packet-dcerpc-netlogon.c

   1 /* packet-dcerpc-netlogon.c
   2  * Routines for SMB \\PIPE\\NETLOGON packet disassembly
   3  * Copyright 2001, Tim Potter <tpot@samba.org>
   4  *  2002 structure and command dissectors by Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-netlogon.c,v 1.16 2002/04/18 00:29:16 guy Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-dcerpc.h"
  34 #include "packet-dcerpc-nt.h"
  35 #include "packet-dcerpc-netlogon.h"
  36 #include "smb.h"        /* for "NT_errors[]" */
  37 #include "packet-smb-common.h"
  38 #include "packet-dcerpc-lsa.h"
  39
  40 static int proto_dcerpc_netlogon = -1;
  41 static int hf_netlogon_rc = -1;
  42 static int hf_netlogon_len = -1;
  43 static int hf_netlogon_status = -1;
  44 static int hf_netlogon_attrs = -1;
  45 static int hf_netlogon_count = -1;
  46 static int hf_netlogon_level = -1;
  47 static int hf_netlogon_level_long = -1;
  48 static int hf_netlogon_unknown_time = -1;
  49 static int hf_netlogon_unknown_string = -1;
  50 static int hf_netlogon_unknown_long = -1;
  51 static int hf_netlogon_unknown_short = -1;
  52 static int hf_netlogon_unknown_char = -1;
  53 static int hf_netlogon_logon_time = -1;
  54 static int hf_netlogon_logoff_time = -1;
  55 static int hf_netlogon_kickoff_time = -1;
  56 static int hf_netlogon_pwd_last_set_time = -1;
  57 static int hf_netlogon_pwd_can_change_time = -1;
  58 static int hf_netlogon_pwd_must_change_time = -1;
  59 static int hf_netlogon_timestamp = -1;
  60 static int hf_netlogon_nt_chal_resp = -1;
  61 static int hf_netlogon_lm_chal_resp = -1;
  62 static int hf_netlogon_credential = -1;
  63 static int hf_netlogon_cypher_block = -1;
  64 static int hf_netlogon_acct_name = -1;
  65 static int hf_netlogon_acct_desc = -1;
  66 static int hf_netlogon_group_desc = -1;
  67 static int hf_netlogon_full_name = -1;
  68 static int hf_netlogon_comment = -1;
  69 static int hf_netlogon_parameters = -1;
  70 static int hf_netlogon_logon_script = -1;
  71 static int hf_netlogon_profile_path = -1;
  72 static int hf_netlogon_home_dir = -1;
  73 static int hf_netlogon_dir_drive = -1;
  74 static int hf_netlogon_logon_count = -1;
  75 static int hf_netlogon_bad_pw_count = -1;
  76 static int hf_netlogon_user_rid = -1;
  77 static int hf_netlogon_alias_rid = -1;
  78 static int hf_netlogon_group_rid = -1;
  79 static int hf_netlogon_logon_srv = -1;
  80 static int hf_netlogon_logon_dom = -1;
  81 static int hf_netlogon_trusted_domain_name = -1;
  82 static int hf_netlogon_num_rids = -1;
  83 static int hf_netlogon_num_other_groups = -1;
  84 static int hf_netlogon_computer_name = -1;
  85 static int hf_netlogon_site_name = -1;
  86 static int hf_netlogon_trusted_dc_name = -1;
  87 static int hf_netlogon_dc_name = -1;
  88 static int hf_netlogon_dc_site_name = -1;
  89 static int hf_netlogon_dns_forest_name = -1;
  90 static int hf_netlogon_dc_address = -1;
  91 static int hf_netlogon_dc_address_type = -1;
  92 static int hf_netlogon_client_name = -1;
  93 static int hf_netlogon_client_site_name = -1;
  94 static int hf_netlogon_workstation_site_name = -1;
  95 static int hf_netlogon_workstation_os = -1;
  96 static int hf_netlogon_workstations = -1;
  97 static int hf_netlogon_workstation_fqdn = -1;
  98 static int hf_netlogon_group_name = -1;
  99 static int hf_netlogon_alias_name = -1;
 100 static int hf_netlogon_cli_name = -1;
 101 static int hf_netlogon_country = -1;
 102 static int hf_netlogon_codepage = -1;
 103 static int hf_netlogon_flags = -1;
 104 static int hf_netlogon_user_flags = -1;
 105 static int hf_netlogon_pwd_expired = -1;
 106 static int hf_netlogon_nt_pwd_present = -1;
 107 static int hf_netlogon_lm_pwd_present = -1;
 108 static int hf_netlogon_code = -1;
 109 static int hf_netlogon_database_id = -1;
 110 static int hf_netlogon_max_size = -1;
 111 static int hf_netlogon_dns_host = -1;
 112 static int hf_netlogon_num_pwd_pairs = -1;
 113 static int hf_netlogon_acct_expiry_time = -1;
 114 static int hf_netlogon_encrypted_lm_owf_password = -1;
 115 static int hf_netlogon_lm_owf_password = -1;
 116 static int hf_netlogon_nt_owf_password = -1;
 117 static int hf_netlogon_param_ctrl = -1;
 118 static int hf_netlogon_logon_id = -1;
 119 static int hf_netlogon_num_deltas = -1;
 120 static int hf_netlogon_user_session_key = -1;
 121 static int hf_netlogon_blob_size = -1;
 122 static int hf_netlogon_blob = -1;
 123 static int hf_netlogon_logon_attempts = -1;
 124 static int hf_netlogon_authoritative = -1;
 125 static int hf_netlogon_secure_channel_type = -1;
 126 static int hf_netlogon_logonsrv_handle = -1;
 127
 128 static gint ett_dcerpc_netlogon = -1;
 129 static gint ett_NETLOGON_SECURITY_DESCRIPTOR = -1;
 130 static gint ett_TYPE_1 = -1;
 131 static gint ett_TYPE_2 = -1;
 132 static gint ett_CYPHER_BLOCK = -1;
 133 static gint ett_NETLOGON_AUTHENTICATOR = -1;
 134 static gint ett_NETLOGON_LOGON_IDENTITY_INFO = -1;
 135 static gint ett_NETLOGON_INTERACTIVE_INFO = -1;
 136 static gint ett_NETLOGON_NETWORK_INFO = -1;
 137 static gint ett_NETLOGON_VALIDATION_SAM_INFO1 = -1;
 138 static gint ett_NETLOGON_VALIDATION_SAM_INFO2 = -1;
 139 static gint ett_TYPE_16 = -1;
 140 static gint ett_NETLOGON_SAM_DOMAIN_INFO = -1;
 141 static gint ett_NETLOGON_SAM_GROUP_INFO = -1;
 142 static gint ett_TYPE_23 = -1;
 143 static gint ett_NETLOGON_SAM_ACCOUNT_INFO = -1;
 144 static gint ett_NETLOGON_SAM_GROUP_MEM_INFO = -1;
 145 static gint ett_NETLOGON_SAM_ALIAS_INFO = -1;
 146 static gint ett_NETLOGON_SAM_ALIAS_MEM_INFO = -1;
 147 static gint ett_TYPE_30 = -1;
 148 static gint ett_TYPE_29 = -1;
 149 static gint ett_TYPE_31 = -1;
 150 static gint ett_TYPE_32 = -1;
 151 static gint ett_TYPE_33 = -1;
 152 static gint ett_TYPE_34 = -1;
 153 static gint ett_TYPE_35 = -1;
 154 static gint ett_SAM_DELTA = -1;
 155 static gint ett_SAM_DELTA_ARRAY = -1;
 156 static gint ett_TYPE_36 = -1;
 157 static gint ett_NETLOGON_INFO_1 = -1;
 158 static gint ett_NETLOGON_INFO_2 = -1;
 159 static gint ett_NETLOGON_INFO_3 = -1;
 160 static gint ett_NETLOGON_INFO_4 = -1;
 161 static gint ett_UNICODE_MULTI = -1;
 162 static gint ett_DOMAIN_CONTROLLER_INFO = -1;
 163 static gint ett_TYPE_46 = -1;
 164 static gint ett_TYPE_48 = -1;
 165 static gint ett_UNICODE_STRING_512 = -1;
 166 static gint ett_TYPE_50 = -1;
 167 static gint ett_TYPE_51 = -1;
 168 static gint ett_TYPE_52 = -1;
 169 static gint ett_NETLOGON_LEVEL = -1;
 170 static gint ett_NETLOGON_VALIDATION = -1;
 171 static gint ett_TYPE_19 = -1;
 172 static gint ett_NETLOGON_CONTROL_QUERY_INFO = -1;
 173 static gint ett_TYPE_44 = -1;
 174 static gint ett_TYPE_20 = -1;
 175 static gint ett_NETLOGON_INFO = -1;
 176 static gint ett_TYPE_45 = -1;
 177 static gint ett_TYPE_47 = -1;
 178 static gint ett_NETLOGON_CREDENTIAL = -1;
 179 static gint ett_GUID = -1;
 180 static gint ett_ENC_LM_OWF_PASSWORD = -1;
 181 static gint ett_LM_OWF_PASSWORD = -1;
 182 static gint ett_NT_OWF_PASSWORD = -1;
 183 static gint ett_GROUP_MEMBERSHIP = -1;
 184 static gint ett_USER_SESSION_KEY = -1;
 185 static gint ett_BLOB = -1;
 186 static gint ett_rid_array = -1;
 187 static gint ett_attrib_array = -1;
 188
 189 static e_uuid_t uuid_dcerpc_netlogon = {
 190         0x12345678, 0x1234, 0xabcd,
 191         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0xcf, 0xfb }
 192 };
 193
 194 static guint16 ver_dcerpc_netlogon = 1;
 195
 196
 197 static int
 198 netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
 199                              packet_info *pinfo, proto_tree *tree,
 200                              char *drep)
 201 {
 202         dcerpc_info *di;
 203
 204         di=pinfo->private_data;
 205         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 206                                      di->hf_index, NULL);
 207         return offset;
 208 }
 209
 210 static int
 211 netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
 212                              packet_info *pinfo, proto_tree *tree,
 213                              char *drep)
 214 {
 215         dcerpc_info *di;
 216
 217         di=pinfo->private_data;
 218         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
 219                                      di->hf_index, NULL);
 220         return offset;
 221 }
 222
 223 static int
 224 netlogon_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 225                              packet_info *pinfo, proto_tree *tree,
 226                              char *drep)
 227 {
 228         dcerpc_info *di;
 229
 230         di=pinfo->private_data;
 231         if(di->conformant_run){
 232                 /*just a run to handle conformant arrays, nothing to dissect */
 233                 return offset;
 234         }
 235
 236         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 237                         di->hf_index, 0);
 238         return offset;
 239 }
 240
 241 int
 242 netlogon_dissect_UNICODE_STRING(tvbuff_t *tvb, int offset,
 243                         packet_info *pinfo, proto_tree *parent_tree,
 244                         char *drep, int type, int hf_index, int levels)
 245 {
 246         proto_item *item=NULL;
 247         proto_tree *tree=NULL;
 248         int old_offset=offset;
 249         dcerpc_info *di;
 250         char *name;
 251
 252         di=pinfo->private_data;
 253         if(di->conformant_run){
 254                 /*just a run to handle conformant arrays, nothing to dissect */
 255                 return offset;
 256         }
 257
 258         name = proto_registrar_get_name(hf_index);
 259         if(parent_tree){
 260                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 261                         "%s", name);
 262                 tree = proto_item_add_subtree(item, ett_nt_unicode_string);
 263         }
 264
 265         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 266                         dissect_ndr_nt_UNICODE_STRING_str, type,
 267                         name, hf_index, levels);
 268
 269         proto_item_set_len(item, offset-old_offset);
 270         return offset;
 271 }
 272
 273
 274 static int
 275 netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 276                         packet_info *pinfo, proto_tree *parent_tree,
 277                         char *drep)
 278 {
 279         proto_item *item=NULL;
 280         proto_tree *tree=NULL;
 281         int old_offset=offset;
 282
 283         if(parent_tree){
 284                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 285                         "NETLOGON_SECURITY_DESCRIPTOR:");
 286                 tree = proto_item_add_subtree(item, ett_NETLOGON_SECURITY_DESCRIPTOR);
 287         }
 288
 289         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 290                 hf_netlogon_len, NULL);
 291
 292         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
 293                 pinfo, tree, drep);
 294
 295         proto_item_set_len(item, offset-old_offset);
 296         return offset;
 297 }
 298
 299 static int
 300 netlogon_dissect_TYPE_1(tvbuff_t *tvb, int offset,
 301                         packet_info *pinfo, proto_tree *parent_tree,
 302                         char *drep)
 303 {
 304         proto_item *item=NULL;
 305         proto_tree *tree=NULL;
 306         int old_offset=offset;
 307
 308         if(parent_tree){
 309                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 310                         "TYPE_1:");
 311                 tree = proto_item_add_subtree(item, ett_TYPE_1);
 312         }
 313
 314         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 315                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 316                 "unknown", hf_netlogon_unknown_string, -1);
 317
 318         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 319                 hf_netlogon_unknown_long, NULL);
 320
 321         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 322                 hf_netlogon_unknown_long, NULL);
 323
 324         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 325                 hf_netlogon_unknown_long, NULL);
 326
 327         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 328                 hf_netlogon_unknown_long, NULL);
 329
 330         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 331                 hf_netlogon_unknown_long, NULL);
 332
 333         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 334                 hf_netlogon_unknown_long, NULL);
 335
 336         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 337                 hf_netlogon_unknown_long, NULL);
 338
 339         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 340                 hf_netlogon_unknown_long, NULL);
 341
 342         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 343                 hf_netlogon_unknown_long, NULL);
 344
 345         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 346                 hf_netlogon_unknown_long, NULL);
 347
 348         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 349                 hf_netlogon_unknown_long, NULL);
 350
 351         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 352                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 353                 "unknown", hf_netlogon_unknown_string, -1);
 354
 355         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 356                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 357                 "unknown", hf_netlogon_unknown_string, -1);
 358
 359         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 360                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 361                 "unknown", hf_netlogon_unknown_string, -1);
 362
 363         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 364                 hf_netlogon_unknown_long, NULL);
 365
 366         proto_item_set_len(item, offset-old_offset);
 367         return offset;
 368 }
 369
 370 static int
 371 netlogon_dissect_TYPE_1_ptr(tvbuff_t *tvb, int offset,
 372                         packet_info *pinfo, proto_tree *tree,
 373                         char *drep)
 374 {
 375         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 376                 netlogon_dissect_TYPE_1, NDR_POINTER_PTR,
 377                 "TYPE_1 pointer: ", -1, 0);
 378         return offset;
 379 }
 380
 381 static int
 382 netlogon_dissect_TYPE_2(tvbuff_t *tvb, int offset,
 383                         packet_info *pinfo, proto_tree *parent_tree,
 384                         char *drep)
 385 {
 386         proto_item *item=NULL;
 387         proto_tree *tree=NULL;
 388         int old_offset=offset;
 389
 390         if(parent_tree){
 391                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 392                         "TYPE_2:");
 393                 tree = proto_item_add_subtree(item, ett_TYPE_2);
 394         }
 395
 396         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 397                 hf_netlogon_unknown_long, NULL);
 398
 399         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 400                 hf_netlogon_unknown_short, NULL);
 401
 402         proto_item_set_len(item, offset-old_offset);
 403         return offset;
 404 }
 405
 406 static int
 407 netlogon_dissect_CYPHER_BLOCK(tvbuff_t *tvb, int offset,
 408                         packet_info *pinfo, proto_tree *parent_tree,
 409                         char *drep)
 410 {
 411         proto_item *item=NULL;
 412         proto_tree *tree=NULL;
 413         int i;
 414         dcerpc_info *di;
 415
 416         di=pinfo->private_data;
 417         if(di->conformant_run){
 418                 /*just a run to handle conformant arrays, nothing to dissect.*/
 419                 return offset;
 420         }
 421
 422         if(parent_tree){
 423                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 424                         "CYPHER_BLOCK:");
 425                 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
 426         }
 427
 428         proto_tree_add_item(tree, hf_netlogon_cypher_block, tvb, offset, 8,
 429                 FALSE);
 430         offset += 8;
 431
 432         return offset;
 433 }
 434
 435 static int
 436 netlogon_dissect_8_unknown_bytes(tvbuff_t *tvb, int offset,
 437                         packet_info *pinfo, proto_tree *parent_tree,
 438                         char *drep)
 439 {
 440         proto_item *item=NULL;
 441         proto_tree *tree=NULL;
 442         int i;
 443         dcerpc_info *di;
 444
 445         di=pinfo->private_data;
 446         if(di->conformant_run){
 447                 /*just a run to handle conformant arrays, nothing to dissect.*/
 448                 return offset;
 449         }
 450
 451         if(parent_tree){
 452                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 453                         "unknown bytes not in IDL:");
 454                 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
 455         }
 456
 457         offset += 8;
 458
 459         return offset;
 460 }
 461
 462 static int
 463 netlogon_dissect_NETLOGON_CREDENTIAL(tvbuff_t *tvb, int offset,
 464                         packet_info *pinfo, proto_tree *parent_tree,
 465                         char *drep)
 466 {
 467         proto_item *item=NULL;
 468         proto_tree *tree=NULL;
 469         int i;
 470         dcerpc_info *di;
 471
 472         di=pinfo->private_data;
 473         if(di->conformant_run){
 474                 /*just a run to handle conformant arrays, nothing to dissect.*/
 475                 return offset;
 476         }
 477
 478         if(parent_tree){
 479                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 480                         "NETLOGON_CREDENTIAL:");
 481                 tree = proto_item_add_subtree(item, ett_NETLOGON_CREDENTIAL);
 482         }
 483
 484         proto_tree_add_item(tree, hf_netlogon_credential, tvb, offset, 8,
 485                 FALSE);
 486         offset += 8;
 487
 488         return offset;
 489 }
 490
 491 static int
 492 netlogon_dissect_NETLOGON_AUTHENTICATOR(tvbuff_t *tvb, int offset,
 493                         packet_info *pinfo, proto_tree *parent_tree,
 494                         char *drep)
 495 {
 496         proto_item *item=NULL;
 497         proto_tree *tree=NULL;
 498         int old_offset=offset;
 499
 500         if(parent_tree){
 501                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 502                         "NETLOGON_AUTHENTICATOR:");
 503                 tree = proto_item_add_subtree(item, ett_NETLOGON_AUTHENTICATOR);
 504         }
 505
 506         offset = netlogon_dissect_NETLOGON_CREDENTIAL(tvb, offset,
 507                 pinfo, tree, drep);
 508
 509         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 510                 hf_netlogon_timestamp, NULL);
 511
 512         proto_item_set_len(item, offset-old_offset);
 513         return offset;
 514 }
 515
 516 static int
 517 netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset,
 518                         packet_info *pinfo, proto_tree *parent_tree,
 519                         char *drep)
 520 {
 521         proto_item *item=NULL;
 522         proto_tree *tree=NULL;
 523         dcerpc_info *di;
 524
 525         di=pinfo->private_data;
 526         if(di->conformant_run){
 527                 /*just a run to handle conformant arrays, nothing to dissect.*/
 528                 return offset;
 529         }
 530
 531         if(parent_tree){
 532                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 533                         "USER_SESSION_KEY:");
 534                 tree = proto_item_add_subtree(item, ett_USER_SESSION_KEY);
 535         }
 536
 537         proto_tree_add_item(tree, hf_netlogon_user_session_key, tvb, offset, 16,
 538                 FALSE);
 539         offset += 16;
 540
 541         return offset;
 542 }
 543
 544 static int
 545 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 546                         packet_info *pinfo, proto_tree *parent_tree,
 547                         char *drep)
 548 {
 549         proto_item *item=NULL;
 550         proto_tree *tree=NULL;
 551         dcerpc_info *di;
 552
 553         di=pinfo->private_data;
 554         if(di->conformant_run){
 555                 /*just a run to handle conformant arrays, nothing to dissect.*/
 556                 return offset;
 557         }
 558
 559         if(parent_tree){
 560                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 561                         "ENCRYPTED_LM_OWF_PASSWORD:");
 562                 tree = proto_item_add_subtree(item, ett_ENC_LM_OWF_PASSWORD);
 563         }
 564
 565         proto_tree_add_item(tree, hf_netlogon_encrypted_lm_owf_password, tvb, offset, 16,
 566                 FALSE);
 567         offset += 16;
 568
 569         return offset;
 570 }
 571
 572 static int
 573 netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 574                         packet_info *pinfo, proto_tree *parent_tree,
 575                         char *drep)
 576 {
 577         proto_item *item=NULL;
 578         proto_tree *tree=NULL;
 579         dcerpc_info *di;
 580
 581         di=pinfo->private_data;
 582         if(di->conformant_run){
 583                 /*just a run to handle conformant arrays, nothing to dissect.*/
 584                 return offset;
 585         }
 586
 587         if(parent_tree){
 588                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 589                         "LM_OWF_PASSWORD:");
 590                 tree = proto_item_add_subtree(item, ett_LM_OWF_PASSWORD);
 591         }
 592
 593         proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16,
 594                 FALSE);
 595         offset += 16;
 596
 597         return offset;
 598 }
 599
 600 static int
 601 netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 602                         packet_info *pinfo, proto_tree *parent_tree,
 603                         char *drep)
 604 {
 605         proto_item *item=NULL;
 606         proto_tree *tree=NULL;
 607         dcerpc_info *di;
 608
 609         di=pinfo->private_data;
 610         if(di->conformant_run){
 611                 /*just a run to handle conformant arrays, nothing to dissect.*/
 612                 return offset;
 613         }
 614
 615         if(parent_tree){
 616                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 617                         "NT_OWF_PASSWORD:");
 618                 tree = proto_item_add_subtree(item, ett_NT_OWF_PASSWORD);
 619         }
 620
 621         proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16,
 622                 FALSE);
 623         offset += 16;
 624
 625         return offset;
 626 }
 627
 628
 629 static int
 630 netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
 631                         packet_info *pinfo, proto_tree *parent_tree,
 632                         char *drep)
 633 {
 634         proto_item *item=NULL;
 635         proto_tree *tree=NULL;
 636         int old_offset=offset;
 637
 638         if(parent_tree){
 639                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 640                         "NETLOGON_LOGON_IDENTITY_INFO:");
 641                 tree = proto_item_add_subtree(item, ett_NETLOGON_LOGON_IDENTITY_INFO);
 642         }
 643
 644         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 645                 hf_netlogon_logon_dom, 0);
 646
 647         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 648                 hf_netlogon_param_ctrl, NULL);
 649
 650         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 651                 hf_netlogon_logon_id, NULL);
 652
 653         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 654                 hf_netlogon_acct_name, 0);
 655
 656         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 657                 hf_netlogon_computer_name, 0);
 658
 659         /* XXX 8 extra bytes here */
 660         /* there were 8 extra bytes, either here or in NETWORK_INFO that does not match
 661            the idl file. Could be a bug in either the NETLOGON implementation or in the
 662            idl file.
 663         */
 664         offset = netlogon_dissect_8_unknown_bytes(tvb, offset, pinfo, tree, drep);
 665
 666         return offset;
 667 }
 668
 669 static int
 670 netlogon_dissect_NETLOGON_INTERACTIVE_INFO(tvbuff_t *tvb, int offset,
 671                         packet_info *pinfo, proto_tree *parent_tree,
 672                         char *drep)
 673 {
 674         proto_item *item=NULL;
 675         proto_tree *tree=NULL;
 676         int old_offset=offset;
 677
 678         if(parent_tree){
 679                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 680                         "NETLOGON_INTERACTIVE_INFO:");
 681                 tree = proto_item_add_subtree(item, ett_NETLOGON_INTERACTIVE_INFO);
 682         }
 683
 684         offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
 685                 pinfo, tree, drep);
 686
 687         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
 688                 pinfo, tree, drep);
 689
 690         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
 691                 pinfo, tree, drep);
 692
 693         proto_item_set_len(item, offset-old_offset);
 694         return offset;
 695 }
 696
 697 static int
 698 netlogon_dissect_NETLOGON_NETWORK_INFO(tvbuff_t *tvb, int offset,
 699                         packet_info *pinfo, proto_tree *parent_tree,
 700                         char *drep)
 701 {
 702         proto_item *item=NULL;
 703         proto_tree *tree=NULL;
 704         int old_offset=offset;
 705
 706         if(parent_tree){
 707                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 708                         "NETLOGON_NETWORK_INFO:");
 709                 tree = proto_item_add_subtree(item, ett_NETLOGON_NETWORK_INFO);
 710         }
 711
 712         offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
 713                 pinfo, tree, drep);
 714
 715         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 716                 hf_netlogon_nt_chal_resp, 0);
 717
 718         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 719                 hf_netlogon_lm_chal_resp, 0);
 720
 721         proto_item_set_len(item, offset-old_offset);
 722         return offset;
 723 }
 724
 725 static int
 726 netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
 727                         packet_info *pinfo, proto_tree *parent_tree,
 728                         char *drep)
 729 {
 730         proto_item *item=NULL;
 731         proto_tree *tree=NULL;
 732         int old_offset=offset;
 733
 734         if(parent_tree){
 735                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 736                         "GROUP_MEMBERSHIP:");
 737                 tree = proto_item_add_subtree(item, ett_GROUP_MEMBERSHIP);
 738         }
 739
 740         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 741                 hf_netlogon_user_rid, NULL);
 742
 743         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 744                 hf_netlogon_attrs, NULL);
 745
 746         return offset;
 747 }
 748
 749 static int
 750 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset,
 751                         packet_info *pinfo, proto_tree *tree,
 752                         char *drep)
 753 {
 754         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 755                 netlogon_dissect_GROUP_MEMBERSHIP);
 756
 757         return offset;
 758 }
 759
 760 static int
 761 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1(tvbuff_t *tvb, int offset,
 762                         packet_info *pinfo, proto_tree *parent_tree,
 763                         char *drep)
 764 {
 765         proto_item *item=NULL;
 766         proto_tree *tree=NULL;
 767         int old_offset=offset;
 768         int i;
 769
 770         if(parent_tree){
 771                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 772                         "NETLOGON_VALIDATION_SAM_INFO1:");
 773                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO1);
 774         }
 775
 776         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 777                 hf_netlogon_logon_time);
 778
 779         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 780                 hf_netlogon_logoff_time);
 781
 782         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 783                 hf_netlogon_kickoff_time);
 784
 785         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 786                 hf_netlogon_pwd_last_set_time);
 787
 788         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 789                 hf_netlogon_pwd_can_change_time);
 790
 791         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 792                 hf_netlogon_pwd_must_change_time);
 793
 794         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 795                 hf_netlogon_acct_name, 0);
 796
 797         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 798                 hf_netlogon_full_name, 0);
 799
 800         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 801                 hf_netlogon_logon_script, 0);
 802
 803         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 804                 hf_netlogon_profile_path, 0);
 805
 806         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 807                 hf_netlogon_home_dir, 0);
 808
 809         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 810                 hf_netlogon_dir_drive, 0);
 811
 812         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 813                 hf_netlogon_logon_count, NULL);
 814
 815         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 816                 hf_netlogon_bad_pw_count, NULL);
 817
 818         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 819                 hf_netlogon_user_rid, NULL);
 820
 821         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 822                 hf_netlogon_group_rid, NULL);
 823
 824         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 825                 hf_netlogon_num_rids, NULL);
 826
 827         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 828                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_PTR,
 829                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 830
 831         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 832                 hf_netlogon_user_flags, NULL);
 833
 834         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 835                 pinfo, tree, drep);
 836
 837         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 838                 hf_netlogon_logon_srv, 0);
 839
 840         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 841                 hf_netlogon_logon_dom, 0);
 842
 843         offset = dissect_ndr_nt_PSID(tvb, offset,
 844                 pinfo, tree, drep);
 845
 846         for(i=0;i<10;i++){
 847                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 848                         hf_netlogon_unknown_long, NULL);
 849         }
 850
 851         proto_item_set_len(item, offset-old_offset);
 852         return offset;
 853 }
 854
 855 static int
 856 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset,
 857                         packet_info *pinfo, proto_tree *parent_tree,
 858                         char *drep)
 859 {
 860         proto_item *item=NULL;
 861         proto_tree *tree=NULL;
 862         int old_offset=offset;
 863         int i;
 864
 865         if(parent_tree){
 866                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 867                         "NETLOGON_VALIDATION_SAM_INFO2:");
 868                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO2);
 869         }
 870
 871         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 872                 hf_netlogon_logon_time);
 873
 874         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 875                 hf_netlogon_logoff_time);
 876
 877         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 878                 hf_netlogon_kickoff_time);
 879
 880         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 881                 hf_netlogon_pwd_last_set_time);
 882
 883         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 884                 hf_netlogon_pwd_can_change_time);
 885
 886         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 887                 hf_netlogon_pwd_must_change_time);
 888
 889         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 890                 hf_netlogon_acct_name, 0);
 891
 892         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 893                 hf_netlogon_full_name, 0);
 894
 895         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 896                 hf_netlogon_logon_script, 0);
 897
 898         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 899                 hf_netlogon_profile_path, 0);
 900
 901         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 902                 hf_netlogon_home_dir, 0);
 903
 904         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 905                 hf_netlogon_dir_drive, 0);
 906
 907         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 908                 hf_netlogon_logon_count, NULL);
 909
 910         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 911                 hf_netlogon_bad_pw_count, NULL);
 912
 913         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 914                 hf_netlogon_user_rid, NULL);
 915
 916         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 917                 hf_netlogon_group_rid, NULL);
 918
 919         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 920                 hf_netlogon_num_rids, NULL);
 921
 922         /* XXX i am not sure about this pointer being UNIQUE, though I am
 923            pretty convinced that it is NOT PTR as the idl file suggests.
 924         */
 925         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 926                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
 927                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 928
 929         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 930                 hf_netlogon_user_flags, NULL);
 931
 932         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 933                 pinfo, tree, drep);
 934
 935         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 936                 hf_netlogon_logon_srv, 0);
 937
 938         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 939                 hf_netlogon_logon_dom, 0);
 940
 941         offset = dissect_ndr_nt_PSID(tvb, offset,
 942                 pinfo, tree, drep);
 943
 944         for(i=0;i<10;i++){
 945                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 946                         hf_netlogon_unknown_long, NULL);
 947         }
 948
 949         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 950                 hf_netlogon_num_other_groups, NULL);
 951
 952         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 953                 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_PTR,
 954                 "SID_AND_ATTRIBUTES_ARRAY:", -1, 0);
 955
 956         proto_item_set_len(item, offset-old_offset);
 957         return offset;
 958 }
 959
 960 static int
 961 netlogon_dissect_TYPE_16(tvbuff_t *tvb, int offset,
 962                         packet_info *pinfo, proto_tree *parent_tree,
 963                         char *drep)
 964 {
 965         proto_item *item=NULL;
 966         proto_tree *tree=NULL;
 967         int old_offset=offset;
 968
 969         if(parent_tree){
 970                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 971                         "TYPE_16:");
 972                 tree = proto_item_add_subtree(item, ett_TYPE_16);
 973         }
 974
 975         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 976                 hf_netlogon_unknown_time);
 977
 978         proto_item_set_len(item, offset-old_offset);
 979         return offset;
 980 }
 981
 982
 983 static int
 984 netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 985                         packet_info *pinfo, proto_tree *parent_tree,
 986                         char *drep)
 987 {
 988         proto_item *item=NULL;
 989         proto_tree *tree=NULL;
 990         int old_offset=offset;
 991
 992         if(parent_tree){
 993                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 994                         "NETLOGON_SAM_DOMAIN_INFO:");
 995                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_DOMAIN_INFO);
 996         }
 997
 998         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 999                 hf_netlogon_unknown_string, 0);
1000
1001         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1002                 hf_netlogon_unknown_string, 0);
1003
1004         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1005                 hf_netlogon_unknown_time);
1006
1007         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1008                 hf_netlogon_unknown_short, NULL);
1009
1010         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1011                 hf_netlogon_unknown_short, NULL);
1012
1013         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1014                 hf_netlogon_unknown_time);
1015
1016         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1017                 hf_netlogon_unknown_time);
1018
1019         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1020                 hf_netlogon_unknown_time);
1021
1022         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1023                 hf_netlogon_unknown_time);
1024
1025         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1026                 hf_netlogon_unknown_string, 0);
1027
1028         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1029                 hf_netlogon_unknown_string, 0);
1030
1031         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1032                 hf_netlogon_unknown_string, 0);
1033
1034         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1035                 hf_netlogon_unknown_string, 0);
1036
1037         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1038                 hf_netlogon_unknown_string, 0);
1039
1040         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1041                 hf_netlogon_unknown_long, NULL);
1042
1043         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1044                 hf_netlogon_unknown_long, NULL);
1045
1046         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1047                 hf_netlogon_unknown_long, NULL);
1048
1049         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1050                 hf_netlogon_unknown_long, NULL);
1051
1052         proto_item_set_len(item, offset-old_offset);
1053         return offset;
1054 }
1055
1056
1057 static int
1058 netlogon_dissect_NETLOGON_SAM_GROUP_INFO(tvbuff_t *tvb, int offset,
1059                         packet_info *pinfo, proto_tree *parent_tree,
1060                         char *drep)
1061 {
1062         proto_item *item=NULL;
1063         proto_tree *tree=NULL;
1064         int old_offset=offset;
1065
1066         if(parent_tree){
1067                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1068                         "NETLOGON_SAM_GROUP_INFO:");
1069                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_INFO);
1070         }
1071
1072         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1073                 hf_netlogon_group_name, 0);
1074
1075         offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset,
1076                 pinfo, tree, drep);
1077
1078         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1079                 hf_netlogon_group_desc, 0);
1080
1081         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1082                 pinfo, tree, drep);
1083
1084         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1085                 hf_netlogon_unknown_string, 0);
1086
1087         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1088                 hf_netlogon_unknown_string, 0);
1089
1090         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1091                 hf_netlogon_unknown_string, 0);
1092
1093         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1094                 hf_netlogon_unknown_string, 0);
1095
1096         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1097                 hf_netlogon_unknown_long, NULL);
1098
1099         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1100                 hf_netlogon_unknown_long, NULL);
1101
1102         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1103                 hf_netlogon_unknown_long, NULL);
1104
1105         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1106                 hf_netlogon_unknown_long, NULL);
1107
1108         proto_item_set_len(item, offset-old_offset);
1109         return offset;
1110 }
1111
1112
1113 static int
1114 netlogon_dissect_TYPE_23(tvbuff_t *tvb, int offset,
1115                         packet_info *pinfo, proto_tree *parent_tree,
1116                         char *drep)
1117 {
1118         proto_item *item=NULL;
1119         proto_tree *tree=NULL;
1120         int old_offset=offset;
1121
1122         if(parent_tree){
1123                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1124                         "TYPE_23:");
1125                 tree = proto_item_add_subtree(item, ett_TYPE_23);
1126         }
1127
1128         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1129                 hf_netlogon_unknown_string, 0);
1130
1131         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1132                 hf_netlogon_unknown_string, 0);
1133
1134         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1135                 hf_netlogon_unknown_string, 0);
1136
1137         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1138                 hf_netlogon_unknown_string, 0);
1139
1140         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1141                 hf_netlogon_unknown_string, 0);
1142
1143         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1144                 hf_netlogon_unknown_string, 0);
1145
1146         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1147                 hf_netlogon_unknown_long, NULL);
1148
1149         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1150                 hf_netlogon_unknown_long, NULL);
1151
1152         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1153                 hf_netlogon_unknown_long, NULL);
1154
1155         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1156                 hf_netlogon_unknown_long, NULL);
1157
1158         proto_item_set_len(item, offset-old_offset);
1159         return offset;
1160 }
1161
1162
1163 static int
1164 netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO(tvbuff_t *tvb, int offset,
1165                         packet_info *pinfo, proto_tree *parent_tree,
1166                         char *drep)
1167 {
1168         proto_item *item=NULL;
1169         proto_tree *tree=NULL;
1170         int old_offset=offset;
1171
1172         if(parent_tree){
1173                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1174                         "NETLOGON_SAM_ACCOUNT_INFO:");
1175                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ACCOUNT_INFO);
1176         }
1177
1178         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1179                 hf_netlogon_acct_name, 0);
1180
1181         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1182                 hf_netlogon_full_name, 0);
1183
1184         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1185                 hf_netlogon_user_rid, NULL);
1186
1187         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1188                 hf_netlogon_group_rid, NULL);
1189
1190         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1191                 hf_netlogon_home_dir, 0);
1192
1193         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1194                 hf_netlogon_dir_drive, 0);
1195
1196         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1197                 hf_netlogon_logon_script, 0);
1198
1199         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1200                 hf_netlogon_acct_desc, 0);
1201
1202         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1203                 hf_netlogon_workstations, 0);
1204
1205         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1206                 hf_netlogon_logon_time);
1207
1208         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1209                 hf_netlogon_logoff_time);
1210
1211         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
1212
1213         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1214                 hf_netlogon_bad_pw_count, NULL);
1215
1216         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1217                 hf_netlogon_logon_count, NULL);
1218
1219         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1220                 hf_netlogon_pwd_last_set_time);
1221
1222         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1223                 hf_netlogon_acct_expiry_time);
1224
1225         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
1226
1227         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
1228                 pinfo, tree, drep);
1229
1230         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
1231                 pinfo, tree, drep);
1232
1233         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1234                 hf_netlogon_nt_pwd_present, NULL);
1235
1236         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1237                 hf_netlogon_lm_pwd_present, NULL);
1238
1239         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1240                 hf_netlogon_pwd_expired, NULL);
1241
1242         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1243                 hf_netlogon_comment, 0);
1244
1245         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1246                 hf_netlogon_parameters, 0);
1247
1248         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1249                 hf_netlogon_country, NULL);
1250
1251         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1252                 hf_netlogon_codepage, NULL);
1253
1254         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1255                 hf_netlogon_num_pwd_pairs, NULL);
1256
1257         offset = lsa_dissect_LSA_SECRET(tvb, offset,
1258                 pinfo, tree, drep);
1259
1260         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1261                 pinfo, tree, drep);
1262
1263         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1264                 hf_netlogon_profile_path, 0);
1265
1266         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1267                 hf_netlogon_unknown_string, 0);
1268
1269         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1270                 hf_netlogon_unknown_string, 0);
1271
1272         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1273                 hf_netlogon_unknown_string, 0);
1274
1275         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1276                 hf_netlogon_unknown_long, NULL);
1277
1278         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1279                 hf_netlogon_unknown_long, NULL);
1280
1281         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1282                 hf_netlogon_unknown_long, NULL);
1283
1284         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1285                 hf_netlogon_unknown_long, NULL);
1286
1287         proto_item_set_len(item, offset-old_offset);
1288         return offset;
1289 }
1290
1291
1292 static int
1293 netlogon_dissect_rid(tvbuff_t *tvb, int offset,
1294                         packet_info *pinfo, proto_tree *tree,
1295                         char *drep)
1296 {
1297         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1298                                 hf_netlogon_user_rid, NULL);
1299
1300         return offset;
1301 }
1302
1303 static int
1304 netlogon_dissect_rids_array(tvbuff_t *tvb, int offset,
1305                         packet_info *pinfo, proto_tree *parent_tree,
1306                         char *drep)
1307 {
1308         proto_item *item=NULL;
1309         proto_tree *tree=NULL;
1310         int old_offset=offset;
1311
1312         if(parent_tree){
1313                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1314                         "RID array:");
1315                 tree = proto_item_add_subtree(item, ett_rid_array);
1316         }
1317
1318         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1319                         netlogon_dissect_rid);
1320
1321         proto_item_set_len(item, offset-old_offset);
1322         return offset;
1323 }
1324
1325 static int
1326 netlogon_dissect_attrib(tvbuff_t *tvb, int offset,
1327                         packet_info *pinfo, proto_tree *tree,
1328                         char *drep)
1329 {
1330         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1331                 hf_netlogon_attrs, NULL);
1332
1333         return offset;
1334 }
1335
1336 static int
1337 netlogon_dissect_attribs_array(tvbuff_t *tvb, int offset,
1338                         packet_info *pinfo, proto_tree *parent_tree,
1339                         char *drep)
1340 {
1341         proto_item *item=NULL;
1342         proto_tree *tree=NULL;
1343         int old_offset=offset;
1344
1345         if(parent_tree){
1346                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1347                         "Attrib array:");
1348                 tree = proto_item_add_subtree(item, ett_attrib_array);
1349         }
1350
1351         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1352                         netlogon_dissect_attrib);
1353
1354         proto_item_set_len(item, offset-old_offset);
1355         return offset;
1356 }
1357
1358 static int
1359 netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO(tvbuff_t *tvb, int offset,
1360                         packet_info *pinfo, proto_tree *parent_tree,
1361                         char *drep)
1362 {
1363         proto_item *item=NULL;
1364         proto_tree *tree=NULL;
1365         int old_offset=offset;
1366
1367         if(parent_tree){
1368                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1369                         "NETLOGON_SAM_GROUP_MEM_INFO:");
1370                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_MEM_INFO);
1371         }
1372
1373         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1374                 netlogon_dissect_rids_array, NDR_POINTER_PTR,
1375                 "RIDs:", -1, 0);
1376
1377         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1378                 netlogon_dissect_attribs_array, NDR_POINTER_PTR,
1379                 "Attribs:", -1, 0);
1380
1381         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1382                 hf_netlogon_num_rids, NULL);
1383
1384         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1385                 hf_netlogon_unknown_long, NULL);
1386
1387         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1388                 hf_netlogon_unknown_long, NULL);
1389
1390         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1391                 hf_netlogon_unknown_long, NULL);
1392
1393         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1394                 hf_netlogon_unknown_long, NULL);
1395
1396         proto_item_set_len(item, offset-old_offset);
1397         return offset;
1398 }
1399
1400
1401 static int
1402 netlogon_dissect_NETLOGON_SAM_ALIAS_INFO(tvbuff_t *tvb, int offset,
1403                         packet_info *pinfo, proto_tree *parent_tree,
1404                         char *drep)
1405 {
1406         proto_item *item=NULL;
1407         proto_tree *tree=NULL;
1408         int old_offset=offset;
1409
1410         if(parent_tree){
1411                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1412                         "NETLOGON_SAM_ALIAS_INFO:");
1413                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_INFO);
1414         }
1415
1416
1417         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1418                 hf_netlogon_alias_name, 0);
1419
1420         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1421                 hf_netlogon_alias_rid, NULL);
1422
1423         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1424                 pinfo, tree, drep);
1425
1426         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1427                 hf_netlogon_acct_desc, 0);
1428
1429         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1430                 hf_netlogon_unknown_string, 0);
1431
1432         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1433                 hf_netlogon_unknown_string, 0);
1434
1435         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1436                 hf_netlogon_unknown_string, 0);
1437
1438         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1439                 hf_netlogon_unknown_long, NULL);
1440
1441         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1442                 hf_netlogon_unknown_long, NULL);
1443
1444         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1445                 hf_netlogon_unknown_long, NULL);
1446
1447         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1448                 hf_netlogon_unknown_long, NULL);
1449
1450         proto_item_set_len(item, offset-old_offset);
1451         return offset;
1452 }
1453
1454
1455 static int
1456 netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO(tvbuff_t *tvb, int offset,
1457                         packet_info *pinfo, proto_tree *parent_tree,
1458                         char *drep)
1459 {
1460         proto_item *item=NULL;
1461         proto_tree *tree=NULL;
1462         int old_offset=offset;
1463
1464         if(parent_tree){
1465                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1466                         "NETLOGON_SAM_ALIAS_MEM_INFO:");
1467                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_MEM_INFO);
1468         }
1469
1470         offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, drep);
1471
1472         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1473                 hf_netlogon_unknown_long, NULL);
1474
1475         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1476                 hf_netlogon_unknown_long, NULL);
1477
1478         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1479                 hf_netlogon_unknown_long, NULL);
1480
1481         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1482                 hf_netlogon_unknown_long, NULL);
1483
1484         proto_item_set_len(item, offset-old_offset);
1485         return offset;
1486 }
1487
1488 static int
1489 netlogon_dissect_TYPE_30(tvbuff_t *tvb, int offset,
1490                         packet_info *pinfo, proto_tree *parent_tree,
1491                         char *drep)
1492 {
1493         proto_item *item=NULL;
1494         proto_tree *tree=NULL;
1495         int old_offset=offset;
1496
1497         if(parent_tree){
1498                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1499                         "TYPE_30:");
1500                 tree = proto_item_add_subtree(item, ett_TYPE_30);
1501         }
1502
1503         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1504                 hf_netlogon_unknown_long, NULL);
1505
1506         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1507                 hf_netlogon_unknown_long, NULL);
1508
1509         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1510                 hf_netlogon_unknown_long, NULL);
1511
1512         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1513                 hf_netlogon_unknown_long, NULL);
1514
1515         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1516                 hf_netlogon_unknown_long, NULL);
1517
1518         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1519                 hf_netlogon_unknown_time);
1520
1521         proto_item_set_len(item, offset-old_offset);
1522         return offset;
1523 }
1524
1525 static int
1526 netlogon_dissect_element_422(tvbuff_t *tvb, int offset,
1527                         packet_info *pinfo, proto_tree *tree,
1528                         char *drep)
1529 {
1530         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1531                 hf_netlogon_unknown_long, NULL);
1532
1533         return offset;
1534 }
1535
1536 static int
1537 netlogon_dissect_element_422_array(tvbuff_t *tvb, int offset,
1538                         packet_info *pinfo, proto_tree *tree,
1539                         char *drep)
1540 {
1541         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1542                 netlogon_dissect_element_422);
1543
1544         return offset;
1545 }
1546
1547
1548 static int
1549 netlogon_dissect_TYPE_29(tvbuff_t *tvb, int offset,
1550                         packet_info *pinfo, proto_tree *parent_tree,
1551                         char *drep)
1552 {
1553         proto_item *item=NULL;
1554         proto_tree *tree=NULL;
1555         int old_offset=offset;
1556
1557         if(parent_tree){
1558                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1559                         "TYPE_29:");
1560                 tree = proto_item_add_subtree(item, ett_TYPE_29);
1561         }
1562
1563         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1564                 hf_netlogon_unknown_long, NULL);
1565
1566         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1567                 hf_netlogon_unknown_time);
1568
1569         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1570                 hf_netlogon_unknown_char, NULL);
1571
1572         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1573                 hf_netlogon_unknown_long, NULL);
1574
1575         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1576                 netlogon_dissect_element_422_array, NDR_POINTER_PTR,
1577                 "unknown", -1, 0);
1578
1579         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1580                 hf_netlogon_unknown_string, 0);
1581
1582         offset = dissect_ndr_nt_PSID(tvb, offset,
1583                 pinfo, tree, drep);
1584
1585         offset = netlogon_dissect_TYPE_30(tvb, offset,
1586                 pinfo, tree, drep);
1587
1588         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1589                 hf_netlogon_unknown_time);
1590
1591         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1592                 hf_netlogon_unknown_time);
1593
1594         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1595                 pinfo, tree, drep);
1596
1597         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1598                 hf_netlogon_unknown_string, 0);
1599
1600         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1601                 hf_netlogon_unknown_string, 0);
1602
1603         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1604                 hf_netlogon_unknown_string, 0);
1605
1606         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1607                 hf_netlogon_unknown_string, 0);
1608
1609         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1610                 hf_netlogon_unknown_long, NULL);
1611
1612         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1613                 hf_netlogon_unknown_long, NULL);
1614
1615         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1616                 hf_netlogon_unknown_long, NULL);
1617
1618         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1619                 hf_netlogon_unknown_long, NULL);
1620
1621         proto_item_set_len(item, offset-old_offset);
1622         return offset;
1623 }
1624
1625
1626 static int
1627 netlogon_dissect_TYPE_31(tvbuff_t *tvb, int offset,
1628                         packet_info *pinfo, proto_tree *parent_tree,
1629                         char *drep)
1630 {
1631         proto_item *item=NULL;
1632         proto_tree *tree=NULL;
1633         int old_offset=offset;
1634
1635         if(parent_tree){
1636                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1637                         "TYPE_31:");
1638                 tree = proto_item_add_subtree(item, ett_TYPE_31);
1639         }
1640
1641         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1642                 hf_netlogon_unknown_string, 0);
1643
1644         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1645                 hf_netlogon_unknown_string, 0);
1646
1647         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1648                 hf_netlogon_unknown_long, NULL);
1649
1650         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1651                 hf_netlogon_unknown_string, 0);
1652
1653         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1654                 hf_netlogon_unknown_string, 0);
1655
1656         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1657                 hf_netlogon_unknown_string, 0);
1658
1659         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1660                 hf_netlogon_unknown_string, 0);
1661
1662         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1663                 hf_netlogon_unknown_string, 0);
1664
1665         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1666                 hf_netlogon_unknown_long, NULL);
1667
1668         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1669                 hf_netlogon_unknown_long, NULL);
1670
1671         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1672                 hf_netlogon_unknown_long, NULL);
1673
1674         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1675                 hf_netlogon_unknown_long, NULL);
1676
1677         proto_item_set_len(item, offset-old_offset);
1678         return offset;
1679 }
1680
1681
1682 static int
1683 netlogon_dissect_TYPE_32(tvbuff_t *tvb, int offset,
1684                         packet_info *pinfo, proto_tree *parent_tree,
1685                         char *drep)
1686 {
1687         proto_item *item=NULL;
1688         proto_tree *tree=NULL;
1689         int old_offset=offset;
1690
1691         if(parent_tree){
1692                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1693                         "TYPE_32:");
1694                 tree = proto_item_add_subtree(item, ett_TYPE_32);
1695         }
1696
1697         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1698                 hf_netlogon_unknown_string, 0);
1699
1700         proto_item_set_len(item, offset-old_offset);
1701         return offset;
1702 }
1703
1704
1705 static int
1706 netlogon_dissect_attrs(tvbuff_t *tvb, int offset,
1707                         packet_info *pinfo, proto_tree *tree,
1708                         char *drep)
1709 {
1710         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1711                 hf_netlogon_attrs, NULL);
1712
1713         return offset;
1714 }
1715
1716 static int
1717 netlogon_dissect_attrs_array(tvbuff_t *tvb, int offset,
1718                         packet_info *pinfo, proto_tree *tree,
1719                         char *drep)
1720 {
1721         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1722                 netlogon_dissect_attrs);
1723
1724         return offset;
1725 }
1726
1727
1728 static int
1729 netlogon_dissect_TYPE_33(tvbuff_t *tvb, int offset,
1730                         packet_info *pinfo, proto_tree *parent_tree,
1731                         char *drep)
1732 {
1733         proto_item *item=NULL;
1734         proto_tree *tree=NULL;
1735         int old_offset=offset;
1736
1737         if(parent_tree){
1738                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1739                         "TYPE_33:");
1740                 tree = proto_item_add_subtree(item, ett_TYPE_33);
1741         }
1742
1743
1744         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1745                 hf_netlogon_count, NULL);
1746
1747         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1748                 hf_netlogon_unknown_long, NULL);
1749
1750         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1751                 netlogon_dissect_attrs_array, NDR_POINTER_PTR,
1752                 "ATTRS_ARRAY:", -1, 0);
1753
1754         offset = netlogon_dissect_TYPE_30(tvb, offset,
1755                 pinfo, tree, drep);
1756
1757         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1758                 hf_netlogon_unknown_long, NULL);
1759
1760         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1761                 hf_netlogon_unknown_long, NULL);
1762
1763         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1764                 hf_netlogon_unknown_string, 0);
1765
1766         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1767                 hf_netlogon_unknown_string, 0);
1768
1769         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1770                 hf_netlogon_unknown_string, 0);
1771
1772         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1773                 hf_netlogon_unknown_string, 0);
1774
1775         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1776                 hf_netlogon_unknown_string, 0);
1777
1778         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1779                 hf_netlogon_unknown_long, NULL);
1780
1781         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1782                 hf_netlogon_unknown_long, NULL);
1783
1784         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1785                 hf_netlogon_unknown_long, NULL);
1786
1787         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1788                 hf_netlogon_unknown_long, NULL);
1789
1790         proto_item_set_len(item, offset-old_offset);
1791         return offset;
1792 }
1793
1794
1795 static int
1796 netlogon_dissect_TYPE_34(tvbuff_t *tvb, int offset,
1797                         packet_info *pinfo, proto_tree *parent_tree,
1798                         char *drep)
1799 {
1800         proto_item *item=NULL;
1801         proto_tree *tree=NULL;
1802         int old_offset=offset;
1803
1804         if(parent_tree){
1805                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1806                         "TYPE_34:");
1807                 tree = proto_item_add_subtree(item, ett_TYPE_34);
1808         }
1809
1810         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1811                 hf_netlogon_unknown_string, 0);
1812
1813         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1814                 hf_netlogon_unknown_time);
1815
1816         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1817                 hf_netlogon_unknown_string, 0);
1818
1819         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1820                 hf_netlogon_unknown_time);
1821
1822         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1823                 hf_netlogon_unknown_long, NULL);
1824
1825         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1826                 hf_netlogon_unknown_string, 0);
1827
1828         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1829                 hf_netlogon_unknown_string, 0);
1830
1831         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1832                 hf_netlogon_unknown_string, 0);
1833
1834         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1835                 hf_netlogon_unknown_string, 0);
1836
1837         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1838                 hf_netlogon_unknown_string, 0);
1839
1840         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1841                 hf_netlogon_unknown_long, NULL);
1842
1843         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1844                 hf_netlogon_unknown_long, NULL);
1845
1846         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1847                 hf_netlogon_unknown_long, NULL);
1848
1849         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1850                 hf_netlogon_unknown_long, NULL);
1851
1852         proto_item_set_len(item, offset-old_offset);
1853         return offset;
1854 }
1855
1856 static int
1857 netlogon_dissect_TYPE_35(tvbuff_t *tvb, int offset,
1858                         packet_info *pinfo, proto_tree *parent_tree,
1859                         char *drep)
1860 {
1861         proto_item *item=NULL;
1862         proto_tree *tree=NULL;
1863         int old_offset=offset;
1864
1865         if(parent_tree){
1866                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1867                         "TYPE_35:");
1868                 tree = proto_item_add_subtree(item, ett_TYPE_35);
1869         }
1870
1871         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1872                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1873                 "unknown", hf_netlogon_unknown_string, -1);
1874
1875         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1876                 hf_netlogon_unknown_string, 0);
1877
1878         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1879                 hf_netlogon_unknown_string, 0);
1880
1881         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1882                 hf_netlogon_unknown_string, 0);
1883
1884         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1885                 hf_netlogon_unknown_string, 0);
1886
1887         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1888                 hf_netlogon_unknown_long, NULL);
1889
1890         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1891                 hf_netlogon_unknown_long, NULL);
1892
1893         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1894                 hf_netlogon_unknown_long, NULL);
1895
1896         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1897                 hf_netlogon_unknown_long, NULL);
1898
1899         proto_item_set_len(item, offset-old_offset);
1900         return offset;
1901 }
1902
1903 static int
1904 netlogon_dissect_WCHAR_ptr(tvbuff_t *tvb, int offset,
1905                         packet_info *pinfo, proto_tree *tree,
1906                         char *drep)
1907 {
1908         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1909                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1910                 "unknown string", hf_netlogon_unknown_string, -1);
1911
1912         return offset;
1913 }
1914
1915 static int
1916 netlogon_dissect_TYPE_36(tvbuff_t *tvb, int offset,
1917                         packet_info *pinfo, proto_tree *parent_tree,
1918                         char *drep)
1919 {
1920         proto_item *item=NULL;
1921         proto_tree *tree=NULL;
1922         int old_offset=offset;
1923         int i;
1924
1925         if(parent_tree){
1926                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1927                         "TYPE_36:");
1928                 tree = proto_item_add_subtree(item, ett_TYPE_36);
1929         }
1930
1931         for(i=0;i<16;i++){
1932                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1933                         hf_netlogon_unknown_char, NULL);
1934         }
1935
1936         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1937                 hf_netlogon_unknown_long, NULL);
1938
1939         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1940                 hf_netlogon_unknown_long, NULL);
1941
1942         proto_item_set_len(item, offset-old_offset);
1943         return offset;
1944 }
1945
1946 static int
1947 netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
1948                         packet_info *pinfo, proto_tree *parent_tree,
1949                         char *drep)
1950 {
1951         proto_item *item=NULL;
1952         proto_tree *tree=NULL;
1953         int old_offset=offset;
1954
1955         if(parent_tree){
1956                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1957                         "NETLOGON_INFO_1:");
1958                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_1);
1959         }
1960
1961         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1962                 hf_netlogon_flags, NULL);
1963
1964         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1965                 hf_netlogon_status, NULL);
1966
1967         proto_item_set_len(item, offset-old_offset);
1968         return offset;
1969 }
1970
1971 static int
1972 netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
1973                         packet_info *pinfo, proto_tree *parent_tree,
1974                         char *drep)
1975 {
1976         proto_item *item=NULL;
1977         proto_tree *tree=NULL;
1978         int old_offset=offset;
1979
1980         if(parent_tree){
1981                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1982                         "NETLOGON_INFO_2:");
1983                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_2);
1984         }
1985
1986         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1987                 hf_netlogon_unknown_long, NULL);
1988
1989         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1990                 hf_netlogon_unknown_long, NULL);
1991
1992         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1993                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1994                 "unknown", hf_netlogon_unknown_string, -1);
1995
1996         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1997                 hf_netlogon_unknown_long, NULL);
1998
1999         proto_item_set_len(item, offset-old_offset);
2000         return offset;
2001 }
2002
2003 static int
2004 netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
2005                         packet_info *pinfo, proto_tree *parent_tree,
2006                         char *drep)
2007 {
2008         proto_item *item=NULL;
2009         proto_tree *tree=NULL;
2010         int old_offset=offset;
2011
2012         if(parent_tree){
2013                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2014                         "NETLOGON_INFO_3:");
2015                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_3);
2016         }
2017
2018         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2019                 hf_netlogon_flags, NULL);
2020
2021         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2022                 hf_netlogon_logon_attempts, NULL);
2023
2024         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2025                 hf_netlogon_unknown_long, NULL);
2026
2027         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2028                 hf_netlogon_unknown_long, NULL);
2029
2030         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2031                 hf_netlogon_unknown_long, NULL);
2032
2033         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2034                 hf_netlogon_unknown_long, NULL);
2035
2036         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2037                 hf_netlogon_unknown_long, NULL);
2038
2039         proto_item_set_len(item, offset-old_offset);
2040         return offset;
2041 }
2042
2043 static int
2044 netlogon_dissect_NETLOGON_INFO_4(tvbuff_t *tvb, int offset,
2045                         packet_info *pinfo, proto_tree *parent_tree,
2046                         char *drep)
2047 {
2048         proto_item *item=NULL;
2049         proto_tree *tree=NULL;
2050         int old_offset=offset;
2051
2052         if(parent_tree){
2053                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2054                         "NETLOGON_INFO_4:");
2055                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_4);
2056         }
2057
2058         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2059                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2060                 "unknown", hf_netlogon_trusted_dc_name, -1);
2061
2062         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2063                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2064                 "unknown", hf_netlogon_trusted_domain_name, -1);
2065
2066         proto_item_set_len(item, offset-old_offset);
2067         return offset;
2068 }
2069
2070 static int
2071 netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
2072                         packet_info *pinfo, proto_tree *tree,
2073                         char *drep)
2074 {
2075                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2076                         hf_netlogon_unknown_char, NULL);
2077
2078         return offset;
2079 }
2080
2081 static int
2082 netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
2083                         packet_info *pinfo, proto_tree *tree,
2084                         char *drep)
2085 {
2086         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2087                 netlogon_dissect_UNICODE_MULTI_byte);
2088
2089         return offset;
2090 }
2091
2092 static int
2093 netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
2094                         packet_info *pinfo, proto_tree *tree,
2095                         char *drep)
2096 {
2097                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2098                         hf_netlogon_unknown_char, NULL);
2099
2100         return offset;
2101 }
2102
2103 static int
2104 netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
2105                         packet_info *pinfo, proto_tree *tree,
2106                         char *drep)
2107 {
2108         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2109                 netlogon_dissect_BYTE_byte);
2110
2111         return offset;
2112 }
2113
2114 static int
2115 netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
2116                         packet_info *pinfo, proto_tree *parent_tree,
2117                         char *drep)
2118 {
2119         proto_item *item=NULL;
2120         proto_tree *tree=NULL;
2121         int old_offset=offset;
2122
2123         if(parent_tree){
2124                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2125                         "UNICODE_MULTI:");
2126                 tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
2127         }
2128
2129         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2130                 hf_netlogon_len, NULL);
2131
2132         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2133                 netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_PTR,
2134                 "unknown", hf_netlogon_unknown_string, 0);
2135
2136         proto_item_set_len(item, offset-old_offset);
2137         return offset;
2138 }
2139
2140 int
2141 dissect_nt_GUID(tvbuff_t *tvb, int offset,
2142                         packet_info *pinfo, proto_tree *parent_tree,
2143                         char *drep)
2144 {
2145         proto_item *item=NULL;
2146         proto_tree *tree=NULL;
2147         int old_offset=offset;
2148         int i;
2149
2150         if(parent_tree){
2151                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2152                         "GUID:");
2153                 tree = proto_item_add_subtree(item, ett_GUID);
2154         }
2155
2156         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2157                 hf_netlogon_unknown_long, NULL);
2158
2159         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2160                 hf_netlogon_unknown_short, NULL);
2161
2162         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2163                 hf_netlogon_unknown_short, NULL);
2164
2165         for(i=0;i<8;i++){
2166                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2167                         hf_netlogon_unknown_char, NULL);
2168         }
2169
2170         proto_item_set_len(item, offset-old_offset);
2171         return offset;
2172 }
2173
2174 static int
2175 netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
2176                         packet_info *pinfo, proto_tree *parent_tree,
2177                         char *drep)
2178 {
2179         proto_item *item=NULL;
2180         proto_tree *tree=NULL;
2181         int old_offset=offset;
2182
2183         if(parent_tree){
2184                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2185                         "DOMAIN_CONTROLLER_INFO:");
2186                 tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
2187         }
2188
2189         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2190                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2191                 "unknown", hf_netlogon_dc_name, -1);
2192
2193         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2194                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2195                 "unknown", hf_netlogon_dc_address, -1);
2196
2197         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2198                 hf_netlogon_dc_address_type, NULL);
2199
2200         offset = dissect_nt_GUID(tvb, offset,
2201                 pinfo, tree, drep);
2202
2203         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2204                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2205                 "unknown", hf_netlogon_logon_dom, -1);
2206
2207         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2208                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2209                 "unknown", hf_netlogon_dns_forest_name, -1);
2210
2211         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2212                 hf_netlogon_flags, NULL);
2213
2214         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2215                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2216                 "unknown", hf_netlogon_dc_site_name, -1);
2217
2218         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2219                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2220                 "unknown", hf_netlogon_client_site_name, -1);
2221
2222         proto_item_set_len(item, offset-old_offset);
2223         return offset;
2224 }
2225
2226 static int
2227 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr(tvbuff_t *tvb, int offset,
2228                         packet_info *pinfo, proto_tree *tree,
2229                         char *drep)
2230 {
2231         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2232                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_PTR,
2233                 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2234
2235         return offset;
2236 }
2237
2238 static int
2239 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr(tvbuff_t *tvb, int offset,
2240                         packet_info *pinfo, proto_tree *tree,
2241                         char *drep)
2242 {
2243         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2244                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_PTR,
2245                 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2246
2247         return offset;
2248 }
2249
2250 static int
2251 netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
2252                         packet_info *pinfo, proto_tree *tree,
2253                         char *drep)
2254 {
2255         guint32 len;
2256         dcerpc_info *di;
2257
2258         di=pinfo->private_data;
2259         if(di->conformant_run){
2260                 /*just a run to handle conformant arrays, nothing to dissect.*/
2261                 return offset;
2262         }
2263
2264         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2265                 hf_netlogon_blob_size, &len);
2266
2267         proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
2268                 FALSE);
2269         offset += len;
2270
2271         return offset;
2272 }
2273
2274 static int
2275 netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
2276                         packet_info *pinfo, proto_tree *parent_tree,
2277                         char *drep)
2278 {
2279         proto_item *item=NULL;
2280         proto_tree *tree=NULL;
2281         int old_offset=offset;
2282
2283         if(parent_tree){
2284                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2285                         "BLOB:");
2286                 tree = proto_item_add_subtree(item, ett_BLOB);
2287         }
2288
2289         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2290                 hf_netlogon_blob_size, NULL);
2291
2292         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2293                 netlogon_dissect_BLOB_array, NDR_POINTER_PTR,
2294                 "BLOB:", -1, 0);
2295
2296         return offset;
2297 }
2298
2299 static int
2300 netlogon_dissect_BLOB_ptr(tvbuff_t *tvb, int offset,
2301                         packet_info *pinfo, proto_tree *tree,
2302                         char *drep)
2303 {
2304         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2305                 netlogon_dissect_BLOB, NDR_POINTER_PTR,
2306                 "BLOB pointer:", -1, 0);
2307
2308         return offset;
2309 }
2310
2311 static int
2312 netlogon_dissect_TYPE_46(tvbuff_t *tvb, int offset,
2313                         packet_info *pinfo, proto_tree *parent_tree,
2314                         char *drep)
2315 {
2316         proto_item *item=NULL;
2317         proto_tree *tree=NULL;
2318         int old_offset=offset;
2319
2320         if(parent_tree){
2321                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2322                         "TYPE_46:");
2323                 tree = proto_item_add_subtree(item, ett_TYPE_46);
2324         }
2325
2326         offset = netlogon_dissect_BLOB(tvb, offset,
2327                 pinfo, tree, drep);
2328
2329         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2330                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2331                 "unknown", hf_netlogon_workstation_fqdn, -1);
2332
2333         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2334                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2335                 "unknown", hf_netlogon_workstation_site_name, -1);
2336
2337         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2338                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2339                 "unknown", hf_netlogon_workstation_os, -1);
2340
2341         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2342                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2343                 "unknown", hf_netlogon_unknown_string, -1);
2344
2345         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2346                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2347                 "unknown", hf_netlogon_unknown_string, -1);
2348
2349         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2350                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2351                 "unknown", hf_netlogon_unknown_string, -1);
2352
2353         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2354                 hf_netlogon_unknown_string, 0);
2355
2356         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2357                 hf_netlogon_unknown_string, 0);
2358
2359         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2360                 hf_netlogon_unknown_string, 0);
2361
2362         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2363                 hf_netlogon_unknown_string, 0);
2364
2365         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2366                 hf_netlogon_unknown_long, NULL);
2367
2368         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2369                 hf_netlogon_unknown_long, NULL);
2370
2371         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2372                 hf_netlogon_unknown_long, NULL);
2373
2374         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2375                 hf_netlogon_unknown_long, NULL);
2376
2377         proto_item_set_len(item, offset-old_offset);
2378         return offset;
2379 }
2380
2381 static int
2382 netlogon_dissect_TYPE_48(tvbuff_t *tvb, int offset,
2383                         packet_info *pinfo, proto_tree *parent_tree,
2384                         char *drep)
2385 {
2386         proto_item *item=NULL;
2387         proto_tree *tree=NULL;
2388         int old_offset=offset;
2389
2390         if(parent_tree){
2391                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2392                         "TYPE_48:");
2393                 tree = proto_item_add_subtree(item, ett_TYPE_48);
2394         }
2395
2396         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2397                 hf_netlogon_unknown_string, 0);
2398
2399         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2400                 hf_netlogon_unknown_string, 0);
2401
2402         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2403                 hf_netlogon_unknown_string, 0);
2404
2405         offset = dissect_nt_GUID(tvb, offset,
2406                 pinfo, tree, drep);
2407
2408         offset = dissect_ndr_nt_PSID(tvb, offset,
2409                 pinfo, tree, drep);
2410
2411         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2412                 hf_netlogon_unknown_string, 0);
2413
2414         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2415                 hf_netlogon_unknown_string, 0);
2416
2417         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2418                 hf_netlogon_unknown_string, 0);
2419
2420         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2421                 hf_netlogon_unknown_string, 0);
2422
2423         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2424                 hf_netlogon_unknown_long, NULL);
2425
2426         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2427                 hf_netlogon_unknown_long, NULL);
2428
2429         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2430                 hf_netlogon_unknown_long, NULL);
2431
2432         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2433                 hf_netlogon_unknown_long, NULL);
2434
2435         offset = netlogon_dissect_BLOB(tvb, offset,
2436                 pinfo, tree, drep);
2437
2438         offset = netlogon_dissect_BLOB(tvb, offset,
2439                 pinfo, tree, drep);
2440
2441         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2442                 hf_netlogon_unknown_string, 0);
2443
2444         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2445                 hf_netlogon_unknown_string, 0);
2446
2447         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2448                 hf_netlogon_unknown_string, 0);
2449
2450         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2451                 hf_netlogon_unknown_string, 0);
2452
2453         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2454                 hf_netlogon_unknown_long, NULL);
2455
2456         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2457                 hf_netlogon_unknown_long, NULL);
2458
2459         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2460                 hf_netlogon_unknown_long, NULL);
2461
2462         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2463                 hf_netlogon_unknown_long, NULL);
2464
2465         proto_item_set_len(item, offset-old_offset);
2466         return offset;
2467 }
2468
2469 static int
2470 netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
2471                         packet_info *pinfo, proto_tree *parent_tree,
2472                         char *drep)
2473 {
2474         proto_item *item=NULL;
2475         proto_tree *tree=NULL;
2476         int old_offset=offset;
2477         int i;
2478
2479         if(parent_tree){
2480                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2481                         "UNICODE_STRING_512:");
2482                 tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
2483         }
2484
2485         for(i=0;i<512;i++){
2486                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2487                         hf_netlogon_unknown_short, NULL);
2488         }
2489
2490         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2491                 hf_netlogon_unknown_long, NULL);
2492
2493         proto_item_set_len(item, offset-old_offset);
2494         return offset;
2495 }
2496
2497 static int
2498 netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset,
2499                         packet_info *pinfo, proto_tree *tree,
2500                         char *drep)
2501 {
2502                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2503                         hf_netlogon_secure_channel_type, NULL);
2504
2505         return offset;
2506 }
2507
2508 static int
2509 netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
2510                         packet_info *pinfo, proto_tree *tree,
2511                         char *drep)
2512 {
2513                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2514                         hf_netlogon_unknown_char, NULL);
2515
2516         return offset;
2517 }
2518
2519 static int
2520 netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
2521                         packet_info *pinfo, proto_tree *tree,
2522                         char *drep)
2523 {
2524         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2525                 netlogon_dissect_element_844_byte);
2526
2527         return offset;
2528 }
2529
2530 static int
2531 netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
2532                         packet_info *pinfo, proto_tree *parent_tree,
2533                         char *drep)
2534 {
2535         proto_item *item=NULL;
2536         proto_tree *tree=NULL;
2537         int old_offset=offset;
2538
2539         if(parent_tree){
2540                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2541                         "TYPE_50:");
2542                 tree = proto_item_add_subtree(item, ett_TYPE_50);
2543         }
2544
2545         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2546                 hf_netlogon_unknown_long, NULL);
2547
2548         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2549                 netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
2550                 "unknown", hf_netlogon_unknown_string, 0);
2551
2552         proto_item_set_len(item, offset-old_offset);
2553         return offset;
2554 }
2555
2556 static int
2557 netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
2558                         packet_info *pinfo, proto_tree *tree,
2559                         char *drep)
2560 {
2561         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2562                 netlogon_dissect_TYPE_50, NDR_POINTER_PTR,
2563                 "TYPE_50 pointer: unknown_TYPE_50", -1, 0);
2564
2565         return offset;
2566 }
2567
2568 static int
2569 netlogon_dissect_TYPE_50_ptr_ptr(tvbuff_t *tvb, int offset,
2570                         packet_info *pinfo, proto_tree *tree,
2571                         char *drep)
2572 {
2573         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2574                 netlogon_dissect_TYPE_50_ptr, NDR_POINTER_PTR,
2575                 "TYPE_50* pointer: unknown_TYPE_50", -1, 0);
2576
2577         return offset;
2578 }
2579
2580 static int
2581 netlogon_dissect_element_861_byte(tvbuff_t *tvb, int offset,
2582                         packet_info *pinfo, proto_tree *tree,
2583                         char *drep)
2584 {
2585                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2586                         hf_netlogon_unknown_char, NULL);
2587
2588         return offset;
2589 }
2590
2591 static int
2592 netlogon_dissect_element_861_array(tvbuff_t *tvb, int offset,
2593                         packet_info *pinfo, proto_tree *tree,
2594                         char *drep)
2595 {
2596         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2597                 netlogon_dissect_element_861_byte);
2598
2599         return offset;
2600 }
2601
2602 static int
2603 netlogon_dissect_TYPE_51(tvbuff_t *tvb, int offset,
2604                         packet_info *pinfo, proto_tree *parent_tree,
2605                         char *drep)
2606 {
2607         proto_item *item=NULL;
2608         proto_tree *tree=NULL;
2609         int old_offset=offset;
2610
2611         if(parent_tree){
2612                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2613                         "TYPE_51:");
2614                 tree = proto_item_add_subtree(item, ett_TYPE_51);
2615         }
2616
2617         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2618                 hf_netlogon_unknown_long, NULL);
2619
2620         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2621                 netlogon_dissect_element_861_array, NDR_POINTER_UNIQUE,
2622                 "unknown", hf_netlogon_unknown_string, 0);
2623
2624         proto_item_set_len(item, offset-old_offset);
2625         return offset;
2626 }
2627
2628 static int
2629 netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
2630                         packet_info *pinfo, proto_tree *tree,
2631                         char *drep)
2632 {
2633                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2634                         hf_netlogon_unknown_char, NULL);
2635
2636         return offset;
2637 }
2638
2639 static int
2640 netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
2641                         packet_info *pinfo, proto_tree *tree,
2642                         char *drep)
2643 {
2644         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2645                 netlogon_dissect_element_865_byte);
2646
2647         return offset;
2648 }
2649
2650 static int
2651 netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
2652                         packet_info *pinfo, proto_tree *tree,
2653                         char *drep)
2654 {
2655                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2656                         hf_netlogon_unknown_char, NULL);
2657
2658         return offset;
2659 }
2660
2661 static int
2662 netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
2663                         packet_info *pinfo, proto_tree *tree,
2664                         char *drep)
2665 {
2666         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2667                 netlogon_dissect_element_866_byte);
2668
2669         return offset;
2670 }
2671
2672 static int
2673 netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
2674                         packet_info *pinfo, proto_tree *parent_tree,
2675                         char *drep)
2676 {
2677         proto_item *item=NULL;
2678         proto_tree *tree=NULL;
2679         int old_offset=offset;
2680
2681         if(parent_tree){
2682                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2683                         "TYPE_52:");
2684                 tree = proto_item_add_subtree(item, ett_TYPE_52);
2685         }
2686
2687         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2688                 hf_netlogon_unknown_long, NULL);
2689
2690         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2691                 netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
2692                 "unknown", hf_netlogon_unknown_string, 0);
2693
2694         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2695                 netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
2696                 "unknown", hf_netlogon_unknown_string, 0);
2697
2698         proto_item_set_len(item, offset-old_offset);
2699         return offset;
2700 }
2701
2702 static int
2703 netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
2704                         packet_info *pinfo, proto_tree *tree,
2705                         char *drep)
2706 {
2707         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2708                 netlogon_dissect_TYPE_52, NDR_POINTER_PTR,
2709                 "TYPE_52 pointer: unknown_TYPE_52", -1, 0);
2710         return offset;
2711 }
2712
2713 static int
2714 netlogon_dissect_TYPE_52_ptr_ptr(tvbuff_t *tvb, int offset,
2715                         packet_info *pinfo, proto_tree *tree,
2716                         char *drep)
2717 {
2718         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2719                 netlogon_dissect_TYPE_52_ptr, NDR_POINTER_PTR,
2720                 "TYPE_52* pointer: unknown_TYPE_52", -1, 0);
2721         return offset;
2722 }
2723
2724 static int
2725 netlogon_dissect_NETLOGON_LEVEL(tvbuff_t *tvb, int offset,
2726                         packet_info *pinfo, proto_tree *parent_tree,
2727                         char *drep)
2728 {
2729         proto_item *item=NULL;
2730         proto_tree *tree=NULL;
2731         int old_offset=offset;
2732         guint16 level;
2733
2734         if(parent_tree){
2735                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2736                         "NETLOGON_LEVEL:");
2737                 tree = proto_item_add_subtree(item, ett_NETLOGON_LEVEL);
2738         }
2739
2740         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2741                 hf_netlogon_level, &level);
2742
2743         ALIGN_TO_4_BYTES;
2744         switch(level){
2745         case 1:
2746                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2747                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2748                         "INTERACTIVE_INFO pointer:", -1, 0);
2749                 break;
2750         case 2:
2751                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2752                         netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2753                         "NETWORK_INFO pointer:", -1, 0);
2754                 break;
2755         case 3:
2756                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2757                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2758                         "INTERACTIVE_INFO pointer:", -1, 0);
2759                 break;
2760         case 5:
2761                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2762                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2763                         "INTERACTIVE_INFO pointer:", -1, 0);
2764                 break;
2765         case 6:
2766                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2767                         netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2768                         "NETWORK_INFO pointer:", -1, 0);
2769                 break;
2770         case 7:
2771                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2772                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2773                         "INTERACTIVE_INFO pointer:", -1, 0);
2774                 break;
2775         }
2776
2777         proto_item_set_len(item, offset-old_offset);
2778         return offset;
2779 }
2780
2781 static int
2782 netlogon_dissect_NETLOGON_VALIDATION(tvbuff_t *tvb, int offset,
2783                         packet_info *pinfo, proto_tree *parent_tree,
2784                         char *drep)
2785 {
2786         proto_item *item=NULL;
2787         proto_tree *tree=NULL;
2788         int old_offset=offset;
2789         guint16 level;
2790
2791         if(parent_tree){
2792                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2793                         "NETLOGON_VALIDATION:");
2794                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION);
2795         }
2796
2797         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2798                 hf_netlogon_level, &level);
2799
2800         /* XXX i am not sure about these pointers being UNIQUE, though I am
2801            pretty convinced that they are NOT PTR as the idl file suggests.
2802         */
2803         ALIGN_TO_4_BYTES;
2804         switch(level){
2805         case 2:
2806                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2807                         netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1, NDR_POINTER_UNIQUE,
2808                         "NETLOGON_VALIDATION_SAM_INFO1 pointer:", -1, 0);
2809                 break;
2810         case 3:
2811                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2812                         netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE,
2813                         "NETLOGON_VALIDATION_SAM_INFO2 pointer:", -1, 0);
2814                 break;
2815         case 4:
2816                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2817                         netlogon_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
2818                         "STRING pointer:", -1, 0);
2819                 break;
2820         case 5:
2821                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2822                         netlogon_dissect_BLOB_ptr, NDR_POINTER_UNIQUE,
2823                         "BLOB pointer:", -1, 0);
2824                 break;
2825         }
2826
2827         proto_item_set_len(item, offset-old_offset);
2828         return offset;
2829 }
2830
2831
2832 static int
2833 netlogon_dissect_TYPE_19(tvbuff_t *tvb, int offset,
2834                         packet_info *pinfo, proto_tree *parent_tree,
2835                         char *drep)
2836 {
2837         proto_item *item=NULL;
2838         proto_tree *tree=NULL;
2839         int old_offset=offset;
2840         guint16 level;
2841
2842         if(parent_tree){
2843                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2844                         "TYPE_19:");
2845                 tree = proto_item_add_subtree(item, ett_TYPE_19);
2846         }
2847
2848         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2849                 hf_netlogon_level, &level);
2850
2851         ALIGN_TO_4_BYTES;
2852         switch(level){
2853         case 1:
2854                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2855                         hf_netlogon_unknown_long, NULL);
2856                 break;
2857         case 2:
2858                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2859                         hf_netlogon_unknown_long, NULL);
2860                 break;
2861         case 3:
2862                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2863                         hf_netlogon_unknown_long, NULL);
2864                 break;
2865         case 4:
2866                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2867                         hf_netlogon_unknown_long, NULL);
2868                 break;
2869         case 5:
2870                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2871                         hf_netlogon_unknown_long, NULL);
2872                 break;
2873         case 6:
2874                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2875                         hf_netlogon_unknown_long, NULL);
2876                 break;
2877         case 7:
2878                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2879                         hf_netlogon_unknown_long, NULL);
2880                 break;
2881         case 8:
2882                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2883                         hf_netlogon_unknown_long, NULL);
2884                 break;
2885         case 9:
2886                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2887                         hf_netlogon_unknown_long, NULL);
2888                 break;
2889         case 10:
2890                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2891                         hf_netlogon_unknown_long, NULL);
2892                 break;
2893         case 11:
2894                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2895                         hf_netlogon_unknown_long, NULL);
2896                 break;
2897         case 12:
2898                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2899                         hf_netlogon_unknown_long, NULL);
2900                 break;
2901         case 20:
2902                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2903                         hf_netlogon_unknown_long, NULL);
2904                 break;
2905         case 21:
2906                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2907                         hf_netlogon_unknown_long, NULL);
2908                 break;
2909         case 13:
2910                 offset = dissect_ndr_nt_PSID(tvb, offset,
2911                         pinfo, tree, drep);
2912                 break;
2913         case 14:
2914                 offset = dissect_ndr_nt_PSID(tvb, offset,
2915                         pinfo, tree, drep);
2916                 break;
2917         case 15:
2918                 offset = dissect_ndr_nt_PSID(tvb, offset,
2919                         pinfo, tree, drep);
2920                 break;
2921         case 16:
2922                 offset = dissect_ndr_nt_PSID(tvb, offset,
2923                         pinfo, tree, drep);
2924                 break;
2925         case 17:
2926                 offset = dissect_ndr_nt_PSID(tvb, offset,
2927                         pinfo, tree, drep);
2928                 break;
2929         case 18:
2930                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2931                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2932                         "unknown", hf_netlogon_unknown_string, -1);
2933                 break;
2934         case 19:
2935                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2936                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2937                         "unknown", hf_netlogon_unknown_string, -1);
2938                 break;
2939         }
2940
2941         proto_item_set_len(item, offset-old_offset);
2942         return offset;
2943 }
2944
2945
2946 static int
2947 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO(tvbuff_t *tvb, int offset,
2948                         packet_info *pinfo, proto_tree *parent_tree,
2949                         char *drep)
2950 {
2951         proto_item *item=NULL;
2952         proto_tree *tree=NULL;
2953         int old_offset=offset;
2954         guint32 level;
2955
2956         if(parent_tree){
2957                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2958                         "NETLOGON_CONTROL_QUERY_INFO:");
2959                 tree = proto_item_add_subtree(item, ett_NETLOGON_CONTROL_QUERY_INFO);
2960         }
2961
2962         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2963                 hf_netlogon_level_long, &level);
2964
2965         ALIGN_TO_4_BYTES;
2966         switch(level){
2967         case 5:
2968                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2969                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2970                         "unknown", hf_netlogon_unknown_string, -1);
2971                 break;
2972         case 6:
2973                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2974                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2975                         "unknown", hf_netlogon_unknown_string, -1);
2976                 break;
2977         case 0xfffe:
2978                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2979                         hf_netlogon_unknown_long, NULL);
2980                 break;
2981         case 8:
2982                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2983                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2984                         "unknown", hf_netlogon_unknown_string, -1);
2985                 break;
2986         }
2987
2988         proto_item_set_len(item, offset-old_offset);
2989         return offset;
2990 }
2991
2992
2993 static int
2994 netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
2995                         packet_info *pinfo, proto_tree *parent_tree,
2996                         char *drep)
2997 {
2998         proto_item *item=NULL;
2999         proto_tree *tree=NULL;
3000         int old_offset=offset;
3001         guint32 level;
3002
3003         if(parent_tree){
3004                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3005                         "TYPE_44:");
3006                 tree = proto_item_add_subtree(item, ett_TYPE_44);
3007         }
3008
3009         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3010                 hf_netlogon_level_long, &level);
3011
3012         ALIGN_TO_4_BYTES;
3013         switch(level){
3014         case 1:
3015                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3016                         hf_netlogon_unknown_long, NULL);
3017                 break;
3018         }
3019
3020         proto_item_set_len(item, offset-old_offset);
3021         return offset;
3022 }
3023
3024 static int
3025 netlogon_dissect_TYPE_20(tvbuff_t *tvb, int offset,
3026                         packet_info *pinfo, proto_tree *parent_tree,
3027                         char *drep)
3028 {
3029         proto_item *item=NULL;
3030         proto_tree *tree=NULL;
3031         int old_offset=offset;
3032         guint16 level;
3033
3034         if(parent_tree){
3035                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3036                         "TYPE_20:");
3037                 tree = proto_item_add_subtree(item, ett_TYPE_20);
3038         }
3039
3040         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3041                 hf_netlogon_level, &level);
3042
3043         ALIGN_TO_4_BYTES;
3044         switch(level){
3045         case 1:
3046                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3047                         netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO, NDR_POINTER_PTR,
3048                         "NETLOGON_SAM_DOMAIN_INFO pointer:", -1, 0);
3049                 break;
3050         case 2:
3051                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3052                         netlogon_dissect_NETLOGON_SAM_GROUP_INFO, NDR_POINTER_PTR,
3053                         "NETLOGON_SAM_GROUP_INFO pointer:", -1, 0);
3054                 break;
3055         case 4:
3056                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3057                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3058                         "TYPE_23 pointer:", -1, 0);
3059                 break;
3060         case 5:
3061                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3062                         netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO, NDR_POINTER_PTR,
3063                         "NETLOGON_SAM_ACCOUNT_INFO pointer:", -1, 0);
3064                 break;
3065         case 7:
3066                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3067                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3068                         "TYPE_23 pointer:", -1, 0);
3069                 break;
3070         case 8:
3071                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3072                         netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO, NDR_POINTER_PTR,
3073                         "NETLOGON_SAM_GROUP_MEM_INFO pointer:", -1, 0);
3074                 break;
3075         case 9:
3076                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3077                         netlogon_dissect_NETLOGON_SAM_ALIAS_INFO, NDR_POINTER_PTR,
3078                         "NETLOGON_SAM_ALIAS_INFO pointer:", -1, 0);
3079                 break;
3080         case 11:
3081                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3082                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3083                         "TYPE_23 pointer:", -1, 0);
3084                 break;
3085         case 12:
3086                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3087                         netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO, NDR_POINTER_PTR,
3088                         "NETLOGON_SAM_ALIAS_MEM_INFO pointer:", -1, 0);
3089                 break;
3090         case 13:
3091                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3092                         netlogon_dissect_TYPE_29, NDR_POINTER_PTR,
3093                         "TYPE_29 pointer:", -1, 0);
3094                 break;
3095         case 14:
3096                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3097                         netlogon_dissect_TYPE_31, NDR_POINTER_PTR,
3098                         "TYPE_31 pointer:", -1, 0);
3099                 break;
3100         case 16:
3101                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3102                         netlogon_dissect_TYPE_33, NDR_POINTER_PTR,
3103                         "TYPE_33 pointer:", -1, 0);
3104                 break;
3105         case 18:
3106                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3107                         netlogon_dissect_TYPE_34, NDR_POINTER_PTR,
3108                         "TYPE_34 pointer:", -1, 0);
3109                 break;
3110         case 20:
3111                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3112                         netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3113                         "TYPE_35 pointer:", -1, 0);
3114                 break;
3115         case 21:
3116                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3117                         netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3118                         "TYPE_35 pointer:", -1, 0);
3119                 break;
3120         case 22:
3121                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3122                         netlogon_dissect_TYPE_16, NDR_POINTER_PTR,
3123                         "TYPE_16 pointer:", -1, 0);
3124                 break;
3125         }
3126
3127         proto_item_set_len(item, offset-old_offset);
3128         return offset;
3129 }
3130
3131 static int
3132 netlogon_dissect_SAM_DELTA(tvbuff_t *tvb, int offset,
3133                         packet_info *pinfo, proto_tree *parent_tree,
3134                         char *drep)
3135 {
3136         proto_item *item=NULL;
3137         proto_tree *tree=NULL;
3138         int old_offset=offset;
3139
3140         if(parent_tree){
3141                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3142                         "SAM_DELTA:");
3143                 tree = proto_item_add_subtree(item, ett_SAM_DELTA);
3144         }
3145
3146         offset = netlogon_dissect_TYPE_19(tvb, offset,
3147                 pinfo, tree, drep);
3148
3149         offset = netlogon_dissect_TYPE_20(tvb, offset,
3150                 pinfo, tree, drep);
3151
3152         proto_item_set_len(item, offset-old_offset);
3153         return offset;
3154 }
3155
3156 static int
3157 netlogon_dissect_SAM_DELTA_array(tvbuff_t *tvb, int offset,
3158                         packet_info *pinfo, proto_tree *tree,
3159                         char *drep)
3160 {
3161         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3162                 netlogon_dissect_SAM_DELTA);
3163
3164         return offset;
3165 }
3166
3167 static int
3168 netlogon_dissect_SAM_DELTA_ARRAY(tvbuff_t *tvb, int offset,
3169                         packet_info *pinfo, proto_tree *parent_tree,
3170                         char *drep)
3171 {
3172         proto_item *item=NULL;
3173         proto_tree *tree=NULL;
3174         int old_offset=offset;
3175
3176         if(parent_tree){
3177                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3178                         "SAM_DELTA_ARRAY:");
3179                 tree = proto_item_add_subtree(item, ett_SAM_DELTA_ARRAY);
3180         }
3181
3182         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3183                 hf_netlogon_num_deltas, NULL);
3184
3185         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3186                 netlogon_dissect_SAM_DELTA_array, NDR_POINTER_UNIQUE,
3187                 "unknown", -1, 0);
3188
3189         proto_item_set_len(item, offset-old_offset);
3190         return offset;
3191 }
3192
3193 static int
3194 netlogon_dissect_SAM_DELTA_ARRAY_ptr(tvbuff_t *tvb, int offset,
3195                         packet_info *pinfo, proto_tree *tree,
3196                         char *drep)
3197 {
3198         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3199                 netlogon_dissect_SAM_DELTA_ARRAY, NDR_POINTER_PTR,
3200                 "SAM_DELTA_ARRAY pointer: deltas", -1, 0);
3201
3202         return offset;
3203 }
3204
3205 static int
3206 netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset,
3207                         packet_info *pinfo, proto_tree *tree,
3208                         char *drep)
3209 {
3210         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3211                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3212                 "Handle", hf_netlogon_logonsrv_handle, 0);
3213
3214         return offset;
3215 }
3216
3217 static int
3218 netlogon_dissect_NETLOGON_INFO(tvbuff_t *tvb, int offset,
3219                         packet_info *pinfo, proto_tree *parent_tree,
3220                         char *drep)
3221 {
3222         proto_item *item=NULL;
3223         proto_tree *tree=NULL;
3224         int old_offset=offset;
3225         guint32 level;
3226
3227         if(parent_tree){
3228                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3229                         "NETLOGON_INFO:");
3230                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO);
3231         }
3232
3233         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3234                 hf_netlogon_level_long, &level);
3235
3236         ALIGN_TO_4_BYTES;
3237         switch(level){
3238         case 1:
3239                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3240                         netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_PTR,
3241                         "NETLOGON_INFO_1 pointer:", -1, 0);
3242                 break;
3243         case 2:
3244                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3245                         netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_PTR,
3246                         "NETLOGON_INFO_2 pointer:", -1, 0);
3247                 break;
3248         case 3:
3249                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3250                         netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_PTR,
3251                         "NETLOGON_INFO_3 pointer:", -1, 0);
3252                 break;
3253         case 4:
3254                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3255                         netlogon_dissect_NETLOGON_INFO_4, NDR_POINTER_PTR,
3256                         "NETLOGON_INFO_4 pointer:", -1, 0);
3257                 break;
3258         }
3259
3260         proto_item_set_len(item, offset-old_offset);
3261         return offset;
3262 }
3263
3264 static int
3265 netlogon_dissect_TYPE_45(tvbuff_t *tvb, int offset,
3266                         packet_info *pinfo, proto_tree *parent_tree,
3267                         char *drep)
3268 {
3269         proto_item *item=NULL;
3270         proto_tree *tree=NULL;
3271         int old_offset=offset;
3272         guint32 level;
3273
3274         if(parent_tree){
3275                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3276                         "TYPE_45:");
3277                 tree = proto_item_add_subtree(item, ett_TYPE_45);
3278         }
3279
3280         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3281                 hf_netlogon_level_long, &level);
3282
3283         ALIGN_TO_4_BYTES;
3284         switch(level){
3285         case 1:
3286                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3287                         netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3288                         "TYPE_46 pointer:", -1, 0);
3289                 break;
3290         case 2:
3291                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3292                         netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3293                         "TYPE_46 pointer:", -1, 0);
3294                 break;
3295         }
3296
3297         proto_item_set_len(item, offset-old_offset);
3298         return offset;
3299 }
3300
3301 static int
3302 netlogon_dissect_TYPE_47(tvbuff_t *tvb, int offset,
3303                         packet_info *pinfo, proto_tree *parent_tree,
3304                         char *drep)
3305 {
3306         proto_item *item=NULL;
3307         proto_tree *tree=NULL;
3308         int old_offset=offset;
3309         guint32 level;
3310
3311         if(parent_tree){
3312                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3313                         "TYPE_47:");
3314                 tree = proto_item_add_subtree(item, ett_TYPE_47);
3315         }
3316
3317         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3318                 hf_netlogon_level_long, &level);
3319
3320         ALIGN_TO_4_BYTES;
3321         switch(level){
3322         case 1:
3323                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3324                         netlogon_dissect_TYPE_48, NDR_POINTER_PTR,
3325                         "TYPE_48 pointer:", -1, 0);
3326                 break;
3327         case 2:
3328                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3329                         netlogon_dissect_UNICODE_MULTI, NDR_POINTER_PTR,
3330                         "UNICODE_MULTI pointer:", -1, 0);
3331                 break;
3332         }
3333
3334         proto_item_set_len(item, offset-old_offset);
3335         return offset;
3336 }
3337
3338
3339 static int
3340 netlogon_dissect_function_00_rqst(tvbuff_t *tvb, int offset,
3341         packet_info *pinfo, proto_tree *tree, char *drep)
3342 {
3343         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3344                 pinfo, tree, drep);
3345
3346         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3347                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3348                 "unknown string", hf_netlogon_unknown_string, -1);
3349
3350         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3351                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3352                 "unknown string", hf_netlogon_unknown_string, -1);
3353
3354         return offset;
3355 }
3356
3357
3358 static int
3359 netlogon_dissect_function_00_reply(tvbuff_t *tvb, int offset,
3360         packet_info *pinfo, proto_tree *tree, char *drep)
3361 {
3362         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3363                 netlogon_dissect_TYPE_1_ptr, NDR_POINTER_REF,
3364                 "TYPE_1* pointer: unknown_TYPE_1", -1, 0);
3365
3366         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3367                 hf_netlogon_rc, NULL);
3368
3369         return offset;
3370 }
3371
3372 static int
3373 netlogon_dissect_function_01_rqst(tvbuff_t *tvb, int offset,
3374         packet_info *pinfo, proto_tree *tree, char *drep)
3375 {
3376         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3377                 pinfo, tree, drep);
3378
3379         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3380                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3381                 "unknown string", hf_netlogon_unknown_string, -1);
3382
3383         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3384                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3385                 "unknown string", hf_netlogon_unknown_string, -1);
3386
3387         return offset;
3388 }
3389
3390
3391 static int
3392 netlogon_dissect_function_01_reply(tvbuff_t *tvb, int offset,
3393         packet_info *pinfo, proto_tree *tree, char *drep)
3394 {
3395         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3396                 netlogon_dissect_TYPE_2, NDR_POINTER_REF,
3397                 "TYPE_2 pointer: unknown_TYPE_2", -1, 0);
3398
3399         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3400                 hf_netlogon_rc, NULL);
3401
3402         return offset;
3403 }
3404
3405 static int
3406 netlogon_dissect_netlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
3407         packet_info *pinfo, proto_tree *tree, char *drep)
3408 {
3409         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3410                 pinfo, tree, drep);
3411
3412         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3413                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3414                 "Computer Name", hf_netlogon_computer_name, 0);
3415
3416         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3417                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3418                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3419
3420         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3421                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3422                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3423
3424         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3425                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3426                 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3427
3428         return offset;
3429 }
3430
3431
3432 static int
3433 netlogon_dissect_netlogonsamlogon_reply(tvbuff_t *tvb, int offset,
3434         packet_info *pinfo, proto_tree *tree, char *drep)
3435 {
3436         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3437                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3438                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3439
3440         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3441                 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_REF,
3442                 "NETLOGON_VALIDATION pointer: ctr", -1, 0);
3443
3444         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3445                 netlogon_dissect_pointer_char, NDR_POINTER_REF,
3446                 "BOOLEAN pointer: Authoritative", hf_netlogon_authoritative, 0);
3447
3448         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3449                 hf_netlogon_rc, NULL);
3450
3451         return offset;
3452 }
3453
3454 static int
3455 netlogon_dissect_netlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
3456         packet_info *pinfo, proto_tree *tree, char *drep)
3457 {
3458         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3459                 pinfo, tree, drep);
3460
3461         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3462                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3463                 "unknown string", hf_netlogon_unknown_string, 0);
3464
3465         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3466                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3467                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3468
3469         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3470                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3471                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3472
3473         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3474                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3475                 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3476
3477         return offset;
3478 }
3479
3480
3481 static int
3482 netlogon_dissect_netlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
3483         packet_info *pinfo, proto_tree *tree, char *drep)
3484 {
3485
3486         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3487                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3488                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3489
3490         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3491                 hf_netlogon_rc, NULL);
3492
3493         return offset;
3494 }
3495
3496 static int
3497 netlogon_dissect_netserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
3498         packet_info *pinfo, proto_tree *tree, char *drep)
3499 {
3500         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3501                 pinfo, tree, drep);
3502
3503         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3504                 NDR_POINTER_REF, hf_netlogon_client_name, 0);
3505
3506         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3507                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3508                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3509
3510         return offset;
3511 }
3512
3513
3514 static int
3515 netlogon_dissect_netserverreqchallenge_reply(tvbuff_t *tvb, int offset,
3516         packet_info *pinfo, proto_tree *tree, char *drep)
3517 {
3518         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3519                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3520                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3521
3522         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3523                 hf_netlogon_rc, NULL);
3524
3525         return offset;
3526 }
3527
3528 static int
3529 netlogon_dissect_netserverauthenticate_rqst(tvbuff_t *tvb, int offset,
3530         packet_info *pinfo, proto_tree *tree, char *drep)
3531 {
3532         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3533                 pinfo, tree, drep);
3534
3535         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3536                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3537
3538         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3539                 pinfo, tree, drep);
3540
3541         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3542                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3543
3544         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3545                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3546                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3547
3548         return offset;
3549 }
3550
3551
3552 static int
3553 netlogon_dissect_netserverauthenticate_reply(tvbuff_t *tvb, int offset,
3554         packet_info *pinfo, proto_tree *tree, char *drep)
3555 {
3556         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3557                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3558                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3559
3560         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3561                 hf_netlogon_rc, NULL);
3562
3563         return offset;
3564 }
3565
3566 static int
3567 netlogon_dissect_netserverpasswordset_rqst(tvbuff_t *tvb, int offset,
3568         packet_info *pinfo, proto_tree *tree, char *drep)
3569 {
3570         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3571                 pinfo, tree, drep);
3572
3573         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3574                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3575
3576         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3577                 pinfo, tree, drep);
3578
3579         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3580                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3581
3582         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3583                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3584                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3585
3586         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3587                 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF,
3588                 "ENCRYPTED_LM_OWF_PASSWORD pointer: hashed_pwd", -1, 0);
3589
3590         return offset;
3591 }
3592
3593
3594 static int
3595 netlogon_dissect_netserverpasswordset_reply(tvbuff_t *tvb, int offset,
3596         packet_info *pinfo, proto_tree *tree, char *drep)
3597 {
3598         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3599                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3600                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3601
3602         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3603                 hf_netlogon_rc, NULL);
3604
3605         return offset;
3606 }
3607
3608 static int
3609 netlogon_dissect_netsamdeltas_rqst(tvbuff_t *tvb, int offset,
3610         packet_info *pinfo, proto_tree *tree, char *drep)
3611 {
3612         /* XXX idl file has LOGONSRV_HANDLE here, ms capture has string srv_name */
3613         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3614                 NDR_POINTER_REF, hf_netlogon_logon_srv, 0);
3615
3616         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3617                 NDR_POINTER_REF, hf_netlogon_cli_name, 0);
3618
3619         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3620                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3621                 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3622
3623         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3624                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3625                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3626
3627         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3628                 hf_netlogon_database_id, NULL);
3629
3630         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3631                 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3632                 "TYPE_16 pointer: dom_mod_count", -1, 0);
3633
3634         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3635                 hf_netlogon_max_size, NULL);
3636         return offset;
3637 }
3638
3639
3640 static int
3641 netlogon_dissect_netsamdeltas_reply(tvbuff_t *tvb, int offset,
3642         packet_info *pinfo, proto_tree *tree, char *drep)
3643 {
3644         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3645                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3646                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3647
3648         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3649                 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3650                 "TYPE_16 pointer: dom_mod_count", -1, 0);
3651
3652         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3653                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3654                 "SAM_DELTA_ARRAY_ptr pointer: deltas", -1, 0);
3655
3656         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3657                 hf_netlogon_rc, NULL);
3658
3659         return offset;
3660 }
3661
3662 static int
3663 netlogon_dissect_function_08_rqst(tvbuff_t *tvb, int offset,
3664         packet_info *pinfo, proto_tree *tree, char *drep)
3665 {
3666         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3667                 NDR_POINTER_REF, hf_netlogon_logon_srv, 0);
3668
3669         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3670                 NDR_POINTER_REF, hf_netlogon_cli_name, 0);
3671
3672         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3673                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3674                 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3675
3676         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3677                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3678                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3679
3680         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3681                 hf_netlogon_unknown_long, NULL);
3682
3683         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3684                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3685                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3686
3687         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3688                 hf_netlogon_unknown_long, NULL);
3689         return offset;
3690 }
3691
3692
3693 static int
3694 netlogon_dissect_function_08_reply(tvbuff_t *tvb, int offset,
3695         packet_info *pinfo, proto_tree *tree, char *drep)
3696 {
3697         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3698                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3699                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3700
3701         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3702                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3703                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3704
3705         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3706                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3707                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
3708
3709         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3710                 hf_netlogon_rc, NULL);
3711
3712         return offset;
3713 }
3714
3715 static int
3716 netlogon_dissect_function_09_rqst(tvbuff_t *tvb, int offset,
3717         packet_info *pinfo, proto_tree *tree, char *drep)
3718 {
3719         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3720                 pinfo, tree, drep);
3721
3722         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3723                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3724
3725         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3726                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3727                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3728
3729         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3730                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3731                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3732
3733         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3734                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3735                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3736
3737         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3738                 hf_netlogon_unknown_long, NULL);
3739
3740         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3741                 hf_netlogon_unknown_long, NULL);
3742
3743         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3744                 hf_netlogon_unknown_long, NULL);
3745         return offset;
3746 }
3747
3748
3749 static int
3750 netlogon_dissect_function_09_reply(tvbuff_t *tvb, int offset,
3751         packet_info *pinfo, proto_tree *tree, char *drep)
3752 {
3753         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3754                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3755                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3756
3757         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3758                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3759                 "BYTE_array pointer: unknown_BYTE", -1, 0);
3760
3761         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3762                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3763                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3764
3765         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3766                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3767                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3768
3769         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3770                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3771                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3772
3773         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3774                 hf_netlogon_rc, NULL);
3775
3776         return offset;
3777 }
3778
3779 static int
3780 netlogon_dissect_function_0a_rqst(tvbuff_t *tvb, int offset,
3781         packet_info *pinfo, proto_tree *tree, char *drep)
3782 {
3783         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3784                 pinfo, tree, drep);
3785
3786         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3787                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3788
3789         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3790                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3791                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3792
3793         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3794                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3795                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3796
3797         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3798                 hf_netlogon_unknown_long, NULL);
3799
3800         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3801                 hf_netlogon_unknown_long, NULL);
3802
3803         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3804                 hf_netlogon_unknown_long, NULL);
3805
3806         return offset;
3807 }
3808
3809
3810 static int
3811 netlogon_dissect_function_0a_reply(tvbuff_t *tvb, int offset,
3812         packet_info *pinfo, proto_tree *tree, char *drep)
3813 {
3814         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3815                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3816                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3817
3818         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3819                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3820                 "BYTE_array pointer: unknown_BYTE", -1, 0);
3821
3822         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3823                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3824                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3825
3826         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3827                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3828                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3829
3830         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3831                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3832                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3833
3834         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3835                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3836                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3837
3838         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3839                 hf_netlogon_rc, NULL);
3840
3841         return offset;
3842 }
3843
3844 static int
3845 netlogon_dissect_function_0b_rqst(tvbuff_t *tvb, int offset,
3846         packet_info *pinfo, proto_tree *tree, char *drep)
3847 {
3848
3849         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3850                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3851
3852         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3853                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3854                 "unknown string", hf_netlogon_unknown_string, 0);
3855
3856         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3857                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3858                 "WCHAR* pointer: unknown string", -1, 0);
3859         return offset;
3860 }
3861
3862
3863 static int
3864 netlogon_dissect_function_0b_reply(tvbuff_t *tvb, int offset,
3865         packet_info *pinfo, proto_tree *tree, char *drep)
3866 {
3867         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3868                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3869                 "WCHAR* pointer: unknown string", -1, 0);
3870
3871         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3872                 hf_netlogon_rc, NULL);
3873
3874         return offset;
3875 }
3876
3877 static int
3878 netlogon_dissect_netlogoncontrol_rqst(tvbuff_t *tvb, int offset,
3879         packet_info *pinfo, proto_tree *tree, char *drep)
3880 {
3881         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3882                 pinfo, tree, drep);
3883
3884         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3885                 hf_netlogon_code, NULL);
3886
3887         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3888                 hf_netlogon_level, NULL);
3889
3890         return offset;
3891 }
3892
3893
3894 static int
3895 netlogon_dissect_netlogoncontrol_reply(tvbuff_t *tvb, int offset,
3896         packet_info *pinfo, proto_tree *tree, char *drep)
3897 {
3898         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3899                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3900                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3901
3902         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3903                 hf_netlogon_rc, NULL);
3904
3905         return offset;
3906 }
3907
3908 static int
3909 netlogon_dissect_function_0d_rqst(tvbuff_t *tvb, int offset,
3910         packet_info *pinfo, proto_tree *tree, char *drep)
3911 {
3912         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3913                 pinfo, tree, drep);
3914
3915         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3916                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3917                 "unknown string", hf_netlogon_unknown_string, 0);
3918
3919         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3920                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3921                 "WCHAR* pointer: unknown string", -1, 0);
3922         return offset;
3923 }
3924
3925
3926 static int
3927 netlogon_dissect_function_0d_reply(tvbuff_t *tvb, int offset,
3928         packet_info *pinfo, proto_tree *tree, char *drep)
3929 {
3930         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3931                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3932                 "WCHAR* pointer: unknown string", -1, 0);
3933
3934         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3935                 hf_netlogon_rc, NULL);
3936
3937         return offset;
3938 }
3939
3940 static int
3941 netlogon_dissect_netlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
3942         packet_info *pinfo, proto_tree *tree, char *drep)
3943 {
3944         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3945                 pinfo, tree, drep);
3946
3947         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3948                 hf_netlogon_code, NULL);
3949
3950         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3951                 hf_netlogon_level, NULL);
3952
3953         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3954                 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
3955                 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
3956
3957         return offset;
3958 }
3959
3960
3961 static int
3962 netlogon_dissect_netlogoncontrol2_reply(tvbuff_t *tvb, int offset,
3963         packet_info *pinfo, proto_tree *tree, char *drep)
3964 {
3965         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3966                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3967                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3968
3969         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3970                 hf_netlogon_rc, NULL);
3971
3972         return offset;
3973 }
3974
3975 static int
3976 netlogon_dissect_netserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
3977         packet_info *pinfo, proto_tree *tree, char *drep)
3978 {
3979         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3980                 pinfo, tree, drep);
3981
3982         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3983                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3984
3985         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3986                 pinfo, tree, drep);
3987
3988         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3989                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3990
3991         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3992                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3993                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3994
3995         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3996                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3997                 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
3998         return offset;
3999 }
4000
4001
4002 static int
4003 netlogon_dissect_netserverauthenticate2_reply(tvbuff_t *tvb, int offset,
4004         packet_info *pinfo, proto_tree *tree, char *drep)
4005 {
4006         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4007                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4008                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
4009
4010         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4011                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4012                 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4013
4014         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4015                 hf_netlogon_rc, NULL);
4016
4017         return offset;
4018 }
4019
4020 static int
4021 netlogon_dissect_netdatabasesync2_rqst(tvbuff_t *tvb, int offset,
4022         packet_info *pinfo, proto_tree *tree, char *drep)
4023 {
4024         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4025                 pinfo, tree, drep);
4026
4027         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4028                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4029
4030         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4031                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4032                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4033
4034         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4035                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4036                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4037
4038         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4039                 hf_netlogon_unknown_long, NULL);
4040
4041         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4042                 hf_netlogon_unknown_short, NULL);
4043
4044         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4045                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4046                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4047
4048         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4049                 hf_netlogon_unknown_long, NULL);
4050
4051         return offset;
4052 }
4053
4054
4055 static int
4056 netlogon_dissect_netdatabasesync2_reply(tvbuff_t *tvb, int offset,
4057         packet_info *pinfo, proto_tree *tree, char *drep)
4058 {
4059         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4060                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4061                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4062
4063         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4064                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4065                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4066
4067         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4068                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4069                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4070
4071         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4072                 hf_netlogon_rc, NULL);
4073
4074         return offset;
4075 }
4076
4077 static int
4078 netlogon_dissect_function_11_rqst(tvbuff_t *tvb, int offset,
4079         packet_info *pinfo, proto_tree *tree, char *drep)
4080 {
4081         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4082                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4083
4084         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4085                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4086
4087         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4088                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4089                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4090
4091         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4092                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4093                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4094
4095         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4096                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
4097                 "BYTE pointer: unknown_BYTE", -1, 0);
4098
4099         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4100                 hf_netlogon_unknown_long, NULL);
4101
4102         return offset;
4103 }
4104
4105
4106 static int
4107 netlogon_dissect_function_11_reply(tvbuff_t *tvb, int offset,
4108         packet_info *pinfo, proto_tree *tree, char *drep)
4109 {
4110         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4111                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4112                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4113
4114         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4115                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4116                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4117
4118         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4119                 hf_netlogon_rc, NULL);
4120
4121         return offset;
4122 }
4123
4124 static int
4125 netlogon_dissect_function_12_rqst(tvbuff_t *tvb, int offset,
4126         packet_info *pinfo, proto_tree *tree, char *drep)
4127 {
4128         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4129                 pinfo, tree, drep);
4130
4131         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4132                 hf_netlogon_unknown_long, NULL);
4133
4134         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4135                 hf_netlogon_level, NULL);
4136
4137         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4138                 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
4139                 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
4140
4141         return offset;
4142 }
4143
4144
4145 static int
4146 netlogon_dissect_function_12_reply(tvbuff_t *tvb, int offset,
4147         packet_info *pinfo, proto_tree *tree, char *drep)
4148 {
4149         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4150                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
4151                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
4152
4153         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4154                 hf_netlogon_rc, NULL);
4155
4156         return offset;
4157 }
4158
4159 static int
4160 netlogon_dissect_nettrusteddomainlist_rqst(tvbuff_t *tvb, int offset,
4161         packet_info *pinfo, proto_tree *tree, char *drep)
4162 {
4163         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4164                 pinfo, tree, drep);
4165
4166         return offset;
4167 }
4168
4169
4170 static int
4171 netlogon_dissect_nettrusteddomainlist_reply(tvbuff_t *tvb, int offset,
4172         packet_info *pinfo, proto_tree *tree, char *drep)
4173 {
4174         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4175                 netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF,
4176                 "UNICODE_MULTI pointer: trust_dom_name_list", -1, 0);
4177
4178         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4179                 hf_netlogon_rc, NULL);
4180
4181         return offset;
4182 }
4183
4184 static int
4185 netlogon_dissect_dsrgetdcname2_rqst(tvbuff_t *tvb, int offset,
4186         packet_info *pinfo, proto_tree *tree, char *drep)
4187 {
4188         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4189                 pinfo, tree, drep);
4190
4191         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4192                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4193                 "Domain", hf_netlogon_logon_dom, 0);
4194
4195         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4196                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4197                 "GUID pointer: domain_guid", -1, 0);
4198
4199         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4200                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4201                 "GUID pointer: site_guid", -1, 0);
4202
4203         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4204                 hf_netlogon_flags, NULL);
4205
4206         return offset;
4207 }
4208
4209
4210 static int
4211 netlogon_dissect_dsrgetdcname2_reply(tvbuff_t *tvb, int offset,
4212         packet_info *pinfo, proto_tree *tree, char *drep)
4213 {
4214         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4215                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4216                 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4217
4218         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4219                 hf_netlogon_rc, NULL);
4220
4221         return offset;
4222 }
4223
4224 static int
4225 netlogon_dissect_function_15_rqst(tvbuff_t *tvb, int offset,
4226         packet_info *pinfo, proto_tree *tree, char *drep)
4227 {
4228         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4229                 pinfo, tree, drep);
4230
4231         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4232                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4233                 "unknown string", hf_netlogon_unknown_string, 0);
4234
4235         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4236                 pinfo, tree, drep);
4237
4238         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4239                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4240                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4241
4242         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4243                 hf_netlogon_unknown_long, NULL);
4244
4245         return offset;
4246 }
4247
4248
4249 static int
4250 netlogon_dissect_function_15_reply(tvbuff_t *tvb, int offset,
4251         packet_info *pinfo, proto_tree *tree, char *drep)
4252 {
4253         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4254                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4255                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4256
4257         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4258                 netlogon_dissect_TYPE_44, NDR_POINTER_PTR,
4259                 "TYPE_44 pointer: unknown_TYPE_44", -1, 0);
4260
4261         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4262                 hf_netlogon_rc, NULL);
4263
4264         return offset;
4265 }
4266
4267 static int
4268 netlogon_dissect_function_16_rqst(tvbuff_t *tvb, int offset,
4269         packet_info *pinfo, proto_tree *tree, char *drep)
4270 {
4271         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4272                 pinfo, tree, drep);
4273
4274         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4275                 hf_netlogon_unknown_long, NULL);
4276
4277         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4278                 hf_netlogon_unknown_long, NULL);
4279
4280         return offset;
4281 }
4282
4283
4284 static int
4285 netlogon_dissect_function_16_reply(tvbuff_t *tvb, int offset,
4286         packet_info *pinfo, proto_tree *tree, char *drep)
4287 {
4288         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4289                 hf_netlogon_rc, NULL);
4290
4291         return offset;
4292 }
4293
4294 static int
4295 netlogon_dissect_function_17_rqst(tvbuff_t *tvb, int offset,
4296         packet_info *pinfo, proto_tree *tree, char *drep)
4297 {
4298         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4299                 pinfo, tree, drep);
4300
4301         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4302                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4303                 "unknown string", hf_netlogon_unknown_string, 0);
4304
4305         return offset;
4306 }
4307
4308
4309 static int
4310 netlogon_dissect_function_17_reply(tvbuff_t *tvb, int offset,
4311         packet_info *pinfo, proto_tree *tree, char *drep)
4312 {
4313         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4314                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4315                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4316
4317         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4318                 hf_netlogon_rc, NULL);
4319
4320         return offset;
4321 }
4322
4323 static int
4324 netlogon_dissect_function_18_rqst(tvbuff_t *tvb, int offset,
4325         packet_info *pinfo, proto_tree *tree, char *drep)
4326 {
4327         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4328                 pinfo, tree, drep);
4329
4330         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4331                 hf_netlogon_unknown_long, NULL);
4332
4333         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4334                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4335                 "BYTE pointer: unknown_BYTE", -1, 0);
4336
4337         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4338                 hf_netlogon_unknown_long, NULL);
4339
4340         return offset;
4341 }
4342
4343 static int
4344 netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset,
4345         packet_info *pinfo, proto_tree *tree, char *drep)
4346 {
4347         int i;
4348
4349         for(i=0;i<16;i++){
4350                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4351                         hf_netlogon_unknown_char, NULL);
4352         }
4353
4354         return offset;
4355 }
4356
4357 static int
4358 netlogon_dissect_function_18_reply(tvbuff_t *tvb, int offset,
4359         packet_info *pinfo, proto_tree *tree, char *drep)
4360 {
4361         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4362                 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4363                 "BYTE pointer: unknown_BYTE", -1, 0);
4364
4365         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4366                 hf_netlogon_rc, NULL);
4367
4368         return offset;
4369 }
4370
4371 static int
4372 netlogon_dissect_function_19_rqst(tvbuff_t *tvb, int offset,
4373         packet_info *pinfo, proto_tree *tree, char *drep)
4374 {
4375         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4376                 pinfo, tree, drep);
4377
4378         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4379                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4380                 "unknown string", hf_netlogon_unknown_string, 0);
4381
4382         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4383                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4384                 "BYTE pointer: unknown_BYTE", -1, 0);
4385
4386         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4387                 hf_netlogon_unknown_long, NULL);
4388
4389         return offset;
4390 }
4391
4392
4393 static int
4394 netlogon_dissect_function_19_reply(tvbuff_t *tvb, int offset,
4395         packet_info *pinfo, proto_tree *tree, char *drep)
4396 {
4397         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4398                 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4399                 "BYTE pointer: unknown_BYTE", -1, 0);
4400
4401         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4402                 hf_netlogon_rc, NULL);
4403
4404         return offset;
4405 }
4406
4407 static int
4408 netlogon_dissect_netserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
4409         packet_info *pinfo, proto_tree *tree, char *drep)
4410 {
4411         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4412                 pinfo, tree, drep);
4413
4414         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4415                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4416                 "Acct Name", hf_netlogon_acct_name, 0);
4417
4418         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4419                 pinfo, tree, drep);
4420
4421         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4422                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4423                 "Computer Name", hf_netlogon_computer_name, 0);
4424
4425         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4426                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4427                 "NETLOGON_CREDENTIAL pointer: authenticator", -1, 0);
4428
4429         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4430                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4431                 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4432
4433         return offset;
4434 }
4435
4436
4437 static int
4438 netlogon_dissect_netserverauthenticate3_reply(tvbuff_t *tvb, int offset,
4439         packet_info *pinfo, proto_tree *tree, char *drep)
4440 {
4441         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4442                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4443                 "NETLOGON_CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1, 0);
4444
4445         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4446                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4447                 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4448
4449         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4450                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4451                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4452
4453         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4454                 hf_netlogon_rc, NULL);
4455
4456         return offset;
4457 }
4458
4459 static int
4460 netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
4461         packet_info *pinfo, proto_tree *tree, char *drep)
4462 {
4463         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4464                 pinfo, tree, drep);
4465
4466         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4467                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4468                 "Domain", hf_netlogon_logon_dom, 0);
4469
4470         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4471                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4472                 "GUID pointer: domain_guid", -1, 0);
4473
4474         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4475                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4476                 "Site Name", hf_netlogon_site_name, 0);
4477
4478         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4479                 hf_netlogon_flags, NULL);
4480
4481         return offset;
4482 }
4483
4484
4485 static int
4486 netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
4487         packet_info *pinfo, proto_tree *tree, char *drep)
4488 {
4489         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4490                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4491                 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4492
4493         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4494                 hf_netlogon_rc, NULL);
4495
4496         return offset;
4497 }
4498
4499 static int
4500 netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset,
4501         packet_info *pinfo, proto_tree *tree, char *drep)
4502 {
4503         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4504                 pinfo, tree, drep);
4505
4506         return offset;
4507 }
4508
4509
4510 static int
4511 netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset,
4512         packet_info *pinfo, proto_tree *tree, char *drep)
4513 {
4514
4515         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4516                 NDR_POINTER_REF, hf_netlogon_site_name, 0);
4517
4518         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4519                 hf_netlogon_rc, NULL);
4520
4521         return offset;
4522 }
4523
4524 static int
4525 netlogon_dissect_function_1d_rqst(tvbuff_t *tvb, int offset,
4526         packet_info *pinfo, proto_tree *tree, char *drep)
4527 {
4528         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4529                 pinfo, tree, drep);
4530
4531         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4532                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4533                 "Computer Name", hf_netlogon_computer_name, 0);
4534
4535         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4536                 pinfo, tree, drep);
4537
4538         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4539                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4540                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4541
4542         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4543                 hf_netlogon_unknown_long, NULL);
4544
4545         offset = netlogon_dissect_TYPE_45(tvb, offset,
4546                 pinfo, tree, drep);
4547
4548         return offset;
4549 }
4550
4551
4552 static int
4553 netlogon_dissect_function_1d_reply(tvbuff_t *tvb, int offset,
4554         packet_info *pinfo, proto_tree *tree, char *drep)
4555 {
4556         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4557                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4558                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4559
4560         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4561                 netlogon_dissect_TYPE_47, NDR_POINTER_PTR,
4562                 "TYPE_47 pointer: unknown_TYPE_47", -1, 0);
4563
4564         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4565                 hf_netlogon_rc, NULL);
4566
4567         return offset;
4568 }
4569
4570 static int
4571 netlogon_dissect_function_1e_rqst(tvbuff_t *tvb, int offset,
4572         packet_info *pinfo, proto_tree *tree, char *drep)
4573 {
4574         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4575                 pinfo, tree, drep);
4576
4577         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4578                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4579                 "unknown string", hf_netlogon_unknown_string, 0);
4580
4581         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4582                 hf_netlogon_unknown_short, NULL);
4583
4584         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4585                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4586                 "unknown string", hf_netlogon_unknown_string, 0);
4587
4588         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4589                 pinfo, tree, drep);
4590
4591         offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset,
4592                 pinfo, tree, drep);
4593
4594         return offset;
4595 }
4596
4597
4598 static int
4599 netlogon_dissect_function_1e_reply(tvbuff_t *tvb, int offset,
4600         packet_info *pinfo, proto_tree *tree, char *drep)
4601 {
4602         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4603                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4604                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4605
4606         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4607                 hf_netlogon_rc, NULL);
4608
4609         return offset;
4610 }
4611
4612 static int
4613 netlogon_dissect_netserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
4614         packet_info *pinfo, proto_tree *tree, char *drep)
4615 {
4616         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4617                 pinfo, tree, drep);
4618
4619         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4620                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4621                 "Acct Name", hf_netlogon_acct_name, 0);
4622
4623         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4624                 pinfo, tree, drep);
4625
4626         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4627                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4628                 "Computer Name", hf_netlogon_computer_name, 0);
4629
4630         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4631                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4632                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
4633
4634         return offset;
4635 }
4636
4637
4638 static int
4639 netlogon_dissect_netserverpasswordset2_reply(tvbuff_t *tvb, int offset,
4640         packet_info *pinfo, proto_tree *tree, char *drep)
4641 {
4642         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4643                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4644                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
4645
4646         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4647                 netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF,
4648                 "LM_OWF_PASSWORD pointer: server_pwd", -1, 0);
4649
4650         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4651                 hf_netlogon_rc, NULL);
4652
4653         return offset;
4654 }
4655
4656 static int
4657 netlogon_dissect_function_20_rqst(tvbuff_t *tvb, int offset,
4658         packet_info *pinfo, proto_tree *tree, char *drep)
4659 {
4660         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4661                 pinfo, tree, drep);
4662
4663         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4664                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4665                 "unknown string", hf_netlogon_unknown_string, -1);
4666
4667         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4668                 pinfo, tree, drep);
4669
4670         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4671                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4672                 "BYTE pointer: unknown_BYTE", -1, 0);
4673
4674         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4675                 hf_netlogon_unknown_long, NULL);
4676
4677         return offset;
4678 }
4679
4680
4681 static int
4682 netlogon_dissect_function_20_reply(tvbuff_t *tvb, int offset,
4683         packet_info *pinfo, proto_tree *tree, char *drep)
4684 {
4685         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4686                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4687                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4688
4689         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4690                 hf_netlogon_rc, NULL);
4691
4692         return offset;
4693 }
4694
4695 static int
4696 netlogon_dissect_function_21_rqst(tvbuff_t *tvb, int offset,
4697         packet_info *pinfo, proto_tree *tree, char *drep)
4698 {
4699         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4700                 pinfo, tree, drep);
4701
4702         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4703                 hf_netlogon_unknown_long, NULL);
4704
4705         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4706                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4707                 "BYTE pointer: unknown_BYTE", -1, 0);
4708
4709         return offset;
4710 }
4711
4712
4713 static int
4714 netlogon_dissect_function_21_reply(tvbuff_t *tvb, int offset,
4715         packet_info *pinfo, proto_tree *tree, char *drep)
4716 {
4717         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4718                 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4719                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4720
4721         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4722                 hf_netlogon_rc, NULL);
4723
4724         return offset;
4725 }
4726
4727 static int
4728 netlogon_dissect_function_22_rqst(tvbuff_t *tvb, int offset,
4729         packet_info *pinfo, proto_tree *tree, char *drep)
4730 {
4731         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4732                 pinfo, tree, drep);
4733
4734         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4735                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4736                 "unknown string", hf_netlogon_unknown_string, 0);
4737
4738         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4739                 hf_netlogon_unknown_long, NULL);
4740
4741         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4742                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4743                 "unknown string", hf_netlogon_unknown_string, 0);
4744
4745         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4746                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4747                 "GUID pointer: unknown_GUID", -1, 0);
4748
4749         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4750                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4751                 "unknown string", hf_netlogon_unknown_string, 0);
4752
4753         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4754                 hf_netlogon_unknown_long, NULL);
4755
4756         return offset;
4757 }
4758
4759
4760 static int
4761 netlogon_dissect_function_22_reply(tvbuff_t *tvb, int offset,
4762         packet_info *pinfo, proto_tree *tree, char *drep)
4763 {
4764         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4765                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr, NDR_POINTER_REF,
4766                 "DOMAIN_CONTROLLER_INFO** pointer: unknown_DOMAIN_CONTROLLER_INFO", -1, 0);
4767
4768         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4769                 hf_netlogon_rc, NULL);
4770
4771         return offset;
4772 }
4773
4774 static int
4775 netlogon_dissect_function_23_rqst(tvbuff_t *tvb, int offset,
4776         packet_info *pinfo, proto_tree *tree, char *drep)
4777 {
4778         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4779                 pinfo, tree, drep);
4780
4781         return offset;
4782 }
4783
4784
4785 static int
4786 netlogon_dissect_function_23_reply(tvbuff_t *tvb, int offset,
4787         packet_info *pinfo, proto_tree *tree, char *drep)
4788 {
4789         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4790                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4791                 "unknown string", hf_netlogon_unknown_string, -1);
4792
4793         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4794                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4795                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4796
4797         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4798                 hf_netlogon_rc, NULL);
4799
4800         return offset;
4801 }
4802
4803 static int
4804 netlogon_dissect_function_24_rqst(tvbuff_t *tvb, int offset,
4805         packet_info *pinfo, proto_tree *tree, char *drep)
4806 {
4807         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4808                 pinfo, tree, drep);
4809
4810         return offset;
4811 }
4812
4813
4814 static int
4815 netlogon_dissect_function_24_reply(tvbuff_t *tvb, int offset,
4816         packet_info *pinfo, proto_tree *tree, char *drep)
4817 {
4818         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4819                 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4820                 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4821
4822         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4823                 hf_netlogon_rc, NULL);
4824
4825         return offset;
4826 }
4827
4828 static int
4829 netlogon_dissect_function_25_rqst(tvbuff_t *tvb, int offset,
4830         packet_info *pinfo, proto_tree *tree, char *drep)
4831 {
4832         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4833                 pinfo, tree, drep);
4834
4835         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4836                 hf_netlogon_unknown_long, NULL);
4837
4838         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4839                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4840                 "BYTE pointer: unknown_BYTE", -1, 0);
4841
4842         return offset;
4843 }
4844
4845
4846 static int
4847 netlogon_dissect_function_25_reply(tvbuff_t *tvb, int offset,
4848         packet_info *pinfo, proto_tree *tree, char *drep)
4849 {
4850         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4851                 netlogon_dissect_TYPE_52_ptr_ptr, NDR_POINTER_REF,
4852                 "TYPE_52** pointer: unknown_TYPE_52", -1, 0);
4853
4854         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4855                 hf_netlogon_rc, NULL);
4856
4857         return offset;
4858 }
4859
4860
4861 static int
4862 netlogon_dissect_function_26_rqst(tvbuff_t *tvb, int offset,
4863         packet_info *pinfo, proto_tree *tree, char *drep)
4864 {
4865         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4866                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4867                 "unknown string", hf_netlogon_unknown_string, 0);
4868
4869         return offset;
4870 }
4871
4872
4873 static int
4874 netlogon_dissect_function_26_reply(tvbuff_t *tvb, int offset,
4875         packet_info *pinfo, proto_tree *tree, char *drep)
4876 {
4877         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4878                 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4879                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4880
4881         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4882                 hf_netlogon_rc, NULL);
4883
4884         return offset;
4885 }
4886
4887 static int
4888 netlogon_dissect_function_27_rqst(tvbuff_t *tvb, int offset,
4889         packet_info *pinfo, proto_tree *tree, char *drep)
4890 {
4891         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4892                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4893                 "unknown string", hf_netlogon_unknown_string, 0);
4894
4895         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4896                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4897                 "unknown string", hf_netlogon_unknown_string, 0);
4898
4899         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4900                 hf_netlogon_unknown_short, NULL);
4901
4902         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4903                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_PTR,
4904                 "NETLOGON_LEVEL pointer: unknown_NETLOGON_LEVEL", -1, 0);
4905
4906         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4907                 hf_netlogon_unknown_short, NULL);
4908
4909         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4910                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4911                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4912         return offset;
4913 }
4914
4915
4916 static int
4917 netlogon_dissect_function_27_reply(tvbuff_t *tvb, int offset,
4918         packet_info *pinfo, proto_tree *tree, char *drep)
4919 {
4920         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4921                 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_PTR,
4922                 "NETLOGON_VALIDATION pointer: unknown_NETLOGON_VALIDATION", -1, 0);
4923
4924         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4925                 netlogon_dissect_pointer_char, NDR_POINTER_PTR,
4926                 "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char, 0);
4927
4928         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4929                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4930                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4931
4932         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4933                 hf_netlogon_rc, NULL);
4934
4935         return offset;
4936 }
4937
4938 static int
4939 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst(tvbuff_t *tvb, int offset,
4940         packet_info *pinfo, proto_tree *tree, char *drep)
4941 {
4942         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4943                 pinfo, tree, drep);
4944
4945         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4946                 hf_netlogon_unknown_long, NULL);
4947
4948         return offset;
4949 }
4950
4951
4952 static int
4953 netlogon_dissect_dsrrolegetprimarydomaininformation_reply(tvbuff_t *tvb, int offset,
4954         packet_info *pinfo, proto_tree *tree, char *drep)
4955 {
4956         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4957                 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4958                 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4959
4960         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4961                 hf_netlogon_rc, NULL);
4962
4963         return offset;
4964 }
4965
4966 static int
4967 netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset,
4968         packet_info *pinfo, proto_tree *tree, char *drep)
4969 {
4970         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4971                 pinfo, tree, drep);
4972
4973         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4974                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4975                 "Domain", hf_netlogon_logon_dom, 0);
4976
4977         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4978                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4979                 "GUID pointer: domain_guid", -1, 0);
4980
4981         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4982                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4983                 "GUID pointer: dsa_guid", -1, 0);
4984
4985         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4986                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4987                 "dns_host", hf_netlogon_dns_host, -1);
4988
4989         return offset;
4990 }
4991
4992
4993 static int
4994 netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset,
4995         packet_info *pinfo, proto_tree *tree, char *drep)
4996 {
4997         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4998                 hf_netlogon_rc, NULL);
4999
5000         return offset;
5001 }
5002
5003
5004
5005 static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = {
5006         { NETLOGON_FUNCTION_00, "FUNCTION_00",
5007                 netlogon_dissect_function_00_rqst,
5008                 netlogon_dissect_function_00_reply },
5009         { NETLOGON_FUNCTION_01, "FUNCTION_01",
5010                 netlogon_dissect_function_01_rqst,
5011                 netlogon_dissect_function_01_reply },
5012         { NETLOGON_NETLOGONSAMLOGON, "NETLOGONSAMLOGON",
5013                 netlogon_dissect_netlogonsamlogon_rqst,
5014                 netlogon_dissect_netlogonsamlogon_reply },
5015         { NETLOGON_NETLOGONSAMLOGOFF, "NETLOGONSAMLOGOFF",
5016                 netlogon_dissect_netlogonsamlogoff_rqst,
5017                 netlogon_dissect_netlogonsamlogoff_reply },
5018         { NETLOGON_NETSERVERREQCHALLENGE, "NETSERVERREQCHALLENGE",
5019                 netlogon_dissect_netserverreqchallenge_rqst,
5020                 netlogon_dissect_netserverreqchallenge_reply },
5021         { NETLOGON_NETSERVERAUTHENTICATE, "NETSERVERAUTHENTICATE",
5022                 netlogon_dissect_netserverauthenticate_rqst,
5023                 netlogon_dissect_netserverauthenticate_reply },
5024         { NETLOGON_NETSERVERPASSWORDSET, "NETSERVERPASSWORDSET",
5025                 netlogon_dissect_netserverpasswordset_rqst,
5026                 netlogon_dissect_netserverpasswordset_reply },
5027         { NETLOGON_NETSAMDELTAS, "NETSAMDELTAS",
5028                 netlogon_dissect_netsamdeltas_rqst,
5029                 netlogon_dissect_netsamdeltas_reply },
5030         { NETLOGON_FUNCTION_08, "FUNCTION_08",
5031                 netlogon_dissect_function_08_rqst,
5032                 netlogon_dissect_function_08_reply },
5033         { NETLOGON_FUNCTION_09, "FUNCTION_09",
5034                 netlogon_dissect_function_09_rqst,
5035                 netlogon_dissect_function_09_reply },
5036         { NETLOGON_FUNCTION_0A, "FUNCTION_0A",
5037                 netlogon_dissect_function_0a_rqst,
5038                 netlogon_dissect_function_0a_reply },
5039         { NETLOGON_FUNCTION_0B, "FUNCTION_0B",
5040                 netlogon_dissect_function_0b_rqst,
5041                 netlogon_dissect_function_0b_reply },
5042         { NETLOGON_NETLOGONCONTROL, "NETLOGONCONTROL",
5043                 netlogon_dissect_netlogoncontrol_rqst,
5044                 netlogon_dissect_netlogoncontrol_reply },
5045         { NETLOGON_FUNCTION_0D, "FUNCTION_0D",
5046                 netlogon_dissect_function_0d_rqst,
5047                 netlogon_dissect_function_0d_reply },
5048         { NETLOGON_NETLOGONCONTROL2, "NETLOGONCONTROL2",
5049                 netlogon_dissect_netlogoncontrol2_rqst,
5050                 netlogon_dissect_netlogoncontrol2_reply },
5051         { NETLOGON_NETSERVERAUTHENTICATE2, "NETSERVERAUTHENTICATE2",
5052                 netlogon_dissect_netserverauthenticate2_rqst,
5053                 netlogon_dissect_netserverauthenticate2_reply },
5054         { NETLOGON_NETDATABASESYNC2, "NETDATABASESYNC2",
5055                 netlogon_dissect_netdatabasesync2_rqst,
5056                 netlogon_dissect_netdatabasesync2_reply },
5057         { NETLOGON_FUNCTION_11, "FUNCTION_11",
5058                 netlogon_dissect_function_11_rqst,
5059                 netlogon_dissect_function_11_reply },
5060         { NETLOGON_FUNCTION_12, "FUNCTION_12",
5061                 netlogon_dissect_function_12_rqst,
5062                 netlogon_dissect_function_12_reply },
5063         { NETLOGON_NETTRUSTEDDOMAINLIST, "NETTRUSTEDDOMAINLIST",
5064                 netlogon_dissect_nettrusteddomainlist_rqst,
5065                 netlogon_dissect_nettrusteddomainlist_reply },
5066         { NETLOGON_DSRGETDCNAME2, "DSRGETDCNAME2",
5067                 netlogon_dissect_dsrgetdcname2_rqst,
5068                 netlogon_dissect_dsrgetdcname2_reply },
5069         { NETLOGON_FUNCTION_15, "FUNCTION_15",
5070                 netlogon_dissect_function_15_rqst,
5071                 netlogon_dissect_function_15_reply },
5072         { NETLOGON_FUNCTION_16, "FUNCTION_16",
5073                 netlogon_dissect_function_16_rqst,
5074                 netlogon_dissect_function_16_reply },
5075         { NETLOGON_FUNCTION_17, "FUNCTION_17",
5076                 netlogon_dissect_function_17_rqst,
5077                 netlogon_dissect_function_17_reply },
5078         { NETLOGON_FUNCTION_18, "FUNCTION_18",
5079                 netlogon_dissect_function_18_rqst,
5080                 netlogon_dissect_function_18_reply },
5081         { NETLOGON_FUNCTION_19, "FUNCTION_19",
5082                 netlogon_dissect_function_19_rqst,
5083                 netlogon_dissect_function_19_reply },
5084         { NETLOGON_NETSERVERAUTHENTICATE3, "NETSERVERAUTHENTICATE3",
5085                 netlogon_dissect_netserverauthenticate3_rqst,
5086                 netlogon_dissect_netserverauthenticate3_reply },
5087         { NETLOGON_DSRGETDCNAME, "DSRGETDCNAME",
5088                 netlogon_dissect_dsrgetdcname_rqst,
5089                 netlogon_dissect_dsrgetdcname_reply },
5090         { NETLOGON_DSRGETSITENAME, "DSRGETSITENAME",
5091                 netlogon_dissect_dsrgetsitename_rqst,
5092                 netlogon_dissect_dsrgetsitename_reply },
5093         { NETLOGON_FUNCTION_1D, "FUNCTION_1D",
5094                 netlogon_dissect_function_1d_rqst,
5095                 netlogon_dissect_function_1d_reply },
5096         { NETLOGON_FUNCTION_1E, "FUNCTION_1E",
5097                 netlogon_dissect_function_1e_rqst,
5098                 netlogon_dissect_function_1e_reply },
5099         { NETLOGON_NETSERVERPASSWORDSET2, "NETSERVERPASSWORDSET2",
5100                 netlogon_dissect_netserverpasswordset2_rqst,
5101                 netlogon_dissect_netserverpasswordset2_reply },
5102         { NETLOGON_FUNCTION_20, "FUNCTION_20",
5103                 netlogon_dissect_function_20_rqst,
5104                 netlogon_dissect_function_20_reply },
5105         { NETLOGON_FUNCTION_21, "FUNCTION_21",
5106                 netlogon_dissect_function_21_rqst,
5107                 netlogon_dissect_function_21_reply },
5108         { NETLOGON_FUNCTION_22, "FUNCTION_22",
5109                 netlogon_dissect_function_22_rqst,
5110                 netlogon_dissect_function_22_reply },
5111         { NETLOGON_FUNCTION_23, "FUNCTION_23",
5112                 netlogon_dissect_function_23_rqst,
5113                 netlogon_dissect_function_23_reply },
5114         { NETLOGON_FUNCTION_24, "FUNCTION_24",
5115                 netlogon_dissect_function_24_rqst,
5116                 netlogon_dissect_function_24_reply },
5117         { NETLOGON_FUNCTION_25, "FUNCTION_25",
5118                 netlogon_dissect_function_25_rqst,
5119                 netlogon_dissect_function_25_reply },
5120         { NETLOGON_FUNCTION_26, "FUNCTION_26",
5121                 netlogon_dissect_function_26_rqst,
5122                 netlogon_dissect_function_26_reply },
5123         { NETLOGON_FUNCTION_27, "FUNCTION_27",
5124                 netlogon_dissect_function_27_rqst,
5125                 netlogon_dissect_function_27_reply },
5126         { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DSRROLEGETPRIMARYDOMAININFORMATION",
5127                 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst,
5128                 netlogon_dissect_dsrrolegetprimarydomaininformation_reply },
5129         { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DSRDEREGISTERDNSHOSTRECORDS",
5130                 netlogon_dissect_dsrderegisterdnshostrecords_rqst,
5131                 netlogon_dissect_dsrderegisterdnshostrecords_reply },
5132         {0, NULL, NULL,  NULL },
5133 };
5134
5135 void
5136 proto_register_dcerpc_netlogon(void)
5137 {
5138
5139 static hf_register_info hf[] = {
5140         { &hf_netlogon_rc, {
5141                 "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
5142                 VALS(NT_errors), 0x0, "Netlogon return code", HFILL }},
5143
5144         { &hf_netlogon_param_ctrl, {
5145                 "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
5146                 NULL, 0x0, "Param ctrl", HFILL }},
5147
5148         { &hf_netlogon_logon_id, {
5149                 "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
5150                 NULL, 0x0, "Logon ID", HFILL }},
5151
5152         { &hf_netlogon_count, {
5153                 "Count", "netlogon.count", FT_UINT16, BASE_DEC,
5154                 NULL, 0x0, "", HFILL }},
5155
5156         { &hf_netlogon_credential, {
5157                 "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
5158                 NULL, 0x0, "Netlogon credential", HFILL }},
5159
5160         { &hf_netlogon_cypher_block, {
5161                 "Cypher Block", "netlogon.cypher_block", FT_BYTES, BASE_HEX,
5162                 NULL, 0x0, "Netlogon cypher block", HFILL }},
5163
5164         { &hf_netlogon_lm_owf_password, {
5165                 "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
5166                 NULL, 0x0, "LanManager OWF Password", HFILL }},
5167
5168         { &hf_netlogon_user_session_key, {
5169                 "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
5170                 NULL, 0x0, "User Session Key", HFILL }},
5171
5172         { &hf_netlogon_encrypted_lm_owf_password, {
5173                 "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
5174                 NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }},
5175
5176         { &hf_netlogon_nt_owf_password, {
5177                 "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
5178                 NULL, 0x0, "NT OWF Password", HFILL }},
5179
5180         { &hf_netlogon_blob, {
5181                 "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
5182                 NULL, 0x0, "BLOB", HFILL }},
5183
5184         { &hf_netlogon_len, {
5185                 "Len", "netlogon.len", FT_UINT32, BASE_DEC,
5186                 NULL, 0, "Length", HFILL }},
5187
5188         { &hf_netlogon_status, {
5189                 "Status", "netlogon.status", FT_UINT32, BASE_DEC,
5190                 NULL, 0, "Status", HFILL }},
5191
5192         { &hf_netlogon_attrs, {
5193                 "Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX,
5194                 NULL, 0, "Attributes", HFILL }},
5195
5196         { &hf_netlogon_unknown_string,
5197                 { "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE,
5198                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
5199         { &hf_netlogon_unknown_long,
5200                 { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
5201                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
5202         { &hf_netlogon_unknown_short,
5203                 { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
5204                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
5205
5206         { &hf_netlogon_unknown_char,
5207                 { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
5208                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
5209
5210         { &hf_netlogon_unknown_time,
5211                 { "Unknown time", "netlogon.unknown.time", FT_ABSOLUTE_TIME, BASE_NONE,
5212                 NULL, 0x0, "Unknown time. If you know what this is, contact ethereal developers.", HFILL }},
5213
5214         { &hf_netlogon_acct_expiry_time,
5215                 { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
5216                 NULL, 0x0, "When this account will expire", HFILL }},
5217
5218         { &hf_netlogon_nt_pwd_present,
5219                 { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
5220                 NULL, 0x0, "Is NT password present for this account?", HFILL }},
5221
5222         { &hf_netlogon_lm_pwd_present,
5223                 { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
5224                 NULL, 0x0, "Is LanManager password present for this account?", HFILL }},
5225
5226         { &hf_netlogon_pwd_expired,
5227                 { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
5228                 NULL, 0x0, "Whether this password has expired or not", HFILL }},
5229
5230         { &hf_netlogon_num_pwd_pairs,
5231                 { "Num PWD Pairs", "netlogon.num_pwd_pairs", FT_UINT8, BASE_DEC,
5232                 NULL, 0x0, "Number of password pairs. Password history length?", HFILL }},
5233
5234         { &hf_netlogon_authoritative,
5235                 { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
5236                 NULL, 0x0, "", HFILL }},
5237
5238         { &hf_netlogon_nt_chal_resp,
5239                 { "NT Chal resp", "netlogon.nt_chal_resp", FT_BYTES, BASE_HEX,
5240                 NULL, 0, "Challenge response for NT authentication", HFILL }},
5241
5242         { &hf_netlogon_lm_chal_resp,
5243                 { "LM Chal resp", "netlogon.lm_chal_resp", FT_BYTES, BASE_HEX,
5244                 NULL, 0, "Challenge response for LM authentication", HFILL }},
5245
5246         { &hf_netlogon_acct_name,
5247                 { "Acct Name", "netlogon.acct_name", FT_STRING, BASE_NONE,
5248                 NULL, 0, "Account Name", HFILL }},
5249
5250         { &hf_netlogon_acct_desc,
5251                 { "Acct Desc", "netlogon.acct_desc", FT_STRING, BASE_NONE,
5252                 NULL, 0, "Account Description", HFILL }},
5253
5254         { &hf_netlogon_group_desc,
5255                 { "Group Desc", "netlogon.group_desc", FT_STRING, BASE_NONE,
5256                 NULL, 0, "Group Description", HFILL }},
5257
5258         { &hf_netlogon_full_name,
5259                 { "Full Name", "netlogon.full_name", FT_STRING, BASE_NONE,
5260                 NULL, 0, "Full Name", HFILL }},
5261
5262         { &hf_netlogon_comment,
5263                 { "Comment", "netlogon.comment", FT_STRING, BASE_NONE,
5264                 NULL, 0, "Comment", HFILL }},
5265
5266         { &hf_netlogon_parameters,
5267                 { "Parameters", "netlogon.parameters", FT_STRING, BASE_NONE,
5268                 NULL, 0, "Parameters", HFILL }},
5269
5270         { &hf_netlogon_logon_script,
5271                 { "Logon Script", "netlogon.logon_script", FT_STRING, BASE_NONE,
5272                 NULL, 0, "Logon Script", HFILL }},
5273
5274         { &hf_netlogon_profile_path,
5275                 { "Profile Path", "netlogon.profile_path", FT_STRING, BASE_NONE,
5276                 NULL, 0, "Profile Path", HFILL }},
5277
5278         { &hf_netlogon_home_dir,
5279                 { "Home Dir", "netlogon.home_dir", FT_STRING, BASE_NONE,
5280                 NULL, 0, "Home Directory", HFILL }},
5281
5282         { &hf_netlogon_dir_drive,
5283                 { "Dir Drive", "netlogon.dir_drive", FT_STRING, BASE_NONE,
5284                 NULL, 0, "Drive letter for home directory", HFILL }},
5285
5286         { &hf_netlogon_logon_srv,
5287                 { "Server", "netlogon.server", FT_STRING, BASE_NONE,
5288                 NULL, 0, "Server", HFILL }},
5289
5290         { &hf_netlogon_logon_dom,
5291                 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
5292                 NULL, 0, "Domain", HFILL }},
5293
5294         { &hf_netlogon_computer_name,
5295                 { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
5296                 NULL, 0, "Computer Name", HFILL }},
5297
5298         { &hf_netlogon_site_name,
5299                 { "Site Name", "netlogon.site_name", FT_STRING, BASE_NONE,
5300                 NULL, 0, "Site Name", HFILL }},
5301
5302         { &hf_netlogon_dc_name,
5303                 { "DC Name", "netlogon.dc.name", FT_STRING, BASE_NONE,
5304                 NULL, 0, "DC Name", HFILL }},
5305
5306         { &hf_netlogon_dc_site_name,
5307                 { "DC Site Name", "netlogon.dc.site_name", FT_STRING, BASE_NONE,
5308                 NULL, 0, "DC Site Name", HFILL }},
5309
5310         { &hf_netlogon_dns_forest_name,
5311                 { "DNS Forest Name", "netlogon.dns.forest_name", FT_STRING, BASE_NONE,
5312                 NULL, 0, "DNS Forest Name", HFILL }},
5313
5314         { &hf_netlogon_dc_address,
5315                 { "DC Address", "netlogon.dc.address", FT_STRING, BASE_NONE,
5316                 NULL, 0, "DC Address", HFILL }},
5317
5318         { &hf_netlogon_dc_address_type,
5319                 { "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC,
5320                 NULL, 0, "DC Address Type", HFILL }},
5321
5322         { &hf_netlogon_client_name,
5323                 { "Client Name", "netlogon.client.name", FT_STRING, BASE_NONE,
5324                 NULL, 0, "Client Name", HFILL }},
5325
5326         { &hf_netlogon_client_site_name,
5327                 { "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE,
5328                 NULL, 0, "Client Site Name", HFILL }},
5329
5330         { &hf_netlogon_workstation_site_name,
5331                 { "Wkst Site Name", "netlogon.wkst.site_name", FT_STRING, BASE_NONE,
5332                 NULL, 0, "Workstation Site Name", HFILL }},
5333
5334         { &hf_netlogon_workstation_os,
5335                 { "Wkst OS", "netlogon.wkst.os", FT_STRING, BASE_NONE,
5336                 NULL, 0, "Workstation OS", HFILL }},
5337
5338         { &hf_netlogon_workstations,
5339                 { "Workstations", "netlogon.wksts", FT_STRING, BASE_NONE,
5340                 NULL, 0, "Workstations", HFILL }},
5341
5342         { &hf_netlogon_workstation_fqdn,
5343                 { "Wkst FQDN", "netlogon.wkst.fqdn", FT_STRING, BASE_NONE,
5344                 NULL, 0, "Workstation FQDN", HFILL }},
5345
5346         { &hf_netlogon_group_name,
5347                 { "Group Name", "netlogon.group_name", FT_STRING, BASE_NONE,
5348                 NULL, 0, "Group Name", HFILL }},
5349
5350         { &hf_netlogon_alias_name,
5351                 { "Alias Name", "netlogon.alias_name", FT_STRING, BASE_NONE,
5352                 NULL, 0, "Alias Name", HFILL }},
5353
5354         { &hf_netlogon_cli_name,
5355                 { "CLI Name", "netlogon.cli_name", FT_STRING, BASE_NONE,
5356                 NULL, 0, "CLI Name", HFILL }},
5357
5358         { &hf_netlogon_dns_host,
5359                 { "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE,
5360                 NULL, 0, "DNS Host", HFILL }},
5361
5362         { &hf_netlogon_trusted_domain_name,
5363                 { "Trusted Domain", "netlogon.trusted_domain", FT_STRING, BASE_NONE,
5364                 NULL, 0, "Trusted Domain Name", HFILL }},
5365
5366         { &hf_netlogon_trusted_dc_name,
5367                 { "Trusted DC", "netlogon.trusted_dc", FT_STRING, BASE_NONE,
5368                 NULL, 0, "Trusted DC", HFILL }},
5369
5370         { &hf_netlogon_logonsrv_handle,
5371                 { "Handle", "netlogon.handle", FT_STRING, BASE_NONE,
5372                 NULL, 0, "Logon Srv Handle", HFILL }},
5373
5374         { &hf_netlogon_logon_count,
5375                 { "Logon Count", "netlogon.logon_count", FT_UINT16, BASE_DEC,
5376                 NULL, 0x0, "Number of successful logins", HFILL }},
5377
5378         { &hf_netlogon_bad_pw_count,
5379                 { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT16, BASE_DEC,
5380                 NULL, 0x0, "Number of failed logins", HFILL }},
5381
5382         { &hf_netlogon_country,
5383                 { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
5384                 VALS(ms_country_codes), 0x0, "Country setting for this account", HFILL }},
5385
5386         { &hf_netlogon_codepage,
5387                 { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
5388                 NULL, 0x0, "Codepage setting for this account", HFILL }},
5389
5390         { &hf_netlogon_level,
5391                 { "Level", "netlogon.level", FT_UINT16, BASE_DEC,
5392                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5393
5394         { &hf_netlogon_secure_channel_type,
5395                 { "Sec Chn Type", "netlogon.sec_chn_type", FT_UINT16, BASE_DEC,
5396                 NULL, 0x0, "Secure Channel Type", HFILL }},
5397
5398         { &hf_netlogon_blob_size,
5399                 { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
5400                 NULL, 0x0, "Size in bytes of BLOB", HFILL }},
5401
5402         { &hf_netlogon_code,
5403                 { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
5404                 NULL, 0x0, "Code", HFILL }},
5405
5406         { &hf_netlogon_level_long,
5407                 { "Level", "netlogon.level32", FT_UINT32, BASE_DEC,
5408                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5409
5410         { &hf_netlogon_timestamp,
5411                 { "Timestamp", "netlogon.timestamp", FT_UINT32, BASE_HEX,
5412                 NULL, 0x0, "Some sort of timestamp", HFILL }},
5413
5414         { &hf_netlogon_user_rid,
5415                 { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
5416                 NULL, 0x0, "", HFILL }},
5417
5418         { &hf_netlogon_alias_rid,
5419                 { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
5420                 NULL, 0x0, "", HFILL }},
5421
5422         { &hf_netlogon_group_rid,
5423                 { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
5424                 NULL, 0x0, "", HFILL }},
5425
5426         { &hf_netlogon_num_rids,
5427                 { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
5428                 NULL, 0x0, "Number of RIDs", HFILL }},
5429
5430         { &hf_netlogon_num_other_groups,
5431                 { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
5432                 NULL, 0x0, "", HFILL }},
5433
5434         { &hf_netlogon_flags,
5435                 { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
5436                 NULL, 0x0, "", HFILL }},
5437
5438         { &hf_netlogon_user_flags,
5439                 { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
5440                 NULL, 0x0, "", HFILL }},
5441
5442         { &hf_netlogon_database_id,
5443                 { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
5444                 NULL, 0x0, "Database Id", HFILL }},
5445
5446         { &hf_netlogon_max_size,
5447                 { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
5448                 NULL, 0x0, "Max Size of database", HFILL }},
5449
5450         { &hf_netlogon_num_deltas,
5451                 { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
5452                 NULL, 0x0, "Number of SAM Deltas in array", HFILL }},
5453
5454         { &hf_netlogon_logon_attempts,
5455                 { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
5456                 NULL, 0x0, "Number of logon attempts", HFILL }},
5457
5458         { &hf_netlogon_logon_time,
5459                 { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
5460                 NULL, 0, "Time for last time this user logged on", HFILL }},
5461
5462         { &hf_netlogon_kickoff_time,
5463                 { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5464                 NULL, 0, "Time when this user will be kicked off", HFILL }},
5465
5466         { &hf_netlogon_logoff_time,
5467                 { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5468                 NULL, 0, "Time for last time this user logged off", HFILL }},
5469
5470         { &hf_netlogon_pwd_last_set_time,
5471                 { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
5472                 NULL, 0, "Last time this users password was changed", HFILL }},
5473
5474         { &hf_netlogon_pwd_can_change_time,
5475                 { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5476                 NULL, 0, "When this users password may be changed", HFILL }},
5477
5478         { &hf_netlogon_pwd_must_change_time,
5479                 { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5480                 NULL, 0, "When this users password must be changed", HFILL }},
5481
5482         };
5483
5484         static gint *ett[] = {
5485                 &ett_dcerpc_netlogon,
5486                 &ett_NETLOGON_SECURITY_DESCRIPTOR,
5487                 &ett_TYPE_1,
5488                 &ett_TYPE_2,
5489                 &ett_CYPHER_BLOCK,
5490                 &ett_NETLOGON_AUTHENTICATOR,
5491                 &ett_NETLOGON_LOGON_IDENTITY_INFO,
5492                 &ett_NETLOGON_INTERACTIVE_INFO,
5493                 &ett_NETLOGON_NETWORK_INFO,
5494                 &ett_NETLOGON_VALIDATION_SAM_INFO1,
5495                 &ett_NETLOGON_VALIDATION_SAM_INFO2,
5496                 &ett_TYPE_16,
5497                 &ett_NETLOGON_SAM_DOMAIN_INFO,
5498                 &ett_NETLOGON_SAM_GROUP_INFO,
5499                 &ett_TYPE_23,
5500                 &ett_NETLOGON_SAM_ACCOUNT_INFO,
5501                 &ett_NETLOGON_SAM_GROUP_MEM_INFO,
5502                 &ett_NETLOGON_SAM_ALIAS_INFO,
5503                 &ett_NETLOGON_SAM_ALIAS_MEM_INFO,
5504                 &ett_TYPE_30,
5505                 &ett_TYPE_29,
5506                 &ett_TYPE_31,
5507                 &ett_TYPE_32,
5508                 &ett_TYPE_33,
5509                 &ett_TYPE_34,
5510                 &ett_TYPE_35,
5511                 &ett_SAM_DELTA,
5512                 &ett_SAM_DELTA_ARRAY,
5513                 &ett_TYPE_36,
5514                 &ett_NETLOGON_INFO_1,
5515                 &ett_NETLOGON_INFO_2,
5516                 &ett_NETLOGON_INFO_3,
5517                 &ett_NETLOGON_INFO_4,
5518                 &ett_UNICODE_MULTI,
5519                 &ett_DOMAIN_CONTROLLER_INFO,
5520                 &ett_TYPE_46,
5521                 &ett_TYPE_48,
5522                 &ett_UNICODE_STRING_512,
5523                 &ett_TYPE_50,
5524                 &ett_TYPE_51,
5525                 &ett_TYPE_52,
5526                 &ett_NETLOGON_LEVEL,
5527                 &ett_NETLOGON_VALIDATION,
5528                 &ett_TYPE_19,
5529                 &ett_NETLOGON_CONTROL_QUERY_INFO,
5530                 &ett_TYPE_44,
5531                 &ett_TYPE_20,
5532                 &ett_NETLOGON_INFO,
5533                 &ett_TYPE_45,
5534                 &ett_TYPE_47,
5535                 &ett_NETLOGON_CREDENTIAL,
5536                 &ett_GUID,
5537                 &ett_ENC_LM_OWF_PASSWORD,
5538                 &ett_LM_OWF_PASSWORD,
5539                 &ett_NT_OWF_PASSWORD,
5540                 &ett_GROUP_MEMBERSHIP,
5541                 &ett_USER_SESSION_KEY,
5542                 &ett_BLOB,
5543                 &ett_rid_array,
5544                 &ett_attrib_array,
5545         };
5546
5547         proto_dcerpc_netlogon = proto_register_protocol(
5548                 "Microsoft Network Logon", "NETLOGON", "rpc_netlogon");
5549
5550         proto_register_field_array(proto_dcerpc_netlogon, hf,
5551                                    array_length(hf));
5552         proto_register_subtree_array(ett, array_length(ett));
5553 }
5554
5555 void
5556 proto_reg_handoff_dcerpc_netlogon(void)
5557 {
5558         /* Register protocol as dcerpc */
5559
5560         dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
5561                          &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
5562                          dcerpc_netlogon_dissectors);
5563 }