_rqst(tvbuff_t *tvb, int offset,
2155         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2156 {
2157         /* [in] LSA_HANDLE hnd */
2158         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2159                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2160
2161         /* [in] char unknown */
2162         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2163                         hf_lsa_unknown_char, NULL);
2164
2165         /* [in, unique] LUID_AND_ATTRIBUTES_ARRAY *privs */
2166         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2167                 lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
2168                 "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
2169
2170         return offset;
2171 }
2172
2173
2174 static int
2175 lsa_dissect_lsarremoveprivilegesfromaccount_reply(tvbuff_t *tvb, int offset,
2176         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2177 {
2178         offset = dissect_ntstatus(
2179                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2180
2181         return offset;
2182 }
2183
2184 static int
2185 lsa_dissect_lsarenumerateaccounts_rqst(tvbuff_t *tvb, int offset,
2186         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2187 {
2188         /* [in] LSA_HANDLE hnd */
2189         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2190                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2191
2192         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2193         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2194                 hf_lsa_resume_handle, NULL);
2195
2196         /* [in] ULONG pref_maxlen */
2197         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2198                 hf_lsa_max_count, NULL);
2199
2200         return offset;
2201 }
2202
2203 static int
2204 lsa_dissect_lsarenumerateaccounts_reply(tvbuff_t *tvb, int offset,
2205         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2206 {
2207         /* [in,out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2208         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2209                 hf_lsa_resume_handle, NULL);
2210
2211         /* [out, ref] PSID_ARRAY **accounts */
2212         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2213                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
2214                         "PSID_ARRAY", -1);
2215
2216         offset = dissect_ntstatus(
2217                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2218
2219         return offset;
2220 }
2221
2222 static int
2223 lsa_dissect_lsarcreatetrusteddomain_rqst(tvbuff_t *tvb, int offset,
2224         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2225 {
2226         /* [in] LSA_HANDLE hnd_pol */
2227         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2228                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2229
2230         /* [in, ref] LSA_TRUST_INFORMATION *domain */
2231         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2232                 lsa_dissect_LSA_TRUST_INFORMATION, NDR_POINTER_REF,
2233                 "LSA_TRUST_INFORMATION pointer: domain", -1);
2234
2235         /* [in] ACCESS_MASK access */
2236         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2237                 pinfo, tree, drep);
2238
2239         return offset;
2240 }
2241
2242 static int
2243 lsa_dissect_lsarcreatetrusteddomain_reply(tvbuff_t *tvb, int offset,
2244         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2245 {
2246         /* [out] LSA_HANDLE *hnd */
2247         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2248                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2249
2250         offset = dissect_ntstatus(
2251                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2252
2253         return offset;
2254 }
2255
2256 static int
2257 lsa_dissect_lsarenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset,
2258         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2259 {
2260         /* [in] LSA_HANDLE hnd */
2261         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2262                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2263
2264         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2265         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2266                 hf_lsa_resume_handle, NULL);
2267
2268         /* [in] ULONG pref_maxlen */
2269         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2270                 hf_lsa_max_count, NULL);
2271
2272         return offset;
2273 }
2274
2275 static int
2276 lsa_dissect_LSA_TRUSTED_DOMAIN(tvbuff_t *tvb, int offset,
2277         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2278 {
2279         proto_item *item=NULL;
2280         proto_tree *tree=NULL;
2281         int old_offset=offset;
2282
2283         if(parent_tree){
2284                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2285                         "TRUSTED_DOMAIN:");
2286                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN);
2287         }
2288
2289         /* domain */
2290         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2291                 hf_lsa_domain, 0);
2292
2293         /* sid */
2294         offset = dissect_ndr_nt_PSID(tvb, offset,
2295                 pinfo, tree, drep, -1);
2296
2297         proto_item_set_len(item, offset-old_offset);
2298         return offset;
2299 }
2300
2301 static int
2302 lsa_dissect_LSA_TRUSTED_DOMAIN_array(tvbuff_t *tvb, int offset,
2303         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2304 {
2305         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2306                 lsa_dissect_LSA_TRUSTED_DOMAIN);
2307
2308         return offset;
2309 }
2310
2311 static int
2312 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST(tvbuff_t *tvb, int offset,
2313         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2314 {
2315         proto_item *item=NULL;
2316         proto_tree *tree=NULL;
2317         int old_offset=offset;
2318
2319         if(parent_tree){
2320                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2321                         "TRUSTED_DOMAIN_LIST:");
2322                 tree = proto_item_add_subtree(item, ett_LSA_TRUSTED_DOMAIN_LIST);
2323         }
2324
2325         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2326                 hf_lsa_count, NULL);
2327
2328         /* privileges */
2329         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2330                 lsa_dissect_LSA_TRUSTED_DOMAIN_array, NDR_POINTER_UNIQUE,
2331                 "TRUSTED_DOMAIN array:", -1);
2332
2333         proto_item_set_len(item, offset-old_offset);
2334         return offset;
2335 }
2336
2337 static int
2338 lsa_dissect_lsarenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset,
2339         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2340 {
2341         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
2342         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2343                 hf_lsa_resume_handle, NULL);
2344
2345         /* [out, ref] LSA_REFERENCED_DOMAIN_LIST *domains */
2346         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2347                 lsa_dissect_LSA_TRUSTED_DOMAIN_LIST, NDR_POINTER_REF,
2348                 "LSA_TRUSTED_DOMAIN_LIST pointer: domains", -1);
2349
2350         offset = dissect_ntstatus(
2351                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2352
2353         return offset;
2354 }
2355
2356
2357 static int
2358 lsa_dissect_LSA_UNICODE_STRING_item(tvbuff_t *tvb, int offset,
2359         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2360 {
2361         dcerpc_info *di;
2362
2363         di=pinfo->private_data;
2364         if(di->conformant_run){
2365                 /*just a run to handle conformant arrays, nothing to dissect */
2366                 return offset;
2367         }
2368
2369         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2370                         di->hf_index, 0);
2371
2372         return offset;
2373 }
2374
2375 static int
2376 lsa_dissect_LSA_UNICODE_STRING_array(tvbuff_t *tvb, int offset,
2377         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2378 {
2379         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2380                 lsa_dissect_LSA_UNICODE_STRING_item);
2381
2382         return offset;
2383 }
2384
2385 static int
2386 lsa_dissect_LSA_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset,
2387         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2388 {
2389         dcerpc_info *di;
2390
2391         di=pinfo->private_data;
2392
2393         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2394                 hf_lsa_count, NULL);
2395         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2396                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2397                 "UNICODE_STRING pointer: ", di->hf_index);
2398
2399         return offset;
2400 }
2401
2402 static int
2403 lsa_dissect_LSA_TRANSLATED_SID(tvbuff_t *tvb, int offset,
2404         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2405 {
2406         /* sid type */
2407         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2408                         hf_lsa_sid_type, NULL);
2409
2410         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2411                                      hf_lsa_rid, NULL);
2412
2413         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2414                                      hf_lsa_index, NULL);
2415
2416         return offset;
2417 }
2418
2419 static int
2420 lsa_dissect_LSA_TRANSLATED_SIDS_array(tvbuff_t *tvb, int offset,
2421         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2422 {
2423         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2424                 lsa_dissect_LSA_TRANSLATED_SID);
2425
2426         return offset;
2427 }
2428
2429 static int
2430 lsa_dissect_LSA_TRANSLATED_SIDS(tvbuff_t *tvb, int offset,
2431         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2432 {
2433         proto_item *item=NULL;
2434         proto_tree *tree=NULL;
2435         int old_offset=offset;
2436
2437         if(parent_tree){
2438                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2439                         "LSA_TRANSLATED_SIDS:");
2440                 tree = proto_item_add_subtree(item, ett_LSA_TRANSLATED_SIDS);
2441         }
2442
2443         /* count */
2444         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2445                                      hf_lsa_count, NULL);
2446
2447         /* settings */
2448         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2449                 lsa_dissect_LSA_TRANSLATED_SIDS_array, NDR_POINTER_UNIQUE,
2450                 "Translated SIDS", -1);
2451
2452         proto_item_set_len(item, offset-old_offset);
2453         return offset;
2454 }
2455
2456 static int
2457 lsa_dissect_lsarlookupnames_rqst(tvbuff_t *tvb, int offset,
2458         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2459 {
2460         /* [in] LSA_HANDLE hnd */
2461         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2462                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2463
2464         /* [in] ULONG count */
2465         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2466                 hf_lsa_count, NULL);
2467
2468         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
2469         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2470                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
2471                 "Account pointer: names", hf_lsa_acct);
2472
2473         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2474         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2475                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2476                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2477
2478         /* [in] USHORT level */
2479         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2480                 hf_lsa_info_level, NULL);
2481
2482         /* [in, out, ref] ULONG *num_mapped */
2483         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2484                 hf_lsa_num_mapped, NULL);
2485
2486         return offset;
2487 }
2488
2489
2490 static int
2491 lsa_dissect_lsarlookupnames_reply(tvbuff_t *tvb, int offset,
2492         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2493 {
2494         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
2495         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2496                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
2497                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
2498
2499         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
2500         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2501                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
2502                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
2503
2504         /* [in, out, ref] ULONG *num_mapped */
2505         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2506                 hf_lsa_num_mapped, NULL);
2507
2508         offset = dissect_ntstatus(
2509                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2510
2511         return offset;
2512 }
2513
2514 static int
2515 lsa_dissect_lsarcreatesecret_rqst(tvbuff_t *tvb, int offset,
2516         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2517 {
2518         /* [in] LSA_HANDLE hnd_pol */
2519         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2520                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2521
2522         /* [in, ref] LSA_UNICODE_STRING *name */
2523         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2524                 hf_lsa_name, 0);
2525
2526         /* [in] ACCESS_MASK access */
2527         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2528                 pinfo, tree, drep);
2529
2530         return offset;
2531 }
2532
2533 static int
2534 lsa_dissect_lsarcreatesecret_reply(tvbuff_t *tvb, int offset,
2535         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2536 {
2537
2538         /* [out] LSA_HANDLE *hnd */
2539         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2540                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2541
2542         offset = dissect_ntstatus(
2543                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2544
2545         return offset;
2546 }
2547
2548 static int
2549 lsa_dissect_lsaropenaccount_rqst(tvbuff_t *tvb, int offset,
2550         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2551 {
2552         /* [in] LSA_HANDLE hnd_pol */
2553         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2554                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2555
2556         /* [in, ref] SID *account */
2557         offset = dissect_ndr_nt_SID(tvb, offset,
2558                 pinfo, tree, drep, -1);
2559
2560         /* [in] ACCESS_MASK access */
2561         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2562                 pinfo, tree, drep);
2563
2564         return offset;
2565 }
2566
2567
2568 static int
2569 lsa_dissect_lsaropenaccount_reply(tvbuff_t *tvb, int offset,
2570         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2571 {
2572         /* [out] LSA_HANDLE *hnd */
2573         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2574                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2575
2576         offset = dissect_ntstatus(
2577                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2578
2579         return offset;
2580 }
2581
2582 static const value_string trusted_info_level_vals[] = {
2583         {1,     "Domain Name Information"},
2584         {2,     "Controllers Information"},
2585         {3,     "Posix Offset Information"},
2586         {4,     "Password Information"},
2587         {5,     "Domain Information Basic"},
2588         {6,     "Domain Information Ex"},
2589         {7,     "Domain Auth Information"},
2590         {8,     "Domain Full Information"},
2591         {9,     "Domain Security Descriptor"},
2592         {10,    "Domain Private Information"},
2593         {0,     NULL}
2594 };
2595
2596 static int
2597 lsa_dissect_TRUSTED_DOMAIN_INFORMATION(tvbuff_t *tvb, int offset,
2598         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
2599 {
2600         proto_item *item=NULL;
2601         proto_tree *tree=NULL;
2602         int old_offset=offset;
2603         guint16 level;
2604
2605         if(parent_tree){
2606                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
2607                         "TRUSTED_DOMAIN_INFO:");
2608                 tree = proto_item_add_subtree(item, ett_lsa_trusted_domain_info);
2609         }
2610
2611         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
2612                                      hf_lsa_trusted_info_level, &level);
2613
2614         ALIGN_TO_4_BYTES;  /* all union arms aligned to 4 bytes, case 7 and 9 need this  */
2615         switch(level){
2616         case 1:
2617                 offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
2618                         hf_lsa_domain, 0);
2619                 break;
2620         case 2:
2621                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2622                         hf_lsa_count, NULL);
2623                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2624                         lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
2625                         "Controllers pointer: ", hf_lsa_controller);
2626                 break;
2627         case 3:
2628                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2629                         hf_lsa_rid_offset, NULL);
2630                 break;
2631         case 4:
2632                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2633                 offset = lsa_dissect_LSA_SECRET(tvb, offset, pinfo, tree, drep);
2634                 break;
2635         case 5:
2636                 offset = lsa_dissect_LSA_TRUST_INFORMATION(tvb, offset,
2637                         pinfo, tree, drep);
2638                 break;
2639         case 6:
2640                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2641                         pinfo, tree, drep);
2642                 break;
2643         case 7:
2644                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2645                 break;
2646         case 8:
2647                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2648                         pinfo, tree, drep);
2649                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2650                         hf_lsa_rid_offset, NULL);
2651                 offset = lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION(tvb, offset, pinfo, tree, drep);
2652                 break;
2653         case 9:
2654                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2655                 break;
2656         case 10:
2657                 offset = lsa_dissect_LSA_TRUST_INFORMATION_EX(tvb, offset,
2658                         pinfo, tree, drep);
2659                 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
2660                         hf_lsa_rid_offset, NULL);
2661                 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset, pinfo, tree, drep);
2662                 break;
2663         }
2664
2665         proto_item_set_len(item, offset-old_offset);
2666         return offset;
2667 }
2668
2669 static int
2670 lsa_dissect_lsarqueryinfotrusteddomain_rqst(tvbuff_t *tvb, int offset,
2671         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2672 {
2673         /* [in] LSA_HANDLE hnd */
2674         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2675                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2676
2677         /* [in] TRUSTED_INFORMATION_CLASS level */
2678         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2679                 hf_lsa_trusted_info_level, NULL);
2680
2681         return offset;
2682 }
2683
2684
2685 static int
2686 lsa_dissect_lsarqueryinfotrusteddomain_reply(tvbuff_t *tvb, int offset,
2687         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2688 {
2689         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info */
2690         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2691                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2692                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2693
2694         offset = dissect_ntstatus(
2695                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2696
2697         return offset;
2698 }
2699
2700 static int
2701 lsa_dissect_lsarsetinformationtrusteddomain_rqst(tvbuff_t *tvb, int offset,
2702         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2703 {
2704         /* [in] LSA_HANDLE hnd */
2705         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2706                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2707
2708         /* [in] TRUSTED_INFORMATION_CLASS level */
2709         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2710                 hf_lsa_trusted_info_level, NULL);
2711
2712         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info */
2713         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2714                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
2715                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
2716
2717         return offset;
2718 }
2719
2720
2721 static int
2722 lsa_dissect_lsarsetinformationtrusteddomain_reply(tvbuff_t *tvb, int offset,
2723         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2724 {
2725         offset = dissect_ntstatus(
2726                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2727
2728         return offset;
2729 }
2730
2731 static int
2732 lsa_dissect_lsaropensecret_rqst(tvbuff_t *tvb, int offset,
2733         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2734 {
2735         /* [in] LSA_HANDLE hnd_pol */
2736         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2737                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2738
2739         /* [in, ref] LSA_UNICODE_STRING *name */
2740         offset = dissect_ndr_counted_string_cb(
2741                 tvb, offset, pinfo, tree, drep, hf_lsa_name,
2742                 cb_wstr_postprocess,
2743                 GINT_TO_POINTER(CB_STR_COL_INFO | 1));
2744
2745         /* [in] ACCESS_MASK access */
2746         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
2747                 pinfo, tree, drep);
2748
2749         return offset;
2750 }
2751
2752
2753 static int
2754 lsa_dissect_lsaropensecret_reply(tvbuff_t *tvb, int offset,
2755         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2756 {
2757         /* [out] LSA_HANDLE *hnd */
2758         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2759                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2760
2761         offset = dissect_ntstatus(
2762                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2763
2764         return offset;
2765 }
2766
2767 static int
2768 lsa_dissect_lsarsetsecret_rqst(tvbuff_t *tvb, int offset,
2769         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2770 {
2771         /* [in] LSA_HANDLE hnd */
2772         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2773                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2774
2775         /* [in, unique] LSA_SECRET *new_val */
2776         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2777                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2778                 "LSA_SECRET pointer: new_val", -1);
2779
2780         /* [in, unique] LSA_SECRET *old_val */
2781         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2782                 lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
2783                 "LSA_SECRET pointer: old_val", -1);
2784
2785         return offset;
2786 }
2787
2788
2789 static int
2790 lsa_dissect_lsarsetsecret_reply(tvbuff_t *tvb, int offset,
2791         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2792 {
2793         offset = dissect_ntstatus(
2794                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2795
2796         return offset;
2797 }
2798
2799 static int
2800 lsa_dissect_lsarquerysecret_rqst(tvbuff_t *tvb, int offset,
2801         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2802 {
2803         /* [in] LSA_HANDLE hnd */
2804         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2805                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2806
2807         /* [in, out, unique] LSA_SECRET **curr_val */
2808         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2809                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2810                 "LSA_SECRET pointer: curr_val", -1);
2811
2812         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2813         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2814                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2815                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2816
2817         /* [in, out, unique] LSA_SECRET **old_val */
2818         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2819                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2820                 "LSA_SECRET pointer: old_val", -1);
2821
2822         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2823         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2824                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2825                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2826
2827         return offset;
2828 }
2829
2830
2831 static int
2832 lsa_dissect_lsarquerysecret_reply(tvbuff_t *tvb, int offset,
2833         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2834 {
2835         /* [in, out, unique] LSA_SECRET **curr_val */
2836         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2837                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2838                 "LSA_SECRET pointer: curr_val", -1);
2839
2840         /* [in, out, unique] LARGE_INTEGER *curr_mtime */
2841         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2842                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2843                 "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
2844
2845         /* [in, out, unique] LSA_SECRET **old_val */
2846         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2847                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
2848                 "LSA_SECRET pointer: old_val", -1);
2849
2850         /* [in, out, unique] LARGE_INTEGER *old_mtime */
2851         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2852                 lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
2853                 "NTIME pointer: old_mtime", hf_lsa_old_mtime);
2854
2855         offset = dissect_ntstatus(
2856                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2857
2858         return offset;
2859 }
2860
2861 static int
2862 lsa_dissect_lsardeleteobject_rqst(tvbuff_t *tvb, int offset,
2863         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2864 {
2865         /* [in] LSA_HANDLE hnd */
2866         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2867                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2868
2869         return offset;
2870 }
2871
2872
2873 static int
2874 lsa_dissect_lsardeleteobject_reply(tvbuff_t *tvb, int offset,
2875         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2876 {
2877         offset = dissect_ntstatus(
2878                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2879
2880         return offset;
2881 }
2882
2883 static int
2884 lsa_dissect_lsarenumerateaccountswithuserright_rqst(tvbuff_t *tvb, int offset,
2885         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2886 {
2887         /* [in] LSA_HANDLE hnd */
2888         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2889                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2890
2891         /* [in, unique] LSA_UNICODE_STRING *rights */
2892         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2893                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
2894                 "LSA_UNICODE_STRING pointer: rights", hf_lsa_rights);
2895
2896         return offset;
2897 }
2898
2899 static int
2900 lsa_dissect_lsarenumerateaccountswithuserright_reply(tvbuff_t *tvb, int offset,
2901         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2902 {
2903         /* [out, ref] LSA_UNICODE_STRING_ARRAY *accounts */
2904         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2905                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2906                 "Account pointer: names", hf_lsa_acct);
2907
2908         offset = dissect_ntstatus(
2909                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2910
2911         return offset;
2912 }
2913
2914 static int
2915 lsa_dissect_lsarenumerateaccountrights_rqst(tvbuff_t *tvb, int offset,
2916         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2917 {
2918         /* [in] LSA_HANDLE hnd */
2919         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2920                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2921
2922         /* [in, ref] SID *account */
2923         offset = dissect_ndr_nt_SID(tvb, offset,
2924                 pinfo, tree, drep, -1);
2925
2926         return offset;
2927 }
2928
2929
2930 static int
2931 lsa_dissect_lsarenumerateaccountrights_reply(tvbuff_t *tvb, int offset,
2932         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2933 {
2934         /* [out, ref] LSA_UNICODE_STRING_ARRAY *rights */
2935         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2936                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2937                 "Account pointer: rights", hf_lsa_rights);
2938
2939         offset = dissect_ntstatus(
2940                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2941
2942         return offset;
2943 }
2944
2945 static int
2946 lsa_dissect_lsaraddaccountrights_rqst(tvbuff_t *tvb, int offset,
2947         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2948 {
2949         /* [in] LSA_HANDLE hnd */
2950         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2951                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2952
2953         /* [in, ref] SID *account */
2954         offset = dissect_ndr_nt_SID(tvb, offset,
2955                 pinfo, tree, drep, -1);
2956
2957         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2958         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2959                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2960                 "Account pointer: rights", hf_lsa_rights);
2961
2962         return offset;
2963 }
2964
2965
2966 static int
2967 lsa_dissect_lsaraddaccountrights_reply(tvbuff_t *tvb, int offset,
2968         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2969 {
2970         offset = dissect_ntstatus(
2971                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
2972
2973         return offset;
2974 }
2975
2976 static int
2977 lsa_dissect_lsarremoveaccountrights_rqst(tvbuff_t *tvb, int offset,
2978         packet_info *pinfo, proto_tree *tree, guint8 *drep)
2979 {
2980         /* [in] LSA_HANDLE hnd */
2981         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
2982                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
2983
2984         /* [in, ref] SID *account */
2985         offset = dissect_ndr_nt_SID(tvb, offset,
2986                 pinfo, tree, drep, -1);
2987
2988         /* remove all */
2989         offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
2990                         hf_lsa_remove_all, NULL);
2991
2992         /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
2993         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2994                 lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
2995                 "Account pointer: rights", hf_lsa_rights);
2996
2997         return offset;
2998 }
2999
3000
3001 static int
3002 lsa_dissect_lsarremoveaccountrights_reply(tvbuff_t *tvb, int offset,
3003         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3004 {
3005         offset = dissect_ntstatus(
3006                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3007
3008         return offset;
3009 }
3010
3011
3012 static int
3013 lsa_dissect_lsarquerytrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3014         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3015 {
3016         /* [in] LSA_HANDLE handle */
3017         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3018                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3019
3020         /* [in, ref] LSA_UNICODE_STRING *name */
3021         /* domain */
3022         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3023                 hf_lsa_domain, 0);
3024
3025         /* [in] TRUSTED_INFORMATION_CLASS level */
3026         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3027                                      hf_lsa_trusted_info_level, NULL);
3028
3029         return offset;
3030 }
3031
3032
3033 static int
3034 lsa_dissect_lsarquerytrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3035         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3036 {
3037         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3038         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3039                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3040                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3041
3042         offset = dissect_ntstatus(
3043                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3044
3045         return offset;
3046 }
3047
3048
3049 static int
3050 lsa_dissect_lsarsettrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
3051         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3052 {
3053         /* [in] LSA_HANDLE handle */
3054         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3055                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3056
3057         /* [in, ref] LSA_UNICODE_STRING *name */
3058         /* domain */
3059         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3060                 hf_lsa_domain, 0);
3061
3062         /* [in] TRUSTED_INFORMATION_CLASS level */
3063         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3064                                      hf_lsa_trusted_info_level, NULL);
3065
3066         /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3067         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3068                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3069                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3070
3071         return offset;
3072 }
3073
3074
3075 static int
3076 lsa_dissect_lsarsettrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
3077         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3078 {
3079         offset = dissect_ntstatus(
3080                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3081
3082         return offset;
3083 }
3084
3085 static int
3086 lsa_dissect_lsarquerytrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3087         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3088 {
3089         /* [in] LSA_HANDLE handle */
3090         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3091                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3092
3093         /* [in, ref] SID *sid */
3094         offset = dissect_ndr_nt_SID(tvb, offset,
3095                 pinfo, tree, drep, -1);
3096
3097         /* [in] TRUSTED_INFORMATION_CLASS level */
3098         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3099                                      hf_lsa_trusted_info_level, NULL);
3100
3101         return offset;
3102 }
3103
3104 static int
3105 lsa_dissect_lsaropentrusteddomainbyname_rqst(tvbuff_t *tvb, int offset,
3106         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3107 {
3108         /* [in] LSA_HANDLE handle */
3109         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3110                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3111
3112         /* [in, ref] LSA_UNICODE_STRING *name */
3113         /* domain */
3114         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3115                 hf_lsa_domain, 0);
3116
3117         /* [in] ACCESS_MASK access */
3118         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3119                 pinfo, tree, drep);
3120
3121         return offset;
3122 }
3123
3124
3125 static int
3126 lsa_dissect_lsaropentrusteddomainbyname_reply(tvbuff_t *tvb, int offset,
3127         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3128 {
3129         /* [out] LSA_HANDLE handle */
3130         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3131                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3132
3133         offset = dissect_ntstatus(
3134                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3135
3136         return offset;
3137 }
3138
3139
3140
3141 static int
3142 lsa_dissect_lsarquerytrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3143         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3144 {
3145         /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3146         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3147                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3148                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3149
3150         offset = dissect_ntstatus(
3151                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3152
3153         return offset;
3154 }
3155
3156 static int
3157 lsa_dissect_lsarsettrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
3158         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3159 {
3160         /* [in] LSA_HANDLE handle */
3161         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3162                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3163
3164         /* [in, ref] SID *sid */
3165         offset = dissect_ndr_nt_SID(tvb, offset,
3166                 pinfo, tree, drep, -1);
3167
3168         /* [in] TRUSTED_INFORMATION_CLASS level */
3169         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3170                                      hf_lsa_trusted_info_level, NULL);
3171
3172         /* [ref, ref] TRUSTED_DOMAIN_INFORMATION *info) */
3173         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3174                 lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
3175                 "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
3176
3177         return offset;
3178 }
3179
3180
3181 static int
3182 lsa_dissect_lsarsettrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
3183         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3184 {
3185         offset = dissect_ntstatus(
3186                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3187
3188         return offset;
3189 }
3190
3191 static int
3192 lsa_dissect_lsarqueryinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3193         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3194 {
3195         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3196                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3197
3198         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3199                 hf_lsa_policy_information_class, NULL);
3200
3201         return offset;
3202 }
3203
3204 static int
3205 lsa_dissect_lsarqueryinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3206         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3207 {
3208         /* This is really a pointer to a pointer though the first level is REF
3209           so we just ignore that one */
3210         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3211                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
3212                 "POLICY_INFORMATION pointer: info", -1);
3213
3214         offset = dissect_ntstatus(
3215                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3216
3217         return offset;
3218 }
3219
3220 static int
3221 lsa_dissect_lsarsetinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
3222         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3223 {
3224         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3225                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3226
3227         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3228                 hf_lsa_policy_information_class, NULL);
3229
3230         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3231                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3232                 "POLICY_INFORMATION pointer: info", -1);
3233
3234         return offset;
3235 }
3236
3237 static int
3238 lsa_dissect_lsarsetinformationpolicy2_reply(tvbuff_t *tvb, int offset,
3239         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3240 {
3241         offset = dissect_ntstatus(
3242                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3243
3244         return offset;
3245 }
3246
3247 static int
3248 lsa_dissect_lsarquerydomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3249         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3250 {
3251         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3252                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3253
3254         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3255                 hf_lsa_policy_information_class, NULL);
3256
3257         return offset;
3258 }
3259
3260 static int
3261 lsa_dissect_lsarquerydomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3262         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3263 {
3264         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3265                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3266                 "POLICY_INFORMATION pointer: info", -1);
3267
3268         offset = dissect_ntstatus(
3269                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3270
3271         return offset;
3272 }
3273
3274 static int
3275 lsa_dissect_lsarsetdomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
3276         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3277 {
3278         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3279                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3280
3281         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3282                 hf_lsa_policy_information_class, NULL);
3283
3284         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3285                 lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
3286                 "POLICY_INFORMATION pointer: info", -1);
3287
3288         return offset;
3289 }
3290
3291 static int
3292 lsa_dissect_lsarsetdomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
3293         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3294 {
3295         offset = dissect_ntstatus(
3296                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3297
3298         return offset;
3299 }
3300
3301 static int
3302 lsa_dissect_lsarlookupnames2_rqst(tvbuff_t *tvb, int offset,
3303         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3304 {
3305         /* [in] LSA_HANDLE hnd */
3306         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3307                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3308
3309         /* [in] ULONG count */
3310         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3311                 hf_lsa_count, NULL);
3312
3313         /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
3314         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3315                 lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
3316                 "Account pointer: names", hf_lsa_acct);
3317
3318         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3319         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3320                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3321                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3322
3323         /* [in] USHORT level */
3324         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3325                 hf_lsa_info_level, NULL);
3326
3327         /* [in, out, ref] ULONG *num_mapped */
3328         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3329                 hf_lsa_num_mapped, NULL);
3330
3331         /* unknown */
3332         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3333                                      hf_lsa_unknown_long, NULL);
3334
3335         /* unknown */
3336         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3337                                      hf_lsa_unknown_long, NULL);
3338
3339         return offset;
3340 }
3341
3342
3343 static int
3344 lsa_dissect_lsarlookupnames2_reply(tvbuff_t *tvb, int offset,
3345         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3346 {
3347         /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
3348         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3349                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3350                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3351
3352         /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
3353         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3354                 lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
3355                 "LSA_TRANSLATED_SIDS pointer: rids", -1);
3356
3357         /* [in, out, ref] ULONG *num_mapped */
3358         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3359                 hf_lsa_num_mapped, NULL);
3360
3361         offset = dissect_ntstatus(
3362                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3363
3364         return offset;
3365 }
3366
3367
3368 static int
3369 lsa_dissect_lsarcreateaccount_rqst(tvbuff_t *tvb, int offset,
3370         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3371 {
3372         /* [in] LSA_HANDLE hnd */
3373         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3374                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3375
3376         offset = dissect_ndr_nt_SID(tvb, offset,
3377                 pinfo, tree, drep, -1);
3378
3379         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3380                 pinfo, tree, drep);
3381
3382         return offset;
3383 }
3384
3385 static int
3386 lsa_dissect_lsarcreateaccount_reply(tvbuff_t *tvb, int offset,
3387         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3388 {
3389         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3390                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3391
3392         offset = dissect_ntstatus(
3393                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3394
3395         return offset;
3396 }
3397
3398 static int
3399 lsa_dissect_lsarlookupprivilegedisplayname_rqst(tvbuff_t *tvb, int offset,
3400         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3401 {
3402         /* [in] LSA_HANDLE hnd */
3403         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3404                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3405
3406         /* [in, ref] LSA_UNICODE_STRING *name */
3407         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3408                 hf_lsa_privilege_name, 0);
3409
3410         /* [in, ref] long *size */
3411         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3412                 hf_lsa_privilege_display_name_size, NULL);
3413
3414         return offset;
3415 }
3416
3417
3418 static int
3419 lsa_dissect_lsarlookupprivilegedisplayname_reply(tvbuff_t *tvb, int offset,
3420         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3421 {
3422         /* [out, ref] LSA_UNICODE_STRING **disp_name */
3423         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3424                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3425                 "NAME pointer: ", hf_lsa_privilege_display_name);
3426
3427         /* [out, ref] long *size */
3428         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3429                 hf_lsa_privilege_display_name_size, NULL);
3430
3431         offset = dissect_ntstatus(
3432                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3433
3434         return offset;
3435 }
3436
3437 static int
3438 lsa_dissect_lsarstoreprivatedata_rqst(tvbuff_t *tvb, int offset,
3439         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3440 {
3441         /* [in] LSA_HANDLE hnd */
3442         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3443                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3444
3445         /* [in, ref] LSA_UNICODE_STRING *key */
3446         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3447                 hf_lsa_key, 0);
3448
3449         /* [in, unique] LSA_SECRET **data */
3450         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3451                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
3452                 "LSA_SECRET* pointer: data", -1);
3453
3454         return offset;
3455 }
3456
3457
3458 static int
3459 lsa_dissect_lsarstoreprivatedata_reply(tvbuff_t *tvb, int offset,
3460         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3461 {
3462         offset = dissect_ntstatus(
3463                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3464
3465         return offset;
3466 }
3467
3468 static int
3469 lsa_dissect_lsarretrieveprivatedata_rqst(tvbuff_t *tvb, int offset,
3470         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3471 {
3472         /* [in] LSA_HANDLE hnd */
3473         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3474                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3475
3476         /* [in, ref] LSA_UNICODE_STRING *key */
3477         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3478                 hf_lsa_key, 0);
3479
3480         /* [in, out, ref] LSA_SECRET **data */
3481         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3482                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3483                 "LSA_SECRET* pointer: data", -1);
3484
3485         return offset;
3486 }
3487
3488
3489 static int
3490 lsa_dissect_lsarretrieveprivatedata_reply(tvbuff_t *tvb, int offset,
3491         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3492 {
3493         /* [in, out, ref] LSA_SECRET **data */
3494         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3495                 lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
3496                 "LSA_SECRET* pointer: data", -1);
3497
3498         offset = dissect_ntstatus(
3499                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3500
3501         return offset;
3502 }
3503
3504 static int
3505 lsa_dissect_lsarclosetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3506         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3507 {
3508
3509         /* [in, out] LSA_HANDLE *tdHnd */
3510         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3511                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3512
3513         return offset;
3514 }
3515
3516
3517 static int
3518 lsa_dissect_lsarclosetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3519         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3520 {
3521
3522         /* [in, out] LSA_HANDLE *tdHnd */
3523         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3524                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3525
3526         offset = dissect_ntstatus(
3527                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3528
3529         return offset;
3530 }
3531
3532 static int
3533 lsa_dissect_LSA_TRANSLATED_NAME_EX(tvbuff_t *tvb, int offset,
3534         packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
3535 {
3536         proto_item *item=NULL;
3537         proto_tree *tree=NULL;
3538         int old_offset=offset;
3539
3540         if(parent_tree){
3541                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
3542                         "LSA_TRANSLATED_NAME:");
3543                 tree = proto_item_add_subtree(item, ett_lsa_translated_name);
3544         }
3545
3546         /* sid type */
3547         offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
3548                         hf_lsa_sid_type, NULL);
3549
3550         /* name */
3551         offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
3552                 hf_lsa_name, 0);
3553
3554         /* index */
3555         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3556                                      hf_lsa_index, NULL);
3557
3558         /* unknown */
3559         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3560                                      hf_lsa_unknown_long, NULL);
3561
3562         proto_item_set_len(item, offset-old_offset);
3563         return offset;
3564 }
3565
3566 static int
3567 lsa_dissect_LSA_TRANSLATED_NAME_EX_array(tvbuff_t *tvb, int offset,
3568         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3569 {
3570         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3571                 lsa_dissect_LSA_TRANSLATED_NAME_EX);
3572
3573         return offset;
3574 }
3575 static int
3576 lsa_dissect_LSA_TRANSLATED_NAMES_EX(tvbuff_t *tvb, int offset,
3577         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3578 {
3579         /* count */
3580         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3581                                      hf_lsa_count, NULL);
3582
3583         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3584                         lsa_dissect_LSA_TRANSLATED_NAME_EX_array, NDR_POINTER_UNIQUE,
3585                         "LSA_TRANSLATED_NAME_EX: pointer", -1);
3586
3587         return offset;
3588 }
3589
3590
3591 static int
3592 lsa_dissect_lsarlookupsids2_rqst(tvbuff_t *tvb, int offset,
3593         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3594 {
3595         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3596                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3597
3598         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3599                         dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
3600                         "PSID_ARRAY", -1);
3601
3602         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3603                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3604                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3605
3606         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3607                 hf_lsa_info_level, NULL);
3608
3609         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3610                 hf_lsa_num_mapped, NULL);
3611
3612         /* unknown */
3613         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3614                                      hf_lsa_unknown_long, NULL);
3615
3616         /* unknown */
3617         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3618                                      hf_lsa_unknown_long, NULL);
3619
3620         return offset;
3621 }
3622
3623 static int
3624 lsa_dissect_lsarlookupsids2_reply(tvbuff_t *tvb, int offset,
3625         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3626 {
3627         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3628                 lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
3629                 "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
3630
3631         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3632                 lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
3633                 "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
3634
3635         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3636                 hf_lsa_num_mapped, NULL);
3637
3638         offset = dissect_ntstatus(
3639                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3640
3641         return offset;
3642 }
3643
3644 static int
3645 lsa_dissect_lsargetusername_rqst(tvbuff_t *tvb, int offset,
3646         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3647 {
3648
3649         /* [in, unique, string] WCHAR *server */
3650         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3651                 dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
3652                 "Server:", hf_lsa_server);
3653
3654         /* [in, out, ref] LSA_UNICODE_STRING **user */
3655         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3656                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3657                 "ACCOUNT pointer: ", hf_lsa_acct);
3658
3659         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3660         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3661                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3662                 "DOMAIN pointer: ", hf_lsa_domain);
3663
3664         return offset;
3665 }
3666
3667
3668 static int
3669 lsa_dissect_lsargetusername_reply(tvbuff_t *tvb, int offset,
3670         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3671 {
3672         /* [in, out, ref] LSA_UNICODE_STRING **user */
3673         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3674                 lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3675                 "ACCOUNT pointer: ", hf_lsa_acct);
3676
3677         /* [in, out, unique] LSA_UNICODE_STRING **domain */
3678         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3679                 lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
3680                 "DOMAIN pointer: ", hf_lsa_domain);
3681
3682         offset = dissect_ntstatus(
3683                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3684
3685         return offset;
3686 }
3687
3688 static int
3689 lsa_dissect_lsarcreatetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
3690         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3691 {
3692         /* [in] LSA_HANDLE hnd */
3693         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3694                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3695
3696         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3697         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3698                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3699                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3700
3701         /* [in, ref] TRUSTED_DOMAIN_AUTH_INFORMATION *auth */
3702         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3703                 lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION, NDR_POINTER_REF,
3704                 "TRUSTED_DOMAIN_AUTH_INFORMATION pointer: auth", -1);
3705
3706         /* [in] ACCESS_MASK mask */
3707         offset = lsa_dissect_ACCESS_MASK(tvb, offset,
3708                 pinfo, tree, drep);
3709
3710         return offset;
3711 }
3712
3713
3714 static int
3715 lsa_dissect_lsarcreatetrusteddomainex_reply(tvbuff_t *tvb, int offset,
3716         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3717 {
3718         /* [out] LSA_HANDLE *tdHnd) */
3719         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3720                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3721
3722         offset = dissect_ntstatus(
3723                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3724
3725         return offset;
3726 }
3727
3728 static int
3729 lsa_dissect_lsarenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset,
3730         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3731 {
3732         /* [in] LSA_HANDLE hnd */
3733         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3734                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3735
3736         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3737         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3738                 hf_lsa_resume_handle, NULL);
3739
3740         /* [in] ULONG pref_maxlen */
3741         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3742                 hf_lsa_max_count, NULL);
3743
3744         return offset;
3745 }
3746
3747
3748 static int
3749 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array(tvbuff_t *tvb, int offset,
3750         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3751 {
3752         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3753                 lsa_dissect_LSA_TRUST_INFORMATION_EX);
3754
3755         return offset;
3756 }
3757
3758 static int
3759 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX(tvbuff_t *tvb, int offset,
3760         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3761 {
3762         /* count */
3763         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3764                                      hf_lsa_count, NULL);
3765
3766         /* trust information */
3767         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3768                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array, NDR_POINTER_UNIQUE,
3769                 "TRUST INFORMATION array:", -1);
3770
3771         /* max count */
3772         /* The original code here was wrong. It now handles these correctly */
3773         /*offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
3774                                      hf_lsa_max_count, NULL);
3775         */
3776
3777         return offset;
3778 }
3779
3780 static int
3781 lsa_dissect_lsarenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset,
3782         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3783 {
3784         /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
3785         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3786                 hf_lsa_resume_handle, NULL);
3787
3788         /* [out, ref] TRUSTED_DOMAIN_INFORMATION_LIST_EX *domains */
3789         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3790                 lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX, NDR_POINTER_REF,
3791                 "TRUSTED_DOMAIN_INFORMATION_LIST_EX pointer: domains", -1);
3792
3793         offset = dissect_ntstatus(
3794                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3795
3796         return offset;
3797 }
3798
3799 static int
3800 lsa_dissect_lsartestcall_rqst(tvbuff_t *tvb, int offset,
3801         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3802 {
3803         /* [in] LSA_HANDLE handle */
3804         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3805                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3806
3807         /* [in] USHORT flag */
3808         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3809                 hf_lsa_unknown_short, NULL);
3810
3811         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3812         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3813                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3814                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3815
3816         return offset;
3817 }
3818
3819
3820 static int
3821 lsa_dissect_lsartestcall_reply(tvbuff_t *tvb, int offset,
3822         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3823 {
3824         /* [out, ref] LSA_SECURITY_DESCRIPTOR **psd) */
3825         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3826                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
3827                 "LSA_SECURITY_DESCRIPTOR pointer: psd)", -1);
3828
3829         offset = dissect_ntstatus(
3830                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3831
3832         return offset;
3833 }
3834
3835 static int
3836 lsa_dissect_lsarcreatetrusteddomainex2_rqst(tvbuff_t *tvb, int offset,
3837         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3838 {
3839         /* [in] LSA_HANDLE hnd */
3840         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3841                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3842
3843         /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
3844         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3845                 lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
3846                 "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
3847
3848         /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
3849         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3850                 lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
3851                 "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
3852
3853         /* [in] ULONG unknown */
3854         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3855                 hf_lsa_unknown_long, NULL);
3856
3857         return offset;
3858 }
3859
3860
3861 static int
3862 lsa_dissect_lsarcreatetrusteddomainex2_reply(tvbuff_t *tvb, int offset,
3863         packet_info *pinfo, proto_tree *tree, guint8 *drep)
3864 {
3865         /* [out] LSA_HANDLE *h2) */
3866         offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
3867                         hf_lsa_hnd, NULL, NULL, FALSE, FALSE);
3868
3869         offset = dissect_ntstatus(
3870                 tvb, offset, pinfo, tree, drep, hf_lsa_rc, NULL);
3871
3872         return offset;
3873 }
3874
3875
3876 static dcerpc_sub_dissector dcerpc_lsa_dissectors[] = {
3877         { LSA_LSARCLOSE, "LsarClose",
3878                 lsa_dissect_lsarclose_rqst,
3879                 lsa_dissect_lsarclose_reply },
3880         { LSA_LSARDELETE, "LsarDelete",
3881                 lsa_dissect_lsardelete_rqst,
3882                 lsa_dissect_lsardelete_reply },
3883         { LSA_LSARENUMERATEPRIVILEGES, "LsarEnumeratePrivileges",
3884                 lsa_dissect_lsarenumerateprivileges_rqst,
3885                 lsa_dissect_lsarenumerateprivileges_reply },
3886         { LSA_LSARQUERYSECURITYOBJECT, "LsarQuerySecurityObject",
3887                 lsa_dissect_lsarquerysecurityobject_rqst,
3888                 lsa_dissect_lsarquerysecurityobject_reply },
3889         { LSA_LSARSETSECURITYOBJECT, "LsarSetSecurityObject",
3890                 lsa_dissect_lsarsetsecurityobject_rqst,
3891                 lsa_dissect_lsarsetsecurityobject_reply },
3892         { LSA_LSARCHANGEPASSWORD, "LsarChangePassword",
3893                 lsa_dissect_lsarchangepassword_rqst,
3894                 lsa_dissect_lsarchangepassword_reply },
3895         { LSA_LSAROPENPOLICY, "LsarOpenPolicy",
3896                 lsa_dissect_lsaropenpolicy_rqst,
3897                 lsa_dissect_lsaropenpolicy_reply },
3898         { LSA_LSARQUERYINFORMATIONPOLICY, "LsarQueryInformationPolicy",
3899                 lsa_dissect_lsarqueryinformationpolicy_rqst,
3900                 lsa_dissect_lsarqueryinformationpolicy_reply },
3901         { LSA_LSARSETINFORMATIONPOLICY, "LsarSetInformationPolicy",
3902                 lsa_dissect_lsarsetinformationpolicy_rqst,
3903                 lsa_dissect_lsarsetinformationpolicy_reply },
3904         { LSA_LSARCLEARAUDITLOG, "LsarClearAuditLog",
3905                 lsa_dissect_lsarclearauditlog_rqst,
3906                 lsa_dissect_lsarclearauditlog_reply },
3907         { LSA_LSARCREATEACCOUNT, "LsarCreateAccount",
3908                 lsa_dissect_lsarcreateaccount_rqst,
3909                 lsa_dissect_lsarcreateaccount_reply },
3910         { LSA_LSARENUMERATEACCOUNTS, "LsarEnumerateAccounts",
3911                 lsa_dissect_lsarenumerateaccounts_rqst,
3912                 lsa_dissect_lsarenumerateaccounts_reply },
3913         { LSA_LSARCREATETRUSTEDDOMAIN, "LsarCreateTrustedDomain",
3914                 lsa_dissect_lsarcreatetrusteddomain_rqst,
3915                 lsa_dissect_lsarcreatetrusteddomain_reply },
3916         { LSA_LSARENUMERATETRUSTEDDOMAINS, "LsarEnumerateTrustedDomains",
3917                 lsa_dissect_lsarenumeratetrusteddomains_rqst,
3918                 lsa_dissect_lsarenumeratetrusteddomains_reply },
3919         { LSA_LSARLOOKUPNAMES, "LsarLookupNames",
3920                 lsa_dissect_lsarlookupnames_rqst,
3921                 lsa_dissect_lsarlookupnames_reply },
3922         { LSA_LSARLOOKUPSIDS, "LsarLookupSids",
3923                 lsa_dissect_lsarlookupsids_rqst,
3924                 lsa_dissect_lsarlookupsids_reply },
3925         { LSA_LSARCREATESECRET, "LsarCreateSecret",
3926                 lsa_dissect_lsarcreatesecret_rqst,
3927                 lsa_dissect_lsarcreatesecret_reply },
3928         { LSA_LSAROPENACCOUNT, "LsarOpenAccount",
3929                 lsa_dissect_lsaropenaccount_rqst,
3930                 lsa_dissect_lsaropenaccount_reply },
3931         { LSA_LSARENUMERATEPRIVILEGESACCOUNT, "LsarEnumeratePrivilegesAccount",
3932                 lsa_dissect_lsarenumerateprivilegesaccount_rqst,
3933                 lsa_dissect_lsarenumerateprivilegesaccount_reply },
3934         { LSA_LSARADDPRIVILEGESTOACCOUNT, "LsarAddPrivilegesToAccount",
3935                 lsa_dissect_lsaraddprivilegestoaccount_rqst,
3936                 lsa_dissect_lsaraddprivilegestoaccount_reply },
3937         { LSA_LSARREMOVEPRIVILEGESFROMACCOUNT, "LsarRemovePrivilegesFromAccount",
3938                 lsa_dissect_lsarremoveprivilegesfromaccount_rqst,
3939                 lsa_dissect_lsarremoveprivilegesfromaccount_reply },
3940         { LSA_LSARGETQUOTASFORACCOUNT, "LsarGetQuotasForAccount",
3941                 lsa_dissect_lsargetquotasforaccount_rqst,
3942                 lsa_dissect_lsargetquotasforaccount_reply },
3943         { LSA_LSARSETQUOTASFORACCOUNT, "LsarSetQuotasForAccount",
3944                 lsa_dissect_lsarsetquotasforaccount_rqst,
3945                 lsa_dissect_lsarsetquotasforaccount_reply },
3946         { LSA_LSARGETSYSTEMACCESSACCOUNT, "LsarGetSystemAccessAccount",
3947                 lsa_dissect_lsargetsystemaccessaccount_rqst,
3948                 lsa_dissect_lsargetsystemaccessaccount_reply },
3949         { LSA_LSARSETSYSTEMACCESSACCOUNT, "LsarSetSystemAccessAccount",
3950                 lsa_dissect_lsarsetsystemaccessaccount_rqst,
3951                 lsa_dissect_lsarsetsystemaccessaccount_reply },
3952         { LSA_LSAROPENTRUSTEDDOMAIN, "LsarOpenTrustedDomain",
3953                 lsa_dissect_lsaropentrusteddomain_rqst,
3954                 lsa_dissect_lsaropentrusteddomain_reply },
3955         { LSA_LSARQUERYINFOTRUSTEDDOMAIN, "LsarQueryInfoTrustedDomain",
3956                 lsa_dissect_lsarqueryinfotrusteddomain_rqst,
3957                 lsa_dissect_lsarqueryinfotrusteddomain_reply },
3958         { LSA_LSARSETINFORMATIONTRUSTEDDOMAIN, "LsarSetInformationTrustedDomain",
3959                 lsa_dissect_lsarsetinformationtrusteddomain_rqst,
3960                 lsa_dissect_lsarsetinformationtrusteddomain_reply },
3961         { LSA_LSAROPENSECRET, "LsarOpenSecret",
3962                 lsa_dissect_lsaropensecret_rqst,
3963                 lsa_dissect_lsaropensecret_reply },
3964         { LSA_LSARSETSECRET, "LsarSetSecret",
3965                 lsa_dissect_lsarsetsecret_rqst,
3966                 lsa_dissect_lsarsetsecret_reply },
3967         { LSA_LSARQUERYSECRET, "LsarQuerySecret",
3968                 lsa_dissect_lsarquerysecret_rqst,
3969                 lsa_dissect_lsarquerysecret_reply },
3970         { LSA_LSARLOOKUPPRIVILEGEVALUE, "LsarLookupPrivilegeValue",
3971                 lsa_dissect_lsarlookupprivilegevalue_rqst,
3972                 lsa_dissect_lsarlookupprivilegevalue_reply },
3973         { LSA_LSARLOOKUPPRIVILEGENAME, "LsarLookupPrivilegeName",
3974                 lsa_dissect_lsarlookupprivilegename_rqst,
3975                 lsa_dissect_lsarlookupprivilegename_reply },
3976         { LSA_LSARLOOKUPPRIVILEGEDISPLAYNAME, "LsarLookupPrivilegeDisplayName",
3977                 lsa_dissect_lsarlookupprivilegedisplayname_rqst,
3978                 lsa_dissect_lsarlookupprivilegedisplayname_reply },
3979         { LSA_LSARDELETEOBJECT, "LsarDeleteObject",
3980                 lsa_dissect_lsardeleteobject_rqst,
3981                 lsa_dissect_lsardeleteobject_reply },
3982         { LSA_LSARENUMERATEACCOUNTSWITHUSERRIGHT, "LsarEnumerateAccountsWithUserRight",
3983                 lsa_dissect_lsarenumerateaccountswithuserright_rqst,
3984                 lsa_dissect_lsarenumerateaccountswithuserright_reply },
3985         { LSA_LSARENUMERATEACCOUNTRIGHTS, "LsarEnumerateAccountRights",
3986                 lsa_dissect_lsarenumerateaccountrights_rqst,
3987                 lsa_dissect_lsarenumerateaccountrights_reply },
3988         { LSA_LSARADDACCOUNTRIGHTS, "LsarAddAccountRights",
3989                 lsa_dissect_lsaraddaccountrights_rqst,
3990                 lsa_dissect_lsaraddaccountrights_reply },
3991         { LSA_LSARREMOVEACCOUNTRIGHTS, "LsarRemoveAccountRights",
3992                 lsa_dissect_lsarremoveaccountrights_rqst,
3993                 lsa_dissect_lsarremoveaccountrights_reply },
3994         { LSA_LSARQUERYTRUSTEDDOMAININFO, "LsarQueryTrustedDomainInfo",
3995                 lsa_dissect_lsarquerytrusteddomaininfo_rqst,
3996                 lsa_dissect_lsarquerytrusteddomaininfo_reply },
3997         { LSA_LSARSETTRUSTEDDOMAININFO, "LsarSetTrustedDomainInfo",
3998                 lsa_dissect_lsarsettrusteddomaininfo_rqst,
3999                 lsa_dissect_lsarsettrusteddomaininfo_reply },
4000         { LSA_LSARDELETETRUSTEDDOMAIN, "LsarDeleteTrustedDomain",
4001                 lsa_dissect_lsardeletetrusteddomain_rqst,
4002                 lsa_dissect_lsardeletetrusteddomain_reply },
4003         { LSA_LSARSTOREPRIVATEDATA, "LsarStorePrivateData",
4004                 lsa_dissect_lsarstoreprivatedata_rqst,
4005                 lsa_dissect_lsarstoreprivatedata_reply },
4006         { LSA_LSARRETRIEVEPRIVATEDATA, "LsarRetrievePrivateData",
4007                 lsa_dissect_lsarretrieveprivatedata_rqst,
4008                 lsa_dissect_lsarretrieveprivatedata_reply },
4009         { LSA_LSAROPENPOLICY2, "LsarOpenPolicy2",
4010                 lsa_dissect_lsaropenpolicy2_rqst,
4011                 lsa_dissect_lsaropenpolicy2_reply },
4012         { LSA_LSARGETUSERNAME, "LsarGetUserName",
4013                 lsa_dissect_lsargetusername_rqst,
4014                 lsa_dissect_lsargetusername_reply },
4015         { LSA_LSARQUERYINFORMATIONPOLICY2, "LsarQueryInformationPolicy2",
4016                 lsa_dissect_lsarqueryinformationpolicy2_rqst,
4017                 lsa_dissect_lsarqueryinformationpolicy2_reply },
4018         { LSA_LSARSETINFORMATIONPOLICY2, "LsarSetInformationPolicy2",
4019                 lsa_dissect_lsarsetinformationpolicy2_rqst,
4020                 lsa_dissect_lsarsetinformationpolicy2_reply },
4021         { LSA_LSARQUERYTRUSTEDDOMAININFOBYNAME, "LsarQueryTrustedDomainInfoByName",
4022                 lsa_dissect_lsarquerytrusteddomaininfobyname_rqst,
4023                 lsa_dissect_lsarquerytrusteddomaininfobyname_reply },
4024         { LSA_LSARSETTRUSTEDDOMAININFOBYNAME, "LsarSetTrustedDomainInfoByName",
4025                 lsa_dissect_lsarsettrusteddomaininfobyname_rqst,
4026                 lsa_dissect_lsarsettrusteddomaininfobyname_reply },
4027         { LSA_LSARENUMERATETRUSTEDDOMAINSEX, "LsarEnumerateTrustedDomainsEx",
4028                 lsa_dissect_lsarenumeratetrusteddomainsex_rqst,
4029                 lsa_dissect_lsarenumeratetrusteddomainsex_reply },
4030         { LSA_LSARCREATETRUSTEDDOMAINEX, "LsarCreateTrustedDomainEx",
4031                 lsa_dissect_lsarcreatetrusteddomainex_rqst,
4032                 lsa_dissect_lsarcreatetrusteddomainex_reply },
4033         { LSA_LSARCLOSETRUSTEDDOMAINEX, "LsarCloseTrustedDomainEx",
4034                 lsa_dissect_lsarclosetrusteddomainex_rqst,
4035                 lsa_dissect_lsarclosetrusteddomainex_reply },
4036         { LSA_LSARQUERYDOMAININFORMATIONPOLICY, "LsarQueryDomainInformationPolicy",
4037                 lsa_dissect_lsarquerydomaininformationpolicy_rqst,
4038                 lsa_dissect_lsarquerydomaininformationpolicy_reply },
4039         { LSA_LSARSETDOMAININFORMATIONPOLICY, "LsarSetDomainInformationPolicy",
4040                 lsa_dissect_lsarsetdomaininformationpolicy_rqst,
4041                 lsa_dissect_lsarsetdomaininformationpolicy_reply },
4042         { LSA_LSAROPENTRUSTEDDOMAINBYNAME, "LsarOpenTrustedDomainByName",
4043                 lsa_dissect_lsaropentrusteddomainbyname_rqst,
4044                 lsa_dissect_lsaropentrusteddomainbyname_reply },
4045         { LSA_LSARTESTCALL, "LsarTestCall",
4046                 lsa_dissect_lsartestcall_rqst,
4047                 lsa_dissect_lsartestcall_reply },
4048         { LSA_LSARLOOKUPSIDS2, "LsarLookupSids2",
4049                 lsa_dissect_lsarlookupsids2_rqst,
4050                 lsa_dissect_lsarlookupsids2_reply },
4051         { LSA_LSARLOOKUPNAMES2, "LsarLookupNames2",
4052                 lsa_dissect_lsarlookupnames2_rqst,
4053                 lsa_dissect_lsarlookupnames2_reply },
4054         { LSA_LSARCREATETRUSTEDDOMAINEX2, "LsarCreateTrustedDomainEx2",
4055                 lsa_dissect_lsarcreatetrusteddomainex2_rqst,
4056                 lsa_dissect_lsarcreatetrusteddomainex2_reply },
4057         { LSA_CREDRWRITE, "CredrWrite", NULL, NULL },
4058         { LSA_CREDRREAD, "CredrRead", NULL, NULL },
4059         { LSA_CREDRENUMERATE, "CredrEnumerate", NULL, NULL },
4060         { LSA_CREDRWRITEDOMAINCREDENTIALS, "CredrWriteDomainCredentials",
4061           NULL, NULL },
4062         { LSA_CREDRREADDOMAINCREDENTIALS, "CredrReadDomainCredentials",
4063           NULL, NULL },
4064         { LSA_CREDRDELETE, "CredrDelete", NULL, NULL },
4065         { LSA_CREDRGETTARGETINFO, "CredrGetTargetInfo", NULL, NULL },
4066         { LSA_CREDRPROFILELOADED, "CredrProfileLoaded", NULL, NULL },
4067         { LSA_LSARLOOKUPNAMES3, "LsarLookupNames3", NULL, NULL },
4068         { LSA_CREDRGETSESSIONTYPES, "CredrGetSessionTypes", NULL, NULL },
4069         { LSA_LSARREGISTERAUDITEVENT, "LsarRegisterAuditEvent", NULL, NULL },
4070         { LSA_LSARGENAUDITEVENT, "LsarGenAuditEvent", NULL, NULL },
4071         { LSA_LSARUNREGISTERAUDITEVENT, "LsarUnregisterAuditEvent", NULL, NULL},
4072         { LSA_LSARQUERYFORESTTRUSTINFORMATION,
4073           "LsarQueryForestTrustInformation", NULL, NULL },
4074         { LSA_LSARSETFORESTTRUSTINFORMATION, "LsarSetForestTrustInformation",
4075           NULL, NULL },
4076         { LSA_CREDRRENAME, "CredrRename", NULL, NULL },
4077         { LSA_LSARLOOKUPSIDS3, "LsarLookupSids3", NULL, NULL },
4078         { LSA_LSARLOOKUPNAMES4, "LsarLookupNames4", NULL, NULL },
4079         { LSA_LSAROPENPOLICYSCE, "LsarOpenPolicySce", NULL, NULL },
4080         { LSA_LSARADTREGISTERSECURITYEVENTSOURCE,
4081             "LsarAdtRegisterSecurityEventSource", NULL, NULL },
4082         { LSA_LSARADTUNREGISTERSECURITYEVENTSOURCE,
4083            "LsarAdtUnregisterSecurityEventSource", NULL, NULL },
4084         { LSA_LSARADTREPORTSECURITYEVENT, "LsarAdtReportSecurityEvent",
4085           NULL, NULL },
4086         {0, NULL, NULL, NULL}
4087 };
4088
4089 void
4090 proto_register_dcerpc_lsa(void)
4091 {
4092         static hf_register_info hf[] = {
4093
4094         { &hf_lsa_opnum,
4095           { "Operation", "lsa.opnum", FT_UINT16, BASE_DEC, NULL, 0x0, "Operation", HFILL }},
4096
4097         { &hf_lsa_unknown_string,
4098                 { "Unknown string", "lsa.unknown_string", FT_STRING, BASE_NONE,
4099                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
4100
4101         { &hf_lsa_hnd,
4102                 { "Context Handle", "lsa.hnd", FT_BYTES, BASE_NONE,
4103                 NULL, 0x0, "LSA policy handle", HFILL }},
4104
4105         { &hf_lsa_server,
4106                 { "Server", "lsa.server", FT_STRING, BASE_NONE,
4107                 NULL, 0, "Name of Server", HFILL }},
4108
4109         { &hf_lsa_controller,
4110                 { "Controller", "lsa.controller", FT_STRING, BASE_NONE,
4111                 NULL, 0, "Name of Domain Controller", HFILL }},
4112
4113         { &hf_lsa_unknown_hyper,
4114                 { "Unknown hyper", "lsa.unknown.hyper", FT_UINT64, BASE_HEX,
4115                 NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
4116
4117         { &hf_lsa_unknown_long,
4118                 { "Unknown long", "lsa.unknown.long", FT_UINT32, BASE_HEX,
4119                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
4120
4121         { &hf_lsa_unknown_short,
4122                 { "Unknown short", "lsa.unknown.short", FT_UINT16, BASE_HEX,
4123                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
4124
4125         { &hf_lsa_unknown_char,
4126                 { "Unknown char", "lsa.unknown.char", FT_UINT8, BASE_HEX,
4127                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
4128
4129         { &hf_lsa_rc,
4130                 { "Return code", "lsa.rc", FT_UINT32, BASE_HEX,
4131                 VALS (NT_errors), 0x0, "LSA return status code", HFILL }},
4132
4133         { &hf_lsa_obj_attr,
4134                 { "Attributes", "lsa.obj_attr", FT_UINT32, BASE_HEX,
4135                 NULL, 0x0, "LSA Attributes", HFILL }},
4136
4137         { &hf_lsa_obj_attr_len,
4138                 { "Length", "lsa.obj_attr.len", FT_UINT32, BASE_DEC,
4139                 NULL, 0x0, "Length of object attribute structure", HFILL }},
4140
4141         { &hf_lsa_obj_attr_name,
4142                 { "Name", "lsa.obj_attr.name", FT_STRING, BASE_NONE,
4143                 NULL, 0x0, "Name of object attribute", HFILL }},
4144
4145         { &hf_lsa_access_mask,
4146                 { "Access Mask", "lsa.access_mask", FT_UINT32, BASE_HEX,
4147                 NULL, 0x0, "LSA Access Mask", HFILL }},
4148
4149         { &hf_lsa_info_level,
4150                 { "Level", "lsa.info.level", FT_UINT16, BASE_DEC,
4151                 NULL, 0x0, "Information level of requested data", HFILL }},
4152
4153         { &hf_lsa_trusted_info_level,
4154                 { "Info Level", "lsa.trusted.info_level", FT_UINT16, BASE_DEC,
4155                 VALS(trusted_info_level_vals), 0x0, "Information level of requested Trusted Domain Information", HFILL }},
4156
4157         { &hf_lsa_sd_size,
4158                 { "Size", "lsa.sd_size", FT_UINT32, BASE_DEC,
4159                 NULL, 0x0, "Size of lsa security descriptor", HFILL }},
4160
4161         { &hf_lsa_qos_len,
4162                 { "Length", "lsa.qos.len", FT_UINT32, BASE_DEC,
4163                 NULL, 0x0, "Length of quality of service structure", HFILL }},
4164
4165         { &hf_lsa_qos_impersonation_level,
4166                 { "Impersonation level", "lsa.qos.imp_lev", FT_UINT16, BASE_DEC,
4167                 VALS(lsa_impersonation_level_vals), 0x0, "QOS Impersonation Level", HFILL }},
4168
4169         { &hf_lsa_qos_track_context,
4170                 { "Context Tracking", "lsa.qos.track_ctx", FT_UINT8, BASE_DEC,
4171                 NULL, 0x0, "QOS Context Tracking Mode", HFILL }},
4172
4173         { &hf_lsa_qos_effective_only,
4174                 { "Effective only", "lsa.qos.effective_only", FT_UINT8, BASE_DEC,
4175                 NULL, 0x0, "QOS Flag whether this is Effective Only or not", HFILL }},
4176
4177         { &hf_lsa_pali_percent_full,
4178                 { "Percent Full", "lsa.pali.percent_full", FT_UINT32, BASE_DEC,
4179                 NULL, 0x0, "How full audit log is in percentage", HFILL }},
4180
4181         { &hf_lsa_pali_log_size,
4182                 { "Log Size", "lsa.pali.log_size", FT_UINT32, BASE_DEC,
4183                 NULL, 0x0, "Size of audit log", HFILL }},
4184
4185         { &hf_lsa_pali_retention_period,
4186                 { "Retention Period", "lsa.pali.retention_period", FT_RELATIVE_TIME, BASE_NONE,
4187                 NULL, 0x0, "", HFILL }},
4188
4189         { &hf_lsa_pali_time_to_shutdown,
4190                 { "Time to shutdown", "lsa.pali.time_to_shutdown", FT_RELATIVE_TIME, BASE_NONE,
4191                 NULL, 0x0, "Time to shutdown", HFILL }},
4192
4193         { &hf_lsa_pali_shutdown_in_progress,
4194                 { "Shutdown in progress", "lsa.pali.shutdown_in_progress", FT_UINT8, BASE_DEC,
4195                 NULL, 0x0, "Flag whether shutdown is in progress or not", HFILL }},
4196
4197         { &hf_lsa_pali_next_audit_record,
4198                 { "Next Audit Record", "lsa.pali.next_audit_record", FT_UINT32, BASE_HEX,
4199                 NULL, 0x0, "Next audit record", HFILL }},
4200
4201         { &hf_lsa_paei_enabled,
4202                 { "Enabled", "lsa.paei.enabled", FT_UINT8, BASE_DEC,
4203                 NULL, 0x0, "If Audit Events Information is Enabled or not", HFILL }},
4204
4205         { &hf_lsa_paei_settings,
4206                 { "Settings", "lsa.paei.settings", FT_UINT32, BASE_HEX,
4207                 NULL, 0x0, "Audit Events Information settings", HFILL }},
4208
4209         { &hf_lsa_count,
4210                 { "Count", "lsa.count", FT_UINT32, BASE_DEC,
4211                 NULL, 0x0, "Count of objects", HFILL }},
4212
4213         { &hf_lsa_max_count,
4214                 { "Max Count", "lsa.max_count", FT_UINT32, BASE_DEC,
4215                 NULL, 0x0, "", HFILL }},
4216
4217         { &hf_lsa_fqdomain,
4218                 { "FQDN", "lsa.fqdn_domain", FT_STRING, BASE_NONE,
4219                 NULL, 0x0, "Fully Qualified Domain Name", HFILL }},
4220
4221         { &hf_lsa_domain,
4222                 { "Domain", "lsa.domain", FT_STRING, BASE_NONE,
4223                 NULL, 0x0, "Domain", HFILL }},
4224
4225         { &hf_lsa_domain_sid,
4226                 { "Domain SID", "lsa.domain_sid", FT_STRING, BASE_NONE,
4227                 NULL, 0x0, "The Domain SID", HFILL }},
4228
4229         { &hf_lsa_acct,
4230                 { "Account", "lsa.acct", FT_STRING, BASE_NONE,
4231                 NULL, 0x0, "Account", HFILL }},
4232
4233         { &hf_lsa_source,
4234                 { "Source", "lsa.source", FT_STRING, BASE_NONE,
4235                 NULL, 0x0, "Replica Source", HFILL }},
4236
4237         { &hf_lsa_server_role,
4238                 { "Role", "lsa.server_role", FT_UINT16, BASE_DEC,
4239                 VALS(server_role_vals), 0x0, "LSA Server Role", HFILL }},
4240
4241         { &hf_lsa_quota_paged_pool,
4242                 { "Paged Pool", "lsa.quota.paged_pool", FT_UINT32, BASE_DEC,
4243                 NULL, 0x0, "Size of Quota Paged Pool", HFILL }},
4244
4245         { &hf_lsa_quota_non_paged_pool,
4246                 { "Non Paged Pool", "lsa.quota.non_paged_pool", FT_UINT32, BASE_DEC,
4247                 NULL, 0x0, "Size of Quota non-Paged Pool", HFILL }},
4248
4249         { &hf_lsa_quota_min_wss,
4250                 { "Min WSS", "lsa.quota.min_wss", FT_UINT32, BASE_DEC,
4251                 NULL, 0x0, "Size of Quota Min WSS", HFILL }},
4252
4253         { &hf_lsa_quota_max_wss,
4254                 { "Max WSS", "lsa.quota.max_wss", FT_UINT32, BASE_DEC,
4255                 NULL, 0x0, "Size of Quota Max WSS", HFILL }},
4256
4257         { &hf_lsa_quota_pagefile,
4258                 { "Pagefile", "lsa.quota.pagefile", FT_UINT32, BASE_DEC,
4259                 NULL, 0x0, "Size of quota pagefile usage", HFILL }},
4260
4261         { &hf_lsa_mod_seq_no,
4262                 { "Seq No", "lsa.mod.seq_no", FT_UINT64, BASE_DEC,
4263                 NULL, 0x0, "Sequence number for this modification", HFILL }},
4264
4265         { &hf_lsa_mod_mtime,
4266                 { "MTime", "lsa.mod.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4267                 NULL, 0x0, "Time when this modification occured", HFILL }},
4268
4269         { &hf_lsa_cur_mtime,
4270                 { "Current MTime", "lsa.cur.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4271                 NULL, 0x0, "Current MTime to set", HFILL }},
4272
4273         { &hf_lsa_old_mtime,
4274                 { "Old MTime", "lsa.old.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
4275                 NULL, 0x0, "Old MTime for this object", HFILL }},
4276
4277         { &hf_lsa_name,
4278                 { "Name", "lsa.name", FT_STRING, BASE_NONE,
4279                 NULL, 0x0, "", HFILL }},
4280
4281         { &hf_lsa_key,
4282                 { "Key", "lsa.key", FT_STRING, BASE_NONE,
4283                 NULL, 0x0, "", HFILL }},
4284
4285         { &hf_lsa_flat_name,
4286                 { "Flat Name", "lsa.flat_name", FT_STRING, BASE_NONE,
4287                 NULL, 0x0, "", HFILL }},
4288
4289         { &hf_lsa_forest,
4290                 { "Forest", "lsa.forest", FT_STRING, BASE_NONE,
4291                 NULL, 0x0, "", HFILL }},
4292
4293         { &hf_lsa_info_type,
4294                 { "Info Type", "lsa.info_type", FT_UINT32, BASE_DEC,
4295                 NULL, 0x0, "", HFILL }},
4296
4297         { &hf_lsa_new_pwd,
4298                 { "New Password", "lsa.new_pwd", FT_BYTES, BASE_HEX,
4299                 NULL, 0x0, "New password", HFILL }},
4300
4301         { &hf_lsa_old_pwd,
4302                 { "Old Password", "lsa.old_pwd", FT_BYTES, BASE_HEX,
4303                 NULL, 0x0, "Old password", HFILL }},
4304
4305         { &hf_lsa_sid_type,
4306                 { "SID Type", "lsa.sid_type", FT_UINT16, BASE_DEC,
4307                 VALS(sid_type_vals), 0x0, "Type of SID", HFILL }},
4308
4309         { &hf_lsa_rid,
4310                 { "RID", "lsa.rid", FT_UINT32, BASE_HEX,
4311                 NULL, 0x0, "RID", HFILL }},
4312
4313         { &hf_lsa_rid_offset,
4314                 { "RID Offset", "lsa.rid.offset", FT_UINT32, BASE_HEX,
4315                 NULL, 0x0, "RID Offset", HFILL }},
4316
4317         { &hf_lsa_index,
4318                 { "Index", "lsa.index", FT_UINT32, BASE_DEC,
4319                 NULL, 0x0, "", HFILL }},
4320
4321         { &hf_lsa_num_mapped,
4322                 { "Num Mapped", "lsa.num_mapped", FT_UINT32, BASE_DEC,
4323                 NULL, 0x0, "", HFILL }},
4324
4325         { &hf_lsa_policy_information_class,
4326                 { "Info Class", "lsa.policy.info", FT_UINT16, BASE_DEC,
4327                 VALS(policy_information_class_vals), 0x0, "Policy information class", HFILL }},
4328
4329         { &hf_lsa_secret,
4330                 { "LSA Secret", "lsa.secret", FT_BYTES, BASE_HEX,
4331                 NULL, 0, "", HFILL }},
4332
4333         { &hf_lsa_auth_blob,
4334                 { "Auth blob", "lsa.auth.blob", FT_BYTES, BASE_HEX,
4335                 NULL, 0, "", HFILL }},
4336
4337         { &hf_nt_luid_high,
4338                 { "High", "nt.luid.high", FT_UINT32, BASE_HEX,
4339                 NULL, 0x0, "LUID High component", HFILL }},
4340
4341         { &hf_nt_luid_low,
4342                 { "Low", "nt.luid.low", FT_UINT32, BASE_HEX,
4343                 NULL, 0x0, "LUID Low component", HFILL }},
4344
4345         { &hf_lsa_size,
4346                 { "Size", "lsa.size", FT_UINT32, BASE_DEC,
4347                 NULL, 0x0, "", HFILL }},
4348
4349         { &hf_lsa_size16,
4350                 { "Size", "lsa.size", FT_UINT16, BASE_DEC,
4351                 NULL, 0x0, "", HFILL }},
4352
4353         { &hf_lsa_privilege_display_name_size,
4354                 { "Size Needed", "lsa.privilege.display__name.size", FT_UINT32, BASE_DEC,
4355                 NULL, 0x0, "Number of characters in the privilege display name", HFILL }},
4356
4357         { &hf_lsa_privilege_name,
4358                 { "Name", "lsa.privilege.name", FT_STRING, BASE_NONE,
4359                 NULL, 0x0, "LSA Privilege Name", HFILL }},
4360
4361         { &hf_lsa_privilege_display_name,
4362                 { "Display Name", "lsa.privilege.display_name", FT_STRING, BASE_NONE,
4363                 NULL, 0x0, "LSA Privilege Display Name", HFILL }},
4364
4365         { &hf_lsa_rights,
4366                 { "Rights", "lsa.rights", FT_STRING, BASE_NONE,
4367                 NULL, 0x0, "Account Rights", HFILL }},
4368
4369         { &hf_lsa_policy_information,
4370                 { "POLICY INFO", "lsa.policy_information", FT_NONE, BASE_NONE,
4371                 NULL, 0x0, "Policy Information union", HFILL }},
4372
4373         { &hf_lsa_attr,
4374                 { "Attr", "lsa.attr", FT_UINT64, BASE_HEX,
4375                 NULL, 0x0, "LSA Attributes", HFILL }},
4376
4377         { &hf_lsa_auth_update,
4378                 { "Update", "lsa.auth.update", FT_UINT64, BASE_HEX,
4379                 NULL, 0x0, "LSA Auth Info update", HFILL }},
4380
4381         { &hf_lsa_resume_handle,
4382                 { "Resume Handle", "lsa.resume_handle", FT_UINT32, BASE_DEC,
4383                 NULL, 0x0, "Resume Handle", HFILL }},
4384
4385         { &hf_lsa_trust_direction,
4386                 { "Trust Direction", "lsa.trust.direction", FT_UINT32, BASE_DEC,
4387                 VALS(trusted_direction_vals), 0x0, "Trust direction", HFILL }},
4388
4389         { &hf_lsa_trust_type,
4390                 { "Trust Type", "lsa.trust.type", FT_UINT32, BASE_DEC,
4391                 VALS(trusted_type_vals), 0x0, "Trust type", HFILL }},
4392
4393         { &hf_lsa_trust_attr,
4394                 { "Trust Attr", "lsa.trust.attr", FT_UINT32, BASE_HEX,
4395                 NULL, 0x0, "Trust attributes", HFILL }},
4396
4397         { &hf_lsa_trust_attr_non_trans,
4398                 { "Non Transitive", "lsa.trust.attr.non_trans", FT_BOOLEAN, 32,
4399                 TFS(&tfs_trust_attr_non_trans), 0x00000001, "Non Transitive trust", HFILL }},
4400
4401         { &hf_lsa_trust_attr_uplevel_only,
4402                 { "Upleve only", "lsa.trust.attr.uplevel_only", FT_BOOLEAN, 32,
4403                 TFS(&tfs_trust_attr_uplevel_only), 0x00000002, "Uplevel only trust", HFILL }},
4404
4405         { &hf_lsa_trust_attr_tree_parent,
4406                 { "Tree Parent", "lsa.trust.attr.tree_parent", FT_BOOLEAN, 32,
4407                 TFS(&tfs_trust_attr_tree_parent), 0x00400000, "Tree Parent trust", HFILL }},
4408
4409         { &hf_lsa_trust_attr_tree_root,
4410                 { "Tree Root", "lsa.trust.attr.tree_root", FT_BOOLEAN, 32,
4411                 TFS(&tfs_trust_attr_tree_root), 0x00800000, "Tree Root trust", HFILL }},
4412
4413         { &hf_lsa_auth_type,
4414                 { "Auth Type", "lsa.auth.type", FT_UINT32, BASE_DEC,
4415                 NULL, 0x0, "Auth Info type", HFILL }},
4416
4417         { &hf_lsa_auth_len,
4418                 { "Auth Len", "lsa.auth.len", FT_UINT32, BASE_DEC,
4419                 NULL, 0x0, "Auth Info len", HFILL }},
4420
4421         { &hf_lsa_remove_all,
4422                 { "Remove All", "lsa.remove_all", FT_UINT8, BASE_DEC,
4423                 NULL, 0x0, "Flag whether all rights should be removed or only the specified ones", HFILL }},
4424
4425         { &hf_view_local_info,
4426                 { "View local info", "lsa.access_mask.view_local_info",
4427                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_LOCAL_INFORMATION,
4428                   "View local info", HFILL }},
4429
4430         { &hf_view_audit_info,
4431                 { "View audit info", "lsa.access_mask.view_audit_info",
4432                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_AUDIT_INFORMATION,
4433                   "View audit info", HFILL }},
4434
4435         { &hf_get_private_info,
4436                 { "Get private info", "lsa.access_mask.get_privateinfo",
4437                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_GET_PRIVATE_INFORMATION,
4438                   "Get private info", HFILL }},
4439
4440         { &hf_trust_admin,
4441                 { "Trust admin", "lsa.access_mask.trust_admin",
4442                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_TRUST_ADMIN,
4443                   "Trust admin", HFILL }},
4444
4445         { &hf_create_account,
4446                 { "Create account", "lsa.access_mask.create_account",
4447                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_ACCOUNT,
4448                   "Create account", HFILL }},
4449
4450         { &hf_create_secret,
4451                 { "Create secret", "lsa.access_mask.create_secret",
4452                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_SECRET,
4453                   "Create secret", HFILL }},
4454
4455         { &hf_create_priv,
4456                 { "Create privilege", "lsa.access_mask.create_priv",
4457                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_PRIVILEGE,
4458                   "Create privilege", HFILL }},
4459
4460         { &hf_set_default_quota_limits,
4461                 { "Set default quota limits", "lsa.access_mask.set_default_quota_limits",
4462                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_DEFAULT_QUOTA_LIMITS,
4463                   "Set default quota limits", HFILL }},
4464
4465         { &hf_set_audit_requirements,
4466                 { "Set audit requirements", "lsa.access_mask.set_audit_requirements",
4467                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_AUDIT_REQUIREMENTS,
4468                   "Set audit requirements", HFILL }},
4469
4470         { &hf_server_admin,
4471                 { "Server admin", "lsa.access_mask.server_admin",
4472                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SERVER_ADMIN,
4473                   "Server admin", HFILL }},
4474
4475         { &hf_lookup_names,
4476                 { "Lookup names", "lsa.access_mask.lookup_names",
4477                   FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_LOOKUP_NAMES,
4478                   "Lookup names", HFILL }}
4479 };
4480
4481         static gint *ett[] = {
4482                 &ett_dcerpc_lsa,
4483                 &ett_lsa_OBJECT_ATTRIBUTES,
4484                 &ett_LSA_SECURITY_DESCRIPTOR,
4485                 &ett_lsa_policy_info,
4486                 &ett_lsa_policy_audit_log_info,
4487                 &ett_lsa_policy_audit_events_info,
4488                 &ett_lsa_policy_primary_domain_info,
4489                 &ett_lsa_policy_primary_account_info,
4490                 &ett_lsa_policy_server_role_info,
4491                 &ett_lsa_policy_replica_source_info,
4492                 &ett_lsa_policy_default_quota_info,
4493                 &ett_lsa_policy_modification_info,
4494                 &ett_lsa_policy_audit_full_set_info,
4495                 &ett_lsa_policy_audit_full_query_info,
4496                 &ett_lsa_policy_dns_domain_info,
4497                 &ett_lsa_translated_names,
4498                 &ett_lsa_translated_name,
4499                 &ett_lsa_referenced_domain_list,
4500                 &ett_lsa_trust_information,
4501                 &ett_lsa_trust_information_ex,
4502                 &ett_LUID,
4503                 &ett_LSA_PRIVILEGES,
4504                 &ett_LSA_PRIVILEGE,
4505                 &ett_LSA_LUID_AND_ATTRIBUTES_ARRAY,
4506                 &ett_LSA_LUID_AND_ATTRIBUTES,
4507                 &ett_LSA_TRUSTED_DOMAIN_LIST,
4508                 &ett_LSA_TRUSTED_DOMAIN,
4509                 &ett_LSA_TRANSLATED_SIDS,
4510                 &ett_lsa_trusted_domain_info,
4511                 &ett_lsa_trust_attr,
4512                 &ett_lsa_trusted_domain_auth_information,
4513                 &ett_lsa_auth_information
4514         };
4515
4516         proto_dcerpc_lsa = proto_register_protocol(
4517                 "Microsoft Local Security Architecture", "LSA", "lsa");
4518
4519         proto_register_field_array (proto_dcerpc_lsa, hf, array_length (hf));
4520         proto_register_subtree_array(ett, array_length(ett));
4521 }
4522
4523 /* Protocol handoff */
4524
4525 static e_uuid_t uuid_dcerpc_lsa = {
4526         0x12345778, 0x1234, 0xabcd,
4527         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab}
4528 };
4529
4530 static guint16 ver_dcerpc_lsa = 0;
4531
4532 void
4533 proto_reg_handoff_dcerpc_lsa(void)
4534 {
4535         /* Register protocol as dcerpc */
4536
4537         dcerpc_init_uuid(proto_dcerpc_lsa, ett_dcerpc_lsa, &uuid_dcerpc_lsa,
4538                          ver_dcerpc_lsa, dcerpc_lsa_dissectors, hf_lsa_opnum);
4539 }