packet-dcerpc-netlogon.c

   1 /* packet-dcerpc-netlogon.c
   2  * Routines for SMB \\PIPE\\NETLOGON packet disassembly
   3  * Copyright 2001, Tim Potter <tpot@samba.org>
   4  *  2002 structure and command dissectors by Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-netlogon.c,v 1.11 2002/03/17 07:43:11 sahlberg Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-dcerpc.h"
  34 #include "packet-dcerpc-nt.h"
  35 #include "packet-dcerpc-netlogon.h"
  36 #include "smb.h"        /* for "NT_errors[]" */
  37 #include "packet-smb-common.h"
  38
  39 static int proto_dcerpc_netlogon = -1;
  40 static int hf_netlogon_rc = -1;
  41 static int hf_netlogon_len = -1;
  42 static int hf_netlogon_status = -1;
  43 static int hf_netlogon_attrs = -1;
  44 static int hf_netlogon_count = -1;
  45 static int hf_netlogon_level = -1;
  46 static int hf_netlogon_level_long = -1;
  47 static int hf_netlogon_unknown_time = -1;
  48 static int hf_netlogon_unknown_string = -1;
  49 static int hf_netlogon_unknown_long = -1;
  50 static int hf_netlogon_unknown_short = -1;
  51 static int hf_netlogon_unknown_char = -1;
  52 static int hf_netlogon_logon_time = -1;
  53 static int hf_netlogon_logoff_time = -1;
  54 static int hf_netlogon_kickoff_time = -1;
  55 static int hf_netlogon_pwd_last_set_time = -1;
  56 static int hf_netlogon_pwd_can_change_time = -1;
  57 static int hf_netlogon_pwd_must_change_time = -1;
  58 static int hf_netlogon_timestamp = -1;
  59 static int hf_netlogon_nt_chal_resp = -1;
  60 static int hf_netlogon_lm_chal_resp = -1;
  61 static int hf_netlogon_credential = -1;
  62 static int hf_netlogon_cypher_block = -1;
  63 static int hf_netlogon_acct_name = -1;
  64 static int hf_netlogon_acct_desc = -1;
  65 static int hf_netlogon_group_desc = -1;
  66 static int hf_netlogon_full_name = -1;
  67 static int hf_netlogon_comment = -1;
  68 static int hf_netlogon_parameters = -1;
  69 static int hf_netlogon_logon_script = -1;
  70 static int hf_netlogon_profile_path = -1;
  71 static int hf_netlogon_home_dir = -1;
  72 static int hf_netlogon_dir_drive = -1;
  73 static int hf_netlogon_logon_count = -1;
  74 static int hf_netlogon_bad_pw_count = -1;
  75 static int hf_netlogon_user_rid = -1;
  76 static int hf_netlogon_alias_rid = -1;
  77 static int hf_netlogon_group_rid = -1;
  78 static int hf_netlogon_logon_srv = -1;
  79 static int hf_netlogon_logon_dom = -1;
  80 static int hf_netlogon_trusted_domain_name = -1;
  81 static int hf_netlogon_num_rids = -1;
  82 static int hf_netlogon_num_other_groups = -1;
  83 static int hf_netlogon_computer_name = -1;
  84 static int hf_netlogon_site_name = -1;
  85 static int hf_netlogon_trusted_dc_name = -1;
  86 static int hf_netlogon_dc_name = -1;
  87 static int hf_netlogon_dc_site_name = -1;
  88 static int hf_netlogon_dns_forest_name = -1;
  89 static int hf_netlogon_dc_address = -1;
  90 static int hf_netlogon_dc_address_type = -1;
  91 static int hf_netlogon_client_name = -1;
  92 static int hf_netlogon_client_site_name = -1;
  93 static int hf_netlogon_workstation_site_name = -1;
  94 static int hf_netlogon_workstation_os = -1;
  95 static int hf_netlogon_workstations = -1;
  96 static int hf_netlogon_workstation_fqdn = -1;
  97 static int hf_netlogon_group_name = -1;
  98 static int hf_netlogon_alias_name = -1;
  99 static int hf_netlogon_cli_name = -1;
 100 static int hf_netlogon_country = -1;
 101 static int hf_netlogon_codepage = -1;
 102 static int hf_netlogon_flags = -1;
 103 static int hf_netlogon_user_flags = -1;
 104 static int hf_netlogon_pwd_expired = -1;
 105 static int hf_netlogon_nt_pwd_present = -1;
 106 static int hf_netlogon_lm_pwd_present = -1;
 107 static int hf_netlogon_code = -1;
 108 static int hf_netlogon_database_id = -1;
 109 static int hf_netlogon_max_size = -1;
 110 static int hf_netlogon_dns_host = -1;
 111 static int hf_netlogon_num_pwd_pairs = -1;
 112 static int hf_netlogon_acct_expiry_time = -1;
 113 static int hf_netlogon_encrypted_lm_owf_password = -1;
 114 static int hf_netlogon_lm_owf_password = -1;
 115 static int hf_netlogon_nt_owf_password = -1;
 116 static int hf_netlogon_param_ctrl = -1;
 117 static int hf_netlogon_logon_id = -1;
 118 static int hf_netlogon_num_deltas = -1;
 119 static int hf_netlogon_user_session_key = -1;
 120 static int hf_netlogon_blob_size = -1;
 121 static int hf_netlogon_blob = -1;
 122 static int hf_netlogon_logon_attempts = -1;
 123 static int hf_netlogon_authoritative = -1;
 124 static int hf_netlogon_secure_channel_type = -1;
 125 static int hf_netlogon_logonsrv_handle = -1;
 126 static int hf_netlogon_lsa_secret = -1;
 127 static int hf_netlogon_lsa_sd_size = -1;
 128
 129 static gint ett_dcerpc_netlogon = -1;
 130 static gint ett_NETLOGON_SECURITY_DESCRIPTOR = -1;
 131 static gint ett_TYPE_1 = -1;
 132 static gint ett_TYPE_2 = -1;
 133 static gint ett_CYPHER_BLOCK = -1;
 134 static gint ett_NETLOGON_AUTHENTICATOR = -1;
 135 static gint ett_NETLOGON_LOGON_IDENTITY_INFO = -1;
 136 static gint ett_NETLOGON_INTERACTIVE_INFO = -1;
 137 static gint ett_NETLOGON_NETWORK_INFO = -1;
 138 static gint ett_NETLOGON_VALIDATION_SAM_INFO1 = -1;
 139 static gint ett_NETLOGON_VALIDATION_SAM_INFO2 = -1;
 140 static gint ett_TYPE_16 = -1;
 141 static gint ett_NETLOGON_SAM_DOMAIN_INFO = -1;
 142 static gint ett_NETLOGON_SAM_GROUP_INFO = -1;
 143 static gint ett_TYPE_23 = -1;
 144 static gint ett_NETLOGON_SAM_ACCOUNT_INFO = -1;
 145 static gint ett_NETLOGON_SAM_GROUP_MEM_INFO = -1;
 146 static gint ett_NETLOGON_SAM_ALIAS_INFO = -1;
 147 static gint ett_NETLOGON_SAM_ALIAS_MEM_INFO = -1;
 148 static gint ett_TYPE_30 = -1;
 149 static gint ett_TYPE_29 = -1;
 150 static gint ett_TYPE_31 = -1;
 151 static gint ett_TYPE_32 = -1;
 152 static gint ett_TYPE_33 = -1;
 153 static gint ett_TYPE_34 = -1;
 154 static gint ett_TYPE_35 = -1;
 155 static gint ett_SAM_DELTA = -1;
 156 static gint ett_SAM_DELTA_ARRAY = -1;
 157 static gint ett_TYPE_36 = -1;
 158 static gint ett_NETLOGON_INFO_1 = -1;
 159 static gint ett_NETLOGON_INFO_2 = -1;
 160 static gint ett_NETLOGON_INFO_3 = -1;
 161 static gint ett_NETLOGON_INFO_4 = -1;
 162 static gint ett_UNICODE_MULTI = -1;
 163 static gint ett_DOMAIN_CONTROLLER_INFO = -1;
 164 static gint ett_TYPE_46 = -1;
 165 static gint ett_TYPE_48 = -1;
 166 static gint ett_UNICODE_STRING_512 = -1;
 167 static gint ett_TYPE_50 = -1;
 168 static gint ett_TYPE_51 = -1;
 169 static gint ett_TYPE_52 = -1;
 170 static gint ett_NETLOGON_LEVEL = -1;
 171 static gint ett_NETLOGON_VALIDATION = -1;
 172 static gint ett_TYPE_19 = -1;
 173 static gint ett_NETLOGON_CONTROL_QUERY_INFO = -1;
 174 static gint ett_TYPE_44 = -1;
 175 static gint ett_TYPE_20 = -1;
 176 static gint ett_NETLOGON_INFO = -1;
 177 static gint ett_TYPE_45 = -1;
 178 static gint ett_TYPE_47 = -1;
 179 static gint ett_NETLOGON_CREDENTIAL = -1;
 180 static gint ett_GUID = -1;
 181 static gint ett_ENC_LM_OWF_PASSWORD = -1;
 182 static gint ett_LM_OWF_PASSWORD = -1;
 183 static gint ett_NT_OWF_PASSWORD = -1;
 184 static gint ett_GROUP_MEMBERSHIP = -1;
 185 static gint ett_USER_SESSION_KEY = -1;
 186 static gint ett_BLOB = -1;
 187 static gint ett_rid_array = -1;
 188 static gint ett_attrib_array = -1;
 189
 190 static e_uuid_t uuid_dcerpc_netlogon = {
 191         0x12345678, 0x1234, 0xabcd,
 192         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0xcf, 0xfb }
 193 };
 194
 195 static guint16 ver_dcerpc_netlogon = 1;
 196
 197
 198 static int
 199 lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
 200                              packet_info *pinfo, proto_tree *tree,
 201                              char *drep)
 202 {
 203         guint32 len;
 204         dcerpc_info *di;
 205
 206         di=pinfo->private_data;
 207         if(di->conformant_run){
 208                 /*just a run to handle conformant arrays, nothing to dissect */
 209                 return offset;
 210         }
 211
 212         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 213                                      hf_netlogon_lsa_sd_size, &len);
 214
 215         dissect_nt_sec_desc(tvb, pinfo, offset, tree, len);
 216         offset += len;
 217
 218         return offset;
 219 }
 220 static int
 221 lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 222                         packet_info *pinfo, proto_tree *parent_tree,
 223                         char *drep)
 224 {
 225         proto_item *item=NULL;
 226         proto_tree *tree=NULL;
 227         int old_offset=offset;
 228
 229         if(parent_tree){
 230                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 231                         "LSA_SECURITY_DESCRIPTOR:");
 232                 tree = proto_item_add_subtree(item, ett_NETLOGON_SECURITY_DESCRIPTOR);
 233         }
 234
 235         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 236                                      hf_netlogon_lsa_sd_size, NULL);
 237         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 238                         lsa_dissect_LSA_SECURITY_DESCRIPTOR_data, NDR_POINTER_UNIQUE,
 239                         "LSA SECURITY DESCRIPTOR data:", -1, 0);
 240
 241         proto_item_set_len(item, offset-old_offset);
 242         return offset;
 243 }
 244
 245 /* XXX temporary, until we get the real one in LSA */
 246 static int
 247 lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
 248                              packet_info *pinfo, proto_tree *tree,
 249                              char *drep)
 250 {
 251         guint32 len;
 252         dcerpc_info *di;
 253
 254         di=pinfo->private_data;
 255         if(di->conformant_run){
 256                 /*just a run to handle conformant arrays, nothing to dissect */
 257                 return offset;
 258         }
 259
 260         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 261                                      hf_netlogon_lsa_sd_size, &len);
 262         proto_tree_add_item(tree, hf_netlogon_lsa_secret, tvb, offset, len, FALSE);
 263         offset += len;
 264
 265         return offset;
 266 }
 267 static int
 268 lsa_dissect_LSA_SECRET(tvbuff_t *tvb, int offset,
 269                         packet_info *pinfo, proto_tree *parent_tree,
 270                         char *drep)
 271 {
 272         proto_item *item=NULL;
 273         proto_tree *tree=NULL;
 274         int old_offset=offset;
 275
 276         if(parent_tree){
 277                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 278                         "LSA_SECRET:");
 279                 tree = proto_item_add_subtree(item, ett_NETLOGON_SECURITY_DESCRIPTOR);
 280         }
 281
 282         /* XXX need to figure this one out */
 283         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 284                                      hf_netlogon_lsa_sd_size, NULL);
 285         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 286                         lsa_dissect_LSA_SECRET_data, NDR_POINTER_UNIQUE,
 287                         "LSA SECRET data:", -1, 0);
 288
 289         proto_item_set_len(item, offset-old_offset);
 290         return offset;
 291 }
 292
 293
 294 static int
 295 netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
 296                              packet_info *pinfo, proto_tree *tree,
 297                              char *drep)
 298 {
 299         dcerpc_info *di;
 300
 301         di=pinfo->private_data;
 302         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 303                                      di->hf_index, NULL);
 304         return offset;
 305 }
 306
 307 static int
 308 netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
 309                              packet_info *pinfo, proto_tree *tree,
 310                              char *drep)
 311 {
 312         dcerpc_info *di;
 313
 314         di=pinfo->private_data;
 315         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
 316                                      di->hf_index, NULL);
 317         return offset;
 318 }
 319
 320 static int
 321 netlogon_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 322                              packet_info *pinfo, proto_tree *tree,
 323                              char *drep)
 324 {
 325         dcerpc_info *di;
 326
 327         di=pinfo->private_data;
 328         if(di->conformant_run){
 329                 /*just a run to handle conformant arrays, nothing to dissect */
 330                 return offset;
 331         }
 332
 333         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 334                         di->hf_index, 0);
 335         return offset;
 336 }
 337
 338
 339 static int
 340 netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 341                         packet_info *pinfo, proto_tree *parent_tree,
 342                         char *drep)
 343 {
 344         proto_item *item=NULL;
 345         proto_tree *tree=NULL;
 346         int old_offset=offset;
 347
 348         if(parent_tree){
 349                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 350                         "NETLOGON_SECURITY_DESCRIPTOR:");
 351                 tree = proto_item_add_subtree(item, ett_NETLOGON_SECURITY_DESCRIPTOR);
 352         }
 353
 354         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 355                 hf_netlogon_len, NULL);
 356
 357         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
 358                 pinfo, tree, drep);
 359
 360         proto_item_set_len(item, offset-old_offset);
 361         return offset;
 362 }
 363
 364 static int
 365 netlogon_dissect_TYPE_1(tvbuff_t *tvb, int offset,
 366                         packet_info *pinfo, proto_tree *parent_tree,
 367                         char *drep)
 368 {
 369         proto_item *item=NULL;
 370         proto_tree *tree=NULL;
 371         int old_offset=offset;
 372
 373         if(parent_tree){
 374                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 375                         "TYPE_1:");
 376                 tree = proto_item_add_subtree(item, ett_TYPE_1);
 377         }
 378
 379         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 380                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 381                 "unknown", hf_netlogon_unknown_string, -1);
 382
 383         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 384                 hf_netlogon_unknown_long, NULL);
 385
 386         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 387                 hf_netlogon_unknown_long, NULL);
 388
 389         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 390                 hf_netlogon_unknown_long, NULL);
 391
 392         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 393                 hf_netlogon_unknown_long, NULL);
 394
 395         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 396                 hf_netlogon_unknown_long, NULL);
 397
 398         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 399                 hf_netlogon_unknown_long, NULL);
 400
 401         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 402                 hf_netlogon_unknown_long, NULL);
 403
 404         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 405                 hf_netlogon_unknown_long, NULL);
 406
 407         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 408                 hf_netlogon_unknown_long, NULL);
 409
 410         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 411                 hf_netlogon_unknown_long, NULL);
 412
 413         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 414                 hf_netlogon_unknown_long, NULL);
 415
 416         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 417                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 418                 "unknown", hf_netlogon_unknown_string, -1);
 419
 420         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 421                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 422                 "unknown", hf_netlogon_unknown_string, -1);
 423
 424         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 425                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 426                 "unknown", hf_netlogon_unknown_string, -1);
 427
 428         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 429                 hf_netlogon_unknown_long, NULL);
 430
 431         proto_item_set_len(item, offset-old_offset);
 432         return offset;
 433 }
 434
 435 static int
 436 netlogon_dissect_TYPE_1_ptr(tvbuff_t *tvb, int offset,
 437                         packet_info *pinfo, proto_tree *tree,
 438                         char *drep)
 439 {
 440         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 441                 netlogon_dissect_TYPE_1, NDR_POINTER_PTR,
 442                 "TYPE_1 pointer: ", -1, 0);
 443         return offset;
 444 }
 445
 446 static int
 447 netlogon_dissect_TYPE_2(tvbuff_t *tvb, int offset,
 448                         packet_info *pinfo, proto_tree *parent_tree,
 449                         char *drep)
 450 {
 451         proto_item *item=NULL;
 452         proto_tree *tree=NULL;
 453         int old_offset=offset;
 454
 455         if(parent_tree){
 456                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 457                         "TYPE_2:");
 458                 tree = proto_item_add_subtree(item, ett_TYPE_2);
 459         }
 460
 461         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 462                 hf_netlogon_unknown_long, NULL);
 463
 464         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 465                 hf_netlogon_unknown_short, NULL);
 466
 467         proto_item_set_len(item, offset-old_offset);
 468         return offset;
 469 }
 470
 471 static int
 472 netlogon_dissect_CYPHER_BLOCK(tvbuff_t *tvb, int offset,
 473                         packet_info *pinfo, proto_tree *parent_tree,
 474                         char *drep)
 475 {
 476         proto_item *item=NULL;
 477         proto_tree *tree=NULL;
 478         int i;
 479         dcerpc_info *di;
 480
 481         di=pinfo->private_data;
 482         if(di->conformant_run){
 483                 /*just a run to handle conformant arrays, nothing to dissect.*/
 484                 return offset;
 485         }
 486
 487         if(parent_tree){
 488                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 489                         "CYPHER_BLOCK:");
 490                 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
 491         }
 492
 493         proto_tree_add_item(tree, hf_netlogon_cypher_block, tvb, offset, 8,
 494                 FALSE);
 495         offset += 8;
 496
 497         return offset;
 498 }
 499
 500 static int
 501 netlogon_dissect_8_unknown_bytes(tvbuff_t *tvb, int offset,
 502                         packet_info *pinfo, proto_tree *parent_tree,
 503                         char *drep)
 504 {
 505         proto_item *item=NULL;
 506         proto_tree *tree=NULL;
 507         int i;
 508         dcerpc_info *di;
 509
 510         di=pinfo->private_data;
 511         if(di->conformant_run){
 512                 /*just a run to handle conformant arrays, nothing to dissect.*/
 513                 return offset;
 514         }
 515
 516         if(parent_tree){
 517                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 518                         "unknown bytes not in IDL:");
 519                 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
 520         }
 521
 522         offset += 8;
 523
 524         return offset;
 525 }
 526
 527 static int
 528 netlogon_dissect_NETLOGON_CREDENTIAL(tvbuff_t *tvb, int offset,
 529                         packet_info *pinfo, proto_tree *parent_tree,
 530                         char *drep)
 531 {
 532         proto_item *item=NULL;
 533         proto_tree *tree=NULL;
 534         int i;
 535         dcerpc_info *di;
 536
 537         di=pinfo->private_data;
 538         if(di->conformant_run){
 539                 /*just a run to handle conformant arrays, nothing to dissect.*/
 540                 return offset;
 541         }
 542
 543         if(parent_tree){
 544                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 545                         "NETLOGON_CREDENTIAL:");
 546                 tree = proto_item_add_subtree(item, ett_NETLOGON_CREDENTIAL);
 547         }
 548
 549         proto_tree_add_item(tree, hf_netlogon_credential, tvb, offset, 8,
 550                 FALSE);
 551         offset += 8;
 552
 553         return offset;
 554 }
 555
 556 static int
 557 netlogon_dissect_NETLOGON_AUTHENTICATOR(tvbuff_t *tvb, int offset,
 558                         packet_info *pinfo, proto_tree *parent_tree,
 559                         char *drep)
 560 {
 561         proto_item *item=NULL;
 562         proto_tree *tree=NULL;
 563         int old_offset=offset;
 564
 565         if(parent_tree){
 566                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 567                         "NETLOGON_AUTHENTICATOR:");
 568                 tree = proto_item_add_subtree(item, ett_NETLOGON_AUTHENTICATOR);
 569         }
 570
 571         offset = netlogon_dissect_NETLOGON_CREDENTIAL(tvb, offset,
 572                 pinfo, tree, drep);
 573
 574         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 575                 hf_netlogon_timestamp, NULL);
 576
 577         proto_item_set_len(item, offset-old_offset);
 578         return offset;
 579 }
 580
 581 static int
 582 netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset,
 583                         packet_info *pinfo, proto_tree *parent_tree,
 584                         char *drep)
 585 {
 586         proto_item *item=NULL;
 587         proto_tree *tree=NULL;
 588         dcerpc_info *di;
 589
 590         di=pinfo->private_data;
 591         if(di->conformant_run){
 592                 /*just a run to handle conformant arrays, nothing to dissect.*/
 593                 return offset;
 594         }
 595
 596         if(parent_tree){
 597                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 598                         "USER_SESSION_KEY:");
 599                 tree = proto_item_add_subtree(item, ett_USER_SESSION_KEY);
 600         }
 601
 602         proto_tree_add_item(tree, hf_netlogon_user_session_key, tvb, offset, 16,
 603                 FALSE);
 604         offset += 16;
 605
 606         return offset;
 607 }
 608
 609 static int
 610 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 611                         packet_info *pinfo, proto_tree *parent_tree,
 612                         char *drep)
 613 {
 614         proto_item *item=NULL;
 615         proto_tree *tree=NULL;
 616         dcerpc_info *di;
 617
 618         di=pinfo->private_data;
 619         if(di->conformant_run){
 620                 /*just a run to handle conformant arrays, nothing to dissect.*/
 621                 return offset;
 622         }
 623
 624         if(parent_tree){
 625                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 626                         "ENCRYPTED_LM_OWF_PASSWORD:");
 627                 tree = proto_item_add_subtree(item, ett_ENC_LM_OWF_PASSWORD);
 628         }
 629
 630         proto_tree_add_item(tree, hf_netlogon_encrypted_lm_owf_password, tvb, offset, 16,
 631                 FALSE);
 632         offset += 16;
 633
 634         return offset;
 635 }
 636
 637 static int
 638 netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 639                         packet_info *pinfo, proto_tree *parent_tree,
 640                         char *drep)
 641 {
 642         proto_item *item=NULL;
 643         proto_tree *tree=NULL;
 644         dcerpc_info *di;
 645
 646         di=pinfo->private_data;
 647         if(di->conformant_run){
 648                 /*just a run to handle conformant arrays, nothing to dissect.*/
 649                 return offset;
 650         }
 651
 652         if(parent_tree){
 653                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 654                         "LM_OWF_PASSWORD:");
 655                 tree = proto_item_add_subtree(item, ett_LM_OWF_PASSWORD);
 656         }
 657
 658         proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16,
 659                 FALSE);
 660         offset += 16;
 661
 662         return offset;
 663 }
 664
 665 static int
 666 netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 667                         packet_info *pinfo, proto_tree *parent_tree,
 668                         char *drep)
 669 {
 670         proto_item *item=NULL;
 671         proto_tree *tree=NULL;
 672         dcerpc_info *di;
 673
 674         di=pinfo->private_data;
 675         if(di->conformant_run){
 676                 /*just a run to handle conformant arrays, nothing to dissect.*/
 677                 return offset;
 678         }
 679
 680         if(parent_tree){
 681                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 682                         "NT_OWF_PASSWORD:");
 683                 tree = proto_item_add_subtree(item, ett_NT_OWF_PASSWORD);
 684         }
 685
 686         proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16,
 687                 FALSE);
 688         offset += 16;
 689
 690         return offset;
 691 }
 692
 693
 694 static int
 695 netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
 696                         packet_info *pinfo, proto_tree *parent_tree,
 697                         char *drep)
 698 {
 699         proto_item *item=NULL;
 700         proto_tree *tree=NULL;
 701         int old_offset=offset;
 702
 703         if(parent_tree){
 704                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 705                         "NETLOGON_LOGON_IDENTITY_INFO:");
 706                 tree = proto_item_add_subtree(item, ett_NETLOGON_LOGON_IDENTITY_INFO);
 707         }
 708
 709         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 710                 hf_netlogon_logon_dom, 0);
 711
 712         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 713                 hf_netlogon_param_ctrl, NULL);
 714
 715         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 716                 hf_netlogon_logon_id, NULL);
 717
 718         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 719                 hf_netlogon_acct_name, 0);
 720
 721         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 722                 hf_netlogon_computer_name, 0);
 723
 724         /* XXX 8 extra bytes here */
 725         /* there were 8 extra bytes, either here or in NETWORK_INFO that does not match
 726            the idl file. Could be a bug in either the NETLOGON implementation or in the
 727            idl file.
 728         */
 729         offset = netlogon_dissect_8_unknown_bytes(tvb, offset, pinfo, tree, drep);
 730
 731         return offset;
 732 }
 733
 734 static int
 735 netlogon_dissect_NETLOGON_INTERACTIVE_INFO(tvbuff_t *tvb, int offset,
 736                         packet_info *pinfo, proto_tree *parent_tree,
 737                         char *drep)
 738 {
 739         proto_item *item=NULL;
 740         proto_tree *tree=NULL;
 741         int old_offset=offset;
 742
 743         if(parent_tree){
 744                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 745                         "NETLOGON_INTERACTIVE_INFO:");
 746                 tree = proto_item_add_subtree(item, ett_NETLOGON_INTERACTIVE_INFO);
 747         }
 748
 749         offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
 750                 pinfo, tree, drep);
 751
 752         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
 753                 pinfo, tree, drep);
 754
 755         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
 756                 pinfo, tree, drep);
 757
 758         proto_item_set_len(item, offset-old_offset);
 759         return offset;
 760 }
 761
 762 static int
 763 netlogon_dissect_NETLOGON_NETWORK_INFO(tvbuff_t *tvb, int offset,
 764                         packet_info *pinfo, proto_tree *parent_tree,
 765                         char *drep)
 766 {
 767         proto_item *item=NULL;
 768         proto_tree *tree=NULL;
 769         int old_offset=offset;
 770
 771         if(parent_tree){
 772                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 773                         "NETLOGON_NETWORK_INFO:");
 774                 tree = proto_item_add_subtree(item, ett_NETLOGON_NETWORK_INFO);
 775         }
 776
 777         offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
 778                 pinfo, tree, drep);
 779
 780         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 781                 hf_netlogon_nt_chal_resp, 0);
 782
 783         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 784                 hf_netlogon_lm_chal_resp, 0);
 785
 786         proto_item_set_len(item, offset-old_offset);
 787         return offset;
 788 }
 789
 790 static int
 791 netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
 792                         packet_info *pinfo, proto_tree *parent_tree,
 793                         char *drep)
 794 {
 795         proto_item *item=NULL;
 796         proto_tree *tree=NULL;
 797         int old_offset=offset;
 798
 799         if(parent_tree){
 800                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 801                         "GROUP_MEMBERSHIP:");
 802                 tree = proto_item_add_subtree(item, ett_GROUP_MEMBERSHIP);
 803         }
 804
 805         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 806                 hf_netlogon_user_rid, NULL);
 807
 808         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 809                 hf_netlogon_attrs, NULL);
 810
 811         return offset;
 812 }
 813
 814 static int
 815 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset,
 816                         packet_info *pinfo, proto_tree *tree,
 817                         char *drep)
 818 {
 819         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 820                 netlogon_dissect_GROUP_MEMBERSHIP);
 821
 822         return offset;
 823 }
 824
 825 static int
 826 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1(tvbuff_t *tvb, int offset,
 827                         packet_info *pinfo, proto_tree *parent_tree,
 828                         char *drep)
 829 {
 830         proto_item *item=NULL;
 831         proto_tree *tree=NULL;
 832         int old_offset=offset;
 833         int i;
 834
 835         if(parent_tree){
 836                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 837                         "NETLOGON_VALIDATION_SAM_INFO1:");
 838                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO1);
 839         }
 840
 841         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 842                 hf_netlogon_logon_time);
 843
 844         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 845                 hf_netlogon_logoff_time);
 846
 847         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 848                 hf_netlogon_kickoff_time);
 849
 850         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 851                 hf_netlogon_pwd_last_set_time);
 852
 853         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 854                 hf_netlogon_pwd_can_change_time);
 855
 856         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 857                 hf_netlogon_pwd_must_change_time);
 858
 859         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 860                 hf_netlogon_acct_name, 0);
 861
 862         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 863                 hf_netlogon_full_name, 0);
 864
 865         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 866                 hf_netlogon_logon_script, 0);
 867
 868         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 869                 hf_netlogon_profile_path, 0);
 870
 871         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 872                 hf_netlogon_home_dir, 0);
 873
 874         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 875                 hf_netlogon_dir_drive, 0);
 876
 877         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 878                 hf_netlogon_logon_count, NULL);
 879
 880         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 881                 hf_netlogon_bad_pw_count, NULL);
 882
 883         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 884                 hf_netlogon_user_rid, NULL);
 885
 886         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 887                 hf_netlogon_group_rid, NULL);
 888
 889         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 890                 hf_netlogon_num_rids, NULL);
 891
 892         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 893                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_PTR,
 894                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 895
 896         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 897                 hf_netlogon_user_flags, NULL);
 898
 899         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 900                 pinfo, tree, drep);
 901
 902         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 903                 hf_netlogon_logon_srv, 0);
 904
 905         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 906                 hf_netlogon_logon_dom, 0);
 907
 908         offset = dissect_ndr_nt_PSID(tvb, offset,
 909                 pinfo, tree, drep);
 910
 911         for(i=0;i<10;i++){
 912                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 913                         hf_netlogon_unknown_long, NULL);
 914         }
 915
 916         proto_item_set_len(item, offset-old_offset);
 917         return offset;
 918 }
 919
 920 static int
 921 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset,
 922                         packet_info *pinfo, proto_tree *parent_tree,
 923                         char *drep)
 924 {
 925         proto_item *item=NULL;
 926         proto_tree *tree=NULL;
 927         int old_offset=offset;
 928         int i;
 929
 930         if(parent_tree){
 931                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 932                         "NETLOGON_VALIDATION_SAM_INFO2:");
 933                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO2);
 934         }
 935
 936         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 937                 hf_netlogon_logon_time);
 938
 939         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 940                 hf_netlogon_logoff_time);
 941
 942         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 943                 hf_netlogon_kickoff_time);
 944
 945         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 946                 hf_netlogon_pwd_last_set_time);
 947
 948         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 949                 hf_netlogon_pwd_can_change_time);
 950
 951         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 952                 hf_netlogon_pwd_must_change_time);
 953
 954         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 955                 hf_netlogon_acct_name, 0);
 956
 957         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 958                 hf_netlogon_full_name, 0);
 959
 960         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 961                 hf_netlogon_logon_script, 0);
 962
 963         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 964                 hf_netlogon_profile_path, 0);
 965
 966         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 967                 hf_netlogon_home_dir, 0);
 968
 969         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 970                 hf_netlogon_dir_drive, 0);
 971
 972         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 973                 hf_netlogon_logon_count, NULL);
 974
 975         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 976                 hf_netlogon_bad_pw_count, NULL);
 977
 978         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 979                 hf_netlogon_user_rid, NULL);
 980
 981         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 982                 hf_netlogon_group_rid, NULL);
 983
 984         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 985                 hf_netlogon_num_rids, NULL);
 986
 987         /* XXX i am not sure about this pointer being UNIQUE, though I am
 988            pretty convinced that it is NOT PTR as the idl file suggests.
 989         */
 990         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 991                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
 992                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 993
 994         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 995                 hf_netlogon_user_flags, NULL);
 996
 997         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 998                 pinfo, tree, drep);
 999
1000         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1001                 hf_netlogon_logon_srv, 0);
1002
1003         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1004                 hf_netlogon_logon_dom, 0);
1005
1006         offset = dissect_ndr_nt_PSID(tvb, offset,
1007                 pinfo, tree, drep);
1008
1009         for(i=0;i<10;i++){
1010                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1011                         hf_netlogon_unknown_long, NULL);
1012         }
1013
1014         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1015                 hf_netlogon_num_other_groups, NULL);
1016
1017         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1018                 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_PTR,
1019                 "SID_AND_ATTRIBUTES_ARRAY:", -1, 0);
1020
1021         proto_item_set_len(item, offset-old_offset);
1022         return offset;
1023 }
1024
1025 static int
1026 netlogon_dissect_TYPE_16(tvbuff_t *tvb, int offset,
1027                         packet_info *pinfo, proto_tree *parent_tree,
1028                         char *drep)
1029 {
1030         proto_item *item=NULL;
1031         proto_tree *tree=NULL;
1032         int old_offset=offset;
1033
1034         if(parent_tree){
1035                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1036                         "TYPE_16:");
1037                 tree = proto_item_add_subtree(item, ett_TYPE_16);
1038         }
1039
1040         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1041                 hf_netlogon_unknown_time);
1042
1043         proto_item_set_len(item, offset-old_offset);
1044         return offset;
1045 }
1046
1047
1048 static int
1049 netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO(tvbuff_t *tvb, int offset,
1050                         packet_info *pinfo, proto_tree *parent_tree,
1051                         char *drep)
1052 {
1053         proto_item *item=NULL;
1054         proto_tree *tree=NULL;
1055         int old_offset=offset;
1056
1057         if(parent_tree){
1058                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1059                         "NETLOGON_SAM_DOMAIN_INFO:");
1060                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_DOMAIN_INFO);
1061         }
1062
1063         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1064                 hf_netlogon_unknown_string, 0);
1065
1066         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1067                 hf_netlogon_unknown_string, 0);
1068
1069         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1070                 hf_netlogon_unknown_time);
1071
1072         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1073                 hf_netlogon_unknown_short, NULL);
1074
1075         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1076                 hf_netlogon_unknown_short, NULL);
1077
1078         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1079                 hf_netlogon_unknown_time);
1080
1081         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1082                 hf_netlogon_unknown_time);
1083
1084         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1085                 hf_netlogon_unknown_time);
1086
1087         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1088                 hf_netlogon_unknown_time);
1089
1090         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1091                 hf_netlogon_unknown_string, 0);
1092
1093         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1094                 hf_netlogon_unknown_string, 0);
1095
1096         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1097                 hf_netlogon_unknown_string, 0);
1098
1099         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1100                 hf_netlogon_unknown_string, 0);
1101
1102         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1103                 hf_netlogon_unknown_string, 0);
1104
1105         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1106                 hf_netlogon_unknown_long, NULL);
1107
1108         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1109                 hf_netlogon_unknown_long, NULL);
1110
1111         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1112                 hf_netlogon_unknown_long, NULL);
1113
1114         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1115                 hf_netlogon_unknown_long, NULL);
1116
1117         proto_item_set_len(item, offset-old_offset);
1118         return offset;
1119 }
1120
1121
1122 static int
1123 netlogon_dissect_NETLOGON_SAM_GROUP_INFO(tvbuff_t *tvb, int offset,
1124                         packet_info *pinfo, proto_tree *parent_tree,
1125                         char *drep)
1126 {
1127         proto_item *item=NULL;
1128         proto_tree *tree=NULL;
1129         int old_offset=offset;
1130
1131         if(parent_tree){
1132                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1133                         "NETLOGON_SAM_GROUP_INFO:");
1134                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_INFO);
1135         }
1136
1137         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1138                 hf_netlogon_group_name, 0);
1139
1140         offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset,
1141                 pinfo, tree, drep);
1142
1143         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1144                 hf_netlogon_group_desc, 0);
1145
1146         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1147                 pinfo, tree, drep);
1148
1149         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1150                 hf_netlogon_unknown_string, 0);
1151
1152         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1153                 hf_netlogon_unknown_string, 0);
1154
1155         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1156                 hf_netlogon_unknown_string, 0);
1157
1158         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1159                 hf_netlogon_unknown_string, 0);
1160
1161         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1162                 hf_netlogon_unknown_long, NULL);
1163
1164         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1165                 hf_netlogon_unknown_long, NULL);
1166
1167         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1168                 hf_netlogon_unknown_long, NULL);
1169
1170         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1171                 hf_netlogon_unknown_long, NULL);
1172
1173         proto_item_set_len(item, offset-old_offset);
1174         return offset;
1175 }
1176
1177
1178 static int
1179 netlogon_dissect_TYPE_23(tvbuff_t *tvb, int offset,
1180                         packet_info *pinfo, proto_tree *parent_tree,
1181                         char *drep)
1182 {
1183         proto_item *item=NULL;
1184         proto_tree *tree=NULL;
1185         int old_offset=offset;
1186
1187         if(parent_tree){
1188                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1189                         "TYPE_23:");
1190                 tree = proto_item_add_subtree(item, ett_TYPE_23);
1191         }
1192
1193         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1194                 hf_netlogon_unknown_string, 0);
1195
1196         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1197                 hf_netlogon_unknown_string, 0);
1198
1199         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1200                 hf_netlogon_unknown_string, 0);
1201
1202         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1203                 hf_netlogon_unknown_string, 0);
1204
1205         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1206                 hf_netlogon_unknown_string, 0);
1207
1208         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1209                 hf_netlogon_unknown_string, 0);
1210
1211         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1212                 hf_netlogon_unknown_long, NULL);
1213
1214         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1215                 hf_netlogon_unknown_long, NULL);
1216
1217         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1218                 hf_netlogon_unknown_long, NULL);
1219
1220         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1221                 hf_netlogon_unknown_long, NULL);
1222
1223         proto_item_set_len(item, offset-old_offset);
1224         return offset;
1225 }
1226
1227
1228 static int
1229 netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO(tvbuff_t *tvb, int offset,
1230                         packet_info *pinfo, proto_tree *parent_tree,
1231                         char *drep)
1232 {
1233         proto_item *item=NULL;
1234         proto_tree *tree=NULL;
1235         int old_offset=offset;
1236
1237         if(parent_tree){
1238                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1239                         "NETLOGON_SAM_ACCOUNT_INFO:");
1240                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ACCOUNT_INFO);
1241         }
1242
1243         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1244                 hf_netlogon_acct_name, 0);
1245
1246         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1247                 hf_netlogon_full_name, 0);
1248
1249         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1250                 hf_netlogon_user_rid, NULL);
1251
1252         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1253                 hf_netlogon_group_rid, NULL);
1254
1255         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1256                 hf_netlogon_home_dir, 0);
1257
1258         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1259                 hf_netlogon_dir_drive, 0);
1260
1261         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1262                 hf_netlogon_logon_script, 0);
1263
1264         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1265                 hf_netlogon_acct_desc, 0);
1266
1267         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1268                 hf_netlogon_workstations, 0);
1269
1270         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1271                 hf_netlogon_logon_time);
1272
1273         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1274                 hf_netlogon_logoff_time);
1275
1276         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
1277
1278         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1279                 hf_netlogon_bad_pw_count, NULL);
1280
1281         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1282                 hf_netlogon_logon_count, NULL);
1283
1284         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1285                 hf_netlogon_pwd_last_set_time);
1286
1287         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1288                 hf_netlogon_acct_expiry_time);
1289
1290         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
1291
1292         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
1293                 pinfo, tree, drep);
1294
1295         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
1296                 pinfo, tree, drep);
1297
1298         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1299                 hf_netlogon_nt_pwd_present, NULL);
1300
1301         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1302                 hf_netlogon_lm_pwd_present, NULL);
1303
1304         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1305                 hf_netlogon_pwd_expired, NULL);
1306
1307         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1308                 hf_netlogon_comment, 0);
1309
1310         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1311                 hf_netlogon_parameters, 0);
1312
1313         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1314                 hf_netlogon_country, NULL);
1315
1316         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1317                 hf_netlogon_codepage, NULL);
1318
1319         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1320                 hf_netlogon_num_pwd_pairs, NULL);
1321
1322         offset = lsa_dissect_LSA_SECRET(tvb, offset,
1323                 pinfo, tree, drep);
1324
1325         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1326                 pinfo, tree, drep);
1327
1328         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1329                 hf_netlogon_profile_path, 0);
1330
1331         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1332                 hf_netlogon_unknown_string, 0);
1333
1334         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1335                 hf_netlogon_unknown_string, 0);
1336
1337         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1338                 hf_netlogon_unknown_string, 0);
1339
1340         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1341                 hf_netlogon_unknown_long, NULL);
1342
1343         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1344                 hf_netlogon_unknown_long, NULL);
1345
1346         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1347                 hf_netlogon_unknown_long, NULL);
1348
1349         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1350                 hf_netlogon_unknown_long, NULL);
1351
1352         proto_item_set_len(item, offset-old_offset);
1353         return offset;
1354 }
1355
1356
1357 static int
1358 netlogon_dissect_rid(tvbuff_t *tvb, int offset,
1359                         packet_info *pinfo, proto_tree *tree,
1360                         char *drep)
1361 {
1362         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1363                                 hf_netlogon_user_rid, NULL);
1364
1365         return offset;
1366 }
1367
1368 static int
1369 netlogon_dissect_rids_array(tvbuff_t *tvb, int offset,
1370                         packet_info *pinfo, proto_tree *parent_tree,
1371                         char *drep)
1372 {
1373         proto_item *item=NULL;
1374         proto_tree *tree=NULL;
1375         int old_offset=offset;
1376
1377         if(parent_tree){
1378                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1379                         "RID array:");
1380                 tree = proto_item_add_subtree(item, ett_rid_array);
1381         }
1382
1383         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1384                         netlogon_dissect_rid);
1385
1386         proto_item_set_len(item, offset-old_offset);
1387         return offset;
1388 }
1389
1390 static int
1391 netlogon_dissect_attrib(tvbuff_t *tvb, int offset,
1392                         packet_info *pinfo, proto_tree *tree,
1393                         char *drep)
1394 {
1395         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1396                 hf_netlogon_attrs, NULL);
1397
1398         return offset;
1399 }
1400
1401 static int
1402 netlogon_dissect_attribs_array(tvbuff_t *tvb, int offset,
1403                         packet_info *pinfo, proto_tree *parent_tree,
1404                         char *drep)
1405 {
1406         proto_item *item=NULL;
1407         proto_tree *tree=NULL;
1408         int old_offset=offset;
1409
1410         if(parent_tree){
1411                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1412                         "Attrib array:");
1413                 tree = proto_item_add_subtree(item, ett_attrib_array);
1414         }
1415
1416         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1417                         netlogon_dissect_attrib);
1418
1419         proto_item_set_len(item, offset-old_offset);
1420         return offset;
1421 }
1422
1423 static int
1424 netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO(tvbuff_t *tvb, int offset,
1425                         packet_info *pinfo, proto_tree *parent_tree,
1426                         char *drep)
1427 {
1428         proto_item *item=NULL;
1429         proto_tree *tree=NULL;
1430         int old_offset=offset;
1431
1432         if(parent_tree){
1433                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1434                         "NETLOGON_SAM_GROUP_MEM_INFO:");
1435                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_MEM_INFO);
1436         }
1437
1438         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1439                 netlogon_dissect_rids_array, NDR_POINTER_PTR,
1440                 "RIDs:", -1, 0);
1441
1442         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1443                 netlogon_dissect_attribs_array, NDR_POINTER_PTR,
1444                 "Attribs:", -1, 0);
1445
1446         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1447                 hf_netlogon_num_rids, NULL);
1448
1449         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1450                 hf_netlogon_unknown_long, NULL);
1451
1452         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1453                 hf_netlogon_unknown_long, NULL);
1454
1455         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1456                 hf_netlogon_unknown_long, NULL);
1457
1458         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1459                 hf_netlogon_unknown_long, NULL);
1460
1461         proto_item_set_len(item, offset-old_offset);
1462         return offset;
1463 }
1464
1465
1466 static int
1467 netlogon_dissect_NETLOGON_SAM_ALIAS_INFO(tvbuff_t *tvb, int offset,
1468                         packet_info *pinfo, proto_tree *parent_tree,
1469                         char *drep)
1470 {
1471         proto_item *item=NULL;
1472         proto_tree *tree=NULL;
1473         int old_offset=offset;
1474
1475         if(parent_tree){
1476                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1477                         "NETLOGON_SAM_ALIAS_INFO:");
1478                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_INFO);
1479         }
1480
1481
1482         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1483                 hf_netlogon_alias_name, 0);
1484
1485         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1486                 hf_netlogon_alias_rid, NULL);
1487
1488         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1489                 pinfo, tree, drep);
1490
1491         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1492                 hf_netlogon_acct_desc, 0);
1493
1494         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1495                 hf_netlogon_unknown_string, 0);
1496
1497         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1498                 hf_netlogon_unknown_string, 0);
1499
1500         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1501                 hf_netlogon_unknown_string, 0);
1502
1503         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1504                 hf_netlogon_unknown_long, NULL);
1505
1506         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1507                 hf_netlogon_unknown_long, NULL);
1508
1509         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1510                 hf_netlogon_unknown_long, NULL);
1511
1512         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1513                 hf_netlogon_unknown_long, NULL);
1514
1515         proto_item_set_len(item, offset-old_offset);
1516         return offset;
1517 }
1518
1519
1520 static int
1521 netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO(tvbuff_t *tvb, int offset,
1522                         packet_info *pinfo, proto_tree *parent_tree,
1523                         char *drep)
1524 {
1525         proto_item *item=NULL;
1526         proto_tree *tree=NULL;
1527         int old_offset=offset;
1528
1529         if(parent_tree){
1530                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1531                         "NETLOGON_SAM_ALIAS_MEM_INFO:");
1532                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_MEM_INFO);
1533         }
1534
1535         offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, drep);
1536
1537         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1538                 hf_netlogon_unknown_long, NULL);
1539
1540         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1541                 hf_netlogon_unknown_long, NULL);
1542
1543         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1544                 hf_netlogon_unknown_long, NULL);
1545
1546         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1547                 hf_netlogon_unknown_long, NULL);
1548
1549         proto_item_set_len(item, offset-old_offset);
1550         return offset;
1551 }
1552
1553 static int
1554 netlogon_dissect_TYPE_30(tvbuff_t *tvb, int offset,
1555                         packet_info *pinfo, proto_tree *parent_tree,
1556                         char *drep)
1557 {
1558         proto_item *item=NULL;
1559         proto_tree *tree=NULL;
1560         int old_offset=offset;
1561
1562         if(parent_tree){
1563                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1564                         "TYPE_30:");
1565                 tree = proto_item_add_subtree(item, ett_TYPE_30);
1566         }
1567
1568         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1569                 hf_netlogon_unknown_long, NULL);
1570
1571         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1572                 hf_netlogon_unknown_long, NULL);
1573
1574         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1575                 hf_netlogon_unknown_long, NULL);
1576
1577         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1578                 hf_netlogon_unknown_long, NULL);
1579
1580         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1581                 hf_netlogon_unknown_long, NULL);
1582
1583         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1584                 hf_netlogon_unknown_time);
1585
1586         proto_item_set_len(item, offset-old_offset);
1587         return offset;
1588 }
1589
1590 static int
1591 netlogon_dissect_element_422(tvbuff_t *tvb, int offset,
1592                         packet_info *pinfo, proto_tree *tree,
1593                         char *drep)
1594 {
1595         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1596                 hf_netlogon_unknown_long, NULL);
1597
1598         return offset;
1599 }
1600
1601 static int
1602 netlogon_dissect_element_422_array(tvbuff_t *tvb, int offset,
1603                         packet_info *pinfo, proto_tree *tree,
1604                         char *drep)
1605 {
1606         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1607                 netlogon_dissect_element_422);
1608
1609         return offset;
1610 }
1611
1612
1613 static int
1614 netlogon_dissect_TYPE_29(tvbuff_t *tvb, int offset,
1615                         packet_info *pinfo, proto_tree *parent_tree,
1616                         char *drep)
1617 {
1618         proto_item *item=NULL;
1619         proto_tree *tree=NULL;
1620         int old_offset=offset;
1621
1622         if(parent_tree){
1623                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1624                         "TYPE_29:");
1625                 tree = proto_item_add_subtree(item, ett_TYPE_29);
1626         }
1627
1628         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1629                 hf_netlogon_unknown_long, NULL);
1630
1631         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1632                 hf_netlogon_unknown_time);
1633
1634         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1635                 hf_netlogon_unknown_char, NULL);
1636
1637         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1638                 hf_netlogon_unknown_long, NULL);
1639
1640         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1641                 netlogon_dissect_element_422_array, NDR_POINTER_PTR,
1642                 "unknown", -1, 0);
1643
1644         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1645                 hf_netlogon_unknown_string, 0);
1646
1647         offset = dissect_ndr_nt_PSID(tvb, offset,
1648                 pinfo, tree, drep);
1649
1650         offset = netlogon_dissect_TYPE_30(tvb, offset,
1651                 pinfo, tree, drep);
1652
1653         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1654                 hf_netlogon_unknown_time);
1655
1656         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1657                 hf_netlogon_unknown_time);
1658
1659         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1660                 pinfo, tree, drep);
1661
1662         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1663                 hf_netlogon_unknown_string, 0);
1664
1665         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1666                 hf_netlogon_unknown_string, 0);
1667
1668         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1669                 hf_netlogon_unknown_string, 0);
1670
1671         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1672                 hf_netlogon_unknown_string, 0);
1673
1674         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1675                 hf_netlogon_unknown_long, NULL);
1676
1677         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1678                 hf_netlogon_unknown_long, NULL);
1679
1680         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1681                 hf_netlogon_unknown_long, NULL);
1682
1683         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1684                 hf_netlogon_unknown_long, NULL);
1685
1686         proto_item_set_len(item, offset-old_offset);
1687         return offset;
1688 }
1689
1690
1691 static int
1692 netlogon_dissect_TYPE_31(tvbuff_t *tvb, int offset,
1693                         packet_info *pinfo, proto_tree *parent_tree,
1694                         char *drep)
1695 {
1696         proto_item *item=NULL;
1697         proto_tree *tree=NULL;
1698         int old_offset=offset;
1699
1700         if(parent_tree){
1701                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1702                         "TYPE_31:");
1703                 tree = proto_item_add_subtree(item, ett_TYPE_31);
1704         }
1705
1706         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1707                 hf_netlogon_unknown_string, 0);
1708
1709         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1710                 hf_netlogon_unknown_string, 0);
1711
1712         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1713                 hf_netlogon_unknown_long, NULL);
1714
1715         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1716                 hf_netlogon_unknown_string, 0);
1717
1718         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1719                 hf_netlogon_unknown_string, 0);
1720
1721         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1722                 hf_netlogon_unknown_string, 0);
1723
1724         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1725                 hf_netlogon_unknown_string, 0);
1726
1727         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1728                 hf_netlogon_unknown_string, 0);
1729
1730         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1731                 hf_netlogon_unknown_long, NULL);
1732
1733         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1734                 hf_netlogon_unknown_long, NULL);
1735
1736         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1737                 hf_netlogon_unknown_long, NULL);
1738
1739         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1740                 hf_netlogon_unknown_long, NULL);
1741
1742         proto_item_set_len(item, offset-old_offset);
1743         return offset;
1744 }
1745
1746
1747 static int
1748 netlogon_dissect_TYPE_32(tvbuff_t *tvb, int offset,
1749                         packet_info *pinfo, proto_tree *parent_tree,
1750                         char *drep)
1751 {
1752         proto_item *item=NULL;
1753         proto_tree *tree=NULL;
1754         int old_offset=offset;
1755
1756         if(parent_tree){
1757                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1758                         "TYPE_32:");
1759                 tree = proto_item_add_subtree(item, ett_TYPE_32);
1760         }
1761
1762         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1763                 hf_netlogon_unknown_string, 0);
1764
1765         proto_item_set_len(item, offset-old_offset);
1766         return offset;
1767 }
1768
1769
1770 static int
1771 netlogon_dissect_attrs(tvbuff_t *tvb, int offset,
1772                         packet_info *pinfo, proto_tree *tree,
1773                         char *drep)
1774 {
1775         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1776                 hf_netlogon_attrs, NULL);
1777
1778         return offset;
1779 }
1780
1781 static int
1782 netlogon_dissect_attrs_array(tvbuff_t *tvb, int offset,
1783                         packet_info *pinfo, proto_tree *tree,
1784                         char *drep)
1785 {
1786         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1787                 netlogon_dissect_attrs);
1788
1789         return offset;
1790 }
1791
1792
1793 static int
1794 netlogon_dissect_TYPE_33(tvbuff_t *tvb, int offset,
1795                         packet_info *pinfo, proto_tree *parent_tree,
1796                         char *drep)
1797 {
1798         proto_item *item=NULL;
1799         proto_tree *tree=NULL;
1800         int old_offset=offset;
1801
1802         if(parent_tree){
1803                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1804                         "TYPE_33:");
1805                 tree = proto_item_add_subtree(item, ett_TYPE_33);
1806         }
1807
1808
1809         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1810                 hf_netlogon_count, NULL);
1811
1812         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1813                 hf_netlogon_unknown_long, NULL);
1814
1815         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1816                 netlogon_dissect_attrs_array, NDR_POINTER_PTR,
1817                 "ATTRS_ARRAY:", -1, 0);
1818
1819         offset = netlogon_dissect_TYPE_30(tvb, offset,
1820                 pinfo, tree, drep);
1821
1822         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1823                 hf_netlogon_unknown_long, NULL);
1824
1825         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1826                 hf_netlogon_unknown_long, NULL);
1827
1828         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1829                 hf_netlogon_unknown_string, 0);
1830
1831         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1832                 hf_netlogon_unknown_string, 0);
1833
1834         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1835                 hf_netlogon_unknown_string, 0);
1836
1837         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1838                 hf_netlogon_unknown_string, 0);
1839
1840         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1841                 hf_netlogon_unknown_string, 0);
1842
1843         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1844                 hf_netlogon_unknown_long, NULL);
1845
1846         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1847                 hf_netlogon_unknown_long, NULL);
1848
1849         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1850                 hf_netlogon_unknown_long, NULL);
1851
1852         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1853                 hf_netlogon_unknown_long, NULL);
1854
1855         proto_item_set_len(item, offset-old_offset);
1856         return offset;
1857 }
1858
1859
1860 static int
1861 netlogon_dissect_TYPE_34(tvbuff_t *tvb, int offset,
1862                         packet_info *pinfo, proto_tree *parent_tree,
1863                         char *drep)
1864 {
1865         proto_item *item=NULL;
1866         proto_tree *tree=NULL;
1867         int old_offset=offset;
1868
1869         if(parent_tree){
1870                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1871                         "TYPE_34:");
1872                 tree = proto_item_add_subtree(item, ett_TYPE_34);
1873         }
1874
1875         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1876                 hf_netlogon_unknown_string, 0);
1877
1878         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1879                 hf_netlogon_unknown_time);
1880
1881         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1882                 hf_netlogon_unknown_string, 0);
1883
1884         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1885                 hf_netlogon_unknown_time);
1886
1887         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1888                 hf_netlogon_unknown_long, NULL);
1889
1890         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1891                 hf_netlogon_unknown_string, 0);
1892
1893         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1894                 hf_netlogon_unknown_string, 0);
1895
1896         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1897                 hf_netlogon_unknown_string, 0);
1898
1899         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1900                 hf_netlogon_unknown_string, 0);
1901
1902         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1903                 hf_netlogon_unknown_string, 0);
1904
1905         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1906                 hf_netlogon_unknown_long, NULL);
1907
1908         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1909                 hf_netlogon_unknown_long, NULL);
1910
1911         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1912                 hf_netlogon_unknown_long, NULL);
1913
1914         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1915                 hf_netlogon_unknown_long, NULL);
1916
1917         proto_item_set_len(item, offset-old_offset);
1918         return offset;
1919 }
1920
1921 static int
1922 netlogon_dissect_TYPE_35(tvbuff_t *tvb, int offset,
1923                         packet_info *pinfo, proto_tree *parent_tree,
1924                         char *drep)
1925 {
1926         proto_item *item=NULL;
1927         proto_tree *tree=NULL;
1928         int old_offset=offset;
1929
1930         if(parent_tree){
1931                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1932                         "TYPE_35:");
1933                 tree = proto_item_add_subtree(item, ett_TYPE_35);
1934         }
1935
1936         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1937                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1938                 "unknown", hf_netlogon_unknown_string, -1);
1939
1940         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1941                 hf_netlogon_unknown_string, 0);
1942
1943         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1944                 hf_netlogon_unknown_string, 0);
1945
1946         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1947                 hf_netlogon_unknown_string, 0);
1948
1949         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1950                 hf_netlogon_unknown_string, 0);
1951
1952         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1953                 hf_netlogon_unknown_long, NULL);
1954
1955         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1956                 hf_netlogon_unknown_long, NULL);
1957
1958         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1959                 hf_netlogon_unknown_long, NULL);
1960
1961         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1962                 hf_netlogon_unknown_long, NULL);
1963
1964         proto_item_set_len(item, offset-old_offset);
1965         return offset;
1966 }
1967
1968 static int
1969 netlogon_dissect_WCHAR_ptr(tvbuff_t *tvb, int offset,
1970                         packet_info *pinfo, proto_tree *tree,
1971                         char *drep)
1972 {
1973         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1974                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1975                 "unknown string", hf_netlogon_unknown_string, -1);
1976
1977         return offset;
1978 }
1979
1980 static int
1981 netlogon_dissect_TYPE_36(tvbuff_t *tvb, int offset,
1982                         packet_info *pinfo, proto_tree *parent_tree,
1983                         char *drep)
1984 {
1985         proto_item *item=NULL;
1986         proto_tree *tree=NULL;
1987         int old_offset=offset;
1988         int i;
1989
1990         if(parent_tree){
1991                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1992                         "TYPE_36:");
1993                 tree = proto_item_add_subtree(item, ett_TYPE_36);
1994         }
1995
1996         for(i=0;i<16;i++){
1997                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1998                         hf_netlogon_unknown_char, NULL);
1999         }
2000
2001         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2002                 hf_netlogon_unknown_long, NULL);
2003
2004         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2005                 hf_netlogon_unknown_long, NULL);
2006
2007         proto_item_set_len(item, offset-old_offset);
2008         return offset;
2009 }
2010
2011 static int
2012 netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
2013                         packet_info *pinfo, proto_tree *parent_tree,
2014                         char *drep)
2015 {
2016         proto_item *item=NULL;
2017         proto_tree *tree=NULL;
2018         int old_offset=offset;
2019
2020         if(parent_tree){
2021                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2022                         "NETLOGON_INFO_1:");
2023                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_1);
2024         }
2025
2026         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2027                 hf_netlogon_flags, NULL);
2028
2029         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2030                 hf_netlogon_status, NULL);
2031
2032         proto_item_set_len(item, offset-old_offset);
2033         return offset;
2034 }
2035
2036 static int
2037 netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
2038                         packet_info *pinfo, proto_tree *parent_tree,
2039                         char *drep)
2040 {
2041         proto_item *item=NULL;
2042         proto_tree *tree=NULL;
2043         int old_offset=offset;
2044
2045         if(parent_tree){
2046                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2047                         "NETLOGON_INFO_2:");
2048                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_2);
2049         }
2050
2051         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2052                 hf_netlogon_unknown_long, NULL);
2053
2054         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2055                 hf_netlogon_unknown_long, NULL);
2056
2057         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2058                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2059                 "unknown", hf_netlogon_unknown_string, -1);
2060
2061         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2062                 hf_netlogon_unknown_long, NULL);
2063
2064         proto_item_set_len(item, offset-old_offset);
2065         return offset;
2066 }
2067
2068 static int
2069 netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
2070                         packet_info *pinfo, proto_tree *parent_tree,
2071                         char *drep)
2072 {
2073         proto_item *item=NULL;
2074         proto_tree *tree=NULL;
2075         int old_offset=offset;
2076
2077         if(parent_tree){
2078                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2079                         "NETLOGON_INFO_3:");
2080                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_3);
2081         }
2082
2083         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2084                 hf_netlogon_flags, NULL);
2085
2086         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2087                 hf_netlogon_logon_attempts, NULL);
2088
2089         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2090                 hf_netlogon_unknown_long, NULL);
2091
2092         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2093                 hf_netlogon_unknown_long, NULL);
2094
2095         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2096                 hf_netlogon_unknown_long, NULL);
2097
2098         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2099                 hf_netlogon_unknown_long, NULL);
2100
2101         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2102                 hf_netlogon_unknown_long, NULL);
2103
2104         proto_item_set_len(item, offset-old_offset);
2105         return offset;
2106 }
2107
2108 static int
2109 netlogon_dissect_NETLOGON_INFO_4(tvbuff_t *tvb, int offset,
2110                         packet_info *pinfo, proto_tree *parent_tree,
2111                         char *drep)
2112 {
2113         proto_item *item=NULL;
2114         proto_tree *tree=NULL;
2115         int old_offset=offset;
2116
2117         if(parent_tree){
2118                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2119                         "NETLOGON_INFO_4:");
2120                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_4);
2121         }
2122
2123         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2124                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2125                 "unknown", hf_netlogon_trusted_dc_name, -1);
2126
2127         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2128                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2129                 "unknown", hf_netlogon_trusted_domain_name, -1);
2130
2131         proto_item_set_len(item, offset-old_offset);
2132         return offset;
2133 }
2134
2135 static int
2136 netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
2137                         packet_info *pinfo, proto_tree *tree,
2138                         char *drep)
2139 {
2140                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2141                         hf_netlogon_unknown_char, NULL);
2142
2143         return offset;
2144 }
2145
2146 static int
2147 netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
2148                         packet_info *pinfo, proto_tree *tree,
2149                         char *drep)
2150 {
2151         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2152                 netlogon_dissect_UNICODE_MULTI_byte);
2153
2154         return offset;
2155 }
2156
2157 static int
2158 netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
2159                         packet_info *pinfo, proto_tree *tree,
2160                         char *drep)
2161 {
2162                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2163                         hf_netlogon_unknown_char, NULL);
2164
2165         return offset;
2166 }
2167
2168 static int
2169 netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
2170                         packet_info *pinfo, proto_tree *tree,
2171                         char *drep)
2172 {
2173         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2174                 netlogon_dissect_BYTE_byte);
2175
2176         return offset;
2177 }
2178
2179 static int
2180 netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
2181                         packet_info *pinfo, proto_tree *parent_tree,
2182                         char *drep)
2183 {
2184         proto_item *item=NULL;
2185         proto_tree *tree=NULL;
2186         int old_offset=offset;
2187
2188         if(parent_tree){
2189                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2190                         "UNICODE_MULTI:");
2191                 tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
2192         }
2193
2194         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2195                 hf_netlogon_len, NULL);
2196
2197         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2198                 netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_PTR,
2199                 "unknown", hf_netlogon_unknown_string, 0);
2200
2201         proto_item_set_len(item, offset-old_offset);
2202         return offset;
2203 }
2204
2205 static int
2206 netlogon_dissect_GUID(tvbuff_t *tvb, int offset,
2207                         packet_info *pinfo, proto_tree *parent_tree,
2208                         char *drep)
2209 {
2210         proto_item *item=NULL;
2211         proto_tree *tree=NULL;
2212         int old_offset=offset;
2213         int i;
2214
2215         if(parent_tree){
2216                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2217                         "GUID:");
2218                 tree = proto_item_add_subtree(item, ett_GUID);
2219         }
2220
2221         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2222                 hf_netlogon_unknown_long, NULL);
2223
2224         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2225                 hf_netlogon_unknown_short, NULL);
2226
2227         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2228                 hf_netlogon_unknown_short, NULL);
2229
2230         for(i=0;i<8;i++){
2231                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2232                         hf_netlogon_unknown_char, NULL);
2233         }
2234
2235         proto_item_set_len(item, offset-old_offset);
2236         return offset;
2237 }
2238
2239 static int
2240 netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
2241                         packet_info *pinfo, proto_tree *parent_tree,
2242                         char *drep)
2243 {
2244         proto_item *item=NULL;
2245         proto_tree *tree=NULL;
2246         int old_offset=offset;
2247
2248         if(parent_tree){
2249                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2250                         "DOMAIN_CONTROLLER_INFO:");
2251                 tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
2252         }
2253
2254         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2255                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2256                 "unknown", hf_netlogon_dc_name, -1);
2257
2258         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2259                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2260                 "unknown", hf_netlogon_dc_address, -1);
2261
2262         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2263                 hf_netlogon_dc_address_type, NULL);
2264
2265         offset = netlogon_dissect_GUID(tvb, offset,
2266                 pinfo, tree, drep);
2267
2268         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2269                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2270                 "unknown", hf_netlogon_logon_dom, -1);
2271
2272         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2273                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2274                 "unknown", hf_netlogon_dns_forest_name, -1);
2275
2276         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2277                 hf_netlogon_flags, NULL);
2278
2279         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2280                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2281                 "unknown", hf_netlogon_dc_site_name, -1);
2282
2283         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2284                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2285                 "unknown", hf_netlogon_client_site_name, -1);
2286
2287         proto_item_set_len(item, offset-old_offset);
2288         return offset;
2289 }
2290
2291 static int
2292 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr(tvbuff_t *tvb, int offset,
2293                         packet_info *pinfo, proto_tree *tree,
2294                         char *drep)
2295 {
2296         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2297                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_PTR,
2298                 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2299
2300         return offset;
2301 }
2302
2303 static int
2304 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr(tvbuff_t *tvb, int offset,
2305                         packet_info *pinfo, proto_tree *tree,
2306                         char *drep)
2307 {
2308         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2309                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_PTR,
2310                 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2311
2312         return offset;
2313 }
2314
2315 static int
2316 netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
2317                         packet_info *pinfo, proto_tree *tree,
2318                         char *drep)
2319 {
2320         guint32 len;
2321         dcerpc_info *di;
2322
2323         di=pinfo->private_data;
2324         if(di->conformant_run){
2325                 /*just a run to handle conformant arrays, nothing to dissect.*/
2326                 return offset;
2327         }
2328
2329         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2330                 hf_netlogon_blob_size, &len);
2331
2332         proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
2333                 FALSE);
2334         offset += len;
2335
2336         return offset;
2337 }
2338
2339 static int
2340 netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
2341                         packet_info *pinfo, proto_tree *parent_tree,
2342                         char *drep)
2343 {
2344         proto_item *item=NULL;
2345         proto_tree *tree=NULL;
2346         int old_offset=offset;
2347
2348         if(parent_tree){
2349                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2350                         "BLOB:");
2351                 tree = proto_item_add_subtree(item, ett_BLOB);
2352         }
2353
2354         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2355                 hf_netlogon_blob_size, NULL);
2356
2357         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2358                 netlogon_dissect_BLOB_array, NDR_POINTER_PTR,
2359                 "BLOB:", -1, 0);
2360
2361         return offset;
2362 }
2363
2364 static int
2365 netlogon_dissect_BLOB_ptr(tvbuff_t *tvb, int offset,
2366                         packet_info *pinfo, proto_tree *tree,
2367                         char *drep)
2368 {
2369         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2370                 netlogon_dissect_BLOB, NDR_POINTER_PTR,
2371                 "BLOB pointer:", -1, 0);
2372
2373         return offset;
2374 }
2375
2376 static int
2377 netlogon_dissect_TYPE_46(tvbuff_t *tvb, int offset,
2378                         packet_info *pinfo, proto_tree *parent_tree,
2379                         char *drep)
2380 {
2381         proto_item *item=NULL;
2382         proto_tree *tree=NULL;
2383         int old_offset=offset;
2384
2385         if(parent_tree){
2386                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2387                         "TYPE_46:");
2388                 tree = proto_item_add_subtree(item, ett_TYPE_46);
2389         }
2390
2391         offset = netlogon_dissect_BLOB(tvb, offset,
2392                 pinfo, tree, drep);
2393
2394         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2395                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2396                 "unknown", hf_netlogon_workstation_fqdn, -1);
2397
2398         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2399                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2400                 "unknown", hf_netlogon_workstation_site_name, -1);
2401
2402         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2403                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2404                 "unknown", hf_netlogon_workstation_os, -1);
2405
2406         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2407                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2408                 "unknown", hf_netlogon_unknown_string, -1);
2409
2410         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2411                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2412                 "unknown", hf_netlogon_unknown_string, -1);
2413
2414         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2415                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2416                 "unknown", hf_netlogon_unknown_string, -1);
2417
2418         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2419                 hf_netlogon_unknown_string, 0);
2420
2421         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2422                 hf_netlogon_unknown_string, 0);
2423
2424         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2425                 hf_netlogon_unknown_string, 0);
2426
2427         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2428                 hf_netlogon_unknown_string, 0);
2429
2430         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2431                 hf_netlogon_unknown_long, NULL);
2432
2433         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2434                 hf_netlogon_unknown_long, NULL);
2435
2436         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2437                 hf_netlogon_unknown_long, NULL);
2438
2439         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2440                 hf_netlogon_unknown_long, NULL);
2441
2442         proto_item_set_len(item, offset-old_offset);
2443         return offset;
2444 }
2445
2446 static int
2447 netlogon_dissect_TYPE_48(tvbuff_t *tvb, int offset,
2448                         packet_info *pinfo, proto_tree *parent_tree,
2449                         char *drep)
2450 {
2451         proto_item *item=NULL;
2452         proto_tree *tree=NULL;
2453         int old_offset=offset;
2454
2455         if(parent_tree){
2456                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2457                         "TYPE_48:");
2458                 tree = proto_item_add_subtree(item, ett_TYPE_48);
2459         }
2460
2461         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2462                 hf_netlogon_unknown_string, 0);
2463
2464         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2465                 hf_netlogon_unknown_string, 0);
2466
2467         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2468                 hf_netlogon_unknown_string, 0);
2469
2470         offset = netlogon_dissect_GUID(tvb, offset,
2471                 pinfo, tree, drep);
2472
2473         offset = dissect_ndr_nt_PSID(tvb, offset,
2474                 pinfo, tree, drep);
2475
2476         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2477                 hf_netlogon_unknown_string, 0);
2478
2479         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2480                 hf_netlogon_unknown_string, 0);
2481
2482         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2483                 hf_netlogon_unknown_string, 0);
2484
2485         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2486                 hf_netlogon_unknown_string, 0);
2487
2488         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2489                 hf_netlogon_unknown_long, NULL);
2490
2491         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2492                 hf_netlogon_unknown_long, NULL);
2493
2494         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2495                 hf_netlogon_unknown_long, NULL);
2496
2497         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2498                 hf_netlogon_unknown_long, NULL);
2499
2500         offset = netlogon_dissect_BLOB(tvb, offset,
2501                 pinfo, tree, drep);
2502
2503         offset = netlogon_dissect_BLOB(tvb, offset,
2504                 pinfo, tree, drep);
2505
2506         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2507                 hf_netlogon_unknown_string, 0);
2508
2509         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2510                 hf_netlogon_unknown_string, 0);
2511
2512         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2513                 hf_netlogon_unknown_string, 0);
2514
2515         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2516                 hf_netlogon_unknown_string, 0);
2517
2518         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2519                 hf_netlogon_unknown_long, NULL);
2520
2521         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2522                 hf_netlogon_unknown_long, NULL);
2523
2524         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2525                 hf_netlogon_unknown_long, NULL);
2526
2527         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2528                 hf_netlogon_unknown_long, NULL);
2529
2530         proto_item_set_len(item, offset-old_offset);
2531         return offset;
2532 }
2533
2534 static int
2535 netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
2536                         packet_info *pinfo, proto_tree *parent_tree,
2537                         char *drep)
2538 {
2539         proto_item *item=NULL;
2540         proto_tree *tree=NULL;
2541         int old_offset=offset;
2542         int i;
2543
2544         if(parent_tree){
2545                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2546                         "UNICODE_STRING_512:");
2547                 tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
2548         }
2549
2550         for(i=0;i<512;i++){
2551                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2552                         hf_netlogon_unknown_short, NULL);
2553         }
2554
2555         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2556                 hf_netlogon_unknown_long, NULL);
2557
2558         proto_item_set_len(item, offset-old_offset);
2559         return offset;
2560 }
2561
2562 static int
2563 netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset,
2564                         packet_info *pinfo, proto_tree *tree,
2565                         char *drep)
2566 {
2567                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2568                         hf_netlogon_secure_channel_type, NULL);
2569
2570         return offset;
2571 }
2572
2573 static int
2574 netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
2575                         packet_info *pinfo, proto_tree *tree,
2576                         char *drep)
2577 {
2578                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2579                         hf_netlogon_unknown_char, NULL);
2580
2581         return offset;
2582 }
2583
2584 static int
2585 netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
2586                         packet_info *pinfo, proto_tree *tree,
2587                         char *drep)
2588 {
2589         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2590                 netlogon_dissect_element_844_byte);
2591
2592         return offset;
2593 }
2594
2595 static int
2596 netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
2597                         packet_info *pinfo, proto_tree *parent_tree,
2598                         char *drep)
2599 {
2600         proto_item *item=NULL;
2601         proto_tree *tree=NULL;
2602         int old_offset=offset;
2603
2604         if(parent_tree){
2605                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2606                         "TYPE_50:");
2607                 tree = proto_item_add_subtree(item, ett_TYPE_50);
2608         }
2609
2610         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2611                 hf_netlogon_unknown_long, NULL);
2612
2613         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2614                 netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
2615                 "unknown", hf_netlogon_unknown_string, 0);
2616
2617         proto_item_set_len(item, offset-old_offset);
2618         return offset;
2619 }
2620
2621 static int
2622 netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
2623                         packet_info *pinfo, proto_tree *tree,
2624                         char *drep)
2625 {
2626         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2627                 netlogon_dissect_TYPE_50, NDR_POINTER_PTR,
2628                 "TYPE_50 pointer: unknown_TYPE_50", -1, 0);
2629
2630         return offset;
2631 }
2632
2633 static int
2634 netlogon_dissect_TYPE_50_ptr_ptr(tvbuff_t *tvb, int offset,
2635                         packet_info *pinfo, proto_tree *tree,
2636                         char *drep)
2637 {
2638         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2639                 netlogon_dissect_TYPE_50_ptr, NDR_POINTER_PTR,
2640                 "TYPE_50* pointer: unknown_TYPE_50", -1, 0);
2641
2642         return offset;
2643 }
2644
2645 static int
2646 netlogon_dissect_element_861_byte(tvbuff_t *tvb, int offset,
2647                         packet_info *pinfo, proto_tree *tree,
2648                         char *drep)
2649 {
2650                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2651                         hf_netlogon_unknown_char, NULL);
2652
2653         return offset;
2654 }
2655
2656 static int
2657 netlogon_dissect_element_861_array(tvbuff_t *tvb, int offset,
2658                         packet_info *pinfo, proto_tree *tree,
2659                         char *drep)
2660 {
2661         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2662                 netlogon_dissect_element_861_byte);
2663
2664         return offset;
2665 }
2666
2667 static int
2668 netlogon_dissect_TYPE_51(tvbuff_t *tvb, int offset,
2669                         packet_info *pinfo, proto_tree *parent_tree,
2670                         char *drep)
2671 {
2672         proto_item *item=NULL;
2673         proto_tree *tree=NULL;
2674         int old_offset=offset;
2675
2676         if(parent_tree){
2677                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2678                         "TYPE_51:");
2679                 tree = proto_item_add_subtree(item, ett_TYPE_51);
2680         }
2681
2682         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2683                 hf_netlogon_unknown_long, NULL);
2684
2685         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2686                 netlogon_dissect_element_861_array, NDR_POINTER_UNIQUE,
2687                 "unknown", hf_netlogon_unknown_string, 0);
2688
2689         proto_item_set_len(item, offset-old_offset);
2690         return offset;
2691 }
2692
2693 static int
2694 netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
2695                         packet_info *pinfo, proto_tree *tree,
2696                         char *drep)
2697 {
2698                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2699                         hf_netlogon_unknown_char, NULL);
2700
2701         return offset;
2702 }
2703
2704 static int
2705 netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
2706                         packet_info *pinfo, proto_tree *tree,
2707                         char *drep)
2708 {
2709         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2710                 netlogon_dissect_element_865_byte);
2711
2712         return offset;
2713 }
2714
2715 static int
2716 netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
2717                         packet_info *pinfo, proto_tree *tree,
2718                         char *drep)
2719 {
2720                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2721                         hf_netlogon_unknown_char, NULL);
2722
2723         return offset;
2724 }
2725
2726 static int
2727 netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
2728                         packet_info *pinfo, proto_tree *tree,
2729                         char *drep)
2730 {
2731         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2732                 netlogon_dissect_element_866_byte);
2733
2734         return offset;
2735 }
2736
2737 static int
2738 netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
2739                         packet_info *pinfo, proto_tree *parent_tree,
2740                         char *drep)
2741 {
2742         proto_item *item=NULL;
2743         proto_tree *tree=NULL;
2744         int old_offset=offset;
2745
2746         if(parent_tree){
2747                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2748                         "TYPE_52:");
2749                 tree = proto_item_add_subtree(item, ett_TYPE_52);
2750         }
2751
2752         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2753                 hf_netlogon_unknown_long, NULL);
2754
2755         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2756                 netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
2757                 "unknown", hf_netlogon_unknown_string, 0);
2758
2759         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2760                 netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
2761                 "unknown", hf_netlogon_unknown_string, 0);
2762
2763         proto_item_set_len(item, offset-old_offset);
2764         return offset;
2765 }
2766
2767 static int
2768 netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
2769                         packet_info *pinfo, proto_tree *tree,
2770                         char *drep)
2771 {
2772         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2773                 netlogon_dissect_TYPE_52, NDR_POINTER_PTR,
2774                 "TYPE_52 pointer: unknown_TYPE_52", -1, 0);
2775         return offset;
2776 }
2777
2778 static int
2779 netlogon_dissect_TYPE_52_ptr_ptr(tvbuff_t *tvb, int offset,
2780                         packet_info *pinfo, proto_tree *tree,
2781                         char *drep)
2782 {
2783         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2784                 netlogon_dissect_TYPE_52_ptr, NDR_POINTER_PTR,
2785                 "TYPE_52* pointer: unknown_TYPE_52", -1, 0);
2786         return offset;
2787 }
2788
2789 static int
2790 netlogon_dissect_NETLOGON_LEVEL(tvbuff_t *tvb, int offset,
2791                         packet_info *pinfo, proto_tree *parent_tree,
2792                         char *drep)
2793 {
2794         proto_item *item=NULL;
2795         proto_tree *tree=NULL;
2796         int old_offset=offset;
2797         guint16 level;
2798
2799         if(parent_tree){
2800                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2801                         "NETLOGON_LEVEL:");
2802                 tree = proto_item_add_subtree(item, ett_NETLOGON_LEVEL);
2803         }
2804
2805         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2806                 hf_netlogon_level, &level);
2807
2808         ALIGN_TO_4_BYTES;
2809         switch(level){
2810         case 1:
2811                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2812                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2813                         "INTERACTIVE_INFO pointer:", -1, 0);
2814                 break;
2815         case 2:
2816                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2817                         netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2818                         "NETWORK_INFO pointer:", -1, 0);
2819                 break;
2820         case 3:
2821                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2822                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2823                         "INTERACTIVE_INFO pointer:", -1, 0);
2824                 break;
2825         case 5:
2826                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2827                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2828                         "INTERACTIVE_INFO pointer:", -1, 0);
2829                 break;
2830         case 6:
2831                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2832                         netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2833                         "NETWORK_INFO pointer:", -1, 0);
2834                 break;
2835         case 7:
2836                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2837                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2838                         "INTERACTIVE_INFO pointer:", -1, 0);
2839                 break;
2840         }
2841
2842         proto_item_set_len(item, offset-old_offset);
2843         return offset;
2844 }
2845
2846 static int
2847 netlogon_dissect_NETLOGON_VALIDATION(tvbuff_t *tvb, int offset,
2848                         packet_info *pinfo, proto_tree *parent_tree,
2849                         char *drep)
2850 {
2851         proto_item *item=NULL;
2852         proto_tree *tree=NULL;
2853         int old_offset=offset;
2854         guint16 level;
2855
2856         if(parent_tree){
2857                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2858                         "NETLOGON_VALIDATION:");
2859                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION);
2860         }
2861
2862         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2863                 hf_netlogon_level, &level);
2864
2865         /* XXX i am not sure about these pointers being UNIQUE, though I am
2866            pretty convinced that they are NOT PTR as the idl file suggests.
2867         */
2868         ALIGN_TO_4_BYTES;
2869         switch(level){
2870         case 2:
2871                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2872                         netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1, NDR_POINTER_UNIQUE,
2873                         "NETLOGON_VALIDATION_SAM_INFO1 pointer:", -1, 0);
2874                 break;
2875         case 3:
2876                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2877                         netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE,
2878                         "NETLOGON_VALIDATION_SAM_INFO2 pointer:", -1, 0);
2879                 break;
2880         case 4:
2881                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2882                         netlogon_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
2883                         "STRING pointer:", -1, 0);
2884                 break;
2885         case 5:
2886                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2887                         netlogon_dissect_BLOB_ptr, NDR_POINTER_UNIQUE,
2888                         "BLOB pointer:", -1, 0);
2889                 break;
2890         }
2891
2892         proto_item_set_len(item, offset-old_offset);
2893         return offset;
2894 }
2895
2896
2897 static int
2898 netlogon_dissect_TYPE_19(tvbuff_t *tvb, int offset,
2899                         packet_info *pinfo, proto_tree *parent_tree,
2900                         char *drep)
2901 {
2902         proto_item *item=NULL;
2903         proto_tree *tree=NULL;
2904         int old_offset=offset;
2905         guint16 level;
2906
2907         if(parent_tree){
2908                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2909                         "TYPE_19:");
2910                 tree = proto_item_add_subtree(item, ett_TYPE_19);
2911         }
2912
2913         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2914                 hf_netlogon_level, &level);
2915
2916         ALIGN_TO_4_BYTES;
2917         switch(level){
2918         case 1:
2919                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2920                         hf_netlogon_unknown_long, NULL);
2921                 break;
2922         case 2:
2923                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2924                         hf_netlogon_unknown_long, NULL);
2925                 break;
2926         case 3:
2927                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2928                         hf_netlogon_unknown_long, NULL);
2929                 break;
2930         case 4:
2931                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2932                         hf_netlogon_unknown_long, NULL);
2933                 break;
2934         case 5:
2935                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2936                         hf_netlogon_unknown_long, NULL);
2937                 break;
2938         case 6:
2939                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2940                         hf_netlogon_unknown_long, NULL);
2941                 break;
2942         case 7:
2943                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2944                         hf_netlogon_unknown_long, NULL);
2945                 break;
2946         case 8:
2947                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2948                         hf_netlogon_unknown_long, NULL);
2949                 break;
2950         case 9:
2951                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2952                         hf_netlogon_unknown_long, NULL);
2953                 break;
2954         case 10:
2955                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2956                         hf_netlogon_unknown_long, NULL);
2957                 break;
2958         case 11:
2959                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2960                         hf_netlogon_unknown_long, NULL);
2961                 break;
2962         case 12:
2963                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2964                         hf_netlogon_unknown_long, NULL);
2965                 break;
2966         case 20:
2967                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2968                         hf_netlogon_unknown_long, NULL);
2969                 break;
2970         case 21:
2971                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2972                         hf_netlogon_unknown_long, NULL);
2973                 break;
2974         case 13:
2975                 offset = dissect_ndr_nt_PSID(tvb, offset,
2976                         pinfo, tree, drep);
2977                 break;
2978         case 14:
2979                 offset = dissect_ndr_nt_PSID(tvb, offset,
2980                         pinfo, tree, drep);
2981                 break;
2982         case 15:
2983                 offset = dissect_ndr_nt_PSID(tvb, offset,
2984                         pinfo, tree, drep);
2985                 break;
2986         case 16:
2987                 offset = dissect_ndr_nt_PSID(tvb, offset,
2988                         pinfo, tree, drep);
2989                 break;
2990         case 17:
2991                 offset = dissect_ndr_nt_PSID(tvb, offset,
2992                         pinfo, tree, drep);
2993                 break;
2994         case 18:
2995                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2996                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2997                         "unknown", hf_netlogon_unknown_string, -1);
2998                 break;
2999         case 19:
3000                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3001                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
3002                         "unknown", hf_netlogon_unknown_string, -1);
3003                 break;
3004         }
3005
3006         proto_item_set_len(item, offset-old_offset);
3007         return offset;
3008 }
3009
3010
3011 static int
3012 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO(tvbuff_t *tvb, int offset,
3013                         packet_info *pinfo, proto_tree *parent_tree,
3014                         char *drep)
3015 {
3016         proto_item *item=NULL;
3017         proto_tree *tree=NULL;
3018         int old_offset=offset;
3019         guint32 level;
3020
3021         if(parent_tree){
3022                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3023                         "NETLOGON_CONTROL_QUERY_INFO:");
3024                 tree = proto_item_add_subtree(item, ett_NETLOGON_CONTROL_QUERY_INFO);
3025         }
3026
3027         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3028                 hf_netlogon_level_long, &level);
3029
3030         ALIGN_TO_4_BYTES;
3031         switch(level){
3032         case 5:
3033                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3034                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
3035                         "unknown", hf_netlogon_unknown_string, -1);
3036                 break;
3037         case 6:
3038                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3039                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
3040                         "unknown", hf_netlogon_unknown_string, -1);
3041                 break;
3042         case 0xfffe:
3043                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3044                         hf_netlogon_unknown_long, NULL);
3045                 break;
3046         case 8:
3047                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3048                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
3049                         "unknown", hf_netlogon_unknown_string, -1);
3050                 break;
3051         }
3052
3053         proto_item_set_len(item, offset-old_offset);
3054         return offset;
3055 }
3056
3057
3058 static int
3059 netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
3060                         packet_info *pinfo, proto_tree *parent_tree,
3061                         char *drep)
3062 {
3063         proto_item *item=NULL;
3064         proto_tree *tree=NULL;
3065         int old_offset=offset;
3066         guint32 level;
3067
3068         if(parent_tree){
3069                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3070                         "TYPE_44:");
3071                 tree = proto_item_add_subtree(item, ett_TYPE_44);
3072         }
3073
3074         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3075                 hf_netlogon_level_long, &level);
3076
3077         ALIGN_TO_4_BYTES;
3078         switch(level){
3079         case 1:
3080                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3081                         hf_netlogon_unknown_long, NULL);
3082                 break;
3083         }
3084
3085         proto_item_set_len(item, offset-old_offset);
3086         return offset;
3087 }
3088
3089 static int
3090 netlogon_dissect_TYPE_20(tvbuff_t *tvb, int offset,
3091                         packet_info *pinfo, proto_tree *parent_tree,
3092                         char *drep)
3093 {
3094         proto_item *item=NULL;
3095         proto_tree *tree=NULL;
3096         int old_offset=offset;
3097         guint16 level;
3098
3099         if(parent_tree){
3100                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3101                         "TYPE_20:");
3102                 tree = proto_item_add_subtree(item, ett_TYPE_20);
3103         }
3104
3105         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3106                 hf_netlogon_level, &level);
3107
3108         ALIGN_TO_4_BYTES;
3109         switch(level){
3110         case 1:
3111                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3112                         netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO, NDR_POINTER_PTR,
3113                         "NETLOGON_SAM_DOMAIN_INFO pointer:", -1, 0);
3114                 break;
3115         case 2:
3116                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3117                         netlogon_dissect_NETLOGON_SAM_GROUP_INFO, NDR_POINTER_PTR,
3118                         "NETLOGON_SAM_GROUP_INFO pointer:", -1, 0);
3119                 break;
3120         case 4:
3121                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3122                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3123                         "TYPE_23 pointer:", -1, 0);
3124                 break;
3125         case 5:
3126                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3127                         netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO, NDR_POINTER_PTR,
3128                         "NETLOGON_SAM_ACCOUNT_INFO pointer:", -1, 0);
3129                 break;
3130         case 7:
3131                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3132                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3133                         "TYPE_23 pointer:", -1, 0);
3134                 break;
3135         case 8:
3136                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3137                         netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO, NDR_POINTER_PTR,
3138                         "NETLOGON_SAM_GROUP_MEM_INFO pointer:", -1, 0);
3139                 break;
3140         case 9:
3141                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3142                         netlogon_dissect_NETLOGON_SAM_ALIAS_INFO, NDR_POINTER_PTR,
3143                         "NETLOGON_SAM_ALIAS_INFO pointer:", -1, 0);
3144                 break;
3145         case 11:
3146                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3147                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3148                         "TYPE_23 pointer:", -1, 0);
3149                 break;
3150         case 12:
3151                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3152                         netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO, NDR_POINTER_PTR,
3153                         "NETLOGON_SAM_ALIAS_MEM_INFO pointer:", -1, 0);
3154                 break;
3155         case 13:
3156                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3157                         netlogon_dissect_TYPE_29, NDR_POINTER_PTR,
3158                         "TYPE_29 pointer:", -1, 0);
3159                 break;
3160         case 14:
3161                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3162                         netlogon_dissect_TYPE_31, NDR_POINTER_PTR,
3163                         "TYPE_31 pointer:", -1, 0);
3164                 break;
3165         case 16:
3166                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3167                         netlogon_dissect_TYPE_33, NDR_POINTER_PTR,
3168                         "TYPE_33 pointer:", -1, 0);
3169                 break;
3170         case 18:
3171                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3172                         netlogon_dissect_TYPE_34, NDR_POINTER_PTR,
3173                         "TYPE_34 pointer:", -1, 0);
3174                 break;
3175         case 20:
3176                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3177                         netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3178                         "TYPE_35 pointer:", -1, 0);
3179                 break;
3180         case 21:
3181                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3182                         netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3183                         "TYPE_35 pointer:", -1, 0);
3184                 break;
3185         case 22:
3186                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3187                         netlogon_dissect_TYPE_16, NDR_POINTER_PTR,
3188                         "TYPE_16 pointer:", -1, 0);
3189                 break;
3190         }
3191
3192         proto_item_set_len(item, offset-old_offset);
3193         return offset;
3194 }
3195
3196 static int
3197 netlogon_dissect_SAM_DELTA(tvbuff_t *tvb, int offset,
3198                         packet_info *pinfo, proto_tree *parent_tree,
3199                         char *drep)
3200 {
3201         proto_item *item=NULL;
3202         proto_tree *tree=NULL;
3203         int old_offset=offset;
3204
3205         if(parent_tree){
3206                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3207                         "SAM_DELTA:");
3208                 tree = proto_item_add_subtree(item, ett_SAM_DELTA);
3209         }
3210
3211         offset = netlogon_dissect_TYPE_19(tvb, offset,
3212                 pinfo, tree, drep);
3213
3214         offset = netlogon_dissect_TYPE_20(tvb, offset,
3215                 pinfo, tree, drep);
3216
3217         proto_item_set_len(item, offset-old_offset);
3218         return offset;
3219 }
3220
3221 static int
3222 netlogon_dissect_SAM_DELTA_array(tvbuff_t *tvb, int offset,
3223                         packet_info *pinfo, proto_tree *tree,
3224                         char *drep)
3225 {
3226         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3227                 netlogon_dissect_SAM_DELTA);
3228
3229         return offset;
3230 }
3231
3232 static int
3233 netlogon_dissect_SAM_DELTA_ARRAY(tvbuff_t *tvb, int offset,
3234                         packet_info *pinfo, proto_tree *parent_tree,
3235                         char *drep)
3236 {
3237         proto_item *item=NULL;
3238         proto_tree *tree=NULL;
3239         int old_offset=offset;
3240
3241         if(parent_tree){
3242                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3243                         "SAM_DELTA_ARRAY:");
3244                 tree = proto_item_add_subtree(item, ett_SAM_DELTA_ARRAY);
3245         }
3246
3247         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3248                 hf_netlogon_num_deltas, NULL);
3249
3250         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3251                 netlogon_dissect_SAM_DELTA_array, NDR_POINTER_UNIQUE,
3252                 "unknown", -1, 0);
3253
3254         proto_item_set_len(item, offset-old_offset);
3255         return offset;
3256 }
3257
3258 static int
3259 netlogon_dissect_SAM_DELTA_ARRAY_ptr(tvbuff_t *tvb, int offset,
3260                         packet_info *pinfo, proto_tree *tree,
3261                         char *drep)
3262 {
3263         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3264                 netlogon_dissect_SAM_DELTA_ARRAY, NDR_POINTER_PTR,
3265                 "SAM_DELTA_ARRAY pointer: deltas", -1, 0);
3266
3267         return offset;
3268 }
3269
3270 static int
3271 netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset,
3272                         packet_info *pinfo, proto_tree *tree,
3273                         char *drep)
3274 {
3275         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3276                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3277                 "Handle:", hf_netlogon_logonsrv_handle, -1);
3278
3279         return offset;
3280 }
3281
3282 static int
3283 netlogon_dissect_NETLOGON_INFO(tvbuff_t *tvb, int offset,
3284                         packet_info *pinfo, proto_tree *parent_tree,
3285                         char *drep)
3286 {
3287         proto_item *item=NULL;
3288         proto_tree *tree=NULL;
3289         int old_offset=offset;
3290         guint32 level;
3291
3292         if(parent_tree){
3293                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3294                         "NETLOGON_INFO:");
3295                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO);
3296         }
3297
3298         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3299                 hf_netlogon_level_long, &level);
3300
3301         ALIGN_TO_4_BYTES;
3302         switch(level){
3303         case 1:
3304                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3305                         netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_PTR,
3306                         "NETLOGON_INFO_1 pointer:", -1, 0);
3307                 break;
3308         case 2:
3309                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3310                         netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_PTR,
3311                         "NETLOGON_INFO_2 pointer:", -1, 0);
3312                 break;
3313         case 3:
3314                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3315                         netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_PTR,
3316                         "NETLOGON_INFO_3 pointer:", -1, 0);
3317                 break;
3318         case 4:
3319                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3320                         netlogon_dissect_NETLOGON_INFO_4, NDR_POINTER_PTR,
3321                         "NETLOGON_INFO_4 pointer:", -1, 0);
3322                 break;
3323         }
3324
3325         proto_item_set_len(item, offset-old_offset);
3326         return offset;
3327 }
3328
3329 static int
3330 netlogon_dissect_TYPE_45(tvbuff_t *tvb, int offset,
3331                         packet_info *pinfo, proto_tree *parent_tree,
3332                         char *drep)
3333 {
3334         proto_item *item=NULL;
3335         proto_tree *tree=NULL;
3336         int old_offset=offset;
3337         guint32 level;
3338
3339         if(parent_tree){
3340                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3341                         "TYPE_45:");
3342                 tree = proto_item_add_subtree(item, ett_TYPE_45);
3343         }
3344
3345         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3346                 hf_netlogon_level_long, &level);
3347
3348         ALIGN_TO_4_BYTES;
3349         switch(level){
3350         case 1:
3351                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3352                         netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3353                         "TYPE_46 pointer:", -1, 0);
3354                 break;
3355         case 2:
3356                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3357                         netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3358                         "TYPE_46 pointer:", -1, 0);
3359                 break;
3360         }
3361
3362         proto_item_set_len(item, offset-old_offset);
3363         return offset;
3364 }
3365
3366 static int
3367 netlogon_dissect_TYPE_47(tvbuff_t *tvb, int offset,
3368                         packet_info *pinfo, proto_tree *parent_tree,
3369                         char *drep)
3370 {
3371         proto_item *item=NULL;
3372         proto_tree *tree=NULL;
3373         int old_offset=offset;
3374         guint32 level;
3375
3376         if(parent_tree){
3377                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3378                         "TYPE_47:");
3379                 tree = proto_item_add_subtree(item, ett_TYPE_47);
3380         }
3381
3382         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3383                 hf_netlogon_level_long, &level);
3384
3385         ALIGN_TO_4_BYTES;
3386         switch(level){
3387         case 1:
3388                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3389                         netlogon_dissect_TYPE_48, NDR_POINTER_PTR,
3390                         "TYPE_48 pointer:", -1, 0);
3391                 break;
3392         case 2:
3393                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3394                         netlogon_dissect_UNICODE_MULTI, NDR_POINTER_PTR,
3395                         "UNICODE_MULTI pointer:", -1, 0);
3396                 break;
3397         }
3398
3399         proto_item_set_len(item, offset-old_offset);
3400         return offset;
3401 }
3402
3403
3404 static int
3405 netlogon_dissect_function_00_rqst(tvbuff_t *tvb, int offset,
3406         packet_info *pinfo, proto_tree *tree, char *drep)
3407 {
3408         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3409                 pinfo, tree, drep);
3410
3411         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3412                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3413                 "unknown string", hf_netlogon_unknown_string, -1);
3414
3415         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3416                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3417                 "unknown string", hf_netlogon_unknown_string, -1);
3418
3419         return offset;
3420 }
3421
3422
3423 static int
3424 netlogon_dissect_function_00_reply(tvbuff_t *tvb, int offset,
3425         packet_info *pinfo, proto_tree *tree, char *drep)
3426 {
3427         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3428                 netlogon_dissect_TYPE_1_ptr, NDR_POINTER_REF,
3429                 "TYPE_1* pointer: unknown_TYPE_1", -1, 0);
3430
3431         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3432                 hf_netlogon_rc, NULL);
3433
3434         return offset;
3435 }
3436
3437 static int
3438 netlogon_dissect_function_01_rqst(tvbuff_t *tvb, int offset,
3439         packet_info *pinfo, proto_tree *tree, char *drep)
3440 {
3441         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3442                 pinfo, tree, drep);
3443
3444         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3445                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3446                 "unknown string", hf_netlogon_unknown_string, -1);
3447
3448         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3449                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3450                 "unknown string", hf_netlogon_unknown_string, -1);
3451
3452         return offset;
3453 }
3454
3455
3456 static int
3457 netlogon_dissect_function_01_reply(tvbuff_t *tvb, int offset,
3458         packet_info *pinfo, proto_tree *tree, char *drep)
3459 {
3460         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3461                 netlogon_dissect_TYPE_2, NDR_POINTER_REF,
3462                 "TYPE_2 pointer: unknown_TYPE_2", -1, 0);
3463
3464         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3465                 hf_netlogon_rc, NULL);
3466
3467         return offset;
3468 }
3469
3470 static int
3471 netlogon_dissect_netlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
3472         packet_info *pinfo, proto_tree *tree, char *drep)
3473 {
3474         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3475                 pinfo, tree, drep);
3476
3477         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3478                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3479                 "Computer Name:", hf_netlogon_computer_name, -1);
3480
3481         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3482                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3483                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3484
3485         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3486                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3487                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3488
3489         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3490                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3491                 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3492
3493         return offset;
3494 }
3495
3496
3497 static int
3498 netlogon_dissect_netlogonsamlogon_reply(tvbuff_t *tvb, int offset,
3499         packet_info *pinfo, proto_tree *tree, char *drep)
3500 {
3501         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3502                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3503                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3504
3505         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3506                 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_REF,
3507                 "NETLOGON_VALIDATION pointer: ctr", -1, 0);
3508
3509         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3510                 netlogon_dissect_pointer_char, NDR_POINTER_REF,
3511                 "BOOLEAN pointer: Authoritative", hf_netlogon_authoritative, 0);
3512
3513         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3514                 hf_netlogon_rc, NULL);
3515
3516         return offset;
3517 }
3518
3519 static int
3520 netlogon_dissect_netlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
3521         packet_info *pinfo, proto_tree *tree, char *drep)
3522 {
3523         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3524                 pinfo, tree, drep);
3525
3526         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3527                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3528                 "unknown string", hf_netlogon_unknown_string, -1);
3529
3530         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3531                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3532                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3533
3534         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3535                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3536                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3537
3538         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3539                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3540                 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3541
3542         return offset;
3543 }
3544
3545
3546 static int
3547 netlogon_dissect_netlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
3548         packet_info *pinfo, proto_tree *tree, char *drep)
3549 {
3550
3551         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3552                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3553                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3554
3555         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3556                 hf_netlogon_rc, NULL);
3557
3558         return offset;
3559 }
3560
3561 static int
3562 netlogon_dissect_netserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
3563         packet_info *pinfo, proto_tree *tree, char *drep)
3564 {
3565         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3566                 pinfo, tree, drep);
3567
3568         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3569                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3570                 "logon_client", hf_netlogon_client_name, -1);
3571
3572         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3573                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3574                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3575
3576         return offset;
3577 }
3578
3579
3580 static int
3581 netlogon_dissect_netserverreqchallenge_reply(tvbuff_t *tvb, int offset,
3582         packet_info *pinfo, proto_tree *tree, char *drep)
3583 {
3584         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3585                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3586                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3587
3588         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3589                 hf_netlogon_rc, NULL);
3590
3591         return offset;
3592 }
3593
3594 static int
3595 netlogon_dissect_netserverauthenticate_rqst(tvbuff_t *tvb, int offset,
3596         packet_info *pinfo, proto_tree *tree, char *drep)
3597 {
3598         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3599                 pinfo, tree, drep);
3600
3601         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3602                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3603                 "acct_name", hf_netlogon_acct_name, -1);
3604
3605         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3606                 pinfo, tree, drep);
3607
3608         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3609                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3610                 "computer_name", hf_netlogon_computer_name, -1);
3611
3612         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3613                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3614                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3615
3616         return offset;
3617 }
3618
3619
3620 static int
3621 netlogon_dissect_netserverauthenticate_reply(tvbuff_t *tvb, int offset,
3622         packet_info *pinfo, proto_tree *tree, char *drep)
3623 {
3624         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3625                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3626                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3627
3628         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3629                 hf_netlogon_rc, NULL);
3630
3631         return offset;
3632 }
3633
3634 static int
3635 netlogon_dissect_netserverpasswordset_rqst(tvbuff_t *tvb, int offset,
3636         packet_info *pinfo, proto_tree *tree, char *drep)
3637 {
3638         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3639                 pinfo, tree, drep);
3640
3641         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3642                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3643                 "acct_name", hf_netlogon_acct_name, -1);
3644
3645         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3646                 pinfo, tree, drep);
3647
3648         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3649                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3650                 "computer_name", hf_netlogon_computer_name, -1);
3651
3652         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3653                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3654                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3655
3656         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3657                 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF,
3658                 "ENCRYPTED_LM_OWF_PASSWORD pointer: hashed_pwd", -1, 0);
3659
3660         return offset;
3661 }
3662
3663
3664 static int
3665 netlogon_dissect_netserverpasswordset_reply(tvbuff_t *tvb, int offset,
3666         packet_info *pinfo, proto_tree *tree, char *drep)
3667 {
3668         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3669                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3670                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3671
3672         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3673                 hf_netlogon_rc, NULL);
3674
3675         return offset;
3676 }
3677
3678 static int
3679 netlogon_dissect_netsamdeltas_rqst(tvbuff_t *tvb, int offset,
3680         packet_info *pinfo, proto_tree *tree, char *drep)
3681 {
3682         /* XXX idl file has LOGONSRV_HANDLE here, ms capture has string srv_name */
3683         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3684                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3685                 "srv_name", hf_netlogon_logon_srv, -1);
3686
3687         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3688                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3689                 "cli_name", hf_netlogon_cli_name, -1);
3690
3691         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3692                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3693                 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3694
3695         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3696                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3697                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3698
3699         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3700                 hf_netlogon_database_id, NULL);
3701
3702         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3703                 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3704                 "TYPE_16 pointer: dom_mod_count", -1, 0);
3705
3706         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3707                 hf_netlogon_max_size, NULL);
3708         return offset;
3709 }
3710
3711
3712 static int
3713 netlogon_dissect_netsamdeltas_reply(tvbuff_t *tvb, int offset,
3714         packet_info *pinfo, proto_tree *tree, char *drep)
3715 {
3716         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3717                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3718                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3719
3720         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3721                 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3722                 "TYPE_16 pointer: dom_mod_count", -1, 0);
3723
3724         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3725                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3726                 "SAM_DELTA_ARRAY_ptr pointer: deltas", -1, 0);
3727
3728         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3729                 hf_netlogon_rc, NULL);
3730
3731         return offset;
3732 }
3733
3734 static int
3735 netlogon_dissect_function_08_rqst(tvbuff_t *tvb, int offset,
3736         packet_info *pinfo, proto_tree *tree, char *drep)
3737 {
3738         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3739                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3740                 "srv_name", hf_netlogon_logon_srv, -1);
3741
3742         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3743                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3744                 "cli_name", hf_netlogon_cli_name, -1);
3745
3746         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3747                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3748                 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3749
3750         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3751                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3752                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3753
3754         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3755                 hf_netlogon_unknown_long, NULL);
3756
3757         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3758                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3759                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3760
3761         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3762                 hf_netlogon_unknown_long, NULL);
3763         return offset;
3764 }
3765
3766
3767 static int
3768 netlogon_dissect_function_08_reply(tvbuff_t *tvb, int offset,
3769         packet_info *pinfo, proto_tree *tree, char *drep)
3770 {
3771         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3772                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3773                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3774
3775         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3776                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3777                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3778
3779         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3780                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3781                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
3782
3783         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3784                 hf_netlogon_rc, NULL);
3785
3786         return offset;
3787 }
3788
3789 static int
3790 netlogon_dissect_function_09_rqst(tvbuff_t *tvb, int offset,
3791         packet_info *pinfo, proto_tree *tree, char *drep)
3792 {
3793         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3794                 pinfo, tree, drep);
3795
3796         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3797                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3798                 "unknown string", hf_netlogon_unknown_string, -1);
3799
3800         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3801                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3802                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3803
3804         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3805                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3806                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3807
3808         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3809                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3810                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3811
3812         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3813                 hf_netlogon_unknown_long, NULL);
3814
3815         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3816                 hf_netlogon_unknown_long, NULL);
3817
3818         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3819                 hf_netlogon_unknown_long, NULL);
3820         return offset;
3821 }
3822
3823
3824 static int
3825 netlogon_dissect_function_09_reply(tvbuff_t *tvb, int offset,
3826         packet_info *pinfo, proto_tree *tree, char *drep)
3827 {
3828         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3829                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3830                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3831
3832         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3833                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3834                 "BYTE_array pointer: unknown_BYTE", -1, 0);
3835
3836         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3837                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3838                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3839
3840         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3841                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3842                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3843
3844         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3845                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3846                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3847
3848         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3849                 hf_netlogon_rc, NULL);
3850
3851         return offset;
3852 }
3853
3854 static int
3855 netlogon_dissect_function_0a_rqst(tvbuff_t *tvb, int offset,
3856         packet_info *pinfo, proto_tree *tree, char *drep)
3857 {
3858         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3859                 pinfo, tree, drep);
3860
3861         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3862                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3863                 "unknown string", hf_netlogon_unknown_string, -1);
3864
3865         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3866                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3867                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3868
3869         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3870                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3871                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3872
3873         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3874                 hf_netlogon_unknown_long, NULL);
3875
3876         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3877                 hf_netlogon_unknown_long, NULL);
3878
3879         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3880                 hf_netlogon_unknown_long, NULL);
3881
3882         return offset;
3883 }
3884
3885
3886 static int
3887 netlogon_dissect_function_0a_reply(tvbuff_t *tvb, int offset,
3888         packet_info *pinfo, proto_tree *tree, char *drep)
3889 {
3890         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3891                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3892                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3893
3894         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3895                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3896                 "BYTE_array pointer: unknown_BYTE", -1, 0);
3897
3898         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3899                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3900                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3901
3902         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3903                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3904                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3905
3906         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3907                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3908                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3909
3910         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3911                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3912                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3913
3914         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3915                 hf_netlogon_rc, NULL);
3916
3917         return offset;
3918 }
3919
3920 static int
3921 netlogon_dissect_function_0b_rqst(tvbuff_t *tvb, int offset,
3922         packet_info *pinfo, proto_tree *tree, char *drep)
3923 {
3924
3925         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3926                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3927                 "unknown string", hf_netlogon_unknown_string, -1);
3928
3929         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3930                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3931                 "unknown string", hf_netlogon_unknown_string, -1);
3932
3933         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3934                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3935                 "WCHAR* pointer: unknown string", -1, 0);
3936         return offset;
3937 }
3938
3939
3940 static int
3941 netlogon_dissect_function_0b_reply(tvbuff_t *tvb, int offset,
3942         packet_info *pinfo, proto_tree *tree, char *drep)
3943 {
3944         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3945                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3946                 "WCHAR* pointer: unknown string", -1, 0);
3947
3948         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3949                 hf_netlogon_rc, NULL);
3950
3951         return offset;
3952 }
3953
3954 static int
3955 netlogon_dissect_netlogoncontrol_rqst(tvbuff_t *tvb, int offset,
3956         packet_info *pinfo, proto_tree *tree, char *drep)
3957 {
3958         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3959                 pinfo, tree, drep);
3960
3961         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3962                 hf_netlogon_code, NULL);
3963
3964         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3965                 hf_netlogon_level, NULL);
3966
3967         return offset;
3968 }
3969
3970
3971 static int
3972 netlogon_dissect_netlogoncontrol_reply(tvbuff_t *tvb, int offset,
3973         packet_info *pinfo, proto_tree *tree, char *drep)
3974 {
3975         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3976                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3977                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3978
3979         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3980                 hf_netlogon_rc, NULL);
3981
3982         return offset;
3983 }
3984
3985 static int
3986 netlogon_dissect_function_0d_rqst(tvbuff_t *tvb, int offset,
3987         packet_info *pinfo, proto_tree *tree, char *drep)
3988 {
3989         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3990                 pinfo, tree, drep);
3991
3992         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3993                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3994                 "unknown string", hf_netlogon_unknown_string, -1);
3995
3996         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3997                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3998                 "WCHAR* pointer: unknown string", -1, 0);
3999         return offset;
4000 }
4001
4002
4003 static int
4004 netlogon_dissect_function_0d_reply(tvbuff_t *tvb, int offset,
4005         packet_info *pinfo, proto_tree *tree, char *drep)
4006 {
4007         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4008                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
4009                 "WCHAR* pointer: unknown string", -1, 0);
4010
4011         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4012                 hf_netlogon_rc, NULL);
4013
4014         return offset;
4015 }
4016
4017 static int
4018 netlogon_dissect_netlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
4019         packet_info *pinfo, proto_tree *tree, char *drep)
4020 {
4021         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4022                 pinfo, tree, drep);
4023
4024         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4025                 hf_netlogon_code, NULL);
4026
4027         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4028                 hf_netlogon_level, NULL);
4029
4030         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4031                 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
4032                 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
4033
4034         return offset;
4035 }
4036
4037
4038 static int
4039 netlogon_dissect_netlogoncontrol2_reply(tvbuff_t *tvb, int offset,
4040         packet_info *pinfo, proto_tree *tree, char *drep)
4041 {
4042         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4043                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
4044                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
4045
4046         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4047                 hf_netlogon_rc, NULL);
4048
4049         return offset;
4050 }
4051
4052 static int
4053 netlogon_dissect_netserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
4054         packet_info *pinfo, proto_tree *tree, char *drep)
4055 {
4056         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4057                 pinfo, tree, drep);
4058
4059         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4060                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
4061                 "acct_name", hf_netlogon_acct_name, -1);
4062
4063         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4064                 pinfo, tree, drep);
4065
4066         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4067                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
4068                 "computer_name", hf_netlogon_computer_name, -1);
4069
4070         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4071                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4072                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
4073
4074         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4075                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4076                 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4077         return offset;
4078 }
4079
4080
4081 static int
4082 netlogon_dissect_netserverauthenticate2_reply(tvbuff_t *tvb, int offset,
4083         packet_info *pinfo, proto_tree *tree, char *drep)
4084 {
4085         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4086                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4087                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
4088
4089         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4090                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4091                 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4092
4093         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4094                 hf_netlogon_rc, NULL);
4095
4096         return offset;
4097 }
4098
4099 static int
4100 netlogon_dissect_netdatabasesync2_rqst(tvbuff_t *tvb, int offset,
4101         packet_info *pinfo, proto_tree *tree, char *drep)
4102 {
4103         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4104                 pinfo, tree, drep);
4105
4106         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4107                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
4108                 "unknown string", hf_netlogon_unknown_string, -1);
4109
4110         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4111                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4112                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4113
4114         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4115                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4116                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4117
4118         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4119                 hf_netlogon_unknown_long, NULL);
4120
4121         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4122                 hf_netlogon_unknown_short, NULL);
4123
4124         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4125                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4126                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4127
4128         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4129                 hf_netlogon_unknown_long, NULL);
4130
4131         return offset;
4132 }
4133
4134
4135 static int
4136 netlogon_dissect_netdatabasesync2_reply(tvbuff_t *tvb, int offset,
4137         packet_info *pinfo, proto_tree *tree, char *drep)
4138 {
4139         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4140                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4141                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4142
4143         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4144                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4145                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4146
4147         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4148                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4149                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4150
4151         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4152                 hf_netlogon_rc, NULL);
4153
4154         return offset;
4155 }
4156
4157 static int
4158 netlogon_dissect_function_11_rqst(tvbuff_t *tvb, int offset,
4159         packet_info *pinfo, proto_tree *tree, char *drep)
4160 {
4161         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4162                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
4163                 "unknown string", hf_netlogon_unknown_string, -1);
4164
4165         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4166                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
4167                 "unknown string", hf_netlogon_unknown_string, -1);
4168
4169         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4170                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4171                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4172
4173         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4174                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4175                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4176
4177         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4178                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
4179                 "BYTE pointer: unknown_BYTE", -1, 0);
4180
4181         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4182                 hf_netlogon_unknown_long, NULL);
4183
4184         return offset;
4185 }
4186
4187
4188 static int
4189 netlogon_dissect_function_11_reply(tvbuff_t *tvb, int offset,
4190         packet_info *pinfo, proto_tree *tree, char *drep)
4191 {
4192         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4193                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4194                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4195
4196         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4197                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4198                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4199
4200         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4201                 hf_netlogon_rc, NULL);
4202
4203         return offset;
4204 }
4205
4206 static int
4207 netlogon_dissect_function_12_rqst(tvbuff_t *tvb, int offset,
4208         packet_info *pinfo, proto_tree *tree, char *drep)
4209 {
4210         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4211                 pinfo, tree, drep);
4212
4213         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4214                 hf_netlogon_unknown_long, NULL);
4215
4216         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4217                 hf_netlogon_level, NULL);
4218
4219         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4220                 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
4221                 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
4222
4223         return offset;
4224 }
4225
4226
4227 static int
4228 netlogon_dissect_function_12_reply(tvbuff_t *tvb, int offset,
4229         packet_info *pinfo, proto_tree *tree, char *drep)
4230 {
4231         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4232                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
4233                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
4234
4235         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4236                 hf_netlogon_rc, NULL);
4237
4238         return offset;
4239 }
4240
4241 static int
4242 netlogon_dissect_nettrusteddomainlist_rqst(tvbuff_t *tvb, int offset,
4243         packet_info *pinfo, proto_tree *tree, char *drep)
4244 {
4245         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4246                 pinfo, tree, drep);
4247
4248         return offset;
4249 }
4250
4251
4252 static int
4253 netlogon_dissect_nettrusteddomainlist_reply(tvbuff_t *tvb, int offset,
4254         packet_info *pinfo, proto_tree *tree, char *drep)
4255 {
4256         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4257                 netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF,
4258                 "UNICODE_MULTI pointer: trust_dom_name_list", -1, 0);
4259
4260         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4261                 hf_netlogon_rc, NULL);
4262
4263         return offset;
4264 }
4265
4266 static int
4267 netlogon_dissect_dsrgetdcname2_rqst(tvbuff_t *tvb, int offset,
4268         packet_info *pinfo, proto_tree *tree, char *drep)
4269 {
4270         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4271                 pinfo, tree, drep);
4272
4273         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4274                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4275                 "domain", hf_netlogon_logon_dom, -1);
4276
4277         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4278                 netlogon_dissect_GUID, NDR_POINTER_UNIQUE,
4279                 "GUID pointer: domain_guid", -1, 0);
4280
4281         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4282                 netlogon_dissect_GUID, NDR_POINTER_UNIQUE,
4283                 "GUID pointer: site_guid", -1, 0);
4284
4285         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4286                 hf_netlogon_flags, NULL);
4287
4288         return offset;
4289 }
4290
4291
4292 static int
4293 netlogon_dissect_dsrgetdcname2_reply(tvbuff_t *tvb, int offset,
4294         packet_info *pinfo, proto_tree *tree, char *drep)
4295 {
4296         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4297                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4298                 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4299
4300         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4301                 hf_netlogon_rc, NULL);
4302
4303         return offset;
4304 }
4305
4306 static int
4307 netlogon_dissect_function_15_rqst(tvbuff_t *tvb, int offset,
4308         packet_info *pinfo, proto_tree *tree, char *drep)
4309 {
4310         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4311                 pinfo, tree, drep);
4312
4313         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4314                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4315                 "unknown string", hf_netlogon_unknown_string, -1);
4316
4317         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4318                 pinfo, tree, drep);
4319
4320         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4321                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4322                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4323
4324         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4325                 hf_netlogon_unknown_long, NULL);
4326
4327         return offset;
4328 }
4329
4330
4331 static int
4332 netlogon_dissect_function_15_reply(tvbuff_t *tvb, int offset,
4333         packet_info *pinfo, proto_tree *tree, char *drep)
4334 {
4335         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4336                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4337                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4338
4339         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4340                 netlogon_dissect_TYPE_44, NDR_POINTER_PTR,
4341                 "TYPE_44 pointer: unknown_TYPE_44", -1, 0);
4342
4343         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4344                 hf_netlogon_rc, NULL);
4345
4346         return offset;
4347 }
4348
4349 static int
4350 netlogon_dissect_function_16_rqst(tvbuff_t *tvb, int offset,
4351         packet_info *pinfo, proto_tree *tree, char *drep)
4352 {
4353         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4354                 pinfo, tree, drep);
4355
4356         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4357                 hf_netlogon_unknown_long, NULL);
4358
4359         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4360                 hf_netlogon_unknown_long, NULL);
4361
4362         return offset;
4363 }
4364
4365
4366 static int
4367 netlogon_dissect_function_16_reply(tvbuff_t *tvb, int offset,
4368         packet_info *pinfo, proto_tree *tree, char *drep)
4369 {
4370         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4371                 hf_netlogon_rc, NULL);
4372
4373         return offset;
4374 }
4375
4376 static int
4377 netlogon_dissect_function_17_rqst(tvbuff_t *tvb, int offset,
4378         packet_info *pinfo, proto_tree *tree, char *drep)
4379 {
4380         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4381                 pinfo, tree, drep);
4382
4383         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4384                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4385                 "unknown string", hf_netlogon_unknown_string, -1);
4386
4387         return offset;
4388 }
4389
4390
4391 static int
4392 netlogon_dissect_function_17_reply(tvbuff_t *tvb, int offset,
4393         packet_info *pinfo, proto_tree *tree, char *drep)
4394 {
4395         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4396                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4397                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4398
4399         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4400                 hf_netlogon_rc, NULL);
4401
4402         return offset;
4403 }
4404
4405 static int
4406 netlogon_dissect_function_18_rqst(tvbuff_t *tvb, int offset,
4407         packet_info *pinfo, proto_tree *tree, char *drep)
4408 {
4409         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4410                 pinfo, tree, drep);
4411
4412         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4413                 hf_netlogon_unknown_long, NULL);
4414
4415         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4416                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4417                 "BYTE pointer: unknown_BYTE", -1, 0);
4418
4419         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4420                 hf_netlogon_unknown_long, NULL);
4421
4422         return offset;
4423 }
4424
4425 static int
4426 netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset,
4427         packet_info *pinfo, proto_tree *tree, char *drep)
4428 {
4429         int i;
4430
4431         for(i=0;i<16;i++){
4432                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4433                         hf_netlogon_unknown_char, NULL);
4434         }
4435
4436         return offset;
4437 }
4438
4439 static int
4440 netlogon_dissect_function_18_reply(tvbuff_t *tvb, int offset,
4441         packet_info *pinfo, proto_tree *tree, char *drep)
4442 {
4443         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4444                 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4445                 "BYTE pointer: unknown_BYTE", -1, 0);
4446
4447         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4448                 hf_netlogon_rc, NULL);
4449
4450         return offset;
4451 }
4452
4453 static int
4454 netlogon_dissect_function_19_rqst(tvbuff_t *tvb, int offset,
4455         packet_info *pinfo, proto_tree *tree, char *drep)
4456 {
4457         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4458                 pinfo, tree, drep);
4459
4460         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4461                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4462                 "unknown string", hf_netlogon_unknown_string, -1);
4463
4464         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4465                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4466                 "BYTE pointer: unknown_BYTE", -1, 0);
4467
4468         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4469                 hf_netlogon_unknown_long, NULL);
4470
4471         return offset;
4472 }
4473
4474
4475 static int
4476 netlogon_dissect_function_19_reply(tvbuff_t *tvb, int offset,
4477         packet_info *pinfo, proto_tree *tree, char *drep)
4478 {
4479         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4480                 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4481                 "BYTE pointer: unknown_BYTE", -1, 0);
4482
4483         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4484                 hf_netlogon_rc, NULL);
4485
4486         return offset;
4487 }
4488
4489 static int
4490 netlogon_dissect_netserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
4491         packet_info *pinfo, proto_tree *tree, char *drep)
4492 {
4493         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4494                 pinfo, tree, drep);
4495
4496         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4497                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4498                 "acct_name", hf_netlogon_acct_name, -1);
4499
4500         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4501                 pinfo, tree, drep);
4502
4503         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4504                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4505                 "computer_name", hf_netlogon_computer_name, -1);
4506
4507         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4508                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4509                 "NETLOGON_CREDENTIAL pointer: authenticator", -1, 0);
4510
4511         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4512                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4513                 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4514
4515         return offset;
4516 }
4517
4518
4519 static int
4520 netlogon_dissect_netserverauthenticate3_reply(tvbuff_t *tvb, int offset,
4521         packet_info *pinfo, proto_tree *tree, char *drep)
4522 {
4523         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4524                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4525                 "NETLOGON_CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1, 0);
4526
4527         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4528                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4529                 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4530
4531         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4532                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4533                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4534
4535         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4536                 hf_netlogon_rc, NULL);
4537
4538         return offset;
4539 }
4540
4541 static int
4542 netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
4543         packet_info *pinfo, proto_tree *tree, char *drep)
4544 {
4545         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4546                 pinfo, tree, drep);
4547
4548         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4549                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4550                 "domain", hf_netlogon_logon_dom, -1);
4551
4552         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4553                 netlogon_dissect_GUID, NDR_POINTER_UNIQUE,
4554                 "GUID pointer: domain_guid", -1, 0);
4555
4556         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4557                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4558                 "site", hf_netlogon_site_name, -1);
4559
4560         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4561                 hf_netlogon_flags, NULL);
4562
4563         return offset;
4564 }
4565
4566
4567 static int
4568 netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
4569         packet_info *pinfo, proto_tree *tree, char *drep)
4570 {
4571         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4572                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4573                 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4574
4575         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4576                 hf_netlogon_rc, NULL);
4577
4578         return offset;
4579 }
4580
4581 static int
4582 netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset,
4583         packet_info *pinfo, proto_tree *tree, char *drep)
4584 {
4585         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4586                 pinfo, tree, drep);
4587
4588         return offset;
4589 }
4590
4591
4592 static int
4593 netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset,
4594         packet_info *pinfo, proto_tree *tree, char *drep)
4595 {
4596
4597         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4598                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
4599                 "site", hf_netlogon_site_name, -1);
4600
4601         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4602                 hf_netlogon_rc, NULL);
4603
4604         return offset;
4605 }
4606
4607 static int
4608 netlogon_dissect_function_1d_rqst(tvbuff_t *tvb, int offset,
4609         packet_info *pinfo, proto_tree *tree, char *drep)
4610 {
4611         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4612                 pinfo, tree, drep);
4613
4614         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4615                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4616                 "computer_name", hf_netlogon_computer_name, -1);
4617
4618         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4619                 pinfo, tree, drep);
4620
4621         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4622                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4623                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4624
4625         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4626                 hf_netlogon_unknown_long, NULL);
4627
4628         offset = netlogon_dissect_TYPE_45(tvb, offset,
4629                 pinfo, tree, drep);
4630
4631         return offset;
4632 }
4633
4634
4635 static int
4636 netlogon_dissect_function_1d_reply(tvbuff_t *tvb, int offset,
4637         packet_info *pinfo, proto_tree *tree, char *drep)
4638 {
4639         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4640                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4641                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4642
4643         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4644                 netlogon_dissect_TYPE_47, NDR_POINTER_PTR,
4645                 "TYPE_47 pointer: unknown_TYPE_47", -1, 0);
4646
4647         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4648                 hf_netlogon_rc, NULL);
4649
4650         return offset;
4651 }
4652
4653 static int
4654 netlogon_dissect_function_1e_rqst(tvbuff_t *tvb, int offset,
4655         packet_info *pinfo, proto_tree *tree, char *drep)
4656 {
4657         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4658                 pinfo, tree, drep);
4659
4660         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4661                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4662                 "unknown string", hf_netlogon_unknown_string, -1);
4663
4664         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4665                 hf_netlogon_unknown_short, NULL);
4666
4667         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4668                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4669                 "unknown string", hf_netlogon_unknown_string, -1);
4670
4671         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4672                 pinfo, tree, drep);
4673
4674         offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset,
4675                 pinfo, tree, drep);
4676
4677         return offset;
4678 }
4679
4680
4681 static int
4682 netlogon_dissect_function_1e_reply(tvbuff_t *tvb, int offset,
4683         packet_info *pinfo, proto_tree *tree, char *drep)
4684 {
4685         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4686                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4687                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4688
4689         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4690                 hf_netlogon_rc, NULL);
4691
4692         return offset;
4693 }
4694
4695 static int
4696 netlogon_dissect_netserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
4697         packet_info *pinfo, proto_tree *tree, char *drep)
4698 {
4699         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4700                 pinfo, tree, drep);
4701
4702         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4703                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4704                 "acct_name", hf_netlogon_acct_name, -1);
4705
4706         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4707                 pinfo, tree, drep);
4708
4709         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4710                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4711                 "computer_name", hf_netlogon_computer_name, -1);
4712
4713         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4714                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4715                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
4716
4717         return offset;
4718 }
4719
4720
4721 static int
4722 netlogon_dissect_netserverpasswordset2_reply(tvbuff_t *tvb, int offset,
4723         packet_info *pinfo, proto_tree *tree, char *drep)
4724 {
4725         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4726                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4727                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
4728
4729         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4730                 netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF,
4731                 "LM_OWF_PASSWORD pointer: server_pwd", -1, 0);
4732
4733         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4734                 hf_netlogon_rc, NULL);
4735
4736         return offset;
4737 }
4738
4739 static int
4740 netlogon_dissect_function_20_rqst(tvbuff_t *tvb, int offset,
4741         packet_info *pinfo, proto_tree *tree, char *drep)
4742 {
4743         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4744                 pinfo, tree, drep);
4745
4746         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4747                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4748                 "unknown string", hf_netlogon_unknown_string, -1);
4749
4750         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4751                 pinfo, tree, drep);
4752
4753         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4754                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4755                 "BYTE pointer: unknown_BYTE", -1, 0);
4756
4757         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4758                 hf_netlogon_unknown_long, NULL);
4759
4760         return offset;
4761 }
4762
4763
4764 static int
4765 netlogon_dissect_function_20_reply(tvbuff_t *tvb, int offset,
4766         packet_info *pinfo, proto_tree *tree, char *drep)
4767 {
4768         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4769                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4770                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4771
4772         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4773                 hf_netlogon_rc, NULL);
4774
4775         return offset;
4776 }
4777
4778 static int
4779 netlogon_dissect_function_21_rqst(tvbuff_t *tvb, int offset,
4780         packet_info *pinfo, proto_tree *tree, char *drep)
4781 {
4782         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4783                 pinfo, tree, drep);
4784
4785         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4786                 hf_netlogon_unknown_long, NULL);
4787
4788         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4789                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4790                 "BYTE pointer: unknown_BYTE", -1, 0);
4791
4792         return offset;
4793 }
4794
4795
4796 static int
4797 netlogon_dissect_function_21_reply(tvbuff_t *tvb, int offset,
4798         packet_info *pinfo, proto_tree *tree, char *drep)
4799 {
4800         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4801                 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4802                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4803
4804         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4805                 hf_netlogon_rc, NULL);
4806
4807         return offset;
4808 }
4809
4810 static int
4811 netlogon_dissect_function_22_rqst(tvbuff_t *tvb, int offset,
4812         packet_info *pinfo, proto_tree *tree, char *drep)
4813 {
4814         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4815                 pinfo, tree, drep);
4816
4817         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4818                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4819                 "unknown string", hf_netlogon_unknown_string, -1);
4820
4821         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4822                 hf_netlogon_unknown_long, NULL);
4823
4824         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4825                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4826                 "unknown string", hf_netlogon_unknown_string, -1);
4827
4828         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4829                 netlogon_dissect_GUID, NDR_POINTER_UNIQUE,
4830                 "GUID pointer: unknown_GUID", -1, 0);
4831
4832         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4833                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4834                 "unknown string", hf_netlogon_unknown_string, -1);
4835
4836         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4837                 hf_netlogon_unknown_long, NULL);
4838
4839         return offset;
4840 }
4841
4842
4843 static int
4844 netlogon_dissect_function_22_reply(tvbuff_t *tvb, int offset,
4845         packet_info *pinfo, proto_tree *tree, char *drep)
4846 {
4847         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4848                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr, NDR_POINTER_REF,
4849                 "DOMAIN_CONTROLLER_INFO** pointer: unknown_DOMAIN_CONTROLLER_INFO", -1, 0);
4850
4851         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4852                 hf_netlogon_rc, NULL);
4853
4854         return offset;
4855 }
4856
4857 static int
4858 netlogon_dissect_function_23_rqst(tvbuff_t *tvb, int offset,
4859         packet_info *pinfo, proto_tree *tree, char *drep)
4860 {
4861         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4862                 pinfo, tree, drep);
4863
4864         return offset;
4865 }
4866
4867
4868 static int
4869 netlogon_dissect_function_23_reply(tvbuff_t *tvb, int offset,
4870         packet_info *pinfo, proto_tree *tree, char *drep)
4871 {
4872         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4873                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4874                 "unknown string", hf_netlogon_unknown_string, -1);
4875
4876         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4877                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4878                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4879
4880         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4881                 hf_netlogon_rc, NULL);
4882
4883         return offset;
4884 }
4885
4886 static int
4887 netlogon_dissect_function_24_rqst(tvbuff_t *tvb, int offset,
4888         packet_info *pinfo, proto_tree *tree, char *drep)
4889 {
4890         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4891                 pinfo, tree, drep);
4892
4893         return offset;
4894 }
4895
4896
4897 static int
4898 netlogon_dissect_function_24_reply(tvbuff_t *tvb, int offset,
4899         packet_info *pinfo, proto_tree *tree, char *drep)
4900 {
4901         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4902                 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4903                 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4904
4905         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4906                 hf_netlogon_rc, NULL);
4907
4908         return offset;
4909 }
4910
4911 static int
4912 netlogon_dissect_function_25_rqst(tvbuff_t *tvb, int offset,
4913         packet_info *pinfo, proto_tree *tree, char *drep)
4914 {
4915         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4916                 pinfo, tree, drep);
4917
4918         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4919                 hf_netlogon_unknown_long, NULL);
4920
4921         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4922                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4923                 "BYTE pointer: unknown_BYTE", -1, 0);
4924
4925         return offset;
4926 }
4927
4928
4929 static int
4930 netlogon_dissect_function_25_reply(tvbuff_t *tvb, int offset,
4931         packet_info *pinfo, proto_tree *tree, char *drep)
4932 {
4933         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4934                 netlogon_dissect_TYPE_52_ptr_ptr, NDR_POINTER_REF,
4935                 "TYPE_52** pointer: unknown_TYPE_52", -1, 0);
4936
4937         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4938                 hf_netlogon_rc, NULL);
4939
4940         return offset;
4941 }
4942
4943
4944 static int
4945 netlogon_dissect_function_26_rqst(tvbuff_t *tvb, int offset,
4946         packet_info *pinfo, proto_tree *tree, char *drep)
4947 {
4948         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4949                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4950                 "unknown string", hf_netlogon_unknown_string, -1);
4951
4952         return offset;
4953 }
4954
4955
4956 static int
4957 netlogon_dissect_function_26_reply(tvbuff_t *tvb, int offset,
4958         packet_info *pinfo, proto_tree *tree, char *drep)
4959 {
4960         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4961                 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4962                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4963
4964         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4965                 hf_netlogon_rc, NULL);
4966
4967         return offset;
4968 }
4969
4970 static int
4971 netlogon_dissect_function_27_rqst(tvbuff_t *tvb, int offset,
4972         packet_info *pinfo, proto_tree *tree, char *drep)
4973 {
4974         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4975                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4976                 "unknown string", hf_netlogon_unknown_string, -1);
4977
4978         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4979                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4980                 "unknown string", hf_netlogon_unknown_string, -1);
4981
4982         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4983                 hf_netlogon_unknown_short, NULL);
4984
4985         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4986                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_PTR,
4987                 "NETLOGON_LEVEL pointer: unknown_NETLOGON_LEVEL", -1, 0);
4988
4989         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4990                 hf_netlogon_unknown_short, NULL);
4991
4992         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4993                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4994                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4995         return offset;
4996 }
4997
4998
4999 static int
5000 netlogon_dissect_function_27_reply(tvbuff_t *tvb, int offset,
5001         packet_info *pinfo, proto_tree *tree, char *drep)
5002 {
5003         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5004                 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_PTR,
5005                 "NETLOGON_VALIDATION pointer: unknown_NETLOGON_VALIDATION", -1, 0);
5006
5007         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5008                 netlogon_dissect_pointer_char, NDR_POINTER_PTR,
5009                 "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char, 0);
5010
5011         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5012                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
5013                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
5014
5015         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5016                 hf_netlogon_rc, NULL);
5017
5018         return offset;
5019 }
5020
5021 static int
5022 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst(tvbuff_t *tvb, int offset,
5023         packet_info *pinfo, proto_tree *tree, char *drep)
5024 {
5025         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5026                 pinfo, tree, drep);
5027
5028         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5029                 hf_netlogon_unknown_long, NULL);
5030
5031         return offset;
5032 }
5033
5034
5035 static int
5036 netlogon_dissect_dsrrolegetprimarydomaininformation_reply(tvbuff_t *tvb, int offset,
5037         packet_info *pinfo, proto_tree *tree, char *drep)
5038 {
5039         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5040                 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
5041                 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
5042
5043         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5044                 hf_netlogon_rc, NULL);
5045
5046         return offset;
5047 }
5048
5049 static int
5050 netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset,
5051         packet_info *pinfo, proto_tree *tree, char *drep)
5052 {
5053         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
5054                 pinfo, tree, drep);
5055
5056         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5057                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
5058                 "domain", hf_netlogon_logon_dom, -1);
5059
5060         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5061                 netlogon_dissect_GUID, NDR_POINTER_UNIQUE,
5062                 "GUID pointer: domain_guid", -1, 0);
5063
5064         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5065                 netlogon_dissect_GUID, NDR_POINTER_UNIQUE,
5066                 "GUID pointer: dsa_guid", -1, 0);
5067
5068         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5069                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
5070                 "dns_host", hf_netlogon_dns_host, -1);
5071
5072         return offset;
5073 }
5074
5075
5076 static int
5077 netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset,
5078         packet_info *pinfo, proto_tree *tree, char *drep)
5079 {
5080         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
5081                 hf_netlogon_rc, NULL);
5082
5083         return offset;
5084 }
5085
5086
5087
5088 static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = {
5089         { NETLOGON_FUNCTION_00, "FUNCTION_00",
5090                 netlogon_dissect_function_00_rqst,
5091                 netlogon_dissect_function_00_reply },
5092         { NETLOGON_FUNCTION_01, "FUNCTION_01",
5093                 netlogon_dissect_function_01_rqst,
5094                 netlogon_dissect_function_01_reply },
5095         { NETLOGON_NETLOGONSAMLOGON, "NETLOGONSAMLOGON",
5096                 netlogon_dissect_netlogonsamlogon_rqst,
5097                 netlogon_dissect_netlogonsamlogon_reply },
5098         { NETLOGON_NETLOGONSAMLOGOFF, "NETLOGONSAMLOGOFF",
5099                 netlogon_dissect_netlogonsamlogoff_rqst,
5100                 netlogon_dissect_netlogonsamlogoff_reply },
5101         { NETLOGON_NETSERVERREQCHALLENGE, "NETSERVERREQCHALLENGE",
5102                 netlogon_dissect_netserverreqchallenge_rqst,
5103                 netlogon_dissect_netserverreqchallenge_reply },
5104         { NETLOGON_NETSERVERAUTHENTICATE, "NETSERVERAUTHENTICATE",
5105                 netlogon_dissect_netserverauthenticate_rqst,
5106                 netlogon_dissect_netserverauthenticate_reply },
5107         { NETLOGON_NETSERVERPASSWORDSET, "NETSERVERPASSWORDSET",
5108                 netlogon_dissect_netserverpasswordset_rqst,
5109                 netlogon_dissect_netserverpasswordset_reply },
5110         { NETLOGON_NETSAMDELTAS, "NETSAMDELTAS",
5111                 netlogon_dissect_netsamdeltas_rqst,
5112                 netlogon_dissect_netsamdeltas_reply },
5113         { NETLOGON_FUNCTION_08, "FUNCTION_08",
5114                 netlogon_dissect_function_08_rqst,
5115                 netlogon_dissect_function_08_reply },
5116         { NETLOGON_FUNCTION_09, "FUNCTION_09",
5117                 netlogon_dissect_function_09_rqst,
5118                 netlogon_dissect_function_09_reply },
5119         { NETLOGON_FUNCTION_0A, "FUNCTION_0A",
5120                 netlogon_dissect_function_0a_rqst,
5121                 netlogon_dissect_function_0a_reply },
5122         { NETLOGON_FUNCTION_0B, "FUNCTION_0B",
5123                 netlogon_dissect_function_0b_rqst,
5124                 netlogon_dissect_function_0b_reply },
5125         { NETLOGON_NETLOGONCONTROL, "NETLOGONCONTROL",
5126                 netlogon_dissect_netlogoncontrol_rqst,
5127                 netlogon_dissect_netlogoncontrol_reply },
5128         { NETLOGON_FUNCTION_0D, "FUNCTION_0D",
5129                 netlogon_dissect_function_0d_rqst,
5130                 netlogon_dissect_function_0d_reply },
5131         { NETLOGON_NETLOGONCONTROL2, "NETLOGONCONTROL2",
5132                 netlogon_dissect_netlogoncontrol2_rqst,
5133                 netlogon_dissect_netlogoncontrol2_reply },
5134         { NETLOGON_NETSERVERAUTHENTICATE2, "NETSERVERAUTHENTICATE2",
5135                 netlogon_dissect_netserverauthenticate2_rqst,
5136                 netlogon_dissect_netserverauthenticate2_reply },
5137         { NETLOGON_NETDATABASESYNC2, "NETDATABASESYNC2",
5138                 netlogon_dissect_netdatabasesync2_rqst,
5139                 netlogon_dissect_netdatabasesync2_reply },
5140         { NETLOGON_FUNCTION_11, "FUNCTION_11",
5141                 netlogon_dissect_function_11_rqst,
5142                 netlogon_dissect_function_11_reply },
5143         { NETLOGON_FUNCTION_12, "FUNCTION_12",
5144                 netlogon_dissect_function_12_rqst,
5145                 netlogon_dissect_function_12_reply },
5146         { NETLOGON_NETTRUSTEDDOMAINLIST, "NETTRUSTEDDOMAINLIST",
5147                 netlogon_dissect_nettrusteddomainlist_rqst,
5148                 netlogon_dissect_nettrusteddomainlist_reply },
5149         { NETLOGON_DSRGETDCNAME2, "DSRGETDCNAME2",
5150                 netlogon_dissect_dsrgetdcname2_rqst,
5151                 netlogon_dissect_dsrgetdcname2_reply },
5152         { NETLOGON_FUNCTION_15, "FUNCTION_15",
5153                 netlogon_dissect_function_15_rqst,
5154                 netlogon_dissect_function_15_reply },
5155         { NETLOGON_FUNCTION_16, "FUNCTION_16",
5156                 netlogon_dissect_function_16_rqst,
5157                 netlogon_dissect_function_16_reply },
5158         { NETLOGON_FUNCTION_17, "FUNCTION_17",
5159                 netlogon_dissect_function_17_rqst,
5160                 netlogon_dissect_function_17_reply },
5161         { NETLOGON_FUNCTION_18, "FUNCTION_18",
5162                 netlogon_dissect_function_18_rqst,
5163                 netlogon_dissect_function_18_reply },
5164         { NETLOGON_FUNCTION_19, "FUNCTION_19",
5165                 netlogon_dissect_function_19_rqst,
5166                 netlogon_dissect_function_19_reply },
5167         { NETLOGON_NETSERVERAUTHENTICATE3, "NETSERVERAUTHENTICATE3",
5168                 netlogon_dissect_netserverauthenticate3_rqst,
5169                 netlogon_dissect_netserverauthenticate3_reply },
5170         { NETLOGON_DSRGETDCNAME, "DSRGETDCNAME",
5171                 netlogon_dissect_dsrgetdcname_rqst,
5172                 netlogon_dissect_dsrgetdcname_reply },
5173         { NETLOGON_DSRGETSITENAME, "DSRGETSITENAME",
5174                 netlogon_dissect_dsrgetsitename_rqst,
5175                 netlogon_dissect_dsrgetsitename_reply },
5176         { NETLOGON_FUNCTION_1D, "FUNCTION_1D",
5177                 netlogon_dissect_function_1d_rqst,
5178                 netlogon_dissect_function_1d_reply },
5179         { NETLOGON_FUNCTION_1E, "FUNCTION_1E",
5180                 netlogon_dissect_function_1e_rqst,
5181                 netlogon_dissect_function_1e_reply },
5182         { NETLOGON_NETSERVERPASSWORDSET2, "NETSERVERPASSWORDSET2",
5183                 netlogon_dissect_netserverpasswordset2_rqst,
5184                 netlogon_dissect_netserverpasswordset2_reply },
5185         { NETLOGON_FUNCTION_20, "FUNCTION_20",
5186                 netlogon_dissect_function_20_rqst,
5187                 netlogon_dissect_function_20_reply },
5188         { NETLOGON_FUNCTION_21, "FUNCTION_21",
5189                 netlogon_dissect_function_21_rqst,
5190                 netlogon_dissect_function_21_reply },
5191         { NETLOGON_FUNCTION_22, "FUNCTION_22",
5192                 netlogon_dissect_function_22_rqst,
5193                 netlogon_dissect_function_22_reply },
5194         { NETLOGON_FUNCTION_23, "FUNCTION_23",
5195                 netlogon_dissect_function_23_rqst,
5196                 netlogon_dissect_function_23_reply },
5197         { NETLOGON_FUNCTION_24, "FUNCTION_24",
5198                 netlogon_dissect_function_24_rqst,
5199                 netlogon_dissect_function_24_reply },
5200         { NETLOGON_FUNCTION_25, "FUNCTION_25",
5201                 netlogon_dissect_function_25_rqst,
5202                 netlogon_dissect_function_25_reply },
5203         { NETLOGON_FUNCTION_26, "FUNCTION_26",
5204                 netlogon_dissect_function_26_rqst,
5205                 netlogon_dissect_function_26_reply },
5206         { NETLOGON_FUNCTION_27, "FUNCTION_27",
5207                 netlogon_dissect_function_27_rqst,
5208                 netlogon_dissect_function_27_reply },
5209         { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DSRROLEGETPRIMARYDOMAININFORMATION",
5210                 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst,
5211                 netlogon_dissect_dsrrolegetprimarydomaininformation_reply },
5212         { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DSRDEREGISTERDNSHOSTRECORDS",
5213                 netlogon_dissect_dsrderegisterdnshostrecords_rqst,
5214                 netlogon_dissect_dsrderegisterdnshostrecords_reply },
5215         {0, NULL, NULL,  NULL },
5216 };
5217
5218 void
5219 proto_register_dcerpc_netlogon(void)
5220 {
5221
5222 static hf_register_info hf[] = {
5223         { &hf_netlogon_rc, {
5224                 "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
5225                 VALS(NT_errors), 0x0, "Netlogon return code", HFILL }},
5226
5227         { &hf_netlogon_param_ctrl, {
5228                 "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
5229                 NULL, 0x0, "Param ctrl", HFILL }},
5230
5231         { &hf_netlogon_logon_id, {
5232                 "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
5233                 NULL, 0x0, "Logon ID", HFILL }},
5234
5235         { &hf_netlogon_count, {
5236                 "Count", "netlogon.count", FT_UINT16, BASE_DEC,
5237                 NULL, 0x0, "", HFILL }},
5238
5239         { &hf_netlogon_credential, {
5240                 "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
5241                 NULL, 0x0, "Netlogon credential", HFILL }},
5242
5243         { &hf_netlogon_cypher_block, {
5244                 "Cypher Block", "netlogon.cypher_block", FT_BYTES, BASE_HEX,
5245                 NULL, 0x0, "Netlogon cypher block", HFILL }},
5246
5247         { &hf_netlogon_lm_owf_password, {
5248                 "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
5249                 NULL, 0x0, "LanManager OWF Password", HFILL }},
5250
5251         { &hf_netlogon_user_session_key, {
5252                 "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
5253                 NULL, 0x0, "User Session Key", HFILL }},
5254
5255         { &hf_netlogon_encrypted_lm_owf_password, {
5256                 "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
5257                 NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }},
5258
5259         { &hf_netlogon_nt_owf_password, {
5260                 "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
5261                 NULL, 0x0, "NT OWF Password", HFILL }},
5262
5263         { &hf_netlogon_blob, {
5264                 "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
5265                 NULL, 0x0, "BLOB", HFILL }},
5266
5267         { &hf_netlogon_len, {
5268                 "Len", "netlogon.len", FT_UINT32, BASE_DEC,
5269                 NULL, 0, "Length", HFILL }},
5270
5271         { &hf_netlogon_status, {
5272                 "Status", "netlogon.status", FT_UINT32, BASE_DEC,
5273                 NULL, 0, "Status", HFILL }},
5274
5275         { &hf_netlogon_attrs, {
5276                 "Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX,
5277                 NULL, 0, "Attributes", HFILL }},
5278
5279         { &hf_netlogon_unknown_string,
5280                 { "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE,
5281                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
5282         { &hf_netlogon_unknown_long,
5283                 { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
5284                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
5285         { &hf_netlogon_unknown_short,
5286                 { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
5287                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
5288
5289         { &hf_netlogon_unknown_char,
5290                 { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
5291                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
5292
5293         { &hf_netlogon_unknown_time,
5294                 { "Unknown time", "netlogon.unknown.time", FT_ABSOLUTE_TIME, BASE_NONE,
5295                 NULL, 0x0, "Unknown time. If you know what this is, contact ethereal developers.", HFILL }},
5296
5297         { &hf_netlogon_acct_expiry_time,
5298                 { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
5299                 NULL, 0x0, "When this account will expire", HFILL }},
5300
5301         { &hf_netlogon_nt_pwd_present,
5302                 { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
5303                 NULL, 0x0, "Is NT password present for this account?", HFILL }},
5304
5305         { &hf_netlogon_lm_pwd_present,
5306                 { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
5307                 NULL, 0x0, "Is LanManager password present for this account?", HFILL }},
5308
5309         { &hf_netlogon_pwd_expired,
5310                 { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
5311                 NULL, 0x0, "Whether this password has expired or not", HFILL }},
5312
5313         { &hf_netlogon_num_pwd_pairs,
5314                 { "Num PWD Pairs", "netlogon.num_pwd_pairs", FT_UINT8, BASE_DEC,
5315                 NULL, 0x0, "Number of password pairs. Password history length?", HFILL }},
5316
5317         { &hf_netlogon_authoritative,
5318                 { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
5319                 NULL, 0x0, "", HFILL }},
5320
5321         { &hf_netlogon_nt_chal_resp,
5322                 { "NT Chal resp", "netlogon.nt_chal_resp", FT_BYTES, BASE_HEX,
5323                 NULL, 0, "Challenge response for NT authentication", HFILL }},
5324
5325         { &hf_netlogon_lm_chal_resp,
5326                 { "LM Chal resp", "netlogon.lm_chal_resp", FT_BYTES, BASE_HEX,
5327                 NULL, 0, "Challenge response for LM authentication", HFILL }},
5328
5329         { &hf_netlogon_lsa_secret,
5330                 { "LSA Secret", "netlogon.lsa.secret", FT_BYTES, BASE_HEX,
5331                 NULL, 0, "", HFILL }},
5332
5333         { &hf_netlogon_acct_name,
5334                 { "Acct Name", "netlogon.acct_name", FT_STRING, BASE_NONE,
5335                 NULL, 0, "Account Name", HFILL }},
5336
5337         { &hf_netlogon_acct_desc,
5338                 { "Acct Desc", "netlogon.acct_desc", FT_STRING, BASE_NONE,
5339                 NULL, 0, "Account Description", HFILL }},
5340
5341         { &hf_netlogon_group_desc,
5342                 { "Group Desc", "netlogon.group_desc", FT_STRING, BASE_NONE,
5343                 NULL, 0, "Group Description", HFILL }},
5344
5345         { &hf_netlogon_full_name,
5346                 { "Full Name", "netlogon.full_name", FT_STRING, BASE_NONE,
5347                 NULL, 0, "Full Name", HFILL }},
5348
5349         { &hf_netlogon_comment,
5350                 { "Comment", "netlogon.comment", FT_STRING, BASE_NONE,
5351                 NULL, 0, "Comment", HFILL }},
5352
5353         { &hf_netlogon_parameters,
5354                 { "Parameters", "netlogon.parameters", FT_STRING, BASE_NONE,
5355                 NULL, 0, "Parameters", HFILL }},
5356
5357         { &hf_netlogon_logon_script,
5358                 { "Logon Script", "netlogon.logon_script", FT_STRING, BASE_NONE,
5359                 NULL, 0, "Logon Script", HFILL }},
5360
5361         { &hf_netlogon_profile_path,
5362                 { "Profile Path", "netlogon.profile_path", FT_STRING, BASE_NONE,
5363                 NULL, 0, "Profile Path", HFILL }},
5364
5365         { &hf_netlogon_home_dir,
5366                 { "Home Dir", "netlogon.home_dir", FT_STRING, BASE_NONE,
5367                 NULL, 0, "Home Directory", HFILL }},
5368
5369         { &hf_netlogon_dir_drive,
5370                 { "Dir Drive", "netlogon.dir_drive", FT_STRING, BASE_NONE,
5371                 NULL, 0, "Drive letter for home directory", HFILL }},
5372
5373         { &hf_netlogon_logon_srv,
5374                 { "Server", "netlogon.server", FT_STRING, BASE_NONE,
5375                 NULL, 0, "Server", HFILL }},
5376
5377         { &hf_netlogon_logon_dom,
5378                 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
5379                 NULL, 0, "Domain", HFILL }},
5380
5381         { &hf_netlogon_computer_name,
5382                 { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
5383                 NULL, 0, "Computer Name", HFILL }},
5384
5385         { &hf_netlogon_site_name,
5386                 { "Site Name", "netlogon.site_name", FT_STRING, BASE_NONE,
5387                 NULL, 0, "Site Name", HFILL }},
5388
5389         { &hf_netlogon_dc_name,
5390                 { "DC Name", "netlogon.dc.name", FT_STRING, BASE_NONE,
5391                 NULL, 0, "DC Name", HFILL }},
5392
5393         { &hf_netlogon_dc_site_name,
5394                 { "DC Site Name", "netlogon.dc.site_name", FT_STRING, BASE_NONE,
5395                 NULL, 0, "DC Site Name", HFILL }},
5396
5397         { &hf_netlogon_dns_forest_name,
5398                 { "DNS Forest Name", "netlogon.dns.forest_name", FT_STRING, BASE_NONE,
5399                 NULL, 0, "DNS Forest Name", HFILL }},
5400
5401         { &hf_netlogon_dc_address,
5402                 { "DC Address", "netlogon.dc.address", FT_STRING, BASE_NONE,
5403                 NULL, 0, "DC Address", HFILL }},
5404
5405         { &hf_netlogon_dc_address_type,
5406                 { "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC,
5407                 NULL, 0, "DC Address Type", HFILL }},
5408
5409         { &hf_netlogon_client_name,
5410                 { "Client Name", "netlogon.client.name", FT_STRING, BASE_NONE,
5411                 NULL, 0, "Client Name", HFILL }},
5412
5413         { &hf_netlogon_client_site_name,
5414                 { "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE,
5415                 NULL, 0, "Client Site Name", HFILL }},
5416
5417         { &hf_netlogon_workstation_site_name,
5418                 { "Wkst Site Name", "netlogon.wkst.site_name", FT_STRING, BASE_NONE,
5419                 NULL, 0, "Workstation Site Name", HFILL }},
5420
5421         { &hf_netlogon_workstation_os,
5422                 { "Wkst OS", "netlogon.wkst.os", FT_STRING, BASE_NONE,
5423                 NULL, 0, "Workstation OS", HFILL }},
5424
5425         { &hf_netlogon_workstations,
5426                 { "Workstations", "netlogon.wksts", FT_STRING, BASE_NONE,
5427                 NULL, 0, "Workstations", HFILL }},
5428
5429         { &hf_netlogon_workstation_fqdn,
5430                 { "Wkst FQDN", "netlogon.wkst.fqdn", FT_STRING, BASE_NONE,
5431                 NULL, 0, "Workstation FQDN", HFILL }},
5432
5433         { &hf_netlogon_group_name,
5434                 { "Group Name", "netlogon.group_name", FT_STRING, BASE_NONE,
5435                 NULL, 0, "Group Name", HFILL }},
5436
5437         { &hf_netlogon_alias_name,
5438                 { "Alias Name", "netlogon.alias_name", FT_STRING, BASE_NONE,
5439                 NULL, 0, "Alias Name", HFILL }},
5440
5441         { &hf_netlogon_cli_name,
5442                 { "CLI Name", "netlogon.cli_name", FT_STRING, BASE_NONE,
5443                 NULL, 0, "CLI Name", HFILL }},
5444
5445         { &hf_netlogon_dns_host,
5446                 { "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE,
5447                 NULL, 0, "DNS Host", HFILL }},
5448
5449         { &hf_netlogon_trusted_domain_name,
5450                 { "Trusted Domain", "netlogon.trusted_domain", FT_STRING, BASE_NONE,
5451                 NULL, 0, "Trusted Domain Name", HFILL }},
5452
5453         { &hf_netlogon_trusted_dc_name,
5454                 { "Trusted DC", "netlogon.trusted_dc", FT_STRING, BASE_NONE,
5455                 NULL, 0, "Trusted DC", HFILL }},
5456
5457         { &hf_netlogon_logonsrv_handle,
5458                 { "Handle", "netlogon.handle", FT_STRING, BASE_NONE,
5459                 NULL, 0, "Logon Srv Handle", HFILL }},
5460
5461         { &hf_netlogon_logon_count,
5462                 { "Logon Count", "netlogon.logon_count", FT_UINT16, BASE_DEC,
5463                 NULL, 0x0, "Number of successful logins", HFILL }},
5464
5465         { &hf_netlogon_bad_pw_count,
5466                 { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT16, BASE_DEC,
5467                 NULL, 0x0, "Number of failed logins", HFILL }},
5468
5469         { &hf_netlogon_country,
5470                 { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
5471                 VALS(ms_country_codes), 0x0, "Country setting for this account", HFILL }},
5472
5473         { &hf_netlogon_codepage,
5474                 { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
5475                 NULL, 0x0, "Codepage setting for this account", HFILL }},
5476
5477         { &hf_netlogon_level,
5478                 { "Level", "netlogon.level", FT_UINT16, BASE_DEC,
5479                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5480
5481         { &hf_netlogon_secure_channel_type,
5482                 { "Sec Chn Type", "netlogon.sec_chn_type", FT_UINT16, BASE_DEC,
5483                 NULL, 0x0, "Secure Channel Type", HFILL }},
5484
5485         { &hf_netlogon_blob_size,
5486                 { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
5487                 NULL, 0x0, "Size in bytes of BLOB", HFILL }},
5488
5489         { &hf_netlogon_code,
5490                 { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
5491                 NULL, 0x0, "Code", HFILL }},
5492
5493         { &hf_netlogon_level_long,
5494                 { "Level", "netlogon.level32", FT_UINT32, BASE_DEC,
5495                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5496
5497         { &hf_netlogon_timestamp,
5498                 { "Timestamp", "netlogon.timestamp", FT_UINT32, BASE_HEX,
5499                 NULL, 0x0, "Some sort of timestamp", HFILL }},
5500
5501         { &hf_netlogon_user_rid,
5502                 { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
5503                 NULL, 0x0, "", HFILL }},
5504
5505         { &hf_netlogon_alias_rid,
5506                 { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
5507                 NULL, 0x0, "", HFILL }},
5508
5509         { &hf_netlogon_group_rid,
5510                 { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
5511                 NULL, 0x0, "", HFILL }},
5512
5513         { &hf_netlogon_num_rids,
5514                 { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
5515                 NULL, 0x0, "Number of RIDs", HFILL }},
5516
5517         { &hf_netlogon_num_other_groups,
5518                 { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
5519                 NULL, 0x0, "", HFILL }},
5520
5521         { &hf_netlogon_flags,
5522                 { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
5523                 NULL, 0x0, "", HFILL }},
5524
5525         { &hf_netlogon_user_flags,
5526                 { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
5527                 NULL, 0x0, "", HFILL }},
5528
5529         { &hf_netlogon_database_id,
5530                 { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
5531                 NULL, 0x0, "Database Id", HFILL }},
5532
5533         { &hf_netlogon_max_size,
5534                 { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
5535                 NULL, 0x0, "Max Size of database", HFILL }},
5536
5537         { &hf_netlogon_num_deltas,
5538                 { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
5539                 NULL, 0x0, "Number of SAM Deltas in array", HFILL }},
5540
5541         { &hf_netlogon_logon_attempts,
5542                 { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
5543                 NULL, 0x0, "Number of logon attempts", HFILL }},
5544
5545         { &hf_netlogon_lsa_sd_size,
5546                 { "Size", "netlogon.lsa_sd_size", FT_UINT32, BASE_DEC,
5547                 NULL, 0x0, "Size of lsa security descriptor", HFILL }},
5548
5549         { &hf_netlogon_logon_time,
5550                 { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
5551                 NULL, 0, "Time for last time this user logged on", HFILL }},
5552
5553         { &hf_netlogon_kickoff_time,
5554                 { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5555                 NULL, 0, "Time when this user will be kicked off", HFILL }},
5556
5557         { &hf_netlogon_logoff_time,
5558                 { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5559                 NULL, 0, "Time for last time this user logged off", HFILL }},
5560
5561         { &hf_netlogon_pwd_last_set_time,
5562                 { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
5563                 NULL, 0, "Last time this users password was changed", HFILL }},
5564
5565         { &hf_netlogon_pwd_can_change_time,
5566                 { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5567                 NULL, 0, "When this users password may be changed", HFILL }},
5568
5569         { &hf_netlogon_pwd_must_change_time,
5570                 { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5571                 NULL, 0, "When this users password must be changed", HFILL }},
5572
5573         };
5574
5575         static gint *ett[] = {
5576                 &ett_dcerpc_netlogon,
5577                 &ett_NETLOGON_SECURITY_DESCRIPTOR,
5578                 &ett_TYPE_1,
5579                 &ett_TYPE_2,
5580                 &ett_CYPHER_BLOCK,
5581                 &ett_NETLOGON_AUTHENTICATOR,
5582                 &ett_NETLOGON_LOGON_IDENTITY_INFO,
5583                 &ett_NETLOGON_INTERACTIVE_INFO,
5584                 &ett_NETLOGON_NETWORK_INFO,
5585                 &ett_NETLOGON_VALIDATION_SAM_INFO1,
5586                 &ett_NETLOGON_VALIDATION_SAM_INFO2,
5587                 &ett_TYPE_16,
5588                 &ett_NETLOGON_SAM_DOMAIN_INFO,
5589                 &ett_NETLOGON_SAM_GROUP_INFO,
5590                 &ett_TYPE_23,
5591                 &ett_NETLOGON_SAM_ACCOUNT_INFO,
5592                 &ett_NETLOGON_SAM_GROUP_MEM_INFO,
5593                 &ett_NETLOGON_SAM_ALIAS_INFO,
5594                 &ett_NETLOGON_SAM_ALIAS_MEM_INFO,
5595                 &ett_TYPE_30,
5596                 &ett_TYPE_29,
5597                 &ett_TYPE_31,
5598                 &ett_TYPE_32,
5599                 &ett_TYPE_33,
5600                 &ett_TYPE_34,
5601                 &ett_TYPE_35,
5602                 &ett_SAM_DELTA,
5603                 &ett_SAM_DELTA_ARRAY,
5604                 &ett_TYPE_36,
5605                 &ett_NETLOGON_INFO_1,
5606                 &ett_NETLOGON_INFO_2,
5607                 &ett_NETLOGON_INFO_3,
5608                 &ett_NETLOGON_INFO_4,
5609                 &ett_UNICODE_MULTI,
5610                 &ett_DOMAIN_CONTROLLER_INFO,
5611                 &ett_TYPE_46,
5612                 &ett_TYPE_48,
5613                 &ett_UNICODE_STRING_512,
5614                 &ett_TYPE_50,
5615                 &ett_TYPE_51,
5616                 &ett_TYPE_52,
5617                 &ett_NETLOGON_LEVEL,
5618                 &ett_NETLOGON_VALIDATION,
5619                 &ett_TYPE_19,
5620                 &ett_NETLOGON_CONTROL_QUERY_INFO,
5621                 &ett_TYPE_44,
5622                 &ett_TYPE_20,
5623                 &ett_NETLOGON_INFO,
5624                 &ett_TYPE_45,
5625                 &ett_TYPE_47,
5626                 &ett_NETLOGON_CREDENTIAL,
5627                 &ett_GUID,
5628                 &ett_ENC_LM_OWF_PASSWORD,
5629                 &ett_LM_OWF_PASSWORD,
5630                 &ett_NT_OWF_PASSWORD,
5631                 &ett_GROUP_MEMBERSHIP,
5632                 &ett_USER_SESSION_KEY,
5633                 &ett_BLOB,
5634                 &ett_rid_array,
5635                 &ett_attrib_array,
5636         };
5637
5638         proto_dcerpc_netlogon = proto_register_protocol(
5639                 "Microsoft Network Logon", "NETLOGON", "rpc_netlogon");
5640
5641         proto_register_field_array (proto_dcerpc_netlogon, hf, array_length (hf));
5642         proto_register_subtree_array(ett, array_length(ett));
5643 }
5644
5645 void
5646 proto_reg_handoff_dcerpc_netlogon(void)
5647 {
5648         /* Register protocol as dcerpc */
5649
5650         dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
5651                          &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
5652                          dcerpc_netlogon_dissectors);
5653 }