packet-dcerpc-netlogon.c

   1 /* packet-dcerpc-netlogon.c
   2  * Routines for SMB \\PIPE\\NETLOGON packet disassembly
   3  * Copyright 2001, Tim Potter <tpot@samba.org>
   4  *  2002 structure and command dissectors by Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-netlogon.c,v 1.17 2002/04/20 07:15:19 tpot Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-dcerpc.h"
  34 #include "packet-dcerpc-nt.h"
  35 #include "packet-dcerpc-netlogon.h"
  36 #include "smb.h"        /* for "NT_errors[]" */
  37 #include "packet-smb-common.h"
  38 #include "packet-dcerpc-lsa.h"
  39
  40 static int proto_dcerpc_netlogon = -1;
  41 static int hf_netlogon_rc = -1;
  42 static int hf_netlogon_len = -1;
  43 static int hf_netlogon_status = -1;
  44 static int hf_netlogon_attrs = -1;
  45 static int hf_netlogon_count = -1;
  46 static int hf_netlogon_level = -1;
  47 static int hf_netlogon_level_long = -1;
  48 static int hf_netlogon_unknown_time = -1;
  49 static int hf_netlogon_unknown_string = -1;
  50 static int hf_netlogon_unknown_long = -1;
  51 static int hf_netlogon_unknown_short = -1;
  52 static int hf_netlogon_unknown_char = -1;
  53 static int hf_netlogon_logon_time = -1;
  54 static int hf_netlogon_logoff_time = -1;
  55 static int hf_netlogon_kickoff_time = -1;
  56 static int hf_netlogon_pwd_last_set_time = -1;
  57 static int hf_netlogon_pwd_can_change_time = -1;
  58 static int hf_netlogon_pwd_must_change_time = -1;
  59 static int hf_netlogon_timestamp = -1;
  60 static int hf_netlogon_nt_chal_resp = -1;
  61 static int hf_netlogon_lm_chal_resp = -1;
  62 static int hf_netlogon_credential = -1;
  63 static int hf_netlogon_cypher_block = -1;
  64 static int hf_netlogon_acct_name = -1;
  65 static int hf_netlogon_acct_desc = -1;
  66 static int hf_netlogon_group_desc = -1;
  67 static int hf_netlogon_full_name = -1;
  68 static int hf_netlogon_comment = -1;
  69 static int hf_netlogon_parameters = -1;
  70 static int hf_netlogon_logon_script = -1;
  71 static int hf_netlogon_profile_path = -1;
  72 static int hf_netlogon_home_dir = -1;
  73 static int hf_netlogon_dir_drive = -1;
  74 static int hf_netlogon_logon_count = -1;
  75 static int hf_netlogon_bad_pw_count = -1;
  76 static int hf_netlogon_user_rid = -1;
  77 static int hf_netlogon_alias_rid = -1;
  78 static int hf_netlogon_group_rid = -1;
  79 static int hf_netlogon_logon_srv = -1;
  80 static int hf_netlogon_logon_dom = -1;
  81 static int hf_netlogon_trusted_domain_name = -1;
  82 static int hf_netlogon_num_rids = -1;
  83 static int hf_netlogon_num_other_groups = -1;
  84 static int hf_netlogon_computer_name = -1;
  85 static int hf_netlogon_site_name = -1;
  86 static int hf_netlogon_trusted_dc_name = -1;
  87 static int hf_netlogon_dc_name = -1;
  88 static int hf_netlogon_dc_site_name = -1;
  89 static int hf_netlogon_dns_forest_name = -1;
  90 static int hf_netlogon_dc_address = -1;
  91 static int hf_netlogon_dc_address_type = -1;
  92 static int hf_netlogon_client_name = -1;
  93 static int hf_netlogon_client_site_name = -1;
  94 static int hf_netlogon_workstation_site_name = -1;
  95 static int hf_netlogon_workstation_os = -1;
  96 static int hf_netlogon_workstations = -1;
  97 static int hf_netlogon_workstation_fqdn = -1;
  98 static int hf_netlogon_group_name = -1;
  99 static int hf_netlogon_alias_name = -1;
 100 static int hf_netlogon_cli_name = -1;
 101 static int hf_netlogon_country = -1;
 102 static int hf_netlogon_codepage = -1;
 103 static int hf_netlogon_flags = -1;
 104 static int hf_netlogon_user_flags = -1;
 105 static int hf_netlogon_pwd_expired = -1;
 106 static int hf_netlogon_nt_pwd_present = -1;
 107 static int hf_netlogon_lm_pwd_present = -1;
 108 static int hf_netlogon_code = -1;
 109 static int hf_netlogon_database_id = -1;
 110 static int hf_netlogon_max_size = -1;
 111 static int hf_netlogon_dns_host = -1;
 112 static int hf_netlogon_num_pwd_pairs = -1;
 113 static int hf_netlogon_acct_expiry_time = -1;
 114 static int hf_netlogon_encrypted_lm_owf_password = -1;
 115 static int hf_netlogon_lm_owf_password = -1;
 116 static int hf_netlogon_nt_owf_password = -1;
 117 static int hf_netlogon_param_ctrl = -1;
 118 static int hf_netlogon_logon_id = -1;
 119 static int hf_netlogon_num_deltas = -1;
 120 static int hf_netlogon_user_session_key = -1;
 121 static int hf_netlogon_blob_size = -1;
 122 static int hf_netlogon_blob = -1;
 123 static int hf_netlogon_logon_attempts = -1;
 124 static int hf_netlogon_authoritative = -1;
 125 static int hf_netlogon_secure_channel_type = -1;
 126 static int hf_netlogon_logonsrv_handle = -1;
 127
 128 static gint ett_dcerpc_netlogon = -1;
 129 static gint ett_NETLOGON_SECURITY_DESCRIPTOR = -1;
 130 static gint ett_TYPE_1 = -1;
 131 static gint ett_TYPE_2 = -1;
 132 static gint ett_CYPHER_BLOCK = -1;
 133 static gint ett_NETLOGON_AUTHENTICATOR = -1;
 134 static gint ett_NETLOGON_LOGON_IDENTITY_INFO = -1;
 135 static gint ett_NETLOGON_INTERACTIVE_INFO = -1;
 136 static gint ett_NETLOGON_NETWORK_INFO = -1;
 137 static gint ett_NETLOGON_VALIDATION_SAM_INFO1 = -1;
 138 static gint ett_NETLOGON_VALIDATION_SAM_INFO2 = -1;
 139 static gint ett_TYPE_16 = -1;
 140 static gint ett_NETLOGON_SAM_DOMAIN_INFO = -1;
 141 static gint ett_NETLOGON_SAM_GROUP_INFO = -1;
 142 static gint ett_TYPE_23 = -1;
 143 static gint ett_NETLOGON_SAM_ACCOUNT_INFO = -1;
 144 static gint ett_NETLOGON_SAM_GROUP_MEM_INFO = -1;
 145 static gint ett_NETLOGON_SAM_ALIAS_INFO = -1;
 146 static gint ett_NETLOGON_SAM_ALIAS_MEM_INFO = -1;
 147 static gint ett_TYPE_30 = -1;
 148 static gint ett_TYPE_29 = -1;
 149 static gint ett_TYPE_31 = -1;
 150 static gint ett_TYPE_32 = -1;
 151 static gint ett_TYPE_33 = -1;
 152 static gint ett_TYPE_34 = -1;
 153 static gint ett_TYPE_35 = -1;
 154 static gint ett_SAM_DELTA = -1;
 155 static gint ett_SAM_DELTA_ARRAY = -1;
 156 static gint ett_TYPE_36 = -1;
 157 static gint ett_NETLOGON_INFO_1 = -1;
 158 static gint ett_NETLOGON_INFO_2 = -1;
 159 static gint ett_NETLOGON_INFO_3 = -1;
 160 static gint ett_NETLOGON_INFO_4 = -1;
 161 static gint ett_UNICODE_MULTI = -1;
 162 static gint ett_DOMAIN_CONTROLLER_INFO = -1;
 163 static gint ett_TYPE_46 = -1;
 164 static gint ett_TYPE_48 = -1;
 165 static gint ett_UNICODE_STRING_512 = -1;
 166 static gint ett_TYPE_50 = -1;
 167 static gint ett_TYPE_51 = -1;
 168 static gint ett_TYPE_52 = -1;
 169 static gint ett_NETLOGON_LEVEL = -1;
 170 static gint ett_NETLOGON_VALIDATION = -1;
 171 static gint ett_TYPE_19 = -1;
 172 static gint ett_NETLOGON_CONTROL_QUERY_INFO = -1;
 173 static gint ett_TYPE_44 = -1;
 174 static gint ett_TYPE_20 = -1;
 175 static gint ett_NETLOGON_INFO = -1;
 176 static gint ett_TYPE_45 = -1;
 177 static gint ett_TYPE_47 = -1;
 178 static gint ett_NETLOGON_CREDENTIAL = -1;
 179 static gint ett_GUID = -1;
 180 static gint ett_ENC_LM_OWF_PASSWORD = -1;
 181 static gint ett_LM_OWF_PASSWORD = -1;
 182 static gint ett_NT_OWF_PASSWORD = -1;
 183 static gint ett_GROUP_MEMBERSHIP = -1;
 184 static gint ett_USER_SESSION_KEY = -1;
 185 static gint ett_BLOB = -1;
 186 static gint ett_rid_array = -1;
 187 static gint ett_attrib_array = -1;
 188
 189 static e_uuid_t uuid_dcerpc_netlogon = {
 190         0x12345678, 0x1234, 0xabcd,
 191         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0xcf, 0xfb }
 192 };
 193
 194 static guint16 ver_dcerpc_netlogon = 1;
 195
 196
 197 static int
 198 netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
 199                              packet_info *pinfo, proto_tree *tree,
 200                              char *drep)
 201 {
 202         dcerpc_info *di;
 203
 204         di=pinfo->private_data;
 205         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 206                                      di->hf_index, NULL);
 207         return offset;
 208 }
 209
 210 static int
 211 netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
 212                              packet_info *pinfo, proto_tree *tree,
 213                              char *drep)
 214 {
 215         dcerpc_info *di;
 216
 217         di=pinfo->private_data;
 218         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
 219                                      di->hf_index, NULL);
 220         return offset;
 221 }
 222
 223 static int
 224 netlogon_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 225                              packet_info *pinfo, proto_tree *tree,
 226                              char *drep)
 227 {
 228         dcerpc_info *di;
 229
 230         di=pinfo->private_data;
 231         if(di->conformant_run){
 232                 /*just a run to handle conformant arrays, nothing to dissect */
 233                 return offset;
 234         }
 235
 236         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 237                         di->hf_index, 0);
 238         return offset;
 239 }
 240
 241 int
 242 netlogon_dissect_UNICODE_STRING(tvbuff_t *tvb, int offset,
 243                         packet_info *pinfo, proto_tree *parent_tree,
 244                         char *drep, int type, int hf_index, int levels)
 245 {
 246         proto_item *item=NULL;
 247         proto_tree *tree=NULL;
 248         int old_offset=offset;
 249         dcerpc_info *di;
 250         char *name;
 251
 252         di=pinfo->private_data;
 253         if(di->conformant_run){
 254                 /*just a run to handle conformant arrays, nothing to dissect */
 255                 return offset;
 256         }
 257
 258         name = proto_registrar_get_name(hf_index);
 259         if(parent_tree){
 260                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 261                         "%s", name);
 262                 tree = proto_item_add_subtree(item, ett_nt_unicode_string);
 263         }
 264
 265         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 266                         dissect_ndr_nt_UNICODE_STRING_str, type,
 267                         name, hf_index, levels);
 268
 269         proto_item_set_len(item, offset-old_offset);
 270         return offset;
 271 }
 272
 273
 274 static int
 275 netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 276                         packet_info *pinfo, proto_tree *parent_tree,
 277                         char *drep)
 278 {
 279         proto_item *item=NULL;
 280         proto_tree *tree=NULL;
 281         int old_offset=offset;
 282
 283         if(parent_tree){
 284                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 285                         "NETLOGON_SECURITY_DESCRIPTOR:");
 286                 tree = proto_item_add_subtree(item, ett_NETLOGON_SECURITY_DESCRIPTOR);
 287         }
 288
 289         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 290                 hf_netlogon_len, NULL);
 291
 292         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
 293                 pinfo, tree, drep);
 294
 295         proto_item_set_len(item, offset-old_offset);
 296         return offset;
 297 }
 298
 299 static int
 300 netlogon_dissect_TYPE_1(tvbuff_t *tvb, int offset,
 301                         packet_info *pinfo, proto_tree *parent_tree,
 302                         char *drep)
 303 {
 304         proto_item *item=NULL;
 305         proto_tree *tree=NULL;
 306         int old_offset=offset;
 307
 308         if(parent_tree){
 309                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 310                         "TYPE_1:");
 311                 tree = proto_item_add_subtree(item, ett_TYPE_1);
 312         }
 313
 314         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 315                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 316                 "unknown", hf_netlogon_unknown_string, -1);
 317
 318         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 319                 hf_netlogon_unknown_long, NULL);
 320
 321         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 322                 hf_netlogon_unknown_long, NULL);
 323
 324         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 325                 hf_netlogon_unknown_long, NULL);
 326
 327         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 328                 hf_netlogon_unknown_long, NULL);
 329
 330         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 331                 hf_netlogon_unknown_long, NULL);
 332
 333         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 334                 hf_netlogon_unknown_long, NULL);
 335
 336         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 337                 hf_netlogon_unknown_long, NULL);
 338
 339         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 340                 hf_netlogon_unknown_long, NULL);
 341
 342         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 343                 hf_netlogon_unknown_long, NULL);
 344
 345         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 346                 hf_netlogon_unknown_long, NULL);
 347
 348         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 349                 hf_netlogon_unknown_long, NULL);
 350
 351         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 352                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 353                 "unknown", hf_netlogon_unknown_string, -1);
 354
 355         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 356                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 357                 "unknown", hf_netlogon_unknown_string, -1);
 358
 359         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 360                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 361                 "unknown", hf_netlogon_unknown_string, -1);
 362
 363         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 364                 hf_netlogon_unknown_long, NULL);
 365
 366         proto_item_set_len(item, offset-old_offset);
 367         return offset;
 368 }
 369
 370 static int
 371 netlogon_dissect_TYPE_1_ptr(tvbuff_t *tvb, int offset,
 372                         packet_info *pinfo, proto_tree *tree,
 373                         char *drep)
 374 {
 375         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 376                 netlogon_dissect_TYPE_1, NDR_POINTER_PTR,
 377                 "TYPE_1 pointer: ", -1, 0);
 378         return offset;
 379 }
 380
 381 static int
 382 netlogon_dissect_TYPE_2(tvbuff_t *tvb, int offset,
 383                         packet_info *pinfo, proto_tree *parent_tree,
 384                         char *drep)
 385 {
 386         proto_item *item=NULL;
 387         proto_tree *tree=NULL;
 388         int old_offset=offset;
 389
 390         if(parent_tree){
 391                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 392                         "TYPE_2:");
 393                 tree = proto_item_add_subtree(item, ett_TYPE_2);
 394         }
 395
 396         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 397                 hf_netlogon_unknown_long, NULL);
 398
 399         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 400                 hf_netlogon_unknown_short, NULL);
 401
 402         proto_item_set_len(item, offset-old_offset);
 403         return offset;
 404 }
 405
 406 static int
 407 netlogon_dissect_CYPHER_BLOCK(tvbuff_t *tvb, int offset,
 408                         packet_info *pinfo, proto_tree *parent_tree,
 409                         char *drep)
 410 {
 411         proto_item *item=NULL;
 412         proto_tree *tree=NULL;
 413         int i;
 414         dcerpc_info *di;
 415
 416         di=pinfo->private_data;
 417         if(di->conformant_run){
 418                 /*just a run to handle conformant arrays, nothing to dissect.*/
 419                 return offset;
 420         }
 421
 422         if(parent_tree){
 423                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 424                         "CYPHER_BLOCK:");
 425                 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
 426         }
 427
 428         proto_tree_add_item(tree, hf_netlogon_cypher_block, tvb, offset, 8,
 429                 FALSE);
 430         offset += 8;
 431
 432         return offset;
 433 }
 434
 435 static int
 436 netlogon_dissect_8_unknown_bytes(tvbuff_t *tvb, int offset,
 437                         packet_info *pinfo, proto_tree *parent_tree,
 438                         char *drep)
 439 {
 440         proto_item *item=NULL;
 441         proto_tree *tree=NULL;
 442         int i;
 443         dcerpc_info *di;
 444
 445         di=pinfo->private_data;
 446         if(di->conformant_run){
 447                 /*just a run to handle conformant arrays, nothing to dissect.*/
 448                 return offset;
 449         }
 450
 451         if(parent_tree){
 452                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 453                         "unknown bytes not in IDL:");
 454                 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
 455         }
 456
 457         offset += 8;
 458
 459         return offset;
 460 }
 461
 462 static int
 463 netlogon_dissect_NETLOGON_CREDENTIAL(tvbuff_t *tvb, int offset,
 464                         packet_info *pinfo, proto_tree *parent_tree,
 465                         char *drep)
 466 {
 467         proto_item *item=NULL;
 468         proto_tree *tree=NULL;
 469         int i;
 470         dcerpc_info *di;
 471
 472         di=pinfo->private_data;
 473         if(di->conformant_run){
 474                 /*just a run to handle conformant arrays, nothing to dissect.*/
 475                 return offset;
 476         }
 477
 478         if(parent_tree){
 479                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 480                         "NETLOGON_CREDENTIAL:");
 481                 tree = proto_item_add_subtree(item, ett_NETLOGON_CREDENTIAL);
 482         }
 483
 484         proto_tree_add_item(tree, hf_netlogon_credential, tvb, offset, 8,
 485                 FALSE);
 486         offset += 8;
 487
 488         return offset;
 489 }
 490
 491 static int
 492 netlogon_dissect_NETLOGON_AUTHENTICATOR(tvbuff_t *tvb, int offset,
 493                         packet_info *pinfo, proto_tree *parent_tree,
 494                         char *drep)
 495 {
 496         proto_item *item=NULL;
 497         proto_tree *tree=NULL;
 498         int old_offset=offset;
 499
 500         if(parent_tree){
 501                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 502                         "NETLOGON_AUTHENTICATOR:");
 503                 tree = proto_item_add_subtree(item, ett_NETLOGON_AUTHENTICATOR);
 504         }
 505
 506         offset = netlogon_dissect_NETLOGON_CREDENTIAL(tvb, offset,
 507                 pinfo, tree, drep);
 508
 509         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 510                 hf_netlogon_timestamp, NULL);
 511
 512         proto_item_set_len(item, offset-old_offset);
 513         return offset;
 514 }
 515
 516 static int
 517 netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset,
 518                         packet_info *pinfo, proto_tree *parent_tree,
 519                         char *drep)
 520 {
 521         proto_item *item=NULL;
 522         proto_tree *tree=NULL;
 523         dcerpc_info *di;
 524
 525         di=pinfo->private_data;
 526         if(di->conformant_run){
 527                 /*just a run to handle conformant arrays, nothing to dissect.*/
 528                 return offset;
 529         }
 530
 531         if(parent_tree){
 532                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 533                         "USER_SESSION_KEY:");
 534                 tree = proto_item_add_subtree(item, ett_USER_SESSION_KEY);
 535         }
 536
 537         proto_tree_add_item(tree, hf_netlogon_user_session_key, tvb, offset, 16,
 538                 FALSE);
 539         offset += 16;
 540
 541         return offset;
 542 }
 543
 544 static int
 545 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 546                         packet_info *pinfo, proto_tree *parent_tree,
 547                         char *drep)
 548 {
 549         proto_item *item=NULL;
 550         proto_tree *tree=NULL;
 551         dcerpc_info *di;
 552
 553         di=pinfo->private_data;
 554         if(di->conformant_run){
 555                 /*just a run to handle conformant arrays, nothing to dissect.*/
 556                 return offset;
 557         }
 558
 559         if(parent_tree){
 560                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 561                         "ENCRYPTED_LM_OWF_PASSWORD:");
 562                 tree = proto_item_add_subtree(item, ett_ENC_LM_OWF_PASSWORD);
 563         }
 564
 565         proto_tree_add_item(tree, hf_netlogon_encrypted_lm_owf_password, tvb, offset, 16,
 566                 FALSE);
 567         offset += 16;
 568
 569         return offset;
 570 }
 571
 572 static int
 573 netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 574                         packet_info *pinfo, proto_tree *parent_tree,
 575                         char *drep)
 576 {
 577         proto_item *item=NULL;
 578         proto_tree *tree=NULL;
 579         dcerpc_info *di;
 580
 581         di=pinfo->private_data;
 582         if(di->conformant_run){
 583                 /*just a run to handle conformant arrays, nothing to dissect.*/
 584                 return offset;
 585         }
 586
 587         if(parent_tree){
 588                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 589                         "LM_OWF_PASSWORD:");
 590                 tree = proto_item_add_subtree(item, ett_LM_OWF_PASSWORD);
 591         }
 592
 593         proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16,
 594                 FALSE);
 595         offset += 16;
 596
 597         return offset;
 598 }
 599
 600 static int
 601 netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 602                         packet_info *pinfo, proto_tree *parent_tree,
 603                         char *drep)
 604 {
 605         proto_item *item=NULL;
 606         proto_tree *tree=NULL;
 607         dcerpc_info *di;
 608
 609         di=pinfo->private_data;
 610         if(di->conformant_run){
 611                 /*just a run to handle conformant arrays, nothing to dissect.*/
 612                 return offset;
 613         }
 614
 615         if(parent_tree){
 616                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 617                         "NT_OWF_PASSWORD:");
 618                 tree = proto_item_add_subtree(item, ett_NT_OWF_PASSWORD);
 619         }
 620
 621         proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16,
 622                 FALSE);
 623         offset += 16;
 624
 625         return offset;
 626 }
 627
 628
 629 static int
 630 netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
 631                         packet_info *pinfo, proto_tree *parent_tree,
 632                         char *drep)
 633 {
 634         proto_item *item=NULL;
 635         proto_tree *tree=NULL;
 636         int old_offset=offset;
 637
 638         if(parent_tree){
 639                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 640                         "NETLOGON_LOGON_IDENTITY_INFO:");
 641                 tree = proto_item_add_subtree(item, ett_NETLOGON_LOGON_IDENTITY_INFO);
 642         }
 643
 644         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 645                 hf_netlogon_logon_dom, 0);
 646
 647         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 648                 hf_netlogon_param_ctrl, NULL);
 649
 650         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 651                 hf_netlogon_logon_id, NULL);
 652
 653         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 654                 hf_netlogon_acct_name, 0);
 655
 656         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 657                 hf_netlogon_computer_name, 0);
 658
 659         /* XXX 8 extra bytes here */
 660         /* there were 8 extra bytes, either here or in NETWORK_INFO that does not match
 661            the idl file. Could be a bug in either the NETLOGON implementation or in the
 662            idl file.
 663         */
 664         offset = netlogon_dissect_8_unknown_bytes(tvb, offset, pinfo, tree, drep);
 665
 666         return offset;
 667 }
 668
 669 static int
 670 netlogon_dissect_NETLOGON_INTERACTIVE_INFO(tvbuff_t *tvb, int offset,
 671                         packet_info *pinfo, proto_tree *parent_tree,
 672                         char *drep)
 673 {
 674         proto_item *item=NULL;
 675         proto_tree *tree=NULL;
 676         int old_offset=offset;
 677
 678         if(parent_tree){
 679                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 680                         "NETLOGON_INTERACTIVE_INFO:");
 681                 tree = proto_item_add_subtree(item, ett_NETLOGON_INTERACTIVE_INFO);
 682         }
 683
 684         offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
 685                 pinfo, tree, drep);
 686
 687         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
 688                 pinfo, tree, drep);
 689
 690         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
 691                 pinfo, tree, drep);
 692
 693         proto_item_set_len(item, offset-old_offset);
 694         return offset;
 695 }
 696
 697 static int
 698 netlogon_dissect_NETLOGON_NETWORK_INFO(tvbuff_t *tvb, int offset,
 699                         packet_info *pinfo, proto_tree *parent_tree,
 700                         char *drep)
 701 {
 702         proto_item *item=NULL;
 703         proto_tree *tree=NULL;
 704         int old_offset=offset;
 705
 706         if(parent_tree){
 707                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 708                         "NETLOGON_NETWORK_INFO:");
 709                 tree = proto_item_add_subtree(item, ett_NETLOGON_NETWORK_INFO);
 710         }
 711
 712         offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
 713                 pinfo, tree, drep);
 714
 715         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 716                 hf_netlogon_nt_chal_resp, 0);
 717
 718         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 719                 hf_netlogon_lm_chal_resp, 0);
 720
 721         proto_item_set_len(item, offset-old_offset);
 722         return offset;
 723 }
 724
 725 static int
 726 netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
 727                         packet_info *pinfo, proto_tree *parent_tree,
 728                         char *drep)
 729 {
 730         proto_item *item=NULL;
 731         proto_tree *tree=NULL;
 732         int old_offset=offset;
 733
 734         if(parent_tree){
 735                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 736                         "GROUP_MEMBERSHIP:");
 737                 tree = proto_item_add_subtree(item, ett_GROUP_MEMBERSHIP);
 738         }
 739
 740         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 741                 hf_netlogon_user_rid, NULL);
 742
 743         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 744                 hf_netlogon_attrs, NULL);
 745
 746         return offset;
 747 }
 748
 749 static int
 750 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset,
 751                         packet_info *pinfo, proto_tree *tree,
 752                         char *drep)
 753 {
 754         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 755                 netlogon_dissect_GROUP_MEMBERSHIP);
 756
 757         return offset;
 758 }
 759
 760 static int
 761 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1(tvbuff_t *tvb, int offset,
 762                         packet_info *pinfo, proto_tree *parent_tree,
 763                         char *drep)
 764 {
 765         proto_item *item=NULL;
 766         proto_tree *tree=NULL;
 767         int old_offset=offset;
 768         int i;
 769
 770         if(parent_tree){
 771                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 772                         "NETLOGON_VALIDATION_SAM_INFO1:");
 773                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO1);
 774         }
 775
 776         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 777                 hf_netlogon_logon_time);
 778
 779         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 780                 hf_netlogon_logoff_time);
 781
 782         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 783                 hf_netlogon_kickoff_time);
 784
 785         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 786                 hf_netlogon_pwd_last_set_time);
 787
 788         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 789                 hf_netlogon_pwd_can_change_time);
 790
 791         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 792                 hf_netlogon_pwd_must_change_time);
 793
 794         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 795                 hf_netlogon_acct_name, 0);
 796
 797         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 798                 hf_netlogon_full_name, 0);
 799
 800         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 801                 hf_netlogon_logon_script, 0);
 802
 803         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 804                 hf_netlogon_profile_path, 0);
 805
 806         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 807                 hf_netlogon_home_dir, 0);
 808
 809         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 810                 hf_netlogon_dir_drive, 0);
 811
 812         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 813                 hf_netlogon_logon_count, NULL);
 814
 815         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 816                 hf_netlogon_bad_pw_count, NULL);
 817
 818         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 819                 hf_netlogon_user_rid, NULL);
 820
 821         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 822                 hf_netlogon_group_rid, NULL);
 823
 824         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 825                 hf_netlogon_num_rids, NULL);
 826
 827         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 828                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_PTR,
 829                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 830
 831         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 832                 hf_netlogon_user_flags, NULL);
 833
 834         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 835                 pinfo, tree, drep);
 836
 837         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 838                 hf_netlogon_logon_srv, 0);
 839
 840         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 841                 hf_netlogon_logon_dom, 0);
 842
 843         offset = dissect_ndr_nt_PSID(tvb, offset,
 844                 pinfo, tree, drep);
 845
 846         for(i=0;i<10;i++){
 847                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 848                         hf_netlogon_unknown_long, NULL);
 849         }
 850
 851         proto_item_set_len(item, offset-old_offset);
 852         return offset;
 853 }
 854
 855 static int
 856 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset,
 857                         packet_info *pinfo, proto_tree *parent_tree,
 858                         char *drep)
 859 {
 860         proto_item *item=NULL;
 861         proto_tree *tree=NULL;
 862         int old_offset=offset;
 863         int i;
 864
 865         if(parent_tree){
 866                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 867                         "NETLOGON_VALIDATION_SAM_INFO2:");
 868                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO2);
 869         }
 870
 871         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 872                 hf_netlogon_logon_time);
 873
 874         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 875                 hf_netlogon_logoff_time);
 876
 877         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 878                 hf_netlogon_kickoff_time);
 879
 880         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 881                 hf_netlogon_pwd_last_set_time);
 882
 883         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 884                 hf_netlogon_pwd_can_change_time);
 885
 886         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 887                 hf_netlogon_pwd_must_change_time);
 888
 889         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 890                 hf_netlogon_acct_name, 0);
 891
 892         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 893                 hf_netlogon_full_name, 0);
 894
 895         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 896                 hf_netlogon_logon_script, 0);
 897
 898         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 899                 hf_netlogon_profile_path, 0);
 900
 901         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 902                 hf_netlogon_home_dir, 0);
 903
 904         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 905                 hf_netlogon_dir_drive, 0);
 906
 907         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 908                 hf_netlogon_logon_count, NULL);
 909
 910         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 911                 hf_netlogon_bad_pw_count, NULL);
 912
 913         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 914                 hf_netlogon_user_rid, NULL);
 915
 916         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 917                 hf_netlogon_group_rid, NULL);
 918
 919         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 920                 hf_netlogon_num_rids, NULL);
 921
 922         /* XXX i am not sure about this pointer being UNIQUE, though I am
 923            pretty convinced that it is NOT PTR as the idl file suggests.
 924         */
 925         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 926                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
 927                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 928
 929         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 930                 hf_netlogon_user_flags, NULL);
 931
 932         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 933                 pinfo, tree, drep);
 934
 935         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 936                 hf_netlogon_logon_srv, 0);
 937
 938         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 939                 hf_netlogon_logon_dom, 0);
 940
 941         offset = dissect_ndr_nt_PSID(tvb, offset,
 942                 pinfo, tree, drep);
 943
 944         for(i=0;i<10;i++){
 945                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 946                         hf_netlogon_unknown_long, NULL);
 947         }
 948
 949         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 950                 hf_netlogon_num_other_groups, NULL);
 951
 952         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 953                 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_PTR,
 954                 "SID_AND_ATTRIBUTES_ARRAY:", -1, 0);
 955
 956         proto_item_set_len(item, offset-old_offset);
 957         return offset;
 958 }
 959
 960 static int
 961 netlogon_dissect_TYPE_16(tvbuff_t *tvb, int offset,
 962                         packet_info *pinfo, proto_tree *parent_tree,
 963                         char *drep)
 964 {
 965         proto_item *item=NULL;
 966         proto_tree *tree=NULL;
 967         int old_offset=offset;
 968
 969         if(parent_tree){
 970                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 971                         "TYPE_16:");
 972                 tree = proto_item_add_subtree(item, ett_TYPE_16);
 973         }
 974
 975         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 976                 hf_netlogon_unknown_time);
 977
 978         proto_item_set_len(item, offset-old_offset);
 979         return offset;
 980 }
 981
 982
 983 static int
 984 netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 985                         packet_info *pinfo, proto_tree *parent_tree,
 986                         char *drep)
 987 {
 988         proto_item *item=NULL;
 989         proto_tree *tree=NULL;
 990         int old_offset=offset;
 991
 992         if(parent_tree){
 993                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 994                         "NETLOGON_SAM_DOMAIN_INFO:");
 995                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_DOMAIN_INFO);
 996         }
 997
 998         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 999                 hf_netlogon_unknown_string, 0);
1000
1001         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1002                 hf_netlogon_unknown_string, 0);
1003
1004         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1005                 hf_netlogon_unknown_time);
1006
1007         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1008                 hf_netlogon_unknown_short, NULL);
1009
1010         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1011                 hf_netlogon_unknown_short, NULL);
1012
1013         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1014                 hf_netlogon_unknown_time);
1015
1016         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1017                 hf_netlogon_unknown_time);
1018
1019         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1020                 hf_netlogon_unknown_time);
1021
1022         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1023                 hf_netlogon_unknown_time);
1024
1025         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1026                 hf_netlogon_unknown_string, 0);
1027
1028         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1029                 hf_netlogon_unknown_string, 0);
1030
1031         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1032                 hf_netlogon_unknown_string, 0);
1033
1034         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1035                 hf_netlogon_unknown_string, 0);
1036
1037         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1038                 hf_netlogon_unknown_string, 0);
1039
1040         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1041                 hf_netlogon_unknown_long, NULL);
1042
1043         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1044                 hf_netlogon_unknown_long, NULL);
1045
1046         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1047                 hf_netlogon_unknown_long, NULL);
1048
1049         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1050                 hf_netlogon_unknown_long, NULL);
1051
1052         proto_item_set_len(item, offset-old_offset);
1053         return offset;
1054 }
1055
1056
1057 static int
1058 netlogon_dissect_NETLOGON_SAM_GROUP_INFO(tvbuff_t *tvb, int offset,
1059                         packet_info *pinfo, proto_tree *parent_tree,
1060                         char *drep)
1061 {
1062         proto_item *item=NULL;
1063         proto_tree *tree=NULL;
1064         int old_offset=offset;
1065
1066         if(parent_tree){
1067                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1068                         "NETLOGON_SAM_GROUP_INFO:");
1069                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_INFO);
1070         }
1071
1072         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1073                 hf_netlogon_group_name, 0);
1074
1075         offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset,
1076                 pinfo, tree, drep);
1077
1078         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1079                 hf_netlogon_group_desc, 0);
1080
1081         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1082                 pinfo, tree, drep);
1083
1084         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1085                 hf_netlogon_unknown_string, 0);
1086
1087         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1088                 hf_netlogon_unknown_string, 0);
1089
1090         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1091                 hf_netlogon_unknown_string, 0);
1092
1093         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1094                 hf_netlogon_unknown_string, 0);
1095
1096         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1097                 hf_netlogon_unknown_long, NULL);
1098
1099         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1100                 hf_netlogon_unknown_long, NULL);
1101
1102         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1103                 hf_netlogon_unknown_long, NULL);
1104
1105         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1106                 hf_netlogon_unknown_long, NULL);
1107
1108         proto_item_set_len(item, offset-old_offset);
1109         return offset;
1110 }
1111
1112
1113 static int
1114 netlogon_dissect_TYPE_23(tvbuff_t *tvb, int offset,
1115                         packet_info *pinfo, proto_tree *parent_tree,
1116                         char *drep)
1117 {
1118         proto_item *item=NULL;
1119         proto_tree *tree=NULL;
1120         int old_offset=offset;
1121
1122         if(parent_tree){
1123                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1124                         "TYPE_23:");
1125                 tree = proto_item_add_subtree(item, ett_TYPE_23);
1126         }
1127
1128         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1129                 hf_netlogon_unknown_string, 0);
1130
1131         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1132                 hf_netlogon_unknown_string, 0);
1133
1134         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1135                 hf_netlogon_unknown_string, 0);
1136
1137         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1138                 hf_netlogon_unknown_string, 0);
1139
1140         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1141                 hf_netlogon_unknown_string, 0);
1142
1143         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1144                 hf_netlogon_unknown_string, 0);
1145
1146         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1147                 hf_netlogon_unknown_long, NULL);
1148
1149         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1150                 hf_netlogon_unknown_long, NULL);
1151
1152         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1153                 hf_netlogon_unknown_long, NULL);
1154
1155         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1156                 hf_netlogon_unknown_long, NULL);
1157
1158         proto_item_set_len(item, offset-old_offset);
1159         return offset;
1160 }
1161
1162
1163 static int
1164 netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO(tvbuff_t *tvb, int offset,
1165                         packet_info *pinfo, proto_tree *parent_tree,
1166                         char *drep)
1167 {
1168         proto_item *item=NULL;
1169         proto_tree *tree=NULL;
1170         int old_offset=offset;
1171
1172         if(parent_tree){
1173                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1174                         "NETLOGON_SAM_ACCOUNT_INFO:");
1175                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ACCOUNT_INFO);
1176         }
1177
1178         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1179                 hf_netlogon_acct_name, 0);
1180
1181         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1182                 hf_netlogon_full_name, 0);
1183
1184         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1185                 hf_netlogon_user_rid, NULL);
1186
1187         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1188                 hf_netlogon_group_rid, NULL);
1189
1190         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1191                 hf_netlogon_home_dir, 0);
1192
1193         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1194                 hf_netlogon_dir_drive, 0);
1195
1196         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1197                 hf_netlogon_logon_script, 0);
1198
1199         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1200                 hf_netlogon_acct_desc, 0);
1201
1202         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1203                 hf_netlogon_workstations, 0);
1204
1205         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1206                 hf_netlogon_logon_time);
1207
1208         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1209                 hf_netlogon_logoff_time);
1210
1211         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
1212
1213         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1214                 hf_netlogon_bad_pw_count, NULL);
1215
1216         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1217                 hf_netlogon_logon_count, NULL);
1218
1219         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1220                 hf_netlogon_pwd_last_set_time);
1221
1222         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1223                 hf_netlogon_acct_expiry_time);
1224
1225         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
1226
1227         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
1228                 pinfo, tree, drep);
1229
1230         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
1231                 pinfo, tree, drep);
1232
1233         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1234                 hf_netlogon_nt_pwd_present, NULL);
1235
1236         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1237                 hf_netlogon_lm_pwd_present, NULL);
1238
1239         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1240                 hf_netlogon_pwd_expired, NULL);
1241
1242         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1243                 hf_netlogon_comment, 0);
1244
1245         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1246                 hf_netlogon_parameters, 0);
1247
1248         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1249                 hf_netlogon_country, NULL);
1250
1251         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1252                 hf_netlogon_codepage, NULL);
1253
1254         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1255                 hf_netlogon_num_pwd_pairs, NULL);
1256
1257         offset = lsa_dissect_LSA_SECRET(tvb, offset,
1258                 pinfo, tree, drep);
1259
1260         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1261                 pinfo, tree, drep);
1262
1263         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1264                 hf_netlogon_profile_path, 0);
1265
1266         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1267                 hf_netlogon_unknown_string, 0);
1268
1269         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1270                 hf_netlogon_unknown_string, 0);
1271
1272         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1273                 hf_netlogon_unknown_string, 0);
1274
1275         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1276                 hf_netlogon_unknown_long, NULL);
1277
1278         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1279                 hf_netlogon_unknown_long, NULL);
1280
1281         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1282                 hf_netlogon_unknown_long, NULL);
1283
1284         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1285                 hf_netlogon_unknown_long, NULL);
1286
1287         proto_item_set_len(item, offset-old_offset);
1288         return offset;
1289 }
1290
1291
1292 static int
1293 netlogon_dissect_rid(tvbuff_t *tvb, int offset,
1294                         packet_info *pinfo, proto_tree *tree,
1295                         char *drep)
1296 {
1297         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1298                                 hf_netlogon_user_rid, NULL);
1299
1300         return offset;
1301 }
1302
1303 static int
1304 netlogon_dissect_rids_array(tvbuff_t *tvb, int offset,
1305                         packet_info *pinfo, proto_tree *parent_tree,
1306                         char *drep)
1307 {
1308         proto_item *item=NULL;
1309         proto_tree *tree=NULL;
1310         int old_offset=offset;
1311
1312         if(parent_tree){
1313                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1314                         "RID array:");
1315                 tree = proto_item_add_subtree(item, ett_rid_array);
1316         }
1317
1318         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1319                         netlogon_dissect_rid);
1320
1321         proto_item_set_len(item, offset-old_offset);
1322         return offset;
1323 }
1324
1325 static int
1326 netlogon_dissect_attrib(tvbuff_t *tvb, int offset,
1327                         packet_info *pinfo, proto_tree *tree,
1328                         char *drep)
1329 {
1330         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1331                 hf_netlogon_attrs, NULL);
1332
1333         return offset;
1334 }
1335
1336 static int
1337 netlogon_dissect_attribs_array(tvbuff_t *tvb, int offset,
1338                         packet_info *pinfo, proto_tree *parent_tree,
1339                         char *drep)
1340 {
1341         proto_item *item=NULL;
1342         proto_tree *tree=NULL;
1343         int old_offset=offset;
1344
1345         if(parent_tree){
1346                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1347                         "Attrib array:");
1348                 tree = proto_item_add_subtree(item, ett_attrib_array);
1349         }
1350
1351         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1352                         netlogon_dissect_attrib);
1353
1354         proto_item_set_len(item, offset-old_offset);
1355         return offset;
1356 }
1357
1358 static int
1359 netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO(tvbuff_t *tvb, int offset,
1360                         packet_info *pinfo, proto_tree *parent_tree,
1361                         char *drep)
1362 {
1363         proto_item *item=NULL;
1364         proto_tree *tree=NULL;
1365         int old_offset=offset;
1366
1367         if(parent_tree){
1368                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1369                         "NETLOGON_SAM_GROUP_MEM_INFO:");
1370                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_MEM_INFO);
1371         }
1372
1373         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1374                 netlogon_dissect_rids_array, NDR_POINTER_PTR,
1375                 "RIDs:", -1, 0);
1376
1377         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1378                 netlogon_dissect_attribs_array, NDR_POINTER_PTR,
1379                 "Attribs:", -1, 0);
1380
1381         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1382                 hf_netlogon_num_rids, NULL);
1383
1384         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1385                 hf_netlogon_unknown_long, NULL);
1386
1387         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1388                 hf_netlogon_unknown_long, NULL);
1389
1390         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1391                 hf_netlogon_unknown_long, NULL);
1392
1393         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1394                 hf_netlogon_unknown_long, NULL);
1395
1396         proto_item_set_len(item, offset-old_offset);
1397         return offset;
1398 }
1399
1400
1401 static int
1402 netlogon_dissect_NETLOGON_SAM_ALIAS_INFO(tvbuff_t *tvb, int offset,
1403                         packet_info *pinfo, proto_tree *parent_tree,
1404                         char *drep)
1405 {
1406         proto_item *item=NULL;
1407         proto_tree *tree=NULL;
1408         int old_offset=offset;
1409
1410         if(parent_tree){
1411                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1412                         "NETLOGON_SAM_ALIAS_INFO:");
1413                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_INFO);
1414         }
1415
1416
1417         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1418                 hf_netlogon_alias_name, 0);
1419
1420         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1421                 hf_netlogon_alias_rid, NULL);
1422
1423         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1424                 pinfo, tree, drep);
1425
1426         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1427                 hf_netlogon_acct_desc, 0);
1428
1429         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1430                 hf_netlogon_unknown_string, 0);
1431
1432         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1433                 hf_netlogon_unknown_string, 0);
1434
1435         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1436                 hf_netlogon_unknown_string, 0);
1437
1438         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1439                 hf_netlogon_unknown_long, NULL);
1440
1441         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1442                 hf_netlogon_unknown_long, NULL);
1443
1444         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1445                 hf_netlogon_unknown_long, NULL);
1446
1447         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1448                 hf_netlogon_unknown_long, NULL);
1449
1450         proto_item_set_len(item, offset-old_offset);
1451         return offset;
1452 }
1453
1454
1455 static int
1456 netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO(tvbuff_t *tvb, int offset,
1457                         packet_info *pinfo, proto_tree *parent_tree,
1458                         char *drep)
1459 {
1460         proto_item *item=NULL;
1461         proto_tree *tree=NULL;
1462         int old_offset=offset;
1463
1464         if(parent_tree){
1465                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1466                         "NETLOGON_SAM_ALIAS_MEM_INFO:");
1467                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_MEM_INFO);
1468         }
1469
1470         offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, drep);
1471
1472         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1473                 hf_netlogon_unknown_long, NULL);
1474
1475         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1476                 hf_netlogon_unknown_long, NULL);
1477
1478         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1479                 hf_netlogon_unknown_long, NULL);
1480
1481         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1482                 hf_netlogon_unknown_long, NULL);
1483
1484         proto_item_set_len(item, offset-old_offset);
1485         return offset;
1486 }
1487
1488 static int
1489 netlogon_dissect_TYPE_30(tvbuff_t *tvb, int offset,
1490                         packet_info *pinfo, proto_tree *parent_tree,
1491                         char *drep)
1492 {
1493         proto_item *item=NULL;
1494         proto_tree *tree=NULL;
1495         int old_offset=offset;
1496
1497         if(parent_tree){
1498                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1499                         "TYPE_30:");
1500                 tree = proto_item_add_subtree(item, ett_TYPE_30);
1501         }
1502
1503         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1504                 hf_netlogon_unknown_long, NULL);
1505
1506         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1507                 hf_netlogon_unknown_long, NULL);
1508
1509         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1510                 hf_netlogon_unknown_long, NULL);
1511
1512         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1513                 hf_netlogon_unknown_long, NULL);
1514
1515         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1516                 hf_netlogon_unknown_long, NULL);
1517
1518         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1519                 hf_netlogon_unknown_time);
1520
1521         proto_item_set_len(item, offset-old_offset);
1522         return offset;
1523 }
1524
1525 static int
1526 netlogon_dissect_element_422(tvbuff_t *tvb, int offset,
1527                         packet_info *pinfo, proto_tree *tree,
1528                         char *drep)
1529 {
1530         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1531                 hf_netlogon_unknown_long, NULL);
1532
1533         return offset;
1534 }
1535
1536 static int
1537 netlogon_dissect_element_422_array(tvbuff_t *tvb, int offset,
1538                         packet_info *pinfo, proto_tree *tree,
1539                         char *drep)
1540 {
1541         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1542                 netlogon_dissect_element_422);
1543
1544         return offset;
1545 }
1546
1547
1548 static int
1549 netlogon_dissect_TYPE_29(tvbuff_t *tvb, int offset,
1550                         packet_info *pinfo, proto_tree *parent_tree,
1551                         char *drep)
1552 {
1553         proto_item *item=NULL;
1554         proto_tree *tree=NULL;
1555         int old_offset=offset;
1556
1557         if(parent_tree){
1558                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1559                         "TYPE_29:");
1560                 tree = proto_item_add_subtree(item, ett_TYPE_29);
1561         }
1562
1563         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1564                 hf_netlogon_unknown_long, NULL);
1565
1566         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1567                 hf_netlogon_unknown_time);
1568
1569         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1570                 hf_netlogon_unknown_char, NULL);
1571
1572         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1573                 hf_netlogon_unknown_long, NULL);
1574
1575         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1576                 netlogon_dissect_element_422_array, NDR_POINTER_PTR,
1577                 "unknown", -1, 0);
1578
1579         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1580                 hf_netlogon_unknown_string, 0);
1581
1582         offset = dissect_ndr_nt_PSID(tvb, offset,
1583                 pinfo, tree, drep);
1584
1585         offset = netlogon_dissect_TYPE_30(tvb, offset,
1586                 pinfo, tree, drep);
1587
1588         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1589                 hf_netlogon_unknown_time);
1590
1591         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1592                 hf_netlogon_unknown_time);
1593
1594         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1595                 pinfo, tree, drep);
1596
1597         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1598                 hf_netlogon_unknown_string, 0);
1599
1600         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1601                 hf_netlogon_unknown_string, 0);
1602
1603         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1604                 hf_netlogon_unknown_string, 0);
1605
1606         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1607                 hf_netlogon_unknown_string, 0);
1608
1609         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1610                 hf_netlogon_unknown_long, NULL);
1611
1612         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1613                 hf_netlogon_unknown_long, NULL);
1614
1615         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1616                 hf_netlogon_unknown_long, NULL);
1617
1618         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1619                 hf_netlogon_unknown_long, NULL);
1620
1621         proto_item_set_len(item, offset-old_offset);
1622         return offset;
1623 }
1624
1625
1626 static int
1627 netlogon_dissect_TYPE_31(tvbuff_t *tvb, int offset,
1628                         packet_info *pinfo, proto_tree *parent_tree,
1629                         char *drep)
1630 {
1631         proto_item *item=NULL;
1632         proto_tree *tree=NULL;
1633         int old_offset=offset;
1634
1635         if(parent_tree){
1636                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1637                         "TYPE_31:");
1638                 tree = proto_item_add_subtree(item, ett_TYPE_31);
1639         }
1640
1641         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1642                 hf_netlogon_unknown_string, 0);
1643
1644         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1645                 hf_netlogon_unknown_string, 0);
1646
1647         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1648                 hf_netlogon_unknown_long, NULL);
1649
1650         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1651                 hf_netlogon_unknown_string, 0);
1652
1653         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1654                 hf_netlogon_unknown_string, 0);
1655
1656         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1657                 hf_netlogon_unknown_string, 0);
1658
1659         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1660                 hf_netlogon_unknown_string, 0);
1661
1662         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1663                 hf_netlogon_unknown_string, 0);
1664
1665         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1666                 hf_netlogon_unknown_long, NULL);
1667
1668         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1669                 hf_netlogon_unknown_long, NULL);
1670
1671         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1672                 hf_netlogon_unknown_long, NULL);
1673
1674         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1675                 hf_netlogon_unknown_long, NULL);
1676
1677         proto_item_set_len(item, offset-old_offset);
1678         return offset;
1679 }
1680
1681
1682 static int
1683 netlogon_dissect_TYPE_32(tvbuff_t *tvb, int offset,
1684                         packet_info *pinfo, proto_tree *parent_tree,
1685                         char *drep)
1686 {
1687         proto_item *item=NULL;
1688         proto_tree *tree=NULL;
1689         int old_offset=offset;
1690
1691         if(parent_tree){
1692                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1693                         "TYPE_32:");
1694                 tree = proto_item_add_subtree(item, ett_TYPE_32);
1695         }
1696
1697         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1698                 hf_netlogon_unknown_string, 0);
1699
1700         proto_item_set_len(item, offset-old_offset);
1701         return offset;
1702 }
1703
1704
1705 static int
1706 netlogon_dissect_attrs(tvbuff_t *tvb, int offset,
1707                         packet_info *pinfo, proto_tree *tree,
1708                         char *drep)
1709 {
1710         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1711                 hf_netlogon_attrs, NULL);
1712
1713         return offset;
1714 }
1715
1716 static int
1717 netlogon_dissect_attrs_array(tvbuff_t *tvb, int offset,
1718                         packet_info *pinfo, proto_tree *tree,
1719                         char *drep)
1720 {
1721         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1722                 netlogon_dissect_attrs);
1723
1724         return offset;
1725 }
1726
1727
1728 static int
1729 netlogon_dissect_TYPE_33(tvbuff_t *tvb, int offset,
1730                         packet_info *pinfo, proto_tree *parent_tree,
1731                         char *drep)
1732 {
1733         proto_item *item=NULL;
1734         proto_tree *tree=NULL;
1735         int old_offset=offset;
1736
1737         if(parent_tree){
1738                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1739                         "TYPE_33:");
1740                 tree = proto_item_add_subtree(item, ett_TYPE_33);
1741         }
1742
1743
1744         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1745                 hf_netlogon_count, NULL);
1746
1747         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1748                 hf_netlogon_unknown_long, NULL);
1749
1750         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1751                 netlogon_dissect_attrs_array, NDR_POINTER_PTR,
1752                 "ATTRS_ARRAY:", -1, 0);
1753
1754         offset = netlogon_dissect_TYPE_30(tvb, offset,
1755                 pinfo, tree, drep);
1756
1757         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1758                 hf_netlogon_unknown_long, NULL);
1759
1760         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1761                 hf_netlogon_unknown_long, NULL);
1762
1763         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1764                 hf_netlogon_unknown_string, 0);
1765
1766         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1767                 hf_netlogon_unknown_string, 0);
1768
1769         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1770                 hf_netlogon_unknown_string, 0);
1771
1772         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1773                 hf_netlogon_unknown_string, 0);
1774
1775         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1776                 hf_netlogon_unknown_string, 0);
1777
1778         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1779                 hf_netlogon_unknown_long, NULL);
1780
1781         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1782                 hf_netlogon_unknown_long, NULL);
1783
1784         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1785                 hf_netlogon_unknown_long, NULL);
1786
1787         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1788                 hf_netlogon_unknown_long, NULL);
1789
1790         proto_item_set_len(item, offset-old_offset);
1791         return offset;
1792 }
1793
1794
1795 static int
1796 netlogon_dissect_TYPE_34(tvbuff_t *tvb, int offset,
1797                         packet_info *pinfo, proto_tree *parent_tree,
1798                         char *drep)
1799 {
1800         proto_item *item=NULL;
1801         proto_tree *tree=NULL;
1802         int old_offset=offset;
1803
1804         if(parent_tree){
1805                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1806                         "TYPE_34:");
1807                 tree = proto_item_add_subtree(item, ett_TYPE_34);
1808         }
1809
1810         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1811                 hf_netlogon_unknown_string, 0);
1812
1813         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1814                 hf_netlogon_unknown_time);
1815
1816         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1817                 hf_netlogon_unknown_string, 0);
1818
1819         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1820                 hf_netlogon_unknown_time);
1821
1822         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1823                 hf_netlogon_unknown_long, NULL);
1824
1825         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1826                 hf_netlogon_unknown_string, 0);
1827
1828         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1829                 hf_netlogon_unknown_string, 0);
1830
1831         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1832                 hf_netlogon_unknown_string, 0);
1833
1834         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1835                 hf_netlogon_unknown_string, 0);
1836
1837         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1838                 hf_netlogon_unknown_string, 0);
1839
1840         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1841                 hf_netlogon_unknown_long, NULL);
1842
1843         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1844                 hf_netlogon_unknown_long, NULL);
1845
1846         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1847                 hf_netlogon_unknown_long, NULL);
1848
1849         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1850                 hf_netlogon_unknown_long, NULL);
1851
1852         proto_item_set_len(item, offset-old_offset);
1853         return offset;
1854 }
1855
1856 static int
1857 netlogon_dissect_TYPE_35(tvbuff_t *tvb, int offset,
1858                         packet_info *pinfo, proto_tree *parent_tree,
1859                         char *drep)
1860 {
1861         proto_item *item=NULL;
1862         proto_tree *tree=NULL;
1863         int old_offset=offset;
1864
1865         if(parent_tree){
1866                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1867                         "TYPE_35:");
1868                 tree = proto_item_add_subtree(item, ett_TYPE_35);
1869         }
1870
1871         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1872                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1873                 "unknown", hf_netlogon_unknown_string, -1);
1874
1875         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1876                 hf_netlogon_unknown_string, 0);
1877
1878         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1879                 hf_netlogon_unknown_string, 0);
1880
1881         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1882                 hf_netlogon_unknown_string, 0);
1883
1884         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1885                 hf_netlogon_unknown_string, 0);
1886
1887         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1888                 hf_netlogon_unknown_long, NULL);
1889
1890         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1891                 hf_netlogon_unknown_long, NULL);
1892
1893         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1894                 hf_netlogon_unknown_long, NULL);
1895
1896         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1897                 hf_netlogon_unknown_long, NULL);
1898
1899         proto_item_set_len(item, offset-old_offset);
1900         return offset;
1901 }
1902
1903 static int
1904 netlogon_dissect_WCHAR_ptr(tvbuff_t *tvb, int offset,
1905                         packet_info *pinfo, proto_tree *tree,
1906                         char *drep)
1907 {
1908         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1909                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1910                 "unknown string", hf_netlogon_unknown_string, -1);
1911
1912         return offset;
1913 }
1914
1915 static int
1916 netlogon_dissect_TYPE_36(tvbuff_t *tvb, int offset,
1917                         packet_info *pinfo, proto_tree *parent_tree,
1918                         char *drep)
1919 {
1920         proto_item *item=NULL;
1921         proto_tree *tree=NULL;
1922         int old_offset=offset;
1923         int i;
1924
1925         if(parent_tree){
1926                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1927                         "TYPE_36:");
1928                 tree = proto_item_add_subtree(item, ett_TYPE_36);
1929         }
1930
1931         for(i=0;i<16;i++){
1932                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1933                         hf_netlogon_unknown_char, NULL);
1934         }
1935
1936         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1937                 hf_netlogon_unknown_long, NULL);
1938
1939         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1940                 hf_netlogon_unknown_long, NULL);
1941
1942         proto_item_set_len(item, offset-old_offset);
1943         return offset;
1944 }
1945
1946 static int
1947 netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
1948                         packet_info *pinfo, proto_tree *parent_tree,
1949                         char *drep)
1950 {
1951         proto_item *item=NULL;
1952         proto_tree *tree=NULL;
1953         int old_offset=offset;
1954
1955         if(parent_tree){
1956                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1957                         "NETLOGON_INFO_1:");
1958                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_1);
1959         }
1960
1961         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1962                 hf_netlogon_flags, NULL);
1963
1964         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1965                 hf_netlogon_status, NULL);
1966
1967         proto_item_set_len(item, offset-old_offset);
1968         return offset;
1969 }
1970
1971 static int
1972 netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
1973                         packet_info *pinfo, proto_tree *parent_tree,
1974                         char *drep)
1975 {
1976         proto_item *item=NULL;
1977         proto_tree *tree=NULL;
1978         int old_offset=offset;
1979
1980         if(parent_tree){
1981                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1982                         "NETLOGON_INFO_2:");
1983                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_2);
1984         }
1985
1986         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1987                 hf_netlogon_unknown_long, NULL);
1988
1989         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1990                 hf_netlogon_unknown_long, NULL);
1991
1992         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1993                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1994                 "unknown", hf_netlogon_unknown_string, -1);
1995
1996         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1997                 hf_netlogon_unknown_long, NULL);
1998
1999         proto_item_set_len(item, offset-old_offset);
2000         return offset;
2001 }
2002
2003 static int
2004 netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
2005                         packet_info *pinfo, proto_tree *parent_tree,
2006                         char *drep)
2007 {
2008         proto_item *item=NULL;
2009         proto_tree *tree=NULL;
2010         int old_offset=offset;
2011
2012         if(parent_tree){
2013                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2014                         "NETLOGON_INFO_3:");
2015                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_3);
2016         }
2017
2018         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2019                 hf_netlogon_flags, NULL);
2020
2021         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2022                 hf_netlogon_logon_attempts, NULL);
2023
2024         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2025                 hf_netlogon_unknown_long, NULL);
2026
2027         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2028                 hf_netlogon_unknown_long, NULL);
2029
2030         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2031                 hf_netlogon_unknown_long, NULL);
2032
2033         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2034                 hf_netlogon_unknown_long, NULL);
2035
2036         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2037                 hf_netlogon_unknown_long, NULL);
2038
2039         proto_item_set_len(item, offset-old_offset);
2040         return offset;
2041 }
2042
2043 static int
2044 netlogon_dissect_NETLOGON_INFO_4(tvbuff_t *tvb, int offset,
2045                         packet_info *pinfo, proto_tree *parent_tree,
2046                         char *drep)
2047 {
2048         proto_item *item=NULL;
2049         proto_tree *tree=NULL;
2050         int old_offset=offset;
2051
2052         if(parent_tree){
2053                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2054                         "NETLOGON_INFO_4:");
2055                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_4);
2056         }
2057
2058         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2059                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2060                 "unknown", hf_netlogon_trusted_dc_name, -1);
2061
2062         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2063                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2064                 "unknown", hf_netlogon_trusted_domain_name, -1);
2065
2066         proto_item_set_len(item, offset-old_offset);
2067         return offset;
2068 }
2069
2070 static int
2071 netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
2072                         packet_info *pinfo, proto_tree *tree,
2073                         char *drep)
2074 {
2075                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2076                         hf_netlogon_unknown_char, NULL);
2077
2078         return offset;
2079 }
2080
2081 static int
2082 netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
2083                         packet_info *pinfo, proto_tree *tree,
2084                         char *drep)
2085 {
2086         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2087                 netlogon_dissect_UNICODE_MULTI_byte);
2088
2089         return offset;
2090 }
2091
2092 static int
2093 netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
2094                         packet_info *pinfo, proto_tree *tree,
2095                         char *drep)
2096 {
2097                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2098                         hf_netlogon_unknown_char, NULL);
2099
2100         return offset;
2101 }
2102
2103 static int
2104 netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
2105                         packet_info *pinfo, proto_tree *tree,
2106                         char *drep)
2107 {
2108         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2109                 netlogon_dissect_BYTE_byte);
2110
2111         return offset;
2112 }
2113
2114 static int
2115 netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
2116                         packet_info *pinfo, proto_tree *parent_tree,
2117                         char *drep)
2118 {
2119         proto_item *item=NULL;
2120         proto_tree *tree=NULL;
2121         int old_offset=offset;
2122
2123         if(parent_tree){
2124                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2125                         "UNICODE_MULTI:");
2126                 tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
2127         }
2128
2129         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2130                 hf_netlogon_len, NULL);
2131
2132         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2133                 netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_PTR,
2134                 "unknown", hf_netlogon_unknown_string, 0);
2135
2136         proto_item_set_len(item, offset-old_offset);
2137         return offset;
2138 }
2139
2140 int
2141 dissect_nt_GUID(tvbuff_t *tvb, int offset,
2142                         packet_info *pinfo, proto_tree *parent_tree,
2143                         char *drep)
2144 {
2145         proto_item *item=NULL;
2146         proto_tree *tree=NULL;
2147         int old_offset=offset;
2148         int i;
2149
2150         if(parent_tree){
2151                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2152                         "GUID:");
2153                 tree = proto_item_add_subtree(item, ett_GUID);
2154         }
2155
2156         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2157                 hf_netlogon_unknown_long, NULL);
2158
2159         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2160                 hf_netlogon_unknown_short, NULL);
2161
2162         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2163                 hf_netlogon_unknown_short, NULL);
2164
2165         for(i=0;i<8;i++){
2166                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2167                         hf_netlogon_unknown_char, NULL);
2168         }
2169
2170         proto_item_set_len(item, offset-old_offset);
2171         return offset;
2172 }
2173
2174 static int
2175 netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
2176                         packet_info *pinfo, proto_tree *parent_tree,
2177                         char *drep)
2178 {
2179         proto_item *item=NULL;
2180         proto_tree *tree=NULL;
2181         int old_offset=offset;
2182
2183         if(parent_tree){
2184                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2185                         "DOMAIN_CONTROLLER_INFO:");
2186                 tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
2187         }
2188
2189         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2190                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2191                 "unknown", hf_netlogon_dc_name, -1);
2192
2193         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2194                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2195                 "unknown", hf_netlogon_dc_address, -1);
2196
2197         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2198                 hf_netlogon_dc_address_type, NULL);
2199
2200         offset = dissect_nt_GUID(tvb, offset,
2201                 pinfo, tree, drep);
2202
2203         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2204                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2205                 "unknown", hf_netlogon_logon_dom, -1);
2206
2207         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2208                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2209                 "unknown", hf_netlogon_dns_forest_name, -1);
2210
2211         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2212                 hf_netlogon_flags, NULL);
2213
2214         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2215                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2216                 "unknown", hf_netlogon_dc_site_name, -1);
2217
2218         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2219                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2220                 "unknown", hf_netlogon_client_site_name, -1);
2221
2222         proto_item_set_len(item, offset-old_offset);
2223         return offset;
2224 }
2225
2226 static int
2227 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr(tvbuff_t *tvb, int offset,
2228                         packet_info *pinfo, proto_tree *tree,
2229                         char *drep)
2230 {
2231         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2232                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_PTR,
2233                 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2234
2235         return offset;
2236 }
2237
2238 static int
2239 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr(tvbuff_t *tvb, int offset,
2240                         packet_info *pinfo, proto_tree *tree,
2241                         char *drep)
2242 {
2243         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2244                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_PTR,
2245                 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2246
2247         return offset;
2248 }
2249
2250 static int
2251 netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
2252                         packet_info *pinfo, proto_tree *tree,
2253                         char *drep)
2254 {
2255         guint32 len;
2256         dcerpc_info *di;
2257
2258         di=pinfo->private_data;
2259         if(di->conformant_run){
2260                 /*just a run to handle conformant arrays, nothing to dissect.*/
2261                 return offset;
2262         }
2263
2264         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2265                 hf_netlogon_blob_size, &len);
2266
2267         proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
2268                 FALSE);
2269         offset += len;
2270
2271         return offset;
2272 }
2273
2274 static int
2275 netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
2276                         packet_info *pinfo, proto_tree *parent_tree,
2277                         char *drep)
2278 {
2279         proto_item *item=NULL;
2280         proto_tree *tree=NULL;
2281         int old_offset=offset;
2282
2283         if(parent_tree){
2284                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2285                         "BLOB:");
2286                 tree = proto_item_add_subtree(item, ett_BLOB);
2287         }
2288
2289         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2290                 hf_netlogon_blob_size, NULL);
2291
2292         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2293                 netlogon_dissect_BLOB_array, NDR_POINTER_PTR,
2294                 "BLOB:", -1, 0);
2295
2296         return offset;
2297 }
2298
2299 static int
2300 netlogon_dissect_BLOB_ptr(tvbuff_t *tvb, int offset,
2301                         packet_info *pinfo, proto_tree *tree,
2302                         char *drep)
2303 {
2304         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2305                 netlogon_dissect_BLOB, NDR_POINTER_PTR,
2306                 "BLOB pointer:", -1, 0);
2307
2308         return offset;
2309 }
2310
2311 static int
2312 netlogon_dissect_TYPE_46(tvbuff_t *tvb, int offset,
2313                         packet_info *pinfo, proto_tree *parent_tree,
2314                         char *drep)
2315 {
2316         proto_item *item=NULL;
2317         proto_tree *tree=NULL;
2318         int old_offset=offset;
2319
2320         if(parent_tree){
2321                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2322                         "TYPE_46:");
2323                 tree = proto_item_add_subtree(item, ett_TYPE_46);
2324         }
2325
2326         offset = netlogon_dissect_BLOB(tvb, offset,
2327                 pinfo, tree, drep);
2328
2329         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2330                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2331                 "unknown", hf_netlogon_workstation_fqdn, -1);
2332
2333         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2334                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2335                 "unknown", hf_netlogon_workstation_site_name, -1);
2336
2337         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2338                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2339                 "unknown", hf_netlogon_workstation_os, -1);
2340
2341         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2342                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2343                 "unknown", hf_netlogon_unknown_string, -1);
2344
2345         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2346                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2347                 "unknown", hf_netlogon_unknown_string, -1);
2348
2349         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2350                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2351                 "unknown", hf_netlogon_unknown_string, -1);
2352
2353         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2354                 hf_netlogon_unknown_string, 0);
2355
2356         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2357                 hf_netlogon_unknown_string, 0);
2358
2359         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2360                 hf_netlogon_unknown_string, 0);
2361
2362         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2363                 hf_netlogon_unknown_string, 0);
2364
2365         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2366                 hf_netlogon_unknown_long, NULL);
2367
2368         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2369                 hf_netlogon_unknown_long, NULL);
2370
2371         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2372                 hf_netlogon_unknown_long, NULL);
2373
2374         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2375                 hf_netlogon_unknown_long, NULL);
2376
2377         proto_item_set_len(item, offset-old_offset);
2378         return offset;
2379 }
2380
2381 static int
2382 netlogon_dissect_TYPE_48(tvbuff_t *tvb, int offset,
2383                         packet_info *pinfo, proto_tree *parent_tree,
2384                         char *drep)
2385 {
2386         proto_item *item=NULL;
2387         proto_tree *tree=NULL;
2388         int old_offset=offset;
2389
2390         if(parent_tree){
2391                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2392                         "TYPE_48:");
2393                 tree = proto_item_add_subtree(item, ett_TYPE_48);
2394         }
2395
2396         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2397                 hf_netlogon_unknown_string, 0);
2398
2399         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2400                 hf_netlogon_unknown_string, 0);
2401
2402         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2403                 hf_netlogon_unknown_string, 0);
2404
2405         offset = dissect_nt_GUID(tvb, offset,
2406                 pinfo, tree, drep);
2407
2408         offset = dissect_ndr_nt_PSID(tvb, offset,
2409                 pinfo, tree, drep);
2410
2411         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2412                 hf_netlogon_unknown_string, 0);
2413
2414         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2415                 hf_netlogon_unknown_string, 0);
2416
2417         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2418                 hf_netlogon_unknown_string, 0);
2419
2420         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2421                 hf_netlogon_unknown_string, 0);
2422
2423         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2424                 hf_netlogon_unknown_long, NULL);
2425
2426         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2427                 hf_netlogon_unknown_long, NULL);
2428
2429         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2430                 hf_netlogon_unknown_long, NULL);
2431
2432         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2433                 hf_netlogon_unknown_long, NULL);
2434
2435         offset = netlogon_dissect_BLOB(tvb, offset,
2436                 pinfo, tree, drep);
2437
2438         offset = netlogon_dissect_BLOB(tvb, offset,
2439                 pinfo, tree, drep);
2440
2441         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2442                 hf_netlogon_unknown_string, 0);
2443
2444         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2445                 hf_netlogon_unknown_string, 0);
2446
2447         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2448                 hf_netlogon_unknown_string, 0);
2449
2450         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2451                 hf_netlogon_unknown_string, 0);
2452
2453         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2454                 hf_netlogon_unknown_long, NULL);
2455
2456         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2457                 hf_netlogon_unknown_long, NULL);
2458
2459         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2460                 hf_netlogon_unknown_long, NULL);
2461
2462         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2463                 hf_netlogon_unknown_long, NULL);
2464
2465         proto_item_set_len(item, offset-old_offset);
2466         return offset;
2467 }
2468
2469 static int
2470 netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
2471                         packet_info *pinfo, proto_tree *parent_tree,
2472                         char *drep)
2473 {
2474         proto_item *item=NULL;
2475         proto_tree *tree=NULL;
2476         int old_offset=offset;
2477         int i;
2478
2479         if(parent_tree){
2480                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2481                         "UNICODE_STRING_512:");
2482                 tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
2483         }
2484
2485         for(i=0;i<512;i++){
2486                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2487                         hf_netlogon_unknown_short, NULL);
2488         }
2489
2490         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2491                 hf_netlogon_unknown_long, NULL);
2492
2493         proto_item_set_len(item, offset-old_offset);
2494         return offset;
2495 }
2496
2497 static int
2498 netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset,
2499                         packet_info *pinfo, proto_tree *tree,
2500                         char *drep)
2501 {
2502                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2503                         hf_netlogon_secure_channel_type, NULL);
2504
2505         return offset;
2506 }
2507
2508 static int
2509 netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
2510                         packet_info *pinfo, proto_tree *tree,
2511                         char *drep)
2512 {
2513                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2514                         hf_netlogon_unknown_char, NULL);
2515
2516         return offset;
2517 }
2518
2519 static int
2520 netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
2521                         packet_info *pinfo, proto_tree *tree,
2522                         char *drep)
2523 {
2524         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2525                 netlogon_dissect_element_844_byte);
2526
2527         return offset;
2528 }
2529
2530 static int
2531 netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
2532                         packet_info *pinfo, proto_tree *parent_tree,
2533                         char *drep)
2534 {
2535         proto_item *item=NULL;
2536         proto_tree *tree=NULL;
2537         int old_offset=offset;
2538
2539         if(parent_tree){
2540                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2541                         "TYPE_50:");
2542                 tree = proto_item_add_subtree(item, ett_TYPE_50);
2543         }
2544
2545         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2546                 hf_netlogon_unknown_long, NULL);
2547
2548         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2549                 netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
2550                 "unknown", hf_netlogon_unknown_string, 0);
2551
2552         proto_item_set_len(item, offset-old_offset);
2553         return offset;
2554 }
2555
2556 static int
2557 netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
2558                         packet_info *pinfo, proto_tree *tree,
2559                         char *drep)
2560 {
2561         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2562                 netlogon_dissect_TYPE_50, NDR_POINTER_PTR,
2563                 "TYPE_50 pointer: unknown_TYPE_50", -1, 0);
2564
2565         return offset;
2566 }
2567
2568 static int
2569 netlogon_dissect_TYPE_50_ptr_ptr(tvbuff_t *tvb, int offset,
2570                         packet_info *pinfo, proto_tree *tree,
2571                         char *drep)
2572 {
2573         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2574                 netlogon_dissect_TYPE_50_ptr, NDR_POINTER_PTR,
2575                 "TYPE_50* pointer: unknown_TYPE_50", -1, 0);
2576
2577         return offset;
2578 }
2579
2580 static int
2581 netlogon_dissect_element_861_byte(tvbuff_t *tvb, int offset,
2582                         packet_info *pinfo, proto_tree *tree,
2583                         char *drep)
2584 {
2585                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2586                         hf_netlogon_unknown_char, NULL);
2587
2588         return offset;
2589 }
2590
2591 static int
2592 netlogon_dissect_element_861_array(tvbuff_t *tvb, int offset,
2593                         packet_info *pinfo, proto_tree *tree,
2594                         char *drep)
2595 {
2596         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2597                 netlogon_dissect_element_861_byte);
2598
2599         return offset;
2600 }
2601
2602 static int
2603 netlogon_dissect_TYPE_51(tvbuff_t *tvb, int offset,
2604                         packet_info *pinfo, proto_tree *parent_tree,
2605                         char *drep)
2606 {
2607         proto_item *item=NULL;
2608         proto_tree *tree=NULL;
2609         int old_offset=offset;
2610
2611         if(parent_tree){
2612                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2613                         "TYPE_51:");
2614                 tree = proto_item_add_subtree(item, ett_TYPE_51);
2615         }
2616
2617         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2618                 hf_netlogon_unknown_long, NULL);
2619
2620         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2621                 netlogon_dissect_element_861_array, NDR_POINTER_UNIQUE,
2622                 "unknown", hf_netlogon_unknown_string, 0);
2623
2624         proto_item_set_len(item, offset-old_offset);
2625         return offset;
2626 }
2627
2628 static int
2629 netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
2630                         packet_info *pinfo, proto_tree *tree,
2631                         char *drep)
2632 {
2633                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2634                         hf_netlogon_unknown_char, NULL);
2635
2636         return offset;
2637 }
2638
2639 static int
2640 netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
2641                         packet_info *pinfo, proto_tree *tree,
2642                         char *drep)
2643 {
2644         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2645                 netlogon_dissect_element_865_byte);
2646
2647         return offset;
2648 }
2649
2650 static int
2651 netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
2652                         packet_info *pinfo, proto_tree *tree,
2653                         char *drep)
2654 {
2655                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2656                         hf_netlogon_unknown_char, NULL);
2657
2658         return offset;
2659 }
2660
2661 static int
2662 netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
2663                         packet_info *pinfo, proto_tree *tree,
2664                         char *drep)
2665 {
2666         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2667                 netlogon_dissect_element_866_byte);
2668
2669         return offset;
2670 }
2671
2672 static int
2673 netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
2674                         packet_info *pinfo, proto_tree *parent_tree,
2675                         char *drep)
2676 {
2677         proto_item *item=NULL;
2678         proto_tree *tree=NULL;
2679         int old_offset=offset;
2680
2681         if(parent_tree){
2682                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2683                         "TYPE_52:");
2684                 tree = proto_item_add_subtree(item, ett_TYPE_52);
2685         }
2686
2687         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2688                 hf_netlogon_unknown_long, NULL);
2689
2690         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2691                 netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
2692                 "unknown", hf_netlogon_unknown_string, 0);
2693
2694         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2695                 netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
2696                 "unknown", hf_netlogon_unknown_string, 0);
2697
2698         proto_item_set_len(item, offset-old_offset);
2699         return offset;
2700 }
2701
2702 static int
2703 netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
2704                         packet_info *pinfo, proto_tree *tree,
2705                         char *drep)
2706 {
2707         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2708                 netlogon_dissect_TYPE_52, NDR_POINTER_PTR,
2709                 "TYPE_52 pointer: unknown_TYPE_52", -1, 0);
2710         return offset;
2711 }
2712
2713 static int
2714 netlogon_dissect_TYPE_52_ptr_ptr(tvbuff_t *tvb, int offset,
2715                         packet_info *pinfo, proto_tree *tree,
2716                         char *drep)
2717 {
2718         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2719                 netlogon_dissect_TYPE_52_ptr, NDR_POINTER_PTR,
2720                 "TYPE_52* pointer: unknown_TYPE_52", -1, 0);
2721         return offset;
2722 }
2723
2724 static int
2725 netlogon_dissect_NETLOGON_LEVEL(tvbuff_t *tvb, int offset,
2726                         packet_info *pinfo, proto_tree *parent_tree,
2727                         char *drep)
2728 {
2729         proto_item *item=NULL;
2730         proto_tree *tree=NULL;
2731         int old_offset=offset;
2732         guint16 level;
2733
2734         if(parent_tree){
2735                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2736                         "NETLOGON_LEVEL:");
2737                 tree = proto_item_add_subtree(item, ett_NETLOGON_LEVEL);
2738         }
2739
2740         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2741                 hf_netlogon_level, &level);
2742
2743         ALIGN_TO_4_BYTES;
2744         switch(level){
2745         case 1:
2746                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2747                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2748                         "INTERACTIVE_INFO pointer:", -1, 0);
2749                 break;
2750         case 2:
2751                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2752                         netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2753                         "NETWORK_INFO pointer:", -1, 0);
2754                 break;
2755         case 3:
2756                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2757                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2758                         "INTERACTIVE_INFO pointer:", -1, 0);
2759                 break;
2760         case 5:
2761                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2762                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2763                         "INTERACTIVE_INFO pointer:", -1, 0);
2764                 break;
2765         case 6:
2766                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2767                         netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2768                         "NETWORK_INFO pointer:", -1, 0);
2769                 break;
2770         case 7:
2771                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2772                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2773                         "INTERACTIVE_INFO pointer:", -1, 0);
2774                 break;
2775         }
2776
2777         proto_item_set_len(item, offset-old_offset);
2778         return offset;
2779 }
2780
2781 static int
2782 netlogon_dissect_NETLOGON_VALIDATION(tvbuff_t *tvb, int offset,
2783                         packet_info *pinfo, proto_tree *parent_tree,
2784                         char *drep)
2785 {
2786         proto_item *item=NULL;
2787         proto_tree *tree=NULL;
2788         int old_offset=offset;
2789         guint16 level;
2790
2791         if(parent_tree){
2792                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2793                         "NETLOGON_VALIDATION:");
2794                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION);
2795         }
2796
2797         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2798                 hf_netlogon_level, &level);
2799
2800         /* XXX i am not sure about these pointers being UNIQUE, though I am
2801            pretty convinced that they are NOT PTR as the idl file suggests.
2802         */
2803         ALIGN_TO_4_BYTES;
2804         switch(level){
2805         case 2:
2806                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2807                         netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1, NDR_POINTER_UNIQUE,
2808                         "NETLOGON_VALIDATION_SAM_INFO1 pointer:", -1, 0);
2809                 break;
2810         case 3:
2811                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2812                         netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE,
2813                         "NETLOGON_VALIDATION_SAM_INFO2 pointer:", -1, 0);
2814                 break;
2815         case 4:
2816                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2817                         netlogon_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
2818                         "STRING pointer:", -1, 0);
2819                 break;
2820         case 5:
2821                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2822                         netlogon_dissect_BLOB_ptr, NDR_POINTER_UNIQUE,
2823                         "BLOB pointer:", -1, 0);
2824                 break;
2825         }
2826
2827         proto_item_set_len(item, offset-old_offset);
2828         return offset;
2829 }
2830
2831
2832 static int
2833 netlogon_dissect_TYPE_19(tvbuff_t *tvb, int offset,
2834                         packet_info *pinfo, proto_tree *parent_tree,
2835                         char *drep)
2836 {
2837         proto_item *item=NULL;
2838         proto_tree *tree=NULL;
2839         int old_offset=offset;
2840         guint16 level;
2841
2842         if(parent_tree){
2843                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2844                         "TYPE_19:");
2845                 tree = proto_item_add_subtree(item, ett_TYPE_19);
2846         }
2847
2848         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2849                 hf_netlogon_level, &level);
2850
2851         ALIGN_TO_4_BYTES;
2852         switch(level){
2853         case 1:
2854                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2855                         hf_netlogon_unknown_long, NULL);
2856                 break;
2857         case 2:
2858                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2859                         hf_netlogon_unknown_long, NULL);
2860                 break;
2861         case 3:
2862                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2863                         hf_netlogon_unknown_long, NULL);
2864                 break;
2865         case 4:
2866                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2867                         hf_netlogon_unknown_long, NULL);
2868                 break;
2869         case 5:
2870                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2871                         hf_netlogon_unknown_long, NULL);
2872                 break;
2873         case 6:
2874                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2875                         hf_netlogon_unknown_long, NULL);
2876                 break;
2877         case 7:
2878                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2879                         hf_netlogon_unknown_long, NULL);
2880                 break;
2881         case 8:
2882                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2883                         hf_netlogon_unknown_long, NULL);
2884                 break;
2885         case 9:
2886                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2887                         hf_netlogon_unknown_long, NULL);
2888                 break;
2889         case 10:
2890                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2891                         hf_netlogon_unknown_long, NULL);
2892                 break;
2893         case 11:
2894                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2895                         hf_netlogon_unknown_long, NULL);
2896                 break;
2897         case 12:
2898                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2899                         hf_netlogon_unknown_long, NULL);
2900                 break;
2901         case 20:
2902                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2903                         hf_netlogon_unknown_long, NULL);
2904                 break;
2905         case 21:
2906                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2907                         hf_netlogon_unknown_long, NULL);
2908                 break;
2909         case 13:
2910                 offset = dissect_ndr_nt_PSID(tvb, offset,
2911                         pinfo, tree, drep);
2912                 break;
2913         case 14:
2914                 offset = dissect_ndr_nt_PSID(tvb, offset,
2915                         pinfo, tree, drep);
2916                 break;
2917         case 15:
2918                 offset = dissect_ndr_nt_PSID(tvb, offset,
2919                         pinfo, tree, drep);
2920                 break;
2921         case 16:
2922                 offset = dissect_ndr_nt_PSID(tvb, offset,
2923                         pinfo, tree, drep);
2924                 break;
2925         case 17:
2926                 offset = dissect_ndr_nt_PSID(tvb, offset,
2927                         pinfo, tree, drep);
2928                 break;
2929         case 18:
2930                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2931                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2932                         "unknown", hf_netlogon_unknown_string, -1);
2933                 break;
2934         case 19:
2935                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2936                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2937                         "unknown", hf_netlogon_unknown_string, -1);
2938                 break;
2939         }
2940
2941         proto_item_set_len(item, offset-old_offset);
2942         return offset;
2943 }
2944
2945
2946 static int
2947 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO(tvbuff_t *tvb, int offset,
2948                         packet_info *pinfo, proto_tree *parent_tree,
2949                         char *drep)
2950 {
2951         proto_item *item=NULL;
2952         proto_tree *tree=NULL;
2953         int old_offset=offset;
2954         guint32 level;
2955
2956         if(parent_tree){
2957                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2958                         "NETLOGON_CONTROL_QUERY_INFO:");
2959                 tree = proto_item_add_subtree(item, ett_NETLOGON_CONTROL_QUERY_INFO);
2960         }
2961
2962         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2963                 hf_netlogon_level_long, &level);
2964
2965         ALIGN_TO_4_BYTES;
2966         switch(level){
2967         case 5:
2968                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2969                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2970                         "unknown", hf_netlogon_unknown_string, -1);
2971                 break;
2972         case 6:
2973                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2974                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2975                         "unknown", hf_netlogon_unknown_string, -1);
2976                 break;
2977         case 0xfffe:
2978                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2979                         hf_netlogon_unknown_long, NULL);
2980                 break;
2981         case 8:
2982                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2983                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2984                         "unknown", hf_netlogon_unknown_string, -1);
2985                 break;
2986         }
2987
2988         proto_item_set_len(item, offset-old_offset);
2989         return offset;
2990 }
2991
2992
2993 static int
2994 netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
2995                         packet_info *pinfo, proto_tree *parent_tree,
2996                         char *drep)
2997 {
2998         proto_item *item=NULL;
2999         proto_tree *tree=NULL;
3000         int old_offset=offset;
3001         guint32 level;
3002
3003         if(parent_tree){
3004                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3005                         "TYPE_44:");
3006                 tree = proto_item_add_subtree(item, ett_TYPE_44);
3007         }
3008
3009         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3010                 hf_netlogon_level_long, &level);
3011
3012         ALIGN_TO_4_BYTES;
3013         switch(level){
3014         case 1:
3015                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3016                         hf_netlogon_unknown_long, NULL);
3017                 break;
3018         }
3019
3020         proto_item_set_len(item, offset-old_offset);
3021         return offset;
3022 }
3023
3024 static int
3025 netlogon_dissect_TYPE_20(tvbuff_t *tvb, int offset,
3026                         packet_info *pinfo, proto_tree *parent_tree,
3027                         char *drep)
3028 {
3029         proto_item *item=NULL;
3030         proto_tree *tree=NULL;
3031         int old_offset=offset;
3032         guint16 level;
3033
3034         if(parent_tree){
3035                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3036                         "TYPE_20:");
3037                 tree = proto_item_add_subtree(item, ett_TYPE_20);
3038         }
3039
3040         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3041                 hf_netlogon_level, &level);
3042
3043         ALIGN_TO_4_BYTES;
3044         switch(level){
3045         case 1:
3046                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3047                         netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO, NDR_POINTER_PTR,
3048                         "NETLOGON_SAM_DOMAIN_INFO pointer:", -1, 0);
3049                 break;
3050         case 2:
3051                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3052                         netlogon_dissect_NETLOGON_SAM_GROUP_INFO, NDR_POINTER_PTR,
3053                         "NETLOGON_SAM_GROUP_INFO pointer:", -1, 0);
3054                 break;
3055         case 4:
3056                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3057                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3058                         "TYPE_23 pointer:", -1, 0);
3059                 break;
3060         case 5:
3061                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3062                         netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO, NDR_POINTER_PTR,
3063                         "NETLOGON_SAM_ACCOUNT_INFO pointer:", -1, 0);
3064                 break;
3065         case 7:
3066                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3067                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3068                         "TYPE_23 pointer:", -1, 0);
3069                 break;
3070         case 8:
3071                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3072                         netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO, NDR_POINTER_PTR,
3073                         "NETLOGON_SAM_GROUP_MEM_INFO pointer:", -1, 0);
3074                 break;
3075         case 9:
3076                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3077                         netlogon_dissect_NETLOGON_SAM_ALIAS_INFO, NDR_POINTER_PTR,
3078                         "NETLOGON_SAM_ALIAS_INFO pointer:", -1, 0);
3079                 break;
3080         case 11:
3081                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3082                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3083                         "TYPE_23 pointer:", -1, 0);
3084                 break;
3085         case 12:
3086                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3087                         netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO, NDR_POINTER_PTR,
3088                         "NETLOGON_SAM_ALIAS_MEM_INFO pointer:", -1, 0);
3089                 break;
3090         case 13:
3091                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3092                         netlogon_dissect_TYPE_29, NDR_POINTER_PTR,
3093                         "TYPE_29 pointer:", -1, 0);
3094                 break;
3095         case 14:
3096                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3097                         netlogon_dissect_TYPE_31, NDR_POINTER_PTR,
3098                         "TYPE_31 pointer:", -1, 0);
3099                 break;
3100         case 16:
3101                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3102                         netlogon_dissect_TYPE_33, NDR_POINTER_PTR,
3103                         "TYPE_33 pointer:", -1, 0);
3104                 break;
3105         case 18:
3106                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3107                         netlogon_dissect_TYPE_34, NDR_POINTER_PTR,
3108                         "TYPE_34 pointer:", -1, 0);
3109                 break;
3110         case 20:
3111                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3112                         netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3113                         "TYPE_35 pointer:", -1, 0);
3114                 break;
3115         case 21:
3116                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3117                         netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3118                         "TYPE_35 pointer:", -1, 0);
3119                 break;
3120         case 22:
3121                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3122                         netlogon_dissect_TYPE_16, NDR_POINTER_PTR,
3123                         "TYPE_16 pointer:", -1, 0);
3124                 break;
3125         }
3126
3127         proto_item_set_len(item, offset-old_offset);
3128         return offset;
3129 }
3130
3131 static int
3132 netlogon_dissect_SAM_DELTA(tvbuff_t *tvb, int offset,
3133                         packet_info *pinfo, proto_tree *parent_tree,
3134                         char *drep)
3135 {
3136         proto_item *item=NULL;
3137         proto_tree *tree=NULL;
3138         int old_offset=offset;
3139
3140         if(parent_tree){
3141                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3142                         "SAM_DELTA:");
3143                 tree = proto_item_add_subtree(item, ett_SAM_DELTA);
3144         }
3145
3146         offset = netlogon_dissect_TYPE_19(tvb, offset,
3147                 pinfo, tree, drep);
3148
3149         offset = netlogon_dissect_TYPE_20(tvb, offset,
3150                 pinfo, tree, drep);
3151
3152         proto_item_set_len(item, offset-old_offset);
3153         return offset;
3154 }
3155
3156 static int
3157 netlogon_dissect_SAM_DELTA_array(tvbuff_t *tvb, int offset,
3158                         packet_info *pinfo, proto_tree *tree,
3159                         char *drep)
3160 {
3161         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3162                 netlogon_dissect_SAM_DELTA);
3163
3164         return offset;
3165 }
3166
3167 static int
3168 netlogon_dissect_SAM_DELTA_ARRAY(tvbuff_t *tvb, int offset,
3169                         packet_info *pinfo, proto_tree *parent_tree,
3170                         char *drep)
3171 {
3172         proto_item *item=NULL;
3173         proto_tree *tree=NULL;
3174         int old_offset=offset;
3175
3176         if(parent_tree){
3177                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3178                         "SAM_DELTA_ARRAY:");
3179                 tree = proto_item_add_subtree(item, ett_SAM_DELTA_ARRAY);
3180         }
3181
3182         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3183                 hf_netlogon_num_deltas, NULL);
3184
3185         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3186                 netlogon_dissect_SAM_DELTA_array, NDR_POINTER_UNIQUE,
3187                 "unknown", -1, 0);
3188
3189         proto_item_set_len(item, offset-old_offset);
3190         return offset;
3191 }
3192
3193 static int
3194 netlogon_dissect_SAM_DELTA_ARRAY_ptr(tvbuff_t *tvb, int offset,
3195                         packet_info *pinfo, proto_tree *tree,
3196                         char *drep)
3197 {
3198         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3199                 netlogon_dissect_SAM_DELTA_ARRAY, NDR_POINTER_PTR,
3200                 "SAM_DELTA_ARRAY pointer: deltas", -1, 0);
3201
3202         return offset;
3203 }
3204
3205 static int
3206 netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset,
3207                         packet_info *pinfo, proto_tree *tree,
3208                         char *drep)
3209 {
3210         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3211                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3212                 "Handle", hf_netlogon_logonsrv_handle, 0);
3213
3214         return offset;
3215 }
3216
3217 static int
3218 netlogon_dissect_NETLOGON_INFO(tvbuff_t *tvb, int offset,
3219                         packet_info *pinfo, proto_tree *parent_tree,
3220                         char *drep)
3221 {
3222         proto_item *item=NULL;
3223         proto_tree *tree=NULL;
3224         int old_offset=offset;
3225         guint32 level;
3226
3227         if(parent_tree){
3228                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3229                         "NETLOGON_INFO:");
3230                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO);
3231         }
3232
3233         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3234                 hf_netlogon_level_long, &level);
3235
3236         ALIGN_TO_4_BYTES;
3237         switch(level){
3238         case 1:
3239                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3240                         netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_PTR,
3241                         "NETLOGON_INFO_1 pointer:", -1, 0);
3242                 break;
3243         case 2:
3244                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3245                         netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_PTR,
3246                         "NETLOGON_INFO_2 pointer:", -1, 0);
3247                 break;
3248         case 3:
3249                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3250                         netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_PTR,
3251                         "NETLOGON_INFO_3 pointer:", -1, 0);
3252                 break;
3253         case 4:
3254                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3255                         netlogon_dissect_NETLOGON_INFO_4, NDR_POINTER_PTR,
3256                         "NETLOGON_INFO_4 pointer:", -1, 0);
3257                 break;
3258         }
3259
3260         proto_item_set_len(item, offset-old_offset);
3261         return offset;
3262 }
3263
3264 static int
3265 netlogon_dissect_TYPE_45(tvbuff_t *tvb, int offset,
3266                         packet_info *pinfo, proto_tree *parent_tree,
3267                         char *drep)
3268 {
3269         proto_item *item=NULL;
3270         proto_tree *tree=NULL;
3271         int old_offset=offset;
3272         guint32 level;
3273
3274         if(parent_tree){
3275                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3276                         "TYPE_45:");
3277                 tree = proto_item_add_subtree(item, ett_TYPE_45);
3278         }
3279
3280         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3281                 hf_netlogon_level_long, &level);
3282
3283         ALIGN_TO_4_BYTES;
3284         switch(level){
3285         case 1:
3286                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3287                         netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3288                         "TYPE_46 pointer:", -1, 0);
3289                 break;
3290         case 2:
3291                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3292                         netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3293                         "TYPE_46 pointer:", -1, 0);
3294                 break;
3295         }
3296
3297         proto_item_set_len(item, offset-old_offset);
3298         return offset;
3299 }
3300
3301 static int
3302 netlogon_dissect_TYPE_47(tvbuff_t *tvb, int offset,
3303                         packet_info *pinfo, proto_tree *parent_tree,
3304                         char *drep)
3305 {
3306         proto_item *item=NULL;
3307         proto_tree *tree=NULL;
3308         int old_offset=offset;
3309         guint32 level;
3310
3311         if(parent_tree){
3312                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3313                         "TYPE_47:");
3314                 tree = proto_item_add_subtree(item, ett_TYPE_47);
3315         }
3316
3317         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3318                 hf_netlogon_level_long, &level);
3319
3320         ALIGN_TO_4_BYTES;
3321         switch(level){
3322         case 1:
3323                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3324                         netlogon_dissect_TYPE_48, NDR_POINTER_PTR,
3325                         "TYPE_48 pointer:", -1, 0);
3326                 break;
3327         case 2:
3328                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3329                         netlogon_dissect_UNICODE_MULTI, NDR_POINTER_PTR,
3330                         "UNICODE_MULTI pointer:", -1, 0);
3331                 break;
3332         }
3333
3334         proto_item_set_len(item, offset-old_offset);
3335         return offset;
3336 }
3337
3338
3339 static int
3340 netlogon_dissect_function_00_rqst(tvbuff_t *tvb, int offset,
3341         packet_info *pinfo, proto_tree *tree, char *drep)
3342 {
3343         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3344                 pinfo, tree, drep);
3345
3346         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3347                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3348                 "unknown string", hf_netlogon_unknown_string, -1);
3349
3350         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3351                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3352                 "unknown string", hf_netlogon_unknown_string, -1);
3353
3354         return offset;
3355 }
3356
3357
3358 static int
3359 netlogon_dissect_function_00_reply(tvbuff_t *tvb, int offset,
3360         packet_info *pinfo, proto_tree *tree, char *drep)
3361 {
3362         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3363                 netlogon_dissect_TYPE_1_ptr, NDR_POINTER_REF,
3364                 "TYPE_1* pointer: unknown_TYPE_1", -1, 0);
3365
3366         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3367                                   hf_netlogon_rc, NULL);
3368
3369         return offset;
3370 }
3371
3372 static int
3373 netlogon_dissect_function_01_rqst(tvbuff_t *tvb, int offset,
3374         packet_info *pinfo, proto_tree *tree, char *drep)
3375 {
3376         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3377                 pinfo, tree, drep);
3378
3379         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3380                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3381                 "unknown string", hf_netlogon_unknown_string, -1);
3382
3383         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3384                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3385                 "unknown string", hf_netlogon_unknown_string, -1);
3386
3387         return offset;
3388 }
3389
3390
3391 static int
3392 netlogon_dissect_function_01_reply(tvbuff_t *tvb, int offset,
3393         packet_info *pinfo, proto_tree *tree, char *drep)
3394 {
3395         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3396                 netlogon_dissect_TYPE_2, NDR_POINTER_REF,
3397                 "TYPE_2 pointer: unknown_TYPE_2", -1, 0);
3398
3399         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3400                                   hf_netlogon_rc, NULL);
3401
3402         return offset;
3403 }
3404
3405 static int
3406 netlogon_dissect_netlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
3407         packet_info *pinfo, proto_tree *tree, char *drep)
3408 {
3409         if (check_col(pinfo->cinfo, COL_INFO))
3410                 col_set_str(pinfo->cinfo, COL_INFO, "SamLogon request");
3411
3412         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3413                 pinfo, tree, drep);
3414
3415         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3416                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3417                 "Computer Name", hf_netlogon_computer_name, 0);
3418
3419         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3420                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3421                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3422
3423         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3424                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3425                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3426
3427         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3428                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3429                 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3430
3431         return offset;
3432 }
3433
3434
3435 static int
3436 netlogon_dissect_netlogonsamlogon_reply(tvbuff_t *tvb, int offset,
3437         packet_info *pinfo, proto_tree *tree, char *drep)
3438 {
3439         if (check_col(pinfo->cinfo, COL_INFO))
3440                 col_set_str(pinfo->cinfo, COL_INFO, "SamLogon response");
3441
3442         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3443                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3444                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3445
3446         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3447                 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_REF,
3448                 "NETLOGON_VALIDATION pointer: ctr", -1, 0);
3449
3450         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3451                 netlogon_dissect_pointer_char, NDR_POINTER_REF,
3452                 "BOOLEAN pointer: Authoritative", hf_netlogon_authoritative, 0);
3453
3454         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3455                                   hf_netlogon_rc, NULL);
3456
3457         return offset;
3458 }
3459
3460 static int
3461 netlogon_dissect_netlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
3462         packet_info *pinfo, proto_tree *tree, char *drep)
3463 {
3464         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3465                 pinfo, tree, drep);
3466
3467         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3468                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3469                 "unknown string", hf_netlogon_unknown_string, 0);
3470
3471         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3472                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3473                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3474
3475         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3476                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3477                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3478
3479         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3480                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3481                 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3482
3483         return offset;
3484 }
3485
3486
3487 static int
3488 netlogon_dissect_netlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
3489         packet_info *pinfo, proto_tree *tree, char *drep)
3490 {
3491
3492         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3493                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3494                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3495
3496         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3497                                   hf_netlogon_rc, NULL);
3498
3499         return offset;
3500 }
3501
3502 static int
3503 netlogon_dissect_netserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
3504         packet_info *pinfo, proto_tree *tree, char *drep)
3505 {
3506         if (check_col(pinfo->cinfo, COL_INFO))
3507                 col_set_str(pinfo->cinfo, COL_INFO,
3508                             "RequestChallenge request");
3509
3510         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3511                 pinfo, tree, drep);
3512
3513         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3514                 NDR_POINTER_REF, hf_netlogon_client_name, 0);
3515
3516         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3517                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3518                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3519
3520         return offset;
3521 }
3522
3523
3524 static int
3525 netlogon_dissect_netserverreqchallenge_reply(tvbuff_t *tvb, int offset,
3526         packet_info *pinfo, proto_tree *tree, char *drep)
3527 {
3528         if (check_col(pinfo->cinfo, COL_INFO))
3529                 col_set_str(pinfo->cinfo, COL_INFO,
3530                             "RequestChallenge response");
3531
3532         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3533                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3534                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3535
3536         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3537                                   hf_netlogon_rc, NULL);
3538
3539         return offset;
3540 }
3541
3542 static int
3543 netlogon_dissect_netserverauthenticate_rqst(tvbuff_t *tvb, int offset,
3544         packet_info *pinfo, proto_tree *tree, char *drep)
3545 {
3546         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3547                 pinfo, tree, drep);
3548
3549         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3550                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3551
3552         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3553                 pinfo, tree, drep);
3554
3555         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3556                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3557
3558         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3559                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3560                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3561
3562         return offset;
3563 }
3564
3565
3566 static int
3567 netlogon_dissect_netserverauthenticate_reply(tvbuff_t *tvb, int offset,
3568         packet_info *pinfo, proto_tree *tree, char *drep)
3569 {
3570         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3571                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3572                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3573
3574         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3575                                   hf_netlogon_rc, NULL);
3576
3577         return offset;
3578 }
3579
3580 static int
3581 netlogon_dissect_netserverpasswordset_rqst(tvbuff_t *tvb, int offset,
3582         packet_info *pinfo, proto_tree *tree, char *drep)
3583 {
3584         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3585                 pinfo, tree, drep);
3586
3587         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3588                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3589
3590         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3591                 pinfo, tree, drep);
3592
3593         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3594                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3595
3596         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3597                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3598                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3599
3600         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3601                 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF,
3602                 "ENCRYPTED_LM_OWF_PASSWORD pointer: hashed_pwd", -1, 0);
3603
3604         return offset;
3605 }
3606
3607
3608 static int
3609 netlogon_dissect_netserverpasswordset_reply(tvbuff_t *tvb, int offset,
3610         packet_info *pinfo, proto_tree *tree, char *drep)
3611 {
3612         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3613                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3614                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3615
3616         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3617                                   hf_netlogon_rc, NULL);
3618
3619         return offset;
3620 }
3621
3622 static int
3623 netlogon_dissect_netsamdeltas_rqst(tvbuff_t *tvb, int offset,
3624         packet_info *pinfo, proto_tree *tree, char *drep)
3625 {
3626         /* XXX idl file has LOGONSRV_HANDLE here, ms capture has string srv_name */
3627         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3628                 NDR_POINTER_REF, hf_netlogon_logon_srv, 0);
3629
3630         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3631                 NDR_POINTER_REF, hf_netlogon_cli_name, 0);
3632
3633         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3634                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3635                 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3636
3637         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3638                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3639                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3640
3641         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3642                 hf_netlogon_database_id, NULL);
3643
3644         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3645                 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3646                 "TYPE_16 pointer: dom_mod_count", -1, 0);
3647
3648         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3649                 hf_netlogon_max_size, NULL);
3650         return offset;
3651 }
3652
3653
3654 static int
3655 netlogon_dissect_netsamdeltas_reply(tvbuff_t *tvb, int offset,
3656         packet_info *pinfo, proto_tree *tree, char *drep)
3657 {
3658         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3659                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3660                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3661
3662         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3663                 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3664                 "TYPE_16 pointer: dom_mod_count", -1, 0);
3665
3666         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3667                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3668                 "SAM_DELTA_ARRAY_ptr pointer: deltas", -1, 0);
3669
3670         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3671                                   hf_netlogon_rc, NULL);
3672
3673         return offset;
3674 }
3675
3676 static int
3677 netlogon_dissect_function_08_rqst(tvbuff_t *tvb, int offset,
3678         packet_info *pinfo, proto_tree *tree, char *drep)
3679 {
3680         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3681                 NDR_POINTER_REF, hf_netlogon_logon_srv, 0);
3682
3683         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3684                 NDR_POINTER_REF, hf_netlogon_cli_name, 0);
3685
3686         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3687                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3688                 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3689
3690         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3691                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3692                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3693
3694         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3695                 hf_netlogon_unknown_long, NULL);
3696
3697         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3698                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3699                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3700
3701         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3702                 hf_netlogon_unknown_long, NULL);
3703         return offset;
3704 }
3705
3706
3707 static int
3708 netlogon_dissect_function_08_reply(tvbuff_t *tvb, int offset,
3709         packet_info *pinfo, proto_tree *tree, char *drep)
3710 {
3711         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3712                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3713                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3714
3715         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3716                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3717                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3718
3719         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3720                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3721                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
3722
3723         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3724                                   hf_netlogon_rc, NULL);
3725
3726         return offset;
3727 }
3728
3729 static int
3730 netlogon_dissect_function_09_rqst(tvbuff_t *tvb, int offset,
3731         packet_info *pinfo, proto_tree *tree, char *drep)
3732 {
3733         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3734                 pinfo, tree, drep);
3735
3736         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3737                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3738
3739         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3740                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3741                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3742
3743         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3744                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3745                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3746
3747         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3748                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3749                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3750
3751         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3752                 hf_netlogon_unknown_long, NULL);
3753
3754         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3755                 hf_netlogon_unknown_long, NULL);
3756
3757         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3758                 hf_netlogon_unknown_long, NULL);
3759         return offset;
3760 }
3761
3762
3763 static int
3764 netlogon_dissect_function_09_reply(tvbuff_t *tvb, int offset,
3765         packet_info *pinfo, proto_tree *tree, char *drep)
3766 {
3767         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3768                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3769                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3770
3771         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3772                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3773                 "BYTE_array pointer: unknown_BYTE", -1, 0);
3774
3775         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3776                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3777                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3778
3779         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3780                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3781                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3782
3783         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3784                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3785                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3786
3787         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3788                                   hf_netlogon_rc, NULL);
3789
3790         return offset;
3791 }
3792
3793 static int
3794 netlogon_dissect_function_0a_rqst(tvbuff_t *tvb, int offset,
3795         packet_info *pinfo, proto_tree *tree, char *drep)
3796 {
3797         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3798                 pinfo, tree, drep);
3799
3800         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3801                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3802
3803         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3804                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3805                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3806
3807         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3808                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3809                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3810
3811         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3812                 hf_netlogon_unknown_long, NULL);
3813
3814         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3815                 hf_netlogon_unknown_long, NULL);
3816
3817         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3818                 hf_netlogon_unknown_long, NULL);
3819
3820         return offset;
3821 }
3822
3823
3824 static int
3825 netlogon_dissect_function_0a_reply(tvbuff_t *tvb, int offset,
3826         packet_info *pinfo, proto_tree *tree, char *drep)
3827 {
3828         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3829                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3830                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3831
3832         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3833                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3834                 "BYTE_array pointer: unknown_BYTE", -1, 0);
3835
3836         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3837                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3838                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3839
3840         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3841                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3842                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3843
3844         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3845                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3846                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3847
3848         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3849                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3850                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3851
3852         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3853                                   hf_netlogon_rc, NULL);
3854
3855         return offset;
3856 }
3857
3858 static int
3859 netlogon_dissect_function_0b_rqst(tvbuff_t *tvb, int offset,
3860         packet_info *pinfo, proto_tree *tree, char *drep)
3861 {
3862
3863         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3864                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3865
3866         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3867                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3868                 "unknown string", hf_netlogon_unknown_string, 0);
3869
3870         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3871                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3872                 "WCHAR* pointer: unknown string", -1, 0);
3873         return offset;
3874 }
3875
3876
3877 static int
3878 netlogon_dissect_function_0b_reply(tvbuff_t *tvb, int offset,
3879         packet_info *pinfo, proto_tree *tree, char *drep)
3880 {
3881         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3882                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3883                 "WCHAR* pointer: unknown string", -1, 0);
3884
3885         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3886                                   hf_netlogon_rc, NULL);
3887
3888         return offset;
3889 }
3890
3891 static int
3892 netlogon_dissect_netlogoncontrol_rqst(tvbuff_t *tvb, int offset,
3893         packet_info *pinfo, proto_tree *tree, char *drep)
3894 {
3895         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3896                 pinfo, tree, drep);
3897
3898         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3899                 hf_netlogon_code, NULL);
3900
3901         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3902                 hf_netlogon_level, NULL);
3903
3904         return offset;
3905 }
3906
3907
3908 static int
3909 netlogon_dissect_netlogoncontrol_reply(tvbuff_t *tvb, int offset,
3910         packet_info *pinfo, proto_tree *tree, char *drep)
3911 {
3912         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3913                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3914                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3915
3916         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3917                                   hf_netlogon_rc, NULL);
3918
3919         return offset;
3920 }
3921
3922 static int
3923 netlogon_dissect_function_0d_rqst(tvbuff_t *tvb, int offset,
3924         packet_info *pinfo, proto_tree *tree, char *drep)
3925 {
3926         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3927                 pinfo, tree, drep);
3928
3929         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3930                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3931                 "unknown string", hf_netlogon_unknown_string, 0);
3932
3933         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3934                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3935                 "WCHAR* pointer: unknown string", -1, 0);
3936         return offset;
3937 }
3938
3939
3940 static int
3941 netlogon_dissect_function_0d_reply(tvbuff_t *tvb, int offset,
3942         packet_info *pinfo, proto_tree *tree, char *drep)
3943 {
3944         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3945                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3946                 "WCHAR* pointer: unknown string", -1, 0);
3947
3948         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3949                                   hf_netlogon_rc, NULL);
3950
3951         return offset;
3952 }
3953
3954 static int
3955 netlogon_dissect_netlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
3956         packet_info *pinfo, proto_tree *tree, char *drep)
3957 {
3958         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3959                 pinfo, tree, drep);
3960
3961         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3962                 hf_netlogon_code, NULL);
3963
3964         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3965                 hf_netlogon_level, NULL);
3966
3967         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3968                 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
3969                 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
3970
3971         return offset;
3972 }
3973
3974
3975 static int
3976 netlogon_dissect_netlogoncontrol2_reply(tvbuff_t *tvb, int offset,
3977         packet_info *pinfo, proto_tree *tree, char *drep)
3978 {
3979         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3980                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3981                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3982
3983         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3984                                   hf_netlogon_rc, NULL);
3985
3986         return offset;
3987 }
3988
3989 static int
3990 netlogon_dissect_netserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
3991         packet_info *pinfo, proto_tree *tree, char *drep)
3992 {
3993         if (check_col(pinfo->cinfo, COL_INFO))
3994                 col_set_str(pinfo->cinfo, COL_INFO, "Auth2 request");
3995
3996         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3997                 pinfo, tree, drep);
3998
3999         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4000                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
4001
4002         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4003                 pinfo, tree, drep);
4004
4005         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4006                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
4007
4008         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4009                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4010                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
4011
4012         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4013                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4014                 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4015         return offset;
4016 }
4017
4018
4019 static int
4020 netlogon_dissect_netserverauthenticate2_reply(tvbuff_t *tvb, int offset,
4021         packet_info *pinfo, proto_tree *tree, char *drep)
4022 {
4023         if (check_col(pinfo->cinfo, COL_INFO))
4024                 col_set_str(pinfo->cinfo, COL_INFO, "Auth2 response");
4025
4026         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4027                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4028                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
4029
4030         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4031                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4032                 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4033
4034         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4035                                   hf_netlogon_rc, NULL);
4036
4037         return offset;
4038 }
4039
4040 static int
4041 netlogon_dissect_netdatabasesync2_rqst(tvbuff_t *tvb, int offset,
4042         packet_info *pinfo, proto_tree *tree, char *drep)
4043 {
4044         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4045                 pinfo, tree, drep);
4046
4047         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4048                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4049
4050         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4051                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4052                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4053
4054         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4055                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4056                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4057
4058         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4059                 hf_netlogon_unknown_long, NULL);
4060
4061         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4062                 hf_netlogon_unknown_short, NULL);
4063
4064         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4065                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4066                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4067
4068         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4069                 hf_netlogon_unknown_long, NULL);
4070
4071         return offset;
4072 }
4073
4074
4075 static int
4076 netlogon_dissect_netdatabasesync2_reply(tvbuff_t *tvb, int offset,
4077         packet_info *pinfo, proto_tree *tree, char *drep)
4078 {
4079         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4080                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4081                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4082
4083         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4084                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4085                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4086
4087         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4088                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4089                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4090
4091         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4092                                   hf_netlogon_rc, NULL);
4093
4094         return offset;
4095 }
4096
4097 static int
4098 netlogon_dissect_function_11_rqst(tvbuff_t *tvb, int offset,
4099         packet_info *pinfo, proto_tree *tree, char *drep)
4100 {
4101         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4102                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4103
4104         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4105                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4106
4107         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4108                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4109                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4110
4111         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4112                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4113                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4114
4115         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4116                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
4117                 "BYTE pointer: unknown_BYTE", -1, 0);
4118
4119         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4120                 hf_netlogon_unknown_long, NULL);
4121
4122         return offset;
4123 }
4124
4125
4126 static int
4127 netlogon_dissect_function_11_reply(tvbuff_t *tvb, int offset,
4128         packet_info *pinfo, proto_tree *tree, char *drep)
4129 {
4130         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4131                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4132                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4133
4134         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4135                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4136                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4137
4138         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4139                                   hf_netlogon_rc, NULL);
4140
4141         return offset;
4142 }
4143
4144 static int
4145 netlogon_dissect_function_12_rqst(tvbuff_t *tvb, int offset,
4146         packet_info *pinfo, proto_tree *tree, char *drep)
4147 {
4148         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4149                 pinfo, tree, drep);
4150
4151         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4152                 hf_netlogon_unknown_long, NULL);
4153
4154         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4155                 hf_netlogon_level, NULL);
4156
4157         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4158                 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
4159                 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
4160
4161         return offset;
4162 }
4163
4164
4165 static int
4166 netlogon_dissect_function_12_reply(tvbuff_t *tvb, int offset,
4167         packet_info *pinfo, proto_tree *tree, char *drep)
4168 {
4169         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4170                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
4171                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
4172
4173         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4174                                   hf_netlogon_rc, NULL);
4175
4176         return offset;
4177 }
4178
4179 static int
4180 netlogon_dissect_nettrusteddomainlist_rqst(tvbuff_t *tvb, int offset,
4181         packet_info *pinfo, proto_tree *tree, char *drep)
4182 {
4183         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4184                 pinfo, tree, drep);
4185
4186         return offset;
4187 }
4188
4189
4190 static int
4191 netlogon_dissect_nettrusteddomainlist_reply(tvbuff_t *tvb, int offset,
4192         packet_info *pinfo, proto_tree *tree, char *drep)
4193 {
4194         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4195                 netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF,
4196                 "UNICODE_MULTI pointer: trust_dom_name_list", -1, 0);
4197
4198         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4199                                   hf_netlogon_rc, NULL);
4200
4201         return offset;
4202 }
4203
4204 static int
4205 netlogon_dissect_dsrgetdcname2_rqst(tvbuff_t *tvb, int offset,
4206         packet_info *pinfo, proto_tree *tree, char *drep)
4207 {
4208         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4209                 pinfo, tree, drep);
4210
4211         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4212                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4213                 "Domain", hf_netlogon_logon_dom, 0);
4214
4215         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4216                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4217                 "GUID pointer: domain_guid", -1, 0);
4218
4219         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4220                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4221                 "GUID pointer: site_guid", -1, 0);
4222
4223         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4224                 hf_netlogon_flags, NULL);
4225
4226         return offset;
4227 }
4228
4229
4230 static int
4231 netlogon_dissect_dsrgetdcname2_reply(tvbuff_t *tvb, int offset,
4232         packet_info *pinfo, proto_tree *tree, char *drep)
4233 {
4234         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4235                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4236                 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4237
4238         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4239                                   hf_netlogon_rc, NULL);
4240
4241         return offset;
4242 }
4243
4244 static int
4245 netlogon_dissect_function_15_rqst(tvbuff_t *tvb, int offset,
4246         packet_info *pinfo, proto_tree *tree, char *drep)
4247 {
4248         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4249                 pinfo, tree, drep);
4250
4251         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4252                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4253                 "unknown string", hf_netlogon_unknown_string, 0);
4254
4255         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4256                 pinfo, tree, drep);
4257
4258         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4259                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4260                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4261
4262         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4263                 hf_netlogon_unknown_long, NULL);
4264
4265         return offset;
4266 }
4267
4268
4269 static int
4270 netlogon_dissect_function_15_reply(tvbuff_t *tvb, int offset,
4271         packet_info *pinfo, proto_tree *tree, char *drep)
4272 {
4273         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4274                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4275                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4276
4277         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4278                 netlogon_dissect_TYPE_44, NDR_POINTER_PTR,
4279                 "TYPE_44 pointer: unknown_TYPE_44", -1, 0);
4280
4281         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4282                                   hf_netlogon_rc, NULL);
4283
4284         return offset;
4285 }
4286
4287 static int
4288 netlogon_dissect_function_16_rqst(tvbuff_t *tvb, int offset,
4289         packet_info *pinfo, proto_tree *tree, char *drep)
4290 {
4291         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4292                 pinfo, tree, drep);
4293
4294         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4295                 hf_netlogon_unknown_long, NULL);
4296
4297         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4298                 hf_netlogon_unknown_long, NULL);
4299
4300         return offset;
4301 }
4302
4303
4304 static int
4305 netlogon_dissect_function_16_reply(tvbuff_t *tvb, int offset,
4306         packet_info *pinfo, proto_tree *tree, char *drep)
4307 {
4308         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4309                                   hf_netlogon_rc, NULL);
4310
4311         return offset;
4312 }
4313
4314 static int
4315 netlogon_dissect_function_17_rqst(tvbuff_t *tvb, int offset,
4316         packet_info *pinfo, proto_tree *tree, char *drep)
4317 {
4318         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4319                 pinfo, tree, drep);
4320
4321         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4322                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4323                 "unknown string", hf_netlogon_unknown_string, 0);
4324
4325         return offset;
4326 }
4327
4328
4329 static int
4330 netlogon_dissect_function_17_reply(tvbuff_t *tvb, int offset,
4331         packet_info *pinfo, proto_tree *tree, char *drep)
4332 {
4333         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4334                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4335                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4336
4337         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4338                                   hf_netlogon_rc, NULL);
4339
4340         return offset;
4341 }
4342
4343 static int
4344 netlogon_dissect_function_18_rqst(tvbuff_t *tvb, int offset,
4345         packet_info *pinfo, proto_tree *tree, char *drep)
4346 {
4347         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4348                 pinfo, tree, drep);
4349
4350         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4351                 hf_netlogon_unknown_long, NULL);
4352
4353         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4354                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4355                 "BYTE pointer: unknown_BYTE", -1, 0);
4356
4357         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4358                 hf_netlogon_unknown_long, NULL);
4359
4360         return offset;
4361 }
4362
4363 static int
4364 netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset,
4365         packet_info *pinfo, proto_tree *tree, char *drep)
4366 {
4367         int i;
4368
4369         for(i=0;i<16;i++){
4370                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4371                         hf_netlogon_unknown_char, NULL);
4372         }
4373
4374         return offset;
4375 }
4376
4377 static int
4378 netlogon_dissect_function_18_reply(tvbuff_t *tvb, int offset,
4379         packet_info *pinfo, proto_tree *tree, char *drep)
4380 {
4381         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4382                 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4383                 "BYTE pointer: unknown_BYTE", -1, 0);
4384
4385         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4386                                   hf_netlogon_rc, NULL);
4387
4388         return offset;
4389 }
4390
4391 static int
4392 netlogon_dissect_function_19_rqst(tvbuff_t *tvb, int offset,
4393         packet_info *pinfo, proto_tree *tree, char *drep)
4394 {
4395         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4396                 pinfo, tree, drep);
4397
4398         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4399                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4400                 "unknown string", hf_netlogon_unknown_string, 0);
4401
4402         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4403                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4404                 "BYTE pointer: unknown_BYTE", -1, 0);
4405
4406         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4407                 hf_netlogon_unknown_long, NULL);
4408
4409         return offset;
4410 }
4411
4412
4413 static int
4414 netlogon_dissect_function_19_reply(tvbuff_t *tvb, int offset,
4415         packet_info *pinfo, proto_tree *tree, char *drep)
4416 {
4417         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4418                 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4419                 "BYTE pointer: unknown_BYTE", -1, 0);
4420
4421         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4422                                   hf_netlogon_rc, NULL);
4423
4424         return offset;
4425 }
4426
4427 static int
4428 netlogon_dissect_netserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
4429         packet_info *pinfo, proto_tree *tree, char *drep)
4430 {
4431         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4432                 pinfo, tree, drep);
4433
4434         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4435                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4436                 "Acct Name", hf_netlogon_acct_name, 0);
4437
4438         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4439                 pinfo, tree, drep);
4440
4441         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4442                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4443                 "Computer Name", hf_netlogon_computer_name, 0);
4444
4445         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4446                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4447                 "NETLOGON_CREDENTIAL pointer: authenticator", -1, 0);
4448
4449         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4450                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4451                 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4452
4453         return offset;
4454 }
4455
4456
4457 static int
4458 netlogon_dissect_netserverauthenticate3_reply(tvbuff_t *tvb, int offset,
4459         packet_info *pinfo, proto_tree *tree, char *drep)
4460 {
4461         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4462                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4463                 "NETLOGON_CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1, 0);
4464
4465         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4466                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4467                 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4468
4469         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4470                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4471                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4472
4473         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4474                                   hf_netlogon_rc, NULL);
4475
4476         return offset;
4477 }
4478
4479 static int
4480 netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
4481         packet_info *pinfo, proto_tree *tree, char *drep)
4482 {
4483         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4484                 pinfo, tree, drep);
4485
4486         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4487                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4488                 "Domain", hf_netlogon_logon_dom, 0);
4489
4490         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4491                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4492                 "GUID pointer: domain_guid", -1, 0);
4493
4494         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4495                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4496                 "Site Name", hf_netlogon_site_name, 0);
4497
4498         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4499                 hf_netlogon_flags, NULL);
4500
4501         return offset;
4502 }
4503
4504
4505 static int
4506 netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
4507         packet_info *pinfo, proto_tree *tree, char *drep)
4508 {
4509         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4510                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4511                 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4512
4513         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4514                                   hf_netlogon_rc, NULL);
4515
4516         return offset;
4517 }
4518
4519 static int
4520 netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset,
4521         packet_info *pinfo, proto_tree *tree, char *drep)
4522 {
4523         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4524                 pinfo, tree, drep);
4525
4526         return offset;
4527 }
4528
4529
4530 static int
4531 netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset,
4532         packet_info *pinfo, proto_tree *tree, char *drep)
4533 {
4534
4535         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4536                 NDR_POINTER_REF, hf_netlogon_site_name, 0);
4537
4538         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4539                                   hf_netlogon_rc, NULL);
4540
4541         return offset;
4542 }
4543
4544 static int
4545 netlogon_dissect_function_1d_rqst(tvbuff_t *tvb, int offset,
4546         packet_info *pinfo, proto_tree *tree, char *drep)
4547 {
4548         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4549                 pinfo, tree, drep);
4550
4551         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4552                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4553                 "Computer Name", hf_netlogon_computer_name, 0);
4554
4555         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4556                 pinfo, tree, drep);
4557
4558         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4559                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4560                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4561
4562         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4563                 hf_netlogon_unknown_long, NULL);
4564
4565         offset = netlogon_dissect_TYPE_45(tvb, offset,
4566                 pinfo, tree, drep);
4567
4568         return offset;
4569 }
4570
4571
4572 static int
4573 netlogon_dissect_function_1d_reply(tvbuff_t *tvb, int offset,
4574         packet_info *pinfo, proto_tree *tree, char *drep)
4575 {
4576         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4577                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4578                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4579
4580         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4581                 netlogon_dissect_TYPE_47, NDR_POINTER_PTR,
4582                 "TYPE_47 pointer: unknown_TYPE_47", -1, 0);
4583
4584         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4585                                   hf_netlogon_rc, NULL);
4586
4587         return offset;
4588 }
4589
4590 static int
4591 netlogon_dissect_function_1e_rqst(tvbuff_t *tvb, int offset,
4592         packet_info *pinfo, proto_tree *tree, char *drep)
4593 {
4594         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4595                 pinfo, tree, drep);
4596
4597         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4598                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4599                 "unknown string", hf_netlogon_unknown_string, 0);
4600
4601         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4602                 hf_netlogon_unknown_short, NULL);
4603
4604         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4605                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4606                 "unknown string", hf_netlogon_unknown_string, 0);
4607
4608         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4609                 pinfo, tree, drep);
4610
4611         offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset,
4612                 pinfo, tree, drep);
4613
4614         return offset;
4615 }
4616
4617
4618 static int
4619 netlogon_dissect_function_1e_reply(tvbuff_t *tvb, int offset,
4620         packet_info *pinfo, proto_tree *tree, char *drep)
4621 {
4622         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4623                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4624                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4625
4626         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4627                                   hf_netlogon_rc, NULL);
4628
4629         return offset;
4630 }
4631
4632 static int
4633 netlogon_dissect_netserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
4634         packet_info *pinfo, proto_tree *tree, char *drep)
4635 {
4636         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4637                 pinfo, tree, drep);
4638
4639         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4640                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4641                 "Acct Name", hf_netlogon_acct_name, 0);
4642
4643         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4644                 pinfo, tree, drep);
4645
4646         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4647                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4648                 "Computer Name", hf_netlogon_computer_name, 0);
4649
4650         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4651                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4652                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
4653
4654         return offset;
4655 }
4656
4657
4658 static int
4659 netlogon_dissect_netserverpasswordset2_reply(tvbuff_t *tvb, int offset,
4660         packet_info *pinfo, proto_tree *tree, char *drep)
4661 {
4662         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4663                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4664                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
4665
4666         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4667                 netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF,
4668                 "LM_OWF_PASSWORD pointer: server_pwd", -1, 0);
4669
4670         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4671                                   hf_netlogon_rc, NULL);
4672
4673         return offset;
4674 }
4675
4676 static int
4677 netlogon_dissect_function_20_rqst(tvbuff_t *tvb, int offset,
4678         packet_info *pinfo, proto_tree *tree, char *drep)
4679 {
4680         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4681                 pinfo, tree, drep);
4682
4683         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4684                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4685                 "unknown string", hf_netlogon_unknown_string, -1);
4686
4687         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4688                 pinfo, tree, drep);
4689
4690         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4691                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4692                 "BYTE pointer: unknown_BYTE", -1, 0);
4693
4694         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4695                 hf_netlogon_unknown_long, NULL);
4696
4697         return offset;
4698 }
4699
4700
4701 static int
4702 netlogon_dissect_function_20_reply(tvbuff_t *tvb, int offset,
4703         packet_info *pinfo, proto_tree *tree, char *drep)
4704 {
4705         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4706                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4707                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4708
4709         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4710                                   hf_netlogon_rc, NULL);
4711
4712         return offset;
4713 }
4714
4715 static int
4716 netlogon_dissect_function_21_rqst(tvbuff_t *tvb, int offset,
4717         packet_info *pinfo, proto_tree *tree, char *drep)
4718 {
4719         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4720                 pinfo, tree, drep);
4721
4722         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4723                 hf_netlogon_unknown_long, NULL);
4724
4725         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4726                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4727                 "BYTE pointer: unknown_BYTE", -1, 0);
4728
4729         return offset;
4730 }
4731
4732
4733 static int
4734 netlogon_dissect_function_21_reply(tvbuff_t *tvb, int offset,
4735         packet_info *pinfo, proto_tree *tree, char *drep)
4736 {
4737         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4738                 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4739                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4740
4741         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4742                                   hf_netlogon_rc, NULL);
4743
4744         return offset;
4745 }
4746
4747 static int
4748 netlogon_dissect_function_22_rqst(tvbuff_t *tvb, int offset,
4749         packet_info *pinfo, proto_tree *tree, char *drep)
4750 {
4751         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4752                 pinfo, tree, drep);
4753
4754         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4755                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4756                 "unknown string", hf_netlogon_unknown_string, 0);
4757
4758         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4759                 hf_netlogon_unknown_long, NULL);
4760
4761         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4762                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4763                 "unknown string", hf_netlogon_unknown_string, 0);
4764
4765         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4766                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4767                 "GUID pointer: unknown_GUID", -1, 0);
4768
4769         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4770                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4771                 "unknown string", hf_netlogon_unknown_string, 0);
4772
4773         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4774                 hf_netlogon_unknown_long, NULL);
4775
4776         return offset;
4777 }
4778
4779
4780 static int
4781 netlogon_dissect_function_22_reply(tvbuff_t *tvb, int offset,
4782         packet_info *pinfo, proto_tree *tree, char *drep)
4783 {
4784         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4785                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr, NDR_POINTER_REF,
4786                 "DOMAIN_CONTROLLER_INFO** pointer: unknown_DOMAIN_CONTROLLER_INFO", -1, 0);
4787
4788         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4789                                   hf_netlogon_rc, NULL);
4790
4791         return offset;
4792 }
4793
4794 static int
4795 netlogon_dissect_function_23_rqst(tvbuff_t *tvb, int offset,
4796         packet_info *pinfo, proto_tree *tree, char *drep)
4797 {
4798         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4799                 pinfo, tree, drep);
4800
4801         return offset;
4802 }
4803
4804
4805 static int
4806 netlogon_dissect_function_23_reply(tvbuff_t *tvb, int offset,
4807         packet_info *pinfo, proto_tree *tree, char *drep)
4808 {
4809         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4810                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4811                 "unknown string", hf_netlogon_unknown_string, -1);
4812
4813         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4814                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4815                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4816
4817         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4818                                   hf_netlogon_rc, NULL);
4819
4820         return offset;
4821 }
4822
4823 static int
4824 netlogon_dissect_function_24_rqst(tvbuff_t *tvb, int offset,
4825         packet_info *pinfo, proto_tree *tree, char *drep)
4826 {
4827         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4828                 pinfo, tree, drep);
4829
4830         return offset;
4831 }
4832
4833
4834 static int
4835 netlogon_dissect_function_24_reply(tvbuff_t *tvb, int offset,
4836         packet_info *pinfo, proto_tree *tree, char *drep)
4837 {
4838         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4839                 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4840                 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4841
4842         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4843                                   hf_netlogon_rc, NULL);
4844
4845         return offset;
4846 }
4847
4848 static int
4849 netlogon_dissect_function_25_rqst(tvbuff_t *tvb, int offset,
4850         packet_info *pinfo, proto_tree *tree, char *drep)
4851 {
4852         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4853                 pinfo, tree, drep);
4854
4855         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4856                 hf_netlogon_unknown_long, NULL);
4857
4858         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4859                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4860                 "BYTE pointer: unknown_BYTE", -1, 0);
4861
4862         return offset;
4863 }
4864
4865
4866 static int
4867 netlogon_dissect_function_25_reply(tvbuff_t *tvb, int offset,
4868         packet_info *pinfo, proto_tree *tree, char *drep)
4869 {
4870         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4871                 netlogon_dissect_TYPE_52_ptr_ptr, NDR_POINTER_REF,
4872                 "TYPE_52** pointer: unknown_TYPE_52", -1, 0);
4873
4874         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4875                                   hf_netlogon_rc, NULL);
4876
4877         return offset;
4878 }
4879
4880
4881 static int
4882 netlogon_dissect_function_26_rqst(tvbuff_t *tvb, int offset,
4883         packet_info *pinfo, proto_tree *tree, char *drep)
4884 {
4885         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4886                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4887                 "unknown string", hf_netlogon_unknown_string, 0);
4888
4889         return offset;
4890 }
4891
4892
4893 static int
4894 netlogon_dissect_function_26_reply(tvbuff_t *tvb, int offset,
4895         packet_info *pinfo, proto_tree *tree, char *drep)
4896 {
4897         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4898                 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4899                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4900
4901         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4902                                   hf_netlogon_rc, NULL);
4903
4904         return offset;
4905 }
4906
4907 static int
4908 netlogon_dissect_function_27_rqst(tvbuff_t *tvb, int offset,
4909         packet_info *pinfo, proto_tree *tree, char *drep)
4910 {
4911         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4912                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4913                 "unknown string", hf_netlogon_unknown_string, 0);
4914
4915         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4916                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4917                 "unknown string", hf_netlogon_unknown_string, 0);
4918
4919         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4920                 hf_netlogon_unknown_short, NULL);
4921
4922         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4923                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_PTR,
4924                 "NETLOGON_LEVEL pointer: unknown_NETLOGON_LEVEL", -1, 0);
4925
4926         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4927                 hf_netlogon_unknown_short, NULL);
4928
4929         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4930                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4931                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4932         return offset;
4933 }
4934
4935
4936 static int
4937 netlogon_dissect_function_27_reply(tvbuff_t *tvb, int offset,
4938         packet_info *pinfo, proto_tree *tree, char *drep)
4939 {
4940         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4941                 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_PTR,
4942                 "NETLOGON_VALIDATION pointer: unknown_NETLOGON_VALIDATION", -1, 0);
4943
4944         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4945                 netlogon_dissect_pointer_char, NDR_POINTER_PTR,
4946                 "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char, 0);
4947
4948         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4949                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4950                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4951
4952         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4953                                   hf_netlogon_rc, NULL);
4954
4955         return offset;
4956 }
4957
4958 static int
4959 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst(tvbuff_t *tvb, int offset,
4960         packet_info *pinfo, proto_tree *tree, char *drep)
4961 {
4962         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4963                 pinfo, tree, drep);
4964
4965         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4966                 hf_netlogon_unknown_long, NULL);
4967
4968         return offset;
4969 }
4970
4971
4972 static int
4973 netlogon_dissect_dsrrolegetprimarydomaininformation_reply(tvbuff_t *tvb, int offset,
4974         packet_info *pinfo, proto_tree *tree, char *drep)
4975 {
4976         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4977                 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4978                 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4979
4980         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4981                                   hf_netlogon_rc, NULL);
4982
4983         return offset;
4984 }
4985
4986 static int
4987 netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset,
4988         packet_info *pinfo, proto_tree *tree, char *drep)
4989 {
4990         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4991                 pinfo, tree, drep);
4992
4993         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4994                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4995                 "Domain", hf_netlogon_logon_dom, 0);
4996
4997         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4998                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4999                 "GUID pointer: domain_guid", -1, 0);
5000
5001         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5002                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
5003                 "GUID pointer: dsa_guid", -1, 0);
5004
5005         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5006                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
5007                 "dns_host", hf_netlogon_dns_host, -1);
5008
5009         return offset;
5010 }
5011
5012
5013 static int
5014 netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset,
5015         packet_info *pinfo, proto_tree *tree, char *drep)
5016 {
5017         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5018                                   hf_netlogon_rc, NULL);
5019
5020         return offset;
5021 }
5022
5023
5024
5025 static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = {
5026         { NETLOGON_FUNCTION_00, "FUNCTION_00",
5027                 netlogon_dissect_function_00_rqst,
5028                 netlogon_dissect_function_00_reply },
5029         { NETLOGON_FUNCTION_01, "FUNCTION_01",
5030                 netlogon_dissect_function_01_rqst,
5031                 netlogon_dissect_function_01_reply },
5032         { NETLOGON_NETLOGONSAMLOGON, "NETLOGONSAMLOGON",
5033                 netlogon_dissect_netlogonsamlogon_rqst,
5034                 netlogon_dissect_netlogonsamlogon_reply },
5035         { NETLOGON_NETLOGONSAMLOGOFF, "NETLOGONSAMLOGOFF",
5036                 netlogon_dissect_netlogonsamlogoff_rqst,
5037                 netlogon_dissect_netlogonsamlogoff_reply },
5038         { NETLOGON_NETSERVERREQCHALLENGE, "NETSERVERREQCHALLENGE",
5039                 netlogon_dissect_netserverreqchallenge_rqst,
5040                 netlogon_dissect_netserverreqchallenge_reply },
5041         { NETLOGON_NETSERVERAUTHENTICATE, "NETSERVERAUTHENTICATE",
5042                 netlogon_dissect_netserverauthenticate_rqst,
5043                 netlogon_dissect_netserverauthenticate_reply },
5044         { NETLOGON_NETSERVERPASSWORDSET, "NETSERVERPASSWORDSET",
5045                 netlogon_dissect_netserverpasswordset_rqst,
5046                 netlogon_dissect_netserverpasswordset_reply },
5047         { NETLOGON_NETSAMDELTAS, "NETSAMDELTAS",
5048                 netlogon_dissect_netsamdeltas_rqst,
5049                 netlogon_dissect_netsamdeltas_reply },
5050         { NETLOGON_FUNCTION_08, "FUNCTION_08",
5051                 netlogon_dissect_function_08_rqst,
5052                 netlogon_dissect_function_08_reply },
5053         { NETLOGON_FUNCTION_09, "FUNCTION_09",
5054                 netlogon_dissect_function_09_rqst,
5055                 netlogon_dissect_function_09_reply },
5056         { NETLOGON_FUNCTION_0A, "FUNCTION_0A",
5057                 netlogon_dissect_function_0a_rqst,
5058                 netlogon_dissect_function_0a_reply },
5059         { NETLOGON_FUNCTION_0B, "FUNCTION_0B",
5060                 netlogon_dissect_function_0b_rqst,
5061                 netlogon_dissect_function_0b_reply },
5062         { NETLOGON_NETLOGONCONTROL, "NETLOGONCONTROL",
5063                 netlogon_dissect_netlogoncontrol_rqst,
5064                 netlogon_dissect_netlogoncontrol_reply },
5065         { NETLOGON_FUNCTION_0D, "FUNCTION_0D",
5066                 netlogon_dissect_function_0d_rqst,
5067                 netlogon_dissect_function_0d_reply },
5068         { NETLOGON_NETLOGONCONTROL2, "NETLOGONCONTROL2",
5069                 netlogon_dissect_netlogoncontrol2_rqst,
5070                 netlogon_dissect_netlogoncontrol2_reply },
5071         { NETLOGON_NETSERVERAUTHENTICATE2, "NETSERVERAUTHENTICATE2",
5072                 netlogon_dissect_netserverauthenticate2_rqst,
5073                 netlogon_dissect_netserverauthenticate2_reply },
5074         { NETLOGON_NETDATABASESYNC2, "NETDATABASESYNC2",
5075                 netlogon_dissect_netdatabasesync2_rqst,
5076                 netlogon_dissect_netdatabasesync2_reply },
5077         { NETLOGON_FUNCTION_11, "FUNCTION_11",
5078                 netlogon_dissect_function_11_rqst,
5079                 netlogon_dissect_function_11_reply },
5080         { NETLOGON_FUNCTION_12, "FUNCTION_12",
5081                 netlogon_dissect_function_12_rqst,
5082                 netlogon_dissect_function_12_reply },
5083         { NETLOGON_NETTRUSTEDDOMAINLIST, "NETTRUSTEDDOMAINLIST",
5084                 netlogon_dissect_nettrusteddomainlist_rqst,
5085                 netlogon_dissect_nettrusteddomainlist_reply },
5086         { NETLOGON_DSRGETDCNAME2, "DSRGETDCNAME2",
5087                 netlogon_dissect_dsrgetdcname2_rqst,
5088                 netlogon_dissect_dsrgetdcname2_reply },
5089         { NETLOGON_FUNCTION_15, "FUNCTION_15",
5090                 netlogon_dissect_function_15_rqst,
5091                 netlogon_dissect_function_15_reply },
5092         { NETLOGON_FUNCTION_16, "FUNCTION_16",
5093                 netlogon_dissect_function_16_rqst,
5094                 netlogon_dissect_function_16_reply },
5095         { NETLOGON_FUNCTION_17, "FUNCTION_17",
5096                 netlogon_dissect_function_17_rqst,
5097                 netlogon_dissect_function_17_reply },
5098         { NETLOGON_FUNCTION_18, "FUNCTION_18",
5099                 netlogon_dissect_function_18_rqst,
5100                 netlogon_dissect_function_18_reply },
5101         { NETLOGON_FUNCTION_19, "FUNCTION_19",
5102                 netlogon_dissect_function_19_rqst,
5103                 netlogon_dissect_function_19_reply },
5104         { NETLOGON_NETSERVERAUTHENTICATE3, "NETSERVERAUTHENTICATE3",
5105                 netlogon_dissect_netserverauthenticate3_rqst,
5106                 netlogon_dissect_netserverauthenticate3_reply },
5107         { NETLOGON_DSRGETDCNAME, "DSRGETDCNAME",
5108                 netlogon_dissect_dsrgetdcname_rqst,
5109                 netlogon_dissect_dsrgetdcname_reply },
5110         { NETLOGON_DSRGETSITENAME, "DSRGETSITENAME",
5111                 netlogon_dissect_dsrgetsitename_rqst,
5112                 netlogon_dissect_dsrgetsitename_reply },
5113         { NETLOGON_FUNCTION_1D, "FUNCTION_1D",
5114                 netlogon_dissect_function_1d_rqst,
5115                 netlogon_dissect_function_1d_reply },
5116         { NETLOGON_FUNCTION_1E, "FUNCTION_1E",
5117                 netlogon_dissect_function_1e_rqst,
5118                 netlogon_dissect_function_1e_reply },
5119         { NETLOGON_NETSERVERPASSWORDSET2, "NETSERVERPASSWORDSET2",
5120                 netlogon_dissect_netserverpasswordset2_rqst,
5121                 netlogon_dissect_netserverpasswordset2_reply },
5122         { NETLOGON_FUNCTION_20, "FUNCTION_20",
5123                 netlogon_dissect_function_20_rqst,
5124                 netlogon_dissect_function_20_reply },
5125         { NETLOGON_FUNCTION_21, "FUNCTION_21",
5126                 netlogon_dissect_function_21_rqst,
5127                 netlogon_dissect_function_21_reply },
5128         { NETLOGON_FUNCTION_22, "FUNCTION_22",
5129                 netlogon_dissect_function_22_rqst,
5130                 netlogon_dissect_function_22_reply },
5131         { NETLOGON_FUNCTION_23, "FUNCTION_23",
5132                 netlogon_dissect_function_23_rqst,
5133                 netlogon_dissect_function_23_reply },
5134         { NETLOGON_FUNCTION_24, "FUNCTION_24",
5135                 netlogon_dissect_function_24_rqst,
5136                 netlogon_dissect_function_24_reply },
5137         { NETLOGON_FUNCTION_25, "FUNCTION_25",
5138                 netlogon_dissect_function_25_rqst,
5139                 netlogon_dissect_function_25_reply },
5140         { NETLOGON_FUNCTION_26, "FUNCTION_26",
5141                 netlogon_dissect_function_26_rqst,
5142                 netlogon_dissect_function_26_reply },
5143         { NETLOGON_FUNCTION_27, "FUNCTION_27",
5144                 netlogon_dissect_function_27_rqst,
5145                 netlogon_dissect_function_27_reply },
5146         { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DSRROLEGETPRIMARYDOMAININFORMATION",
5147                 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst,
5148                 netlogon_dissect_dsrrolegetprimarydomaininformation_reply },
5149         { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DSRDEREGISTERDNSHOSTRECORDS",
5150                 netlogon_dissect_dsrderegisterdnshostrecords_rqst,
5151                 netlogon_dissect_dsrderegisterdnshostrecords_reply },
5152         {0, NULL, NULL,  NULL },
5153 };
5154
5155 void
5156 proto_register_dcerpc_netlogon(void)
5157 {
5158
5159 static hf_register_info hf[] = {
5160         { &hf_netlogon_rc, {
5161                 "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
5162                 VALS(NT_errors), 0x0, "Netlogon return code", HFILL }},
5163
5164         { &hf_netlogon_param_ctrl, {
5165                 "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
5166                 NULL, 0x0, "Param ctrl", HFILL }},
5167
5168         { &hf_netlogon_logon_id, {
5169                 "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
5170                 NULL, 0x0, "Logon ID", HFILL }},
5171
5172         { &hf_netlogon_count, {
5173                 "Count", "netlogon.count", FT_UINT16, BASE_DEC,
5174                 NULL, 0x0, "", HFILL }},
5175
5176         { &hf_netlogon_credential, {
5177                 "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
5178                 NULL, 0x0, "Netlogon credential", HFILL }},
5179
5180         { &hf_netlogon_cypher_block, {
5181                 "Cypher Block", "netlogon.cypher_block", FT_BYTES, BASE_HEX,
5182                 NULL, 0x0, "Netlogon cypher block", HFILL }},
5183
5184         { &hf_netlogon_lm_owf_password, {
5185                 "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
5186                 NULL, 0x0, "LanManager OWF Password", HFILL }},
5187
5188         { &hf_netlogon_user_session_key, {
5189                 "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
5190                 NULL, 0x0, "User Session Key", HFILL }},
5191
5192         { &hf_netlogon_encrypted_lm_owf_password, {
5193                 "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
5194                 NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }},
5195
5196         { &hf_netlogon_nt_owf_password, {
5197                 "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
5198                 NULL, 0x0, "NT OWF Password", HFILL }},
5199
5200         { &hf_netlogon_blob, {
5201                 "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
5202                 NULL, 0x0, "BLOB", HFILL }},
5203
5204         { &hf_netlogon_len, {
5205                 "Len", "netlogon.len", FT_UINT32, BASE_DEC,
5206                 NULL, 0, "Length", HFILL }},
5207
5208         { &hf_netlogon_status, {
5209                 "Status", "netlogon.status", FT_UINT32, BASE_DEC,
5210                 NULL, 0, "Status", HFILL }},
5211
5212         { &hf_netlogon_attrs, {
5213                 "Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX,
5214                 NULL, 0, "Attributes", HFILL }},
5215
5216         { &hf_netlogon_unknown_string,
5217                 { "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE,
5218                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
5219         { &hf_netlogon_unknown_long,
5220                 { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
5221                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
5222         { &hf_netlogon_unknown_short,
5223                 { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
5224                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
5225
5226         { &hf_netlogon_unknown_char,
5227                 { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
5228                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
5229
5230         { &hf_netlogon_unknown_time,
5231                 { "Unknown time", "netlogon.unknown.time", FT_ABSOLUTE_TIME, BASE_NONE,
5232                 NULL, 0x0, "Unknown time. If you know what this is, contact ethereal developers.", HFILL }},
5233
5234         { &hf_netlogon_acct_expiry_time,
5235                 { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
5236                 NULL, 0x0, "When this account will expire", HFILL }},
5237
5238         { &hf_netlogon_nt_pwd_present,
5239                 { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
5240                 NULL, 0x0, "Is NT password present for this account?", HFILL }},
5241
5242         { &hf_netlogon_lm_pwd_present,
5243                 { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
5244                 NULL, 0x0, "Is LanManager password present for this account?", HFILL }},
5245
5246         { &hf_netlogon_pwd_expired,
5247                 { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
5248                 NULL, 0x0, "Whether this password has expired or not", HFILL }},
5249
5250         { &hf_netlogon_num_pwd_pairs,
5251                 { "Num PWD Pairs", "netlogon.num_pwd_pairs", FT_UINT8, BASE_DEC,
5252                 NULL, 0x0, "Number of password pairs. Password history length?", HFILL }},
5253
5254         { &hf_netlogon_authoritative,
5255                 { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
5256                 NULL, 0x0, "", HFILL }},
5257
5258         { &hf_netlogon_nt_chal_resp,
5259                 { "NT Chal resp", "netlogon.nt_chal_resp", FT_BYTES, BASE_HEX,
5260                 NULL, 0, "Challenge response for NT authentication", HFILL }},
5261
5262         { &hf_netlogon_lm_chal_resp,
5263                 { "LM Chal resp", "netlogon.lm_chal_resp", FT_BYTES, BASE_HEX,
5264                 NULL, 0, "Challenge response for LM authentication", HFILL }},
5265
5266         { &hf_netlogon_acct_name,
5267                 { "Acct Name", "netlogon.acct_name", FT_STRING, BASE_NONE,
5268                 NULL, 0, "Account Name", HFILL }},
5269
5270         { &hf_netlogon_acct_desc,
5271                 { "Acct Desc", "netlogon.acct_desc", FT_STRING, BASE_NONE,
5272                 NULL, 0, "Account Description", HFILL }},
5273
5274         { &hf_netlogon_group_desc,
5275                 { "Group Desc", "netlogon.group_desc", FT_STRING, BASE_NONE,
5276                 NULL, 0, "Group Description", HFILL }},
5277
5278         { &hf_netlogon_full_name,
5279                 { "Full Name", "netlogon.full_name", FT_STRING, BASE_NONE,
5280                 NULL, 0, "Full Name", HFILL }},
5281
5282         { &hf_netlogon_comment,
5283                 { "Comment", "netlogon.comment", FT_STRING, BASE_NONE,
5284                 NULL, 0, "Comment", HFILL }},
5285
5286         { &hf_netlogon_parameters,
5287                 { "Parameters", "netlogon.parameters", FT_STRING, BASE_NONE,
5288                 NULL, 0, "Parameters", HFILL }},
5289
5290         { &hf_netlogon_logon_script,
5291                 { "Logon Script", "netlogon.logon_script", FT_STRING, BASE_NONE,
5292                 NULL, 0, "Logon Script", HFILL }},
5293
5294         { &hf_netlogon_profile_path,
5295                 { "Profile Path", "netlogon.profile_path", FT_STRING, BASE_NONE,
5296                 NULL, 0, "Profile Path", HFILL }},
5297
5298         { &hf_netlogon_home_dir,
5299                 { "Home Dir", "netlogon.home_dir", FT_STRING, BASE_NONE,
5300                 NULL, 0, "Home Directory", HFILL }},
5301
5302         { &hf_netlogon_dir_drive,
5303                 { "Dir Drive", "netlogon.dir_drive", FT_STRING, BASE_NONE,
5304                 NULL, 0, "Drive letter for home directory", HFILL }},
5305
5306         { &hf_netlogon_logon_srv,
5307                 { "Server", "netlogon.server", FT_STRING, BASE_NONE,
5308                 NULL, 0, "Server", HFILL }},
5309
5310         { &hf_netlogon_logon_dom,
5311                 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
5312                 NULL, 0, "Domain", HFILL }},
5313
5314         { &hf_netlogon_computer_name,
5315                 { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
5316                 NULL, 0, "Computer Name", HFILL }},
5317
5318         { &hf_netlogon_site_name,
5319                 { "Site Name", "netlogon.site_name", FT_STRING, BASE_NONE,
5320                 NULL, 0, "Site Name", HFILL }},
5321
5322         { &hf_netlogon_dc_name,
5323                 { "DC Name", "netlogon.dc.name", FT_STRING, BASE_NONE,
5324                 NULL, 0, "DC Name", HFILL }},
5325
5326         { &hf_netlogon_dc_site_name,
5327                 { "DC Site Name", "netlogon.dc.site_name", FT_STRING, BASE_NONE,
5328                 NULL, 0, "DC Site Name", HFILL }},
5329
5330         { &hf_netlogon_dns_forest_name,
5331                 { "DNS Forest Name", "netlogon.dns.forest_name", FT_STRING, BASE_NONE,
5332                 NULL, 0, "DNS Forest Name", HFILL }},
5333
5334         { &hf_netlogon_dc_address,
5335                 { "DC Address", "netlogon.dc.address", FT_STRING, BASE_NONE,
5336                 NULL, 0, "DC Address", HFILL }},
5337
5338         { &hf_netlogon_dc_address_type,
5339                 { "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC,
5340                 NULL, 0, "DC Address Type", HFILL }},
5341
5342         { &hf_netlogon_client_name,
5343                 { "Client Name", "netlogon.client.name", FT_STRING, BASE_NONE,
5344                 NULL, 0, "Client Name", HFILL }},
5345
5346         { &hf_netlogon_client_site_name,
5347                 { "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE,
5348                 NULL, 0, "Client Site Name", HFILL }},
5349
5350         { &hf_netlogon_workstation_site_name,
5351                 { "Wkst Site Name", "netlogon.wkst.site_name", FT_STRING, BASE_NONE,
5352                 NULL, 0, "Workstation Site Name", HFILL }},
5353
5354         { &hf_netlogon_workstation_os,
5355                 { "Wkst OS", "netlogon.wkst.os", FT_STRING, BASE_NONE,
5356                 NULL, 0, "Workstation OS", HFILL }},
5357
5358         { &hf_netlogon_workstations,
5359                 { "Workstations", "netlogon.wksts", FT_STRING, BASE_NONE,
5360                 NULL, 0, "Workstations", HFILL }},
5361
5362         { &hf_netlogon_workstation_fqdn,
5363                 { "Wkst FQDN", "netlogon.wkst.fqdn", FT_STRING, BASE_NONE,
5364                 NULL, 0, "Workstation FQDN", HFILL }},
5365
5366         { &hf_netlogon_group_name,
5367                 { "Group Name", "netlogon.group_name", FT_STRING, BASE_NONE,
5368                 NULL, 0, "Group Name", HFILL }},
5369
5370         { &hf_netlogon_alias_name,
5371                 { "Alias Name", "netlogon.alias_name", FT_STRING, BASE_NONE,
5372                 NULL, 0, "Alias Name", HFILL }},
5373
5374         { &hf_netlogon_cli_name,
5375                 { "CLI Name", "netlogon.cli_name", FT_STRING, BASE_NONE,
5376                 NULL, 0, "CLI Name", HFILL }},
5377
5378         { &hf_netlogon_dns_host,
5379                 { "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE,
5380                 NULL, 0, "DNS Host", HFILL }},
5381
5382         { &hf_netlogon_trusted_domain_name,
5383                 { "Trusted Domain", "netlogon.trusted_domain", FT_STRING, BASE_NONE,
5384                 NULL, 0, "Trusted Domain Name", HFILL }},
5385
5386         { &hf_netlogon_trusted_dc_name,
5387                 { "Trusted DC", "netlogon.trusted_dc", FT_STRING, BASE_NONE,
5388                 NULL, 0, "Trusted DC", HFILL }},
5389
5390         { &hf_netlogon_logonsrv_handle,
5391                 { "Handle", "netlogon.handle", FT_STRING, BASE_NONE,
5392                 NULL, 0, "Logon Srv Handle", HFILL }},
5393
5394         { &hf_netlogon_logon_count,
5395                 { "Logon Count", "netlogon.logon_count", FT_UINT16, BASE_DEC,
5396                 NULL, 0x0, "Number of successful logins", HFILL }},
5397
5398         { &hf_netlogon_bad_pw_count,
5399                 { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT16, BASE_DEC,
5400                 NULL, 0x0, "Number of failed logins", HFILL }},
5401
5402         { &hf_netlogon_country,
5403                 { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
5404                 VALS(ms_country_codes), 0x0, "Country setting for this account", HFILL }},
5405
5406         { &hf_netlogon_codepage,
5407                 { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
5408                 NULL, 0x0, "Codepage setting for this account", HFILL }},
5409
5410         { &hf_netlogon_level,
5411                 { "Level", "netlogon.level", FT_UINT16, BASE_DEC,
5412                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5413
5414         { &hf_netlogon_secure_channel_type,
5415                 { "Sec Chn Type", "netlogon.sec_chn_type", FT_UINT16, BASE_DEC,
5416                 NULL, 0x0, "Secure Channel Type", HFILL }},
5417
5418         { &hf_netlogon_blob_size,
5419                 { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
5420                 NULL, 0x0, "Size in bytes of BLOB", HFILL }},
5421
5422         { &hf_netlogon_code,
5423                 { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
5424                 NULL, 0x0, "Code", HFILL }},
5425
5426         { &hf_netlogon_level_long,
5427                 { "Level", "netlogon.level32", FT_UINT32, BASE_DEC,
5428                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5429
5430         { &hf_netlogon_timestamp,
5431                 { "Timestamp", "netlogon.timestamp", FT_UINT32, BASE_HEX,
5432                 NULL, 0x0, "Some sort of timestamp", HFILL }},
5433
5434         { &hf_netlogon_user_rid,
5435                 { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
5436                 NULL, 0x0, "", HFILL }},
5437
5438         { &hf_netlogon_alias_rid,
5439                 { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
5440                 NULL, 0x0, "", HFILL }},
5441
5442         { &hf_netlogon_group_rid,
5443                 { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
5444                 NULL, 0x0, "", HFILL }},
5445
5446         { &hf_netlogon_num_rids,
5447                 { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
5448                 NULL, 0x0, "Number of RIDs", HFILL }},
5449
5450         { &hf_netlogon_num_other_groups,
5451                 { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
5452                 NULL, 0x0, "", HFILL }},
5453
5454         { &hf_netlogon_flags,
5455                 { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
5456                 NULL, 0x0, "", HFILL }},
5457
5458         { &hf_netlogon_user_flags,
5459                 { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
5460                 NULL, 0x0, "", HFILL }},
5461
5462         { &hf_netlogon_database_id,
5463                 { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
5464                 NULL, 0x0, "Database Id", HFILL }},
5465
5466         { &hf_netlogon_max_size,
5467                 { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
5468                 NULL, 0x0, "Max Size of database", HFILL }},
5469
5470         { &hf_netlogon_num_deltas,
5471                 { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
5472                 NULL, 0x0, "Number of SAM Deltas in array", HFILL }},
5473
5474         { &hf_netlogon_logon_attempts,
5475                 { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
5476                 NULL, 0x0, "Number of logon attempts", HFILL }},
5477
5478         { &hf_netlogon_logon_time,
5479                 { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
5480                 NULL, 0, "Time for last time this user logged on", HFILL }},
5481
5482         { &hf_netlogon_kickoff_time,
5483                 { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5484                 NULL, 0, "Time when this user will be kicked off", HFILL }},
5485
5486         { &hf_netlogon_logoff_time,
5487                 { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5488                 NULL, 0, "Time for last time this user logged off", HFILL }},
5489
5490         { &hf_netlogon_pwd_last_set_time,
5491                 { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
5492                 NULL, 0, "Last time this users password was changed", HFILL }},
5493
5494         { &hf_netlogon_pwd_can_change_time,
5495                 { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5496                 NULL, 0, "When this users password may be changed", HFILL }},
5497
5498         { &hf_netlogon_pwd_must_change_time,
5499                 { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5500                 NULL, 0, "When this users password must be changed", HFILL }},
5501
5502         };
5503
5504         static gint *ett[] = {
5505                 &ett_dcerpc_netlogon,
5506                 &ett_NETLOGON_SECURITY_DESCRIPTOR,
5507                 &ett_TYPE_1,
5508                 &ett_TYPE_2,
5509                 &ett_CYPHER_BLOCK,
5510                 &ett_NETLOGON_AUTHENTICATOR,
5511                 &ett_NETLOGON_LOGON_IDENTITY_INFO,
5512                 &ett_NETLOGON_INTERACTIVE_INFO,
5513                 &ett_NETLOGON_NETWORK_INFO,
5514                 &ett_NETLOGON_VALIDATION_SAM_INFO1,
5515                 &ett_NETLOGON_VALIDATION_SAM_INFO2,
5516                 &ett_TYPE_16,
5517                 &ett_NETLOGON_SAM_DOMAIN_INFO,
5518                 &ett_NETLOGON_SAM_GROUP_INFO,
5519                 &ett_TYPE_23,
5520                 &ett_NETLOGON_SAM_ACCOUNT_INFO,
5521                 &ett_NETLOGON_SAM_GROUP_MEM_INFO,
5522                 &ett_NETLOGON_SAM_ALIAS_INFO,
5523                 &ett_NETLOGON_SAM_ALIAS_MEM_INFO,
5524                 &ett_TYPE_30,
5525                 &ett_TYPE_29,
5526                 &ett_TYPE_31,
5527                 &ett_TYPE_32,
5528                 &ett_TYPE_33,
5529                 &ett_TYPE_34,
5530                 &ett_TYPE_35,
5531                 &ett_SAM_DELTA,
5532                 &ett_SAM_DELTA_ARRAY,
5533                 &ett_TYPE_36,
5534                 &ett_NETLOGON_INFO_1,
5535                 &ett_NETLOGON_INFO_2,
5536                 &ett_NETLOGON_INFO_3,
5537                 &ett_NETLOGON_INFO_4,
5538                 &ett_UNICODE_MULTI,
5539                 &ett_DOMAIN_CONTROLLER_INFO,
5540                 &ett_TYPE_46,
5541                 &ett_TYPE_48,
5542                 &ett_UNICODE_STRING_512,
5543                 &ett_TYPE_50,
5544                 &ett_TYPE_51,
5545                 &ett_TYPE_52,
5546                 &ett_NETLOGON_LEVEL,
5547                 &ett_NETLOGON_VALIDATION,
5548                 &ett_TYPE_19,
5549                 &ett_NETLOGON_CONTROL_QUERY_INFO,
5550                 &ett_TYPE_44,
5551                 &ett_TYPE_20,
5552                 &ett_NETLOGON_INFO,
5553                 &ett_TYPE_45,
5554                 &ett_TYPE_47,
5555                 &ett_NETLOGON_CREDENTIAL,
5556                 &ett_GUID,
5557                 &ett_ENC_LM_OWF_PASSWORD,
5558                 &ett_LM_OWF_PASSWORD,
5559                 &ett_NT_OWF_PASSWORD,
5560                 &ett_GROUP_MEMBERSHIP,
5561                 &ett_USER_SESSION_KEY,
5562                 &ett_BLOB,
5563                 &ett_rid_array,
5564                 &ett_attrib_array,
5565         };
5566
5567         proto_dcerpc_netlogon = proto_register_protocol(
5568                 "Microsoft Network Logon", "NETLOGON", "rpc_netlogon");
5569
5570         proto_register_field_array(proto_dcerpc_netlogon, hf,
5571                                    array_length(hf));
5572         proto_register_subtree_array(ett, array_length(ett));
5573 }
5574
5575 void
5576 proto_reg_handoff_dcerpc_netlogon(void)
5577 {
5578         /* Register protocol as dcerpc */
5579
5580         dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
5581                          &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
5582                          dcerpc_netlogon_dissectors);
5583 }