packet-dcerpc-netlogon.c

   1 /* packet-dcerpc-netlogon.c
   2  * Routines for SMB \\PIPE\\NETLOGON packet disassembly
   3  * Copyright 2001, Tim Potter <tpot@samba.org>
   4  *  2002 structure and command dissectors by Ronnie Sahlberg
   5  *
   6  * $Id: packet-dcerpc-netlogon.c,v 1.18 2002/04/29 08:20:06 guy Exp $
   7  *
   8  * Ethereal - Network traffic analyzer
   9  * By Gerald Combs <gerald@ethereal.com>
  10  * Copyright 1998 Gerald Combs
  11  *
  12  * This program is free software; you can redistribute it and/or
  13  * modify it under the terms of the GNU General Public License
  14  * as published by the Free Software Foundation; either version 2
  15  * of the License, or (at your option) any later version.
  16  *
  17  * This program is distributed in the hope that it will be useful,
  18  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20  * GNU General Public License for more details.
  21  *
  22  * You should have received a copy of the GNU General Public License
  23  * along with this program; if not, write to the Free Software
  24  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  25  */
  26
  27 #ifdef HAVE_CONFIG_H
  28 #include "config.h"
  29 #endif
  30
  31 #include <glib.h>
  32 #include <epan/packet.h>
  33 #include "packet-dcerpc.h"
  34 #include "packet-dcerpc-nt.h"
  35 #include "packet-dcerpc-netlogon.h"
  36 #include "smb.h"        /* for "NT_errors[]" */
  37 #include "packet-smb-common.h"
  38 #include "packet-dcerpc-lsa.h"
  39
  40 static int proto_dcerpc_netlogon = -1;
  41 static int hf_netlogon_rc = -1;
  42 static int hf_netlogon_len = -1;
  43 static int hf_netlogon_status = -1;
  44 static int hf_netlogon_attrs = -1;
  45 static int hf_netlogon_count = -1;
  46 static int hf_netlogon_level = -1;
  47 static int hf_netlogon_level_long = -1;
  48 static int hf_netlogon_unknown_time = -1;
  49 static int hf_netlogon_unknown_string = -1;
  50 static int hf_netlogon_unknown_long = -1;
  51 static int hf_netlogon_unknown_short = -1;
  52 static int hf_netlogon_unknown_char = -1;
  53 static int hf_netlogon_logon_time = -1;
  54 static int hf_netlogon_logoff_time = -1;
  55 static int hf_netlogon_kickoff_time = -1;
  56 static int hf_netlogon_pwd_last_set_time = -1;
  57 static int hf_netlogon_pwd_can_change_time = -1;
  58 static int hf_netlogon_pwd_must_change_time = -1;
  59 static int hf_netlogon_timestamp = -1;
  60 static int hf_netlogon_nt_chal_resp = -1;
  61 static int hf_netlogon_lm_chal_resp = -1;
  62 static int hf_netlogon_credential = -1;
  63 static int hf_netlogon_cypher_block = -1;
  64 static int hf_netlogon_acct_name = -1;
  65 static int hf_netlogon_acct_desc = -1;
  66 static int hf_netlogon_group_desc = -1;
  67 static int hf_netlogon_full_name = -1;
  68 static int hf_netlogon_comment = -1;
  69 static int hf_netlogon_parameters = -1;
  70 static int hf_netlogon_logon_script = -1;
  71 static int hf_netlogon_profile_path = -1;
  72 static int hf_netlogon_home_dir = -1;
  73 static int hf_netlogon_dir_drive = -1;
  74 static int hf_netlogon_logon_count = -1;
  75 static int hf_netlogon_bad_pw_count = -1;
  76 static int hf_netlogon_user_rid = -1;
  77 static int hf_netlogon_alias_rid = -1;
  78 static int hf_netlogon_group_rid = -1;
  79 static int hf_netlogon_logon_srv = -1;
  80 static int hf_netlogon_logon_dom = -1;
  81 static int hf_netlogon_trusted_domain_name = -1;
  82 static int hf_netlogon_num_rids = -1;
  83 static int hf_netlogon_num_other_groups = -1;
  84 static int hf_netlogon_computer_name = -1;
  85 static int hf_netlogon_site_name = -1;
  86 static int hf_netlogon_trusted_dc_name = -1;
  87 static int hf_netlogon_dc_name = -1;
  88 static int hf_netlogon_dc_site_name = -1;
  89 static int hf_netlogon_dns_forest_name = -1;
  90 static int hf_netlogon_dc_address = -1;
  91 static int hf_netlogon_dc_address_type = -1;
  92 static int hf_netlogon_client_name = -1;
  93 static int hf_netlogon_client_site_name = -1;
  94 static int hf_netlogon_workstation_site_name = -1;
  95 static int hf_netlogon_workstation_os = -1;
  96 static int hf_netlogon_workstations = -1;
  97 static int hf_netlogon_workstation_fqdn = -1;
  98 static int hf_netlogon_group_name = -1;
  99 static int hf_netlogon_alias_name = -1;
 100 static int hf_netlogon_cli_name = -1;
 101 static int hf_netlogon_country = -1;
 102 static int hf_netlogon_codepage = -1;
 103 static int hf_netlogon_flags = -1;
 104 static int hf_netlogon_user_flags = -1;
 105 static int hf_netlogon_pwd_expired = -1;
 106 static int hf_netlogon_nt_pwd_present = -1;
 107 static int hf_netlogon_lm_pwd_present = -1;
 108 static int hf_netlogon_code = -1;
 109 static int hf_netlogon_database_id = -1;
 110 static int hf_netlogon_max_size = -1;
 111 static int hf_netlogon_dns_host = -1;
 112 static int hf_netlogon_num_pwd_pairs = -1;
 113 static int hf_netlogon_acct_expiry_time = -1;
 114 static int hf_netlogon_encrypted_lm_owf_password = -1;
 115 static int hf_netlogon_lm_owf_password = -1;
 116 static int hf_netlogon_nt_owf_password = -1;
 117 static int hf_netlogon_param_ctrl = -1;
 118 static int hf_netlogon_logon_id = -1;
 119 static int hf_netlogon_num_deltas = -1;
 120 static int hf_netlogon_user_session_key = -1;
 121 static int hf_netlogon_blob_size = -1;
 122 static int hf_netlogon_blob = -1;
 123 static int hf_netlogon_logon_attempts = -1;
 124 static int hf_netlogon_authoritative = -1;
 125 static int hf_netlogon_secure_channel_type = -1;
 126 static int hf_netlogon_logonsrv_handle = -1;
 127
 128 static gint ett_dcerpc_netlogon = -1;
 129 static gint ett_NETLOGON_SECURITY_DESCRIPTOR = -1;
 130 static gint ett_TYPE_1 = -1;
 131 static gint ett_TYPE_2 = -1;
 132 static gint ett_CYPHER_BLOCK = -1;
 133 static gint ett_NETLOGON_AUTHENTICATOR = -1;
 134 static gint ett_NETLOGON_LOGON_IDENTITY_INFO = -1;
 135 static gint ett_NETLOGON_INTERACTIVE_INFO = -1;
 136 static gint ett_NETLOGON_NETWORK_INFO = -1;
 137 static gint ett_NETLOGON_VALIDATION_SAM_INFO1 = -1;
 138 static gint ett_NETLOGON_VALIDATION_SAM_INFO2 = -1;
 139 static gint ett_TYPE_16 = -1;
 140 static gint ett_NETLOGON_SAM_DOMAIN_INFO = -1;
 141 static gint ett_NETLOGON_SAM_GROUP_INFO = -1;
 142 static gint ett_TYPE_23 = -1;
 143 static gint ett_NETLOGON_SAM_ACCOUNT_INFO = -1;
 144 static gint ett_NETLOGON_SAM_GROUP_MEM_INFO = -1;
 145 static gint ett_NETLOGON_SAM_ALIAS_INFO = -1;
 146 static gint ett_NETLOGON_SAM_ALIAS_MEM_INFO = -1;
 147 static gint ett_TYPE_30 = -1;
 148 static gint ett_TYPE_29 = -1;
 149 static gint ett_TYPE_31 = -1;
 150 static gint ett_TYPE_32 = -1;
 151 static gint ett_TYPE_33 = -1;
 152 static gint ett_TYPE_34 = -1;
 153 static gint ett_TYPE_35 = -1;
 154 static gint ett_SAM_DELTA = -1;
 155 static gint ett_SAM_DELTA_ARRAY = -1;
 156 static gint ett_TYPE_36 = -1;
 157 static gint ett_NETLOGON_INFO_1 = -1;
 158 static gint ett_NETLOGON_INFO_2 = -1;
 159 static gint ett_NETLOGON_INFO_3 = -1;
 160 static gint ett_NETLOGON_INFO_4 = -1;
 161 static gint ett_UNICODE_MULTI = -1;
 162 static gint ett_DOMAIN_CONTROLLER_INFO = -1;
 163 static gint ett_TYPE_46 = -1;
 164 static gint ett_TYPE_48 = -1;
 165 static gint ett_UNICODE_STRING_512 = -1;
 166 static gint ett_TYPE_50 = -1;
 167 static gint ett_TYPE_51 = -1;
 168 static gint ett_TYPE_52 = -1;
 169 static gint ett_NETLOGON_LEVEL = -1;
 170 static gint ett_NETLOGON_VALIDATION = -1;
 171 static gint ett_TYPE_19 = -1;
 172 static gint ett_NETLOGON_CONTROL_QUERY_INFO = -1;
 173 static gint ett_TYPE_44 = -1;
 174 static gint ett_TYPE_20 = -1;
 175 static gint ett_NETLOGON_INFO = -1;
 176 static gint ett_TYPE_45 = -1;
 177 static gint ett_TYPE_47 = -1;
 178 static gint ett_NETLOGON_CREDENTIAL = -1;
 179 static gint ett_GUID = -1;
 180 static gint ett_ENC_LM_OWF_PASSWORD = -1;
 181 static gint ett_LM_OWF_PASSWORD = -1;
 182 static gint ett_NT_OWF_PASSWORD = -1;
 183 static gint ett_GROUP_MEMBERSHIP = -1;
 184 static gint ett_USER_SESSION_KEY = -1;
 185 static gint ett_BLOB = -1;
 186 static gint ett_rid_array = -1;
 187 static gint ett_attrib_array = -1;
 188
 189 static e_uuid_t uuid_dcerpc_netlogon = {
 190         0x12345678, 0x1234, 0xabcd,
 191         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0xcf, 0xfb }
 192 };
 193
 194 static guint16 ver_dcerpc_netlogon = 1;
 195
 196
 197 static int
 198 netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
 199                              packet_info *pinfo, proto_tree *tree,
 200                              char *drep)
 201 {
 202         dcerpc_info *di;
 203
 204         di=pinfo->private_data;
 205         offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
 206                                      di->hf_index, NULL);
 207         return offset;
 208 }
 209
 210 static int
 211 netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
 212                              packet_info *pinfo, proto_tree *tree,
 213                              char *drep)
 214 {
 215         dcerpc_info *di;
 216
 217         di=pinfo->private_data;
 218         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
 219                                      di->hf_index, NULL);
 220         return offset;
 221 }
 222
 223 static int
 224 netlogon_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
 225                              packet_info *pinfo, proto_tree *tree,
 226                              char *drep)
 227 {
 228         dcerpc_info *di;
 229
 230         di=pinfo->private_data;
 231         if(di->conformant_run){
 232                 /*just a run to handle conformant arrays, nothing to dissect */
 233                 return offset;
 234         }
 235
 236         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 237                         di->hf_index, 0);
 238         return offset;
 239 }
 240
 241 int
 242 netlogon_dissect_UNICODE_STRING(tvbuff_t *tvb, int offset,
 243                         packet_info *pinfo, proto_tree *parent_tree,
 244                         char *drep, int type, int hf_index, int levels)
 245 {
 246         proto_item *item=NULL;
 247         proto_tree *tree=NULL;
 248         int old_offset=offset;
 249         dcerpc_info *di;
 250         char *name;
 251
 252         di=pinfo->private_data;
 253         if(di->conformant_run){
 254                 /*just a run to handle conformant arrays, nothing to dissect */
 255                 return offset;
 256         }
 257
 258         name = proto_registrar_get_name(hf_index);
 259         if(parent_tree){
 260                 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
 261                         "%s", name);
 262                 tree = proto_item_add_subtree(item, ett_nt_unicode_string);
 263         }
 264
 265         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 266                         dissect_ndr_nt_UNICODE_STRING_str, type,
 267                         name, hf_index, levels);
 268
 269         proto_item_set_len(item, offset-old_offset);
 270         return offset;
 271 }
 272
 273
 274 static int
 275 netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
 276                         packet_info *pinfo, proto_tree *parent_tree,
 277                         char *drep)
 278 {
 279         proto_item *item=NULL;
 280         proto_tree *tree=NULL;
 281         int old_offset=offset;
 282
 283         if(parent_tree){
 284                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 285                         "NETLOGON_SECURITY_DESCRIPTOR:");
 286                 tree = proto_item_add_subtree(item, ett_NETLOGON_SECURITY_DESCRIPTOR);
 287         }
 288
 289         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 290                 hf_netlogon_len, NULL);
 291
 292         offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
 293                 pinfo, tree, drep);
 294
 295         proto_item_set_len(item, offset-old_offset);
 296         return offset;
 297 }
 298
 299 static int
 300 netlogon_dissect_TYPE_1(tvbuff_t *tvb, int offset,
 301                         packet_info *pinfo, proto_tree *parent_tree,
 302                         char *drep)
 303 {
 304         proto_item *item=NULL;
 305         proto_tree *tree=NULL;
 306         int old_offset=offset;
 307
 308         if(parent_tree){
 309                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 310                         "TYPE_1:");
 311                 tree = proto_item_add_subtree(item, ett_TYPE_1);
 312         }
 313
 314         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 315                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 316                 "unknown", hf_netlogon_unknown_string, -1);
 317
 318         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 319                 hf_netlogon_unknown_long, NULL);
 320
 321         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 322                 hf_netlogon_unknown_long, NULL);
 323
 324         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 325                 hf_netlogon_unknown_long, NULL);
 326
 327         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 328                 hf_netlogon_unknown_long, NULL);
 329
 330         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 331                 hf_netlogon_unknown_long, NULL);
 332
 333         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 334                 hf_netlogon_unknown_long, NULL);
 335
 336         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 337                 hf_netlogon_unknown_long, NULL);
 338
 339         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 340                 hf_netlogon_unknown_long, NULL);
 341
 342         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 343                 hf_netlogon_unknown_long, NULL);
 344
 345         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 346                 hf_netlogon_unknown_long, NULL);
 347
 348         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 349                 hf_netlogon_unknown_long, NULL);
 350
 351         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 352                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 353                 "unknown", hf_netlogon_unknown_string, -1);
 354
 355         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 356                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 357                 "unknown", hf_netlogon_unknown_string, -1);
 358
 359         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 360                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
 361                 "unknown", hf_netlogon_unknown_string, -1);
 362
 363         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 364                 hf_netlogon_unknown_long, NULL);
 365
 366         proto_item_set_len(item, offset-old_offset);
 367         return offset;
 368 }
 369
 370 static int
 371 netlogon_dissect_TYPE_1_ptr(tvbuff_t *tvb, int offset,
 372                         packet_info *pinfo, proto_tree *tree,
 373                         char *drep)
 374 {
 375         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 376                 netlogon_dissect_TYPE_1, NDR_POINTER_PTR,
 377                 "TYPE_1 pointer: ", -1, 0);
 378         return offset;
 379 }
 380
 381 static int
 382 netlogon_dissect_TYPE_2(tvbuff_t *tvb, int offset,
 383                         packet_info *pinfo, proto_tree *parent_tree,
 384                         char *drep)
 385 {
 386         proto_item *item=NULL;
 387         proto_tree *tree=NULL;
 388         int old_offset=offset;
 389
 390         if(parent_tree){
 391                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 392                         "TYPE_2:");
 393                 tree = proto_item_add_subtree(item, ett_TYPE_2);
 394         }
 395
 396         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 397                 hf_netlogon_unknown_long, NULL);
 398
 399         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 400                 hf_netlogon_unknown_short, NULL);
 401
 402         proto_item_set_len(item, offset-old_offset);
 403         return offset;
 404 }
 405 #if 0
 406 static int
 407 netlogon_dissect_CYPHER_BLOCK(tvbuff_t *tvb, int offset,
 408                         packet_info *pinfo, proto_tree *parent_tree,
 409                         char *drep)
 410 {
 411         proto_item *item=NULL;
 412         proto_tree *tree=NULL;
 413         dcerpc_info *di;
 414
 415         di=pinfo->private_data;
 416         if(di->conformant_run){
 417                 /*just a run to handle conformant arrays, nothing to dissect.*/
 418                 return offset;
 419         }
 420
 421         if(parent_tree){
 422                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 423                         "CYPHER_BLOCK:");
 424                 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
 425         }
 426
 427         proto_tree_add_item(tree, hf_netlogon_cypher_block, tvb, offset, 8,
 428                 FALSE);
 429         offset += 8;
 430
 431         return offset;
 432 }
 433 #endif
 434
 435 static int
 436 netlogon_dissect_8_unknown_bytes(tvbuff_t *tvb, int offset,
 437                         packet_info *pinfo, proto_tree *parent_tree,
 438                         char *drep)
 439 {
 440         proto_item *item=NULL;
 441         proto_tree *tree=NULL;
 442         dcerpc_info *di;
 443
 444         di=pinfo->private_data;
 445         if(di->conformant_run){
 446                 /*just a run to handle conformant arrays, nothing to dissect.*/
 447                 return offset;
 448         }
 449
 450         if(parent_tree){
 451                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 452                         "unknown bytes not in IDL:");
 453                 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
 454         }
 455
 456         offset += 8;
 457
 458         return offset;
 459 }
 460
 461 static int
 462 netlogon_dissect_NETLOGON_CREDENTIAL(tvbuff_t *tvb, int offset,
 463                         packet_info *pinfo, proto_tree *parent_tree,
 464                         char *drep)
 465 {
 466         proto_item *item=NULL;
 467         proto_tree *tree=NULL;
 468         dcerpc_info *di;
 469
 470         di=pinfo->private_data;
 471         if(di->conformant_run){
 472                 /*just a run to handle conformant arrays, nothing to dissect.*/
 473                 return offset;
 474         }
 475
 476         if(parent_tree){
 477                 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
 478                         "NETLOGON_CREDENTIAL:");
 479                 tree = proto_item_add_subtree(item, ett_NETLOGON_CREDENTIAL);
 480         }
 481
 482         proto_tree_add_item(tree, hf_netlogon_credential, tvb, offset, 8,
 483                 FALSE);
 484         offset += 8;
 485
 486         return offset;
 487 }
 488
 489 static int
 490 netlogon_dissect_NETLOGON_AUTHENTICATOR(tvbuff_t *tvb, int offset,
 491                         packet_info *pinfo, proto_tree *parent_tree,
 492                         char *drep)
 493 {
 494         proto_item *item=NULL;
 495         proto_tree *tree=NULL;
 496         int old_offset=offset;
 497
 498         if(parent_tree){
 499                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 500                         "NETLOGON_AUTHENTICATOR:");
 501                 tree = proto_item_add_subtree(item, ett_NETLOGON_AUTHENTICATOR);
 502         }
 503
 504         offset = netlogon_dissect_NETLOGON_CREDENTIAL(tvb, offset,
 505                 pinfo, tree, drep);
 506
 507         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 508                 hf_netlogon_timestamp, NULL);
 509
 510         proto_item_set_len(item, offset-old_offset);
 511         return offset;
 512 }
 513
 514 static int
 515 netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset,
 516                         packet_info *pinfo, proto_tree *parent_tree,
 517                         char *drep)
 518 {
 519         proto_item *item=NULL;
 520         proto_tree *tree=NULL;
 521         dcerpc_info *di;
 522
 523         di=pinfo->private_data;
 524         if(di->conformant_run){
 525                 /*just a run to handle conformant arrays, nothing to dissect.*/
 526                 return offset;
 527         }
 528
 529         if(parent_tree){
 530                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 531                         "USER_SESSION_KEY:");
 532                 tree = proto_item_add_subtree(item, ett_USER_SESSION_KEY);
 533         }
 534
 535         proto_tree_add_item(tree, hf_netlogon_user_session_key, tvb, offset, 16,
 536                 FALSE);
 537         offset += 16;
 538
 539         return offset;
 540 }
 541
 542 static int
 543 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 544                         packet_info *pinfo, proto_tree *parent_tree,
 545                         char *drep)
 546 {
 547         proto_item *item=NULL;
 548         proto_tree *tree=NULL;
 549         dcerpc_info *di;
 550
 551         di=pinfo->private_data;
 552         if(di->conformant_run){
 553                 /*just a run to handle conformant arrays, nothing to dissect.*/
 554                 return offset;
 555         }
 556
 557         if(parent_tree){
 558                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 559                         "ENCRYPTED_LM_OWF_PASSWORD:");
 560                 tree = proto_item_add_subtree(item, ett_ENC_LM_OWF_PASSWORD);
 561         }
 562
 563         proto_tree_add_item(tree, hf_netlogon_encrypted_lm_owf_password, tvb, offset, 16,
 564                 FALSE);
 565         offset += 16;
 566
 567         return offset;
 568 }
 569
 570 static int
 571 netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 572                         packet_info *pinfo, proto_tree *parent_tree,
 573                         char *drep)
 574 {
 575         proto_item *item=NULL;
 576         proto_tree *tree=NULL;
 577         dcerpc_info *di;
 578
 579         di=pinfo->private_data;
 580         if(di->conformant_run){
 581                 /*just a run to handle conformant arrays, nothing to dissect.*/
 582                 return offset;
 583         }
 584
 585         if(parent_tree){
 586                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 587                         "LM_OWF_PASSWORD:");
 588                 tree = proto_item_add_subtree(item, ett_LM_OWF_PASSWORD);
 589         }
 590
 591         proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16,
 592                 FALSE);
 593         offset += 16;
 594
 595         return offset;
 596 }
 597
 598 static int
 599 netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
 600                         packet_info *pinfo, proto_tree *parent_tree,
 601                         char *drep)
 602 {
 603         proto_item *item=NULL;
 604         proto_tree *tree=NULL;
 605         dcerpc_info *di;
 606
 607         di=pinfo->private_data;
 608         if(di->conformant_run){
 609                 /*just a run to handle conformant arrays, nothing to dissect.*/
 610                 return offset;
 611         }
 612
 613         if(parent_tree){
 614                 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
 615                         "NT_OWF_PASSWORD:");
 616                 tree = proto_item_add_subtree(item, ett_NT_OWF_PASSWORD);
 617         }
 618
 619         proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16,
 620                 FALSE);
 621         offset += 16;
 622
 623         return offset;
 624 }
 625
 626
 627 static int
 628 netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
 629                         packet_info *pinfo, proto_tree *parent_tree,
 630                         char *drep)
 631 {
 632         proto_item *item=NULL;
 633         proto_tree *tree=NULL;
 634
 635         if(parent_tree){
 636                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 637                         "NETLOGON_LOGON_IDENTITY_INFO:");
 638                 tree = proto_item_add_subtree(item, ett_NETLOGON_LOGON_IDENTITY_INFO);
 639         }
 640
 641         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 642                 hf_netlogon_logon_dom, 0);
 643
 644         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 645                 hf_netlogon_param_ctrl, NULL);
 646
 647         offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
 648                 hf_netlogon_logon_id, NULL);
 649
 650         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 651                 hf_netlogon_acct_name, 0);
 652
 653         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 654                 hf_netlogon_computer_name, 0);
 655
 656         /* XXX 8 extra bytes here */
 657         /* there were 8 extra bytes, either here or in NETWORK_INFO that does not match
 658            the idl file. Could be a bug in either the NETLOGON implementation or in the
 659            idl file.
 660         */
 661         offset = netlogon_dissect_8_unknown_bytes(tvb, offset, pinfo, tree, drep);
 662
 663         return offset;
 664 }
 665
 666 static int
 667 netlogon_dissect_NETLOGON_INTERACTIVE_INFO(tvbuff_t *tvb, int offset,
 668                         packet_info *pinfo, proto_tree *parent_tree,
 669                         char *drep)
 670 {
 671         proto_item *item=NULL;
 672         proto_tree *tree=NULL;
 673         int old_offset=offset;
 674
 675         if(parent_tree){
 676                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 677                         "NETLOGON_INTERACTIVE_INFO:");
 678                 tree = proto_item_add_subtree(item, ett_NETLOGON_INTERACTIVE_INFO);
 679         }
 680
 681         offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
 682                 pinfo, tree, drep);
 683
 684         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
 685                 pinfo, tree, drep);
 686
 687         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
 688                 pinfo, tree, drep);
 689
 690         proto_item_set_len(item, offset-old_offset);
 691         return offset;
 692 }
 693
 694 static int
 695 netlogon_dissect_NETLOGON_NETWORK_INFO(tvbuff_t *tvb, int offset,
 696                         packet_info *pinfo, proto_tree *parent_tree,
 697                         char *drep)
 698 {
 699         proto_item *item=NULL;
 700         proto_tree *tree=NULL;
 701         int old_offset=offset;
 702
 703         if(parent_tree){
 704                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 705                         "NETLOGON_NETWORK_INFO:");
 706                 tree = proto_item_add_subtree(item, ett_NETLOGON_NETWORK_INFO);
 707         }
 708
 709         offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
 710                 pinfo, tree, drep);
 711
 712         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 713                 hf_netlogon_nt_chal_resp, 0);
 714
 715         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
 716                 hf_netlogon_lm_chal_resp, 0);
 717
 718         proto_item_set_len(item, offset-old_offset);
 719         return offset;
 720 }
 721
 722 static int
 723 netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
 724                         packet_info *pinfo, proto_tree *parent_tree,
 725                         char *drep)
 726 {
 727         proto_item *item=NULL;
 728         proto_tree *tree=NULL;
 729
 730         if(parent_tree){
 731                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 732                         "GROUP_MEMBERSHIP:");
 733                 tree = proto_item_add_subtree(item, ett_GROUP_MEMBERSHIP);
 734         }
 735
 736         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 737                 hf_netlogon_user_rid, NULL);
 738
 739         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 740                 hf_netlogon_attrs, NULL);
 741
 742         return offset;
 743 }
 744
 745 static int
 746 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset,
 747                         packet_info *pinfo, proto_tree *tree,
 748                         char *drep)
 749 {
 750         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
 751                 netlogon_dissect_GROUP_MEMBERSHIP);
 752
 753         return offset;
 754 }
 755
 756 static int
 757 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1(tvbuff_t *tvb, int offset,
 758                         packet_info *pinfo, proto_tree *parent_tree,
 759                         char *drep)
 760 {
 761         proto_item *item=NULL;
 762         proto_tree *tree=NULL;
 763         int old_offset=offset;
 764         int i;
 765
 766         if(parent_tree){
 767                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 768                         "NETLOGON_VALIDATION_SAM_INFO1:");
 769                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO1);
 770         }
 771
 772         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 773                 hf_netlogon_logon_time);
 774
 775         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 776                 hf_netlogon_logoff_time);
 777
 778         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 779                 hf_netlogon_kickoff_time);
 780
 781         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 782                 hf_netlogon_pwd_last_set_time);
 783
 784         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 785                 hf_netlogon_pwd_can_change_time);
 786
 787         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 788                 hf_netlogon_pwd_must_change_time);
 789
 790         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 791                 hf_netlogon_acct_name, 0);
 792
 793         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 794                 hf_netlogon_full_name, 0);
 795
 796         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 797                 hf_netlogon_logon_script, 0);
 798
 799         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 800                 hf_netlogon_profile_path, 0);
 801
 802         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 803                 hf_netlogon_home_dir, 0);
 804
 805         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 806                 hf_netlogon_dir_drive, 0);
 807
 808         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 809                 hf_netlogon_logon_count, NULL);
 810
 811         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 812                 hf_netlogon_bad_pw_count, NULL);
 813
 814         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 815                 hf_netlogon_user_rid, NULL);
 816
 817         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 818                 hf_netlogon_group_rid, NULL);
 819
 820         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 821                 hf_netlogon_num_rids, NULL);
 822
 823         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 824                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_PTR,
 825                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 826
 827         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 828                 hf_netlogon_user_flags, NULL);
 829
 830         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 831                 pinfo, tree, drep);
 832
 833         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 834                 hf_netlogon_logon_srv, 0);
 835
 836         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 837                 hf_netlogon_logon_dom, 0);
 838
 839         offset = dissect_ndr_nt_PSID(tvb, offset,
 840                 pinfo, tree, drep);
 841
 842         for(i=0;i<10;i++){
 843                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 844                         hf_netlogon_unknown_long, NULL);
 845         }
 846
 847         proto_item_set_len(item, offset-old_offset);
 848         return offset;
 849 }
 850
 851 static int
 852 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset,
 853                         packet_info *pinfo, proto_tree *parent_tree,
 854                         char *drep)
 855 {
 856         proto_item *item=NULL;
 857         proto_tree *tree=NULL;
 858         int old_offset=offset;
 859         int i;
 860
 861         if(parent_tree){
 862                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 863                         "NETLOGON_VALIDATION_SAM_INFO2:");
 864                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO2);
 865         }
 866
 867         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 868                 hf_netlogon_logon_time);
 869
 870         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 871                 hf_netlogon_logoff_time);
 872
 873         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 874                 hf_netlogon_kickoff_time);
 875
 876         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 877                 hf_netlogon_pwd_last_set_time);
 878
 879         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 880                 hf_netlogon_pwd_can_change_time);
 881
 882         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 883                 hf_netlogon_pwd_must_change_time);
 884
 885         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 886                 hf_netlogon_acct_name, 0);
 887
 888         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 889                 hf_netlogon_full_name, 0);
 890
 891         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 892                 hf_netlogon_logon_script, 0);
 893
 894         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 895                 hf_netlogon_profile_path, 0);
 896
 897         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 898                 hf_netlogon_home_dir, 0);
 899
 900         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 901                 hf_netlogon_dir_drive, 0);
 902
 903         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 904                 hf_netlogon_logon_count, NULL);
 905
 906         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
 907                 hf_netlogon_bad_pw_count, NULL);
 908
 909         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 910                 hf_netlogon_user_rid, NULL);
 911
 912         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 913                 hf_netlogon_group_rid, NULL);
 914
 915         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 916                 hf_netlogon_num_rids, NULL);
 917
 918         /* XXX i am not sure about this pointer being UNIQUE, though I am
 919            pretty convinced that it is NOT PTR as the idl file suggests.
 920         */
 921         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 922                 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
 923                 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
 924
 925         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 926                 hf_netlogon_user_flags, NULL);
 927
 928         offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
 929                 pinfo, tree, drep);
 930
 931         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 932                 hf_netlogon_logon_srv, 0);
 933
 934         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 935                 hf_netlogon_logon_dom, 0);
 936
 937         offset = dissect_ndr_nt_PSID(tvb, offset,
 938                 pinfo, tree, drep);
 939
 940         for(i=0;i<10;i++){
 941                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 942                         hf_netlogon_unknown_long, NULL);
 943         }
 944
 945         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
 946                 hf_netlogon_num_other_groups, NULL);
 947
 948         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
 949                 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_PTR,
 950                 "SID_AND_ATTRIBUTES_ARRAY:", -1, 0);
 951
 952         proto_item_set_len(item, offset-old_offset);
 953         return offset;
 954 }
 955
 956 static int
 957 netlogon_dissect_TYPE_16(tvbuff_t *tvb, int offset,
 958                         packet_info *pinfo, proto_tree *parent_tree,
 959                         char *drep)
 960 {
 961         proto_item *item=NULL;
 962         proto_tree *tree=NULL;
 963         int old_offset=offset;
 964
 965         if(parent_tree){
 966                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 967                         "TYPE_16:");
 968                 tree = proto_item_add_subtree(item, ett_TYPE_16);
 969         }
 970
 971         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
 972                 hf_netlogon_unknown_time);
 973
 974         proto_item_set_len(item, offset-old_offset);
 975         return offset;
 976 }
 977
 978
 979 static int
 980 netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO(tvbuff_t *tvb, int offset,
 981                         packet_info *pinfo, proto_tree *parent_tree,
 982                         char *drep)
 983 {
 984         proto_item *item=NULL;
 985         proto_tree *tree=NULL;
 986         int old_offset=offset;
 987
 988         if(parent_tree){
 989                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
 990                         "NETLOGON_SAM_DOMAIN_INFO:");
 991                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_DOMAIN_INFO);
 992         }
 993
 994         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 995                 hf_netlogon_unknown_string, 0);
 996
 997         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
 998                 hf_netlogon_unknown_string, 0);
 999
1000         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1001                 hf_netlogon_unknown_time);
1002
1003         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1004                 hf_netlogon_unknown_short, NULL);
1005
1006         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1007                 hf_netlogon_unknown_short, NULL);
1008
1009         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1010                 hf_netlogon_unknown_time);
1011
1012         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1013                 hf_netlogon_unknown_time);
1014
1015         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1016                 hf_netlogon_unknown_time);
1017
1018         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1019                 hf_netlogon_unknown_time);
1020
1021         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1022                 hf_netlogon_unknown_string, 0);
1023
1024         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1025                 hf_netlogon_unknown_string, 0);
1026
1027         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1028                 hf_netlogon_unknown_string, 0);
1029
1030         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1031                 hf_netlogon_unknown_string, 0);
1032
1033         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1034                 hf_netlogon_unknown_string, 0);
1035
1036         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1037                 hf_netlogon_unknown_long, NULL);
1038
1039         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1040                 hf_netlogon_unknown_long, NULL);
1041
1042         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1043                 hf_netlogon_unknown_long, NULL);
1044
1045         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1046                 hf_netlogon_unknown_long, NULL);
1047
1048         proto_item_set_len(item, offset-old_offset);
1049         return offset;
1050 }
1051
1052
1053 static int
1054 netlogon_dissect_NETLOGON_SAM_GROUP_INFO(tvbuff_t *tvb, int offset,
1055                         packet_info *pinfo, proto_tree *parent_tree,
1056                         char *drep)
1057 {
1058         proto_item *item=NULL;
1059         proto_tree *tree=NULL;
1060         int old_offset=offset;
1061
1062         if(parent_tree){
1063                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1064                         "NETLOGON_SAM_GROUP_INFO:");
1065                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_INFO);
1066         }
1067
1068         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1069                 hf_netlogon_group_name, 0);
1070
1071         offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset,
1072                 pinfo, tree, drep);
1073
1074         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1075                 hf_netlogon_group_desc, 0);
1076
1077         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1078                 pinfo, tree, drep);
1079
1080         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1081                 hf_netlogon_unknown_string, 0);
1082
1083         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1084                 hf_netlogon_unknown_string, 0);
1085
1086         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1087                 hf_netlogon_unknown_string, 0);
1088
1089         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1090                 hf_netlogon_unknown_string, 0);
1091
1092         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1093                 hf_netlogon_unknown_long, NULL);
1094
1095         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1096                 hf_netlogon_unknown_long, NULL);
1097
1098         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1099                 hf_netlogon_unknown_long, NULL);
1100
1101         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1102                 hf_netlogon_unknown_long, NULL);
1103
1104         proto_item_set_len(item, offset-old_offset);
1105         return offset;
1106 }
1107
1108
1109 static int
1110 netlogon_dissect_TYPE_23(tvbuff_t *tvb, int offset,
1111                         packet_info *pinfo, proto_tree *parent_tree,
1112                         char *drep)
1113 {
1114         proto_item *item=NULL;
1115         proto_tree *tree=NULL;
1116         int old_offset=offset;
1117
1118         if(parent_tree){
1119                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1120                         "TYPE_23:");
1121                 tree = proto_item_add_subtree(item, ett_TYPE_23);
1122         }
1123
1124         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1125                 hf_netlogon_unknown_string, 0);
1126
1127         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1128                 hf_netlogon_unknown_string, 0);
1129
1130         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1131                 hf_netlogon_unknown_string, 0);
1132
1133         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1134                 hf_netlogon_unknown_string, 0);
1135
1136         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1137                 hf_netlogon_unknown_string, 0);
1138
1139         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1140                 hf_netlogon_unknown_string, 0);
1141
1142         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1143                 hf_netlogon_unknown_long, NULL);
1144
1145         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1146                 hf_netlogon_unknown_long, NULL);
1147
1148         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1149                 hf_netlogon_unknown_long, NULL);
1150
1151         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1152                 hf_netlogon_unknown_long, NULL);
1153
1154         proto_item_set_len(item, offset-old_offset);
1155         return offset;
1156 }
1157
1158
1159 static int
1160 netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO(tvbuff_t *tvb, int offset,
1161                         packet_info *pinfo, proto_tree *parent_tree,
1162                         char *drep)
1163 {
1164         proto_item *item=NULL;
1165         proto_tree *tree=NULL;
1166         int old_offset=offset;
1167
1168         if(parent_tree){
1169                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1170                         "NETLOGON_SAM_ACCOUNT_INFO:");
1171                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ACCOUNT_INFO);
1172         }
1173
1174         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1175                 hf_netlogon_acct_name, 0);
1176
1177         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1178                 hf_netlogon_full_name, 0);
1179
1180         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1181                 hf_netlogon_user_rid, NULL);
1182
1183         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1184                 hf_netlogon_group_rid, NULL);
1185
1186         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1187                 hf_netlogon_home_dir, 0);
1188
1189         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1190                 hf_netlogon_dir_drive, 0);
1191
1192         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1193                 hf_netlogon_logon_script, 0);
1194
1195         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1196                 hf_netlogon_acct_desc, 0);
1197
1198         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1199                 hf_netlogon_workstations, 0);
1200
1201         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1202                 hf_netlogon_logon_time);
1203
1204         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1205                 hf_netlogon_logoff_time);
1206
1207         offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
1208
1209         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1210                 hf_netlogon_bad_pw_count, NULL);
1211
1212         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1213                 hf_netlogon_logon_count, NULL);
1214
1215         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1216                 hf_netlogon_pwd_last_set_time);
1217
1218         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1219                 hf_netlogon_acct_expiry_time);
1220
1221         offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
1222
1223         offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
1224                 pinfo, tree, drep);
1225
1226         offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
1227                 pinfo, tree, drep);
1228
1229         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1230                 hf_netlogon_nt_pwd_present, NULL);
1231
1232         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1233                 hf_netlogon_lm_pwd_present, NULL);
1234
1235         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1236                 hf_netlogon_pwd_expired, NULL);
1237
1238         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1239                 hf_netlogon_comment, 0);
1240
1241         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1242                 hf_netlogon_parameters, 0);
1243
1244         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1245                 hf_netlogon_country, NULL);
1246
1247         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1248                 hf_netlogon_codepage, NULL);
1249
1250         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1251                 hf_netlogon_num_pwd_pairs, NULL);
1252
1253         offset = lsa_dissect_LSA_SECRET(tvb, offset,
1254                 pinfo, tree, drep);
1255
1256         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1257                 pinfo, tree, drep);
1258
1259         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1260                 hf_netlogon_profile_path, 0);
1261
1262         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1263                 hf_netlogon_unknown_string, 0);
1264
1265         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1266                 hf_netlogon_unknown_string, 0);
1267
1268         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1269                 hf_netlogon_unknown_string, 0);
1270
1271         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1272                 hf_netlogon_unknown_long, NULL);
1273
1274         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1275                 hf_netlogon_unknown_long, NULL);
1276
1277         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1278                 hf_netlogon_unknown_long, NULL);
1279
1280         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1281                 hf_netlogon_unknown_long, NULL);
1282
1283         proto_item_set_len(item, offset-old_offset);
1284         return offset;
1285 }
1286
1287
1288 static int
1289 netlogon_dissect_rid(tvbuff_t *tvb, int offset,
1290                         packet_info *pinfo, proto_tree *tree,
1291                         char *drep)
1292 {
1293         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1294                                 hf_netlogon_user_rid, NULL);
1295
1296         return offset;
1297 }
1298
1299 static int
1300 netlogon_dissect_rids_array(tvbuff_t *tvb, int offset,
1301                         packet_info *pinfo, proto_tree *parent_tree,
1302                         char *drep)
1303 {
1304         proto_item *item=NULL;
1305         proto_tree *tree=NULL;
1306         int old_offset=offset;
1307
1308         if(parent_tree){
1309                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1310                         "RID array:");
1311                 tree = proto_item_add_subtree(item, ett_rid_array);
1312         }
1313
1314         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1315                         netlogon_dissect_rid);
1316
1317         proto_item_set_len(item, offset-old_offset);
1318         return offset;
1319 }
1320
1321 static int
1322 netlogon_dissect_attrib(tvbuff_t *tvb, int offset,
1323                         packet_info *pinfo, proto_tree *tree,
1324                         char *drep)
1325 {
1326         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1327                 hf_netlogon_attrs, NULL);
1328
1329         return offset;
1330 }
1331
1332 static int
1333 netlogon_dissect_attribs_array(tvbuff_t *tvb, int offset,
1334                         packet_info *pinfo, proto_tree *parent_tree,
1335                         char *drep)
1336 {
1337         proto_item *item=NULL;
1338         proto_tree *tree=NULL;
1339         int old_offset=offset;
1340
1341         if(parent_tree){
1342                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1343                         "Attrib array:");
1344                 tree = proto_item_add_subtree(item, ett_attrib_array);
1345         }
1346
1347         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1348                         netlogon_dissect_attrib);
1349
1350         proto_item_set_len(item, offset-old_offset);
1351         return offset;
1352 }
1353
1354 static int
1355 netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO(tvbuff_t *tvb, int offset,
1356                         packet_info *pinfo, proto_tree *parent_tree,
1357                         char *drep)
1358 {
1359         proto_item *item=NULL;
1360         proto_tree *tree=NULL;
1361         int old_offset=offset;
1362
1363         if(parent_tree){
1364                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1365                         "NETLOGON_SAM_GROUP_MEM_INFO:");
1366                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_MEM_INFO);
1367         }
1368
1369         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1370                 netlogon_dissect_rids_array, NDR_POINTER_PTR,
1371                 "RIDs:", -1, 0);
1372
1373         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1374                 netlogon_dissect_attribs_array, NDR_POINTER_PTR,
1375                 "Attribs:", -1, 0);
1376
1377         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1378                 hf_netlogon_num_rids, NULL);
1379
1380         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1381                 hf_netlogon_unknown_long, NULL);
1382
1383         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1384                 hf_netlogon_unknown_long, NULL);
1385
1386         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1387                 hf_netlogon_unknown_long, NULL);
1388
1389         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1390                 hf_netlogon_unknown_long, NULL);
1391
1392         proto_item_set_len(item, offset-old_offset);
1393         return offset;
1394 }
1395
1396
1397 static int
1398 netlogon_dissect_NETLOGON_SAM_ALIAS_INFO(tvbuff_t *tvb, int offset,
1399                         packet_info *pinfo, proto_tree *parent_tree,
1400                         char *drep)
1401 {
1402         proto_item *item=NULL;
1403         proto_tree *tree=NULL;
1404         int old_offset=offset;
1405
1406         if(parent_tree){
1407                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1408                         "NETLOGON_SAM_ALIAS_INFO:");
1409                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_INFO);
1410         }
1411
1412
1413         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1414                 hf_netlogon_alias_name, 0);
1415
1416         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1417                 hf_netlogon_alias_rid, NULL);
1418
1419         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1420                 pinfo, tree, drep);
1421
1422         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1423                 hf_netlogon_acct_desc, 0);
1424
1425         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1426                 hf_netlogon_unknown_string, 0);
1427
1428         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1429                 hf_netlogon_unknown_string, 0);
1430
1431         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1432                 hf_netlogon_unknown_string, 0);
1433
1434         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1435                 hf_netlogon_unknown_long, NULL);
1436
1437         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1438                 hf_netlogon_unknown_long, NULL);
1439
1440         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1441                 hf_netlogon_unknown_long, NULL);
1442
1443         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1444                 hf_netlogon_unknown_long, NULL);
1445
1446         proto_item_set_len(item, offset-old_offset);
1447         return offset;
1448 }
1449
1450
1451 static int
1452 netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO(tvbuff_t *tvb, int offset,
1453                         packet_info *pinfo, proto_tree *parent_tree,
1454                         char *drep)
1455 {
1456         proto_item *item=NULL;
1457         proto_tree *tree=NULL;
1458         int old_offset=offset;
1459
1460         if(parent_tree){
1461                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1462                         "NETLOGON_SAM_ALIAS_MEM_INFO:");
1463                 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_MEM_INFO);
1464         }
1465
1466         offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, drep);
1467
1468         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1469                 hf_netlogon_unknown_long, NULL);
1470
1471         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1472                 hf_netlogon_unknown_long, NULL);
1473
1474         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1475                 hf_netlogon_unknown_long, NULL);
1476
1477         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1478                 hf_netlogon_unknown_long, NULL);
1479
1480         proto_item_set_len(item, offset-old_offset);
1481         return offset;
1482 }
1483
1484 static int
1485 netlogon_dissect_TYPE_30(tvbuff_t *tvb, int offset,
1486                         packet_info *pinfo, proto_tree *parent_tree,
1487                         char *drep)
1488 {
1489         proto_item *item=NULL;
1490         proto_tree *tree=NULL;
1491         int old_offset=offset;
1492
1493         if(parent_tree){
1494                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1495                         "TYPE_30:");
1496                 tree = proto_item_add_subtree(item, ett_TYPE_30);
1497         }
1498
1499         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1500                 hf_netlogon_unknown_long, NULL);
1501
1502         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1503                 hf_netlogon_unknown_long, NULL);
1504
1505         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1506                 hf_netlogon_unknown_long, NULL);
1507
1508         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1509                 hf_netlogon_unknown_long, NULL);
1510
1511         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1512                 hf_netlogon_unknown_long, NULL);
1513
1514         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1515                 hf_netlogon_unknown_time);
1516
1517         proto_item_set_len(item, offset-old_offset);
1518         return offset;
1519 }
1520
1521 static int
1522 netlogon_dissect_element_422(tvbuff_t *tvb, int offset,
1523                         packet_info *pinfo, proto_tree *tree,
1524                         char *drep)
1525 {
1526         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1527                 hf_netlogon_unknown_long, NULL);
1528
1529         return offset;
1530 }
1531
1532 static int
1533 netlogon_dissect_element_422_array(tvbuff_t *tvb, int offset,
1534                         packet_info *pinfo, proto_tree *tree,
1535                         char *drep)
1536 {
1537         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1538                 netlogon_dissect_element_422);
1539
1540         return offset;
1541 }
1542
1543
1544 static int
1545 netlogon_dissect_TYPE_29(tvbuff_t *tvb, int offset,
1546                         packet_info *pinfo, proto_tree *parent_tree,
1547                         char *drep)
1548 {
1549         proto_item *item=NULL;
1550         proto_tree *tree=NULL;
1551         int old_offset=offset;
1552
1553         if(parent_tree){
1554                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1555                         "TYPE_29:");
1556                 tree = proto_item_add_subtree(item, ett_TYPE_29);
1557         }
1558
1559         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1560                 hf_netlogon_unknown_long, NULL);
1561
1562         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1563                 hf_netlogon_unknown_time);
1564
1565         offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1566                 hf_netlogon_unknown_char, NULL);
1567
1568         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1569                 hf_netlogon_unknown_long, NULL);
1570
1571         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1572                 netlogon_dissect_element_422_array, NDR_POINTER_PTR,
1573                 "unknown", -1, 0);
1574
1575         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1576                 hf_netlogon_unknown_string, 0);
1577
1578         offset = dissect_ndr_nt_PSID(tvb, offset,
1579                 pinfo, tree, drep);
1580
1581         offset = netlogon_dissect_TYPE_30(tvb, offset,
1582                 pinfo, tree, drep);
1583
1584         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1585                 hf_netlogon_unknown_time);
1586
1587         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1588                 hf_netlogon_unknown_time);
1589
1590         offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1591                 pinfo, tree, drep);
1592
1593         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1594                 hf_netlogon_unknown_string, 0);
1595
1596         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1597                 hf_netlogon_unknown_string, 0);
1598
1599         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1600                 hf_netlogon_unknown_string, 0);
1601
1602         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1603                 hf_netlogon_unknown_string, 0);
1604
1605         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1606                 hf_netlogon_unknown_long, NULL);
1607
1608         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1609                 hf_netlogon_unknown_long, NULL);
1610
1611         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1612                 hf_netlogon_unknown_long, NULL);
1613
1614         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1615                 hf_netlogon_unknown_long, NULL);
1616
1617         proto_item_set_len(item, offset-old_offset);
1618         return offset;
1619 }
1620
1621
1622 static int
1623 netlogon_dissect_TYPE_31(tvbuff_t *tvb, int offset,
1624                         packet_info *pinfo, proto_tree *parent_tree,
1625                         char *drep)
1626 {
1627         proto_item *item=NULL;
1628         proto_tree *tree=NULL;
1629         int old_offset=offset;
1630
1631         if(parent_tree){
1632                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1633                         "TYPE_31:");
1634                 tree = proto_item_add_subtree(item, ett_TYPE_31);
1635         }
1636
1637         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1638                 hf_netlogon_unknown_string, 0);
1639
1640         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1641                 hf_netlogon_unknown_string, 0);
1642
1643         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1644                 hf_netlogon_unknown_long, NULL);
1645
1646         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1647                 hf_netlogon_unknown_string, 0);
1648
1649         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1650                 hf_netlogon_unknown_string, 0);
1651
1652         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1653                 hf_netlogon_unknown_string, 0);
1654
1655         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1656                 hf_netlogon_unknown_string, 0);
1657
1658         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1659                 hf_netlogon_unknown_string, 0);
1660
1661         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1662                 hf_netlogon_unknown_long, NULL);
1663
1664         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1665                 hf_netlogon_unknown_long, NULL);
1666
1667         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1668                 hf_netlogon_unknown_long, NULL);
1669
1670         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1671                 hf_netlogon_unknown_long, NULL);
1672
1673         proto_item_set_len(item, offset-old_offset);
1674         return offset;
1675 }
1676
1677 #if 0
1678 static int
1679 netlogon_dissect_TYPE_32(tvbuff_t *tvb, int offset,
1680                         packet_info *pinfo, proto_tree *parent_tree,
1681                         char *drep)
1682 {
1683         proto_item *item=NULL;
1684         proto_tree *tree=NULL;
1685         int old_offset=offset;
1686
1687         if(parent_tree){
1688                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1689                         "TYPE_32:");
1690                 tree = proto_item_add_subtree(item, ett_TYPE_32);
1691         }
1692
1693         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1694                 hf_netlogon_unknown_string, 0);
1695
1696         proto_item_set_len(item, offset-old_offset);
1697         return offset;
1698 }
1699 #endif
1700
1701 static int
1702 netlogon_dissect_attrs(tvbuff_t *tvb, int offset,
1703                         packet_info *pinfo, proto_tree *tree,
1704                         char *drep)
1705 {
1706         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1707                 hf_netlogon_attrs, NULL);
1708
1709         return offset;
1710 }
1711
1712 static int
1713 netlogon_dissect_attrs_array(tvbuff_t *tvb, int offset,
1714                         packet_info *pinfo, proto_tree *tree,
1715                         char *drep)
1716 {
1717         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1718                 netlogon_dissect_attrs);
1719
1720         return offset;
1721 }
1722
1723
1724 static int
1725 netlogon_dissect_TYPE_33(tvbuff_t *tvb, int offset,
1726                         packet_info *pinfo, proto_tree *parent_tree,
1727                         char *drep)
1728 {
1729         proto_item *item=NULL;
1730         proto_tree *tree=NULL;
1731         int old_offset=offset;
1732
1733         if(parent_tree){
1734                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1735                         "TYPE_33:");
1736                 tree = proto_item_add_subtree(item, ett_TYPE_33);
1737         }
1738
1739
1740         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1741                 hf_netlogon_count, NULL);
1742
1743         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1744                 hf_netlogon_unknown_long, NULL);
1745
1746         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1747                 netlogon_dissect_attrs_array, NDR_POINTER_PTR,
1748                 "ATTRS_ARRAY:", -1, 0);
1749
1750         offset = netlogon_dissect_TYPE_30(tvb, offset,
1751                 pinfo, tree, drep);
1752
1753         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1754                 hf_netlogon_unknown_long, NULL);
1755
1756         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1757                 hf_netlogon_unknown_long, NULL);
1758
1759         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1760                 hf_netlogon_unknown_string, 0);
1761
1762         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1763                 hf_netlogon_unknown_string, 0);
1764
1765         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1766                 hf_netlogon_unknown_string, 0);
1767
1768         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1769                 hf_netlogon_unknown_string, 0);
1770
1771         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1772                 hf_netlogon_unknown_string, 0);
1773
1774         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1775                 hf_netlogon_unknown_long, NULL);
1776
1777         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1778                 hf_netlogon_unknown_long, NULL);
1779
1780         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1781                 hf_netlogon_unknown_long, NULL);
1782
1783         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1784                 hf_netlogon_unknown_long, NULL);
1785
1786         proto_item_set_len(item, offset-old_offset);
1787         return offset;
1788 }
1789
1790
1791 static int
1792 netlogon_dissect_TYPE_34(tvbuff_t *tvb, int offset,
1793                         packet_info *pinfo, proto_tree *parent_tree,
1794                         char *drep)
1795 {
1796         proto_item *item=NULL;
1797         proto_tree *tree=NULL;
1798         int old_offset=offset;
1799
1800         if(parent_tree){
1801                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1802                         "TYPE_34:");
1803                 tree = proto_item_add_subtree(item, ett_TYPE_34);
1804         }
1805
1806         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1807                 hf_netlogon_unknown_string, 0);
1808
1809         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1810                 hf_netlogon_unknown_time);
1811
1812         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1813                 hf_netlogon_unknown_string, 0);
1814
1815         offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1816                 hf_netlogon_unknown_time);
1817
1818         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1819                 hf_netlogon_unknown_long, NULL);
1820
1821         offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1822                 hf_netlogon_unknown_string, 0);
1823
1824         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1825                 hf_netlogon_unknown_string, 0);
1826
1827         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1828                 hf_netlogon_unknown_string, 0);
1829
1830         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1831                 hf_netlogon_unknown_string, 0);
1832
1833         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1834                 hf_netlogon_unknown_string, 0);
1835
1836         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1837                 hf_netlogon_unknown_long, NULL);
1838
1839         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1840                 hf_netlogon_unknown_long, NULL);
1841
1842         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1843                 hf_netlogon_unknown_long, NULL);
1844
1845         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1846                 hf_netlogon_unknown_long, NULL);
1847
1848         proto_item_set_len(item, offset-old_offset);
1849         return offset;
1850 }
1851
1852 static int
1853 netlogon_dissect_TYPE_35(tvbuff_t *tvb, int offset,
1854                         packet_info *pinfo, proto_tree *parent_tree,
1855                         char *drep)
1856 {
1857         proto_item *item=NULL;
1858         proto_tree *tree=NULL;
1859         int old_offset=offset;
1860
1861         if(parent_tree){
1862                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1863                         "TYPE_35:");
1864                 tree = proto_item_add_subtree(item, ett_TYPE_35);
1865         }
1866
1867         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1868                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1869                 "unknown", hf_netlogon_unknown_string, -1);
1870
1871         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1872                 hf_netlogon_unknown_string, 0);
1873
1874         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1875                 hf_netlogon_unknown_string, 0);
1876
1877         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1878                 hf_netlogon_unknown_string, 0);
1879
1880         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1881                 hf_netlogon_unknown_string, 0);
1882
1883         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1884                 hf_netlogon_unknown_long, NULL);
1885
1886         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1887                 hf_netlogon_unknown_long, NULL);
1888
1889         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1890                 hf_netlogon_unknown_long, NULL);
1891
1892         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1893                 hf_netlogon_unknown_long, NULL);
1894
1895         proto_item_set_len(item, offset-old_offset);
1896         return offset;
1897 }
1898
1899 static int
1900 netlogon_dissect_WCHAR_ptr(tvbuff_t *tvb, int offset,
1901                         packet_info *pinfo, proto_tree *tree,
1902                         char *drep)
1903 {
1904         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1905                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1906                 "unknown string", hf_netlogon_unknown_string, -1);
1907
1908         return offset;
1909 }
1910
1911 static int
1912 netlogon_dissect_TYPE_36(tvbuff_t *tvb, int offset,
1913                         packet_info *pinfo, proto_tree *parent_tree,
1914                         char *drep)
1915 {
1916         proto_item *item=NULL;
1917         proto_tree *tree=NULL;
1918         int old_offset=offset;
1919         int i;
1920
1921         if(parent_tree){
1922                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1923                         "TYPE_36:");
1924                 tree = proto_item_add_subtree(item, ett_TYPE_36);
1925         }
1926
1927         for(i=0;i<16;i++){
1928                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1929                         hf_netlogon_unknown_char, NULL);
1930         }
1931
1932         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1933                 hf_netlogon_unknown_long, NULL);
1934
1935         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1936                 hf_netlogon_unknown_long, NULL);
1937
1938         proto_item_set_len(item, offset-old_offset);
1939         return offset;
1940 }
1941
1942 static int
1943 netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
1944                         packet_info *pinfo, proto_tree *parent_tree,
1945                         char *drep)
1946 {
1947         proto_item *item=NULL;
1948         proto_tree *tree=NULL;
1949         int old_offset=offset;
1950
1951         if(parent_tree){
1952                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1953                         "NETLOGON_INFO_1:");
1954                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_1);
1955         }
1956
1957         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1958                 hf_netlogon_flags, NULL);
1959
1960         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1961                 hf_netlogon_status, NULL);
1962
1963         proto_item_set_len(item, offset-old_offset);
1964         return offset;
1965 }
1966
1967 static int
1968 netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
1969                         packet_info *pinfo, proto_tree *parent_tree,
1970                         char *drep)
1971 {
1972         proto_item *item=NULL;
1973         proto_tree *tree=NULL;
1974         int old_offset=offset;
1975
1976         if(parent_tree){
1977                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1978                         "NETLOGON_INFO_2:");
1979                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_2);
1980         }
1981
1982         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1983                 hf_netlogon_unknown_long, NULL);
1984
1985         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1986                 hf_netlogon_unknown_long, NULL);
1987
1988         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1989                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1990                 "unknown", hf_netlogon_unknown_string, -1);
1991
1992         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1993                 hf_netlogon_unknown_long, NULL);
1994
1995         proto_item_set_len(item, offset-old_offset);
1996         return offset;
1997 }
1998
1999 static int
2000 netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
2001                         packet_info *pinfo, proto_tree *parent_tree,
2002                         char *drep)
2003 {
2004         proto_item *item=NULL;
2005         proto_tree *tree=NULL;
2006         int old_offset=offset;
2007
2008         if(parent_tree){
2009                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2010                         "NETLOGON_INFO_3:");
2011                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_3);
2012         }
2013
2014         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2015                 hf_netlogon_flags, NULL);
2016
2017         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2018                 hf_netlogon_logon_attempts, NULL);
2019
2020         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2021                 hf_netlogon_unknown_long, NULL);
2022
2023         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2024                 hf_netlogon_unknown_long, NULL);
2025
2026         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2027                 hf_netlogon_unknown_long, NULL);
2028
2029         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2030                 hf_netlogon_unknown_long, NULL);
2031
2032         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2033                 hf_netlogon_unknown_long, NULL);
2034
2035         proto_item_set_len(item, offset-old_offset);
2036         return offset;
2037 }
2038
2039 static int
2040 netlogon_dissect_NETLOGON_INFO_4(tvbuff_t *tvb, int offset,
2041                         packet_info *pinfo, proto_tree *parent_tree,
2042                         char *drep)
2043 {
2044         proto_item *item=NULL;
2045         proto_tree *tree=NULL;
2046         int old_offset=offset;
2047
2048         if(parent_tree){
2049                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2050                         "NETLOGON_INFO_4:");
2051                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_4);
2052         }
2053
2054         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2055                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2056                 "unknown", hf_netlogon_trusted_dc_name, -1);
2057
2058         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2059                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2060                 "unknown", hf_netlogon_trusted_domain_name, -1);
2061
2062         proto_item_set_len(item, offset-old_offset);
2063         return offset;
2064 }
2065
2066 static int
2067 netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
2068                         packet_info *pinfo, proto_tree *tree,
2069                         char *drep)
2070 {
2071                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2072                         hf_netlogon_unknown_char, NULL);
2073
2074         return offset;
2075 }
2076
2077 static int
2078 netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
2079                         packet_info *pinfo, proto_tree *tree,
2080                         char *drep)
2081 {
2082         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2083                 netlogon_dissect_UNICODE_MULTI_byte);
2084
2085         return offset;
2086 }
2087
2088 static int
2089 netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
2090                         packet_info *pinfo, proto_tree *tree,
2091                         char *drep)
2092 {
2093                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2094                         hf_netlogon_unknown_char, NULL);
2095
2096         return offset;
2097 }
2098
2099 static int
2100 netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
2101                         packet_info *pinfo, proto_tree *tree,
2102                         char *drep)
2103 {
2104         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2105                 netlogon_dissect_BYTE_byte);
2106
2107         return offset;
2108 }
2109
2110 static int
2111 netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
2112                         packet_info *pinfo, proto_tree *parent_tree,
2113                         char *drep)
2114 {
2115         proto_item *item=NULL;
2116         proto_tree *tree=NULL;
2117         int old_offset=offset;
2118
2119         if(parent_tree){
2120                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2121                         "UNICODE_MULTI:");
2122                 tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
2123         }
2124
2125         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2126                 hf_netlogon_len, NULL);
2127
2128         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2129                 netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_PTR,
2130                 "unknown", hf_netlogon_unknown_string, 0);
2131
2132         proto_item_set_len(item, offset-old_offset);
2133         return offset;
2134 }
2135
2136 int
2137 dissect_nt_GUID(tvbuff_t *tvb, int offset,
2138                         packet_info *pinfo, proto_tree *parent_tree,
2139                         char *drep)
2140 {
2141         proto_item *item=NULL;
2142         proto_tree *tree=NULL;
2143         int old_offset=offset;
2144         int i;
2145
2146         if(parent_tree){
2147                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2148                         "GUID:");
2149                 tree = proto_item_add_subtree(item, ett_GUID);
2150         }
2151
2152         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2153                 hf_netlogon_unknown_long, NULL);
2154
2155         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2156                 hf_netlogon_unknown_short, NULL);
2157
2158         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2159                 hf_netlogon_unknown_short, NULL);
2160
2161         for(i=0;i<8;i++){
2162                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2163                         hf_netlogon_unknown_char, NULL);
2164         }
2165
2166         proto_item_set_len(item, offset-old_offset);
2167         return offset;
2168 }
2169
2170 static int
2171 netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
2172                         packet_info *pinfo, proto_tree *parent_tree,
2173                         char *drep)
2174 {
2175         proto_item *item=NULL;
2176         proto_tree *tree=NULL;
2177         int old_offset=offset;
2178
2179         if(parent_tree){
2180                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2181                         "DOMAIN_CONTROLLER_INFO:");
2182                 tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
2183         }
2184
2185         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2186                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2187                 "unknown", hf_netlogon_dc_name, -1);
2188
2189         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2190                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2191                 "unknown", hf_netlogon_dc_address, -1);
2192
2193         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2194                 hf_netlogon_dc_address_type, NULL);
2195
2196         offset = dissect_nt_GUID(tvb, offset,
2197                 pinfo, tree, drep);
2198
2199         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2200                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2201                 "unknown", hf_netlogon_logon_dom, -1);
2202
2203         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2204                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2205                 "unknown", hf_netlogon_dns_forest_name, -1);
2206
2207         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2208                 hf_netlogon_flags, NULL);
2209
2210         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2211                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2212                 "unknown", hf_netlogon_dc_site_name, -1);
2213
2214         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2215                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2216                 "unknown", hf_netlogon_client_site_name, -1);
2217
2218         proto_item_set_len(item, offset-old_offset);
2219         return offset;
2220 }
2221
2222 static int
2223 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr(tvbuff_t *tvb, int offset,
2224                         packet_info *pinfo, proto_tree *tree,
2225                         char *drep)
2226 {
2227         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2228                 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_PTR,
2229                 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2230
2231         return offset;
2232 }
2233
2234 static int
2235 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr(tvbuff_t *tvb, int offset,
2236                         packet_info *pinfo, proto_tree *tree,
2237                         char *drep)
2238 {
2239         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2240                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_PTR,
2241                 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2242
2243         return offset;
2244 }
2245
2246 static int
2247 netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
2248                         packet_info *pinfo, proto_tree *tree,
2249                         char *drep)
2250 {
2251         guint32 len;
2252         dcerpc_info *di;
2253
2254         di=pinfo->private_data;
2255         if(di->conformant_run){
2256                 /*just a run to handle conformant arrays, nothing to dissect.*/
2257                 return offset;
2258         }
2259
2260         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2261                 hf_netlogon_blob_size, &len);
2262
2263         proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
2264                 FALSE);
2265         offset += len;
2266
2267         return offset;
2268 }
2269
2270 static int
2271 netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
2272                         packet_info *pinfo, proto_tree *parent_tree,
2273                         char *drep)
2274 {
2275         proto_item *item=NULL;
2276         proto_tree *tree=NULL;
2277
2278         if(parent_tree){
2279                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2280                         "BLOB:");
2281                 tree = proto_item_add_subtree(item, ett_BLOB);
2282         }
2283
2284         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2285                 hf_netlogon_blob_size, NULL);
2286
2287         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2288                 netlogon_dissect_BLOB_array, NDR_POINTER_PTR,
2289                 "BLOB:", -1, 0);
2290
2291         return offset;
2292 }
2293
2294 static int
2295 netlogon_dissect_BLOB_ptr(tvbuff_t *tvb, int offset,
2296                         packet_info *pinfo, proto_tree *tree,
2297                         char *drep)
2298 {
2299         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2300                 netlogon_dissect_BLOB, NDR_POINTER_PTR,
2301                 "BLOB pointer:", -1, 0);
2302
2303         return offset;
2304 }
2305
2306 static int
2307 netlogon_dissect_TYPE_46(tvbuff_t *tvb, int offset,
2308                         packet_info *pinfo, proto_tree *parent_tree,
2309                         char *drep)
2310 {
2311         proto_item *item=NULL;
2312         proto_tree *tree=NULL;
2313         int old_offset=offset;
2314
2315         if(parent_tree){
2316                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2317                         "TYPE_46:");
2318                 tree = proto_item_add_subtree(item, ett_TYPE_46);
2319         }
2320
2321         offset = netlogon_dissect_BLOB(tvb, offset,
2322                 pinfo, tree, drep);
2323
2324         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2325                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2326                 "unknown", hf_netlogon_workstation_fqdn, -1);
2327
2328         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2329                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2330                 "unknown", hf_netlogon_workstation_site_name, -1);
2331
2332         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2333                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2334                 "unknown", hf_netlogon_workstation_os, -1);
2335
2336         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2337                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2338                 "unknown", hf_netlogon_unknown_string, -1);
2339
2340         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2341                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2342                 "unknown", hf_netlogon_unknown_string, -1);
2343
2344         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2345                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2346                 "unknown", hf_netlogon_unknown_string, -1);
2347
2348         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2349                 hf_netlogon_unknown_string, 0);
2350
2351         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2352                 hf_netlogon_unknown_string, 0);
2353
2354         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2355                 hf_netlogon_unknown_string, 0);
2356
2357         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2358                 hf_netlogon_unknown_string, 0);
2359
2360         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2361                 hf_netlogon_unknown_long, NULL);
2362
2363         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2364                 hf_netlogon_unknown_long, NULL);
2365
2366         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2367                 hf_netlogon_unknown_long, NULL);
2368
2369         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2370                 hf_netlogon_unknown_long, NULL);
2371
2372         proto_item_set_len(item, offset-old_offset);
2373         return offset;
2374 }
2375
2376 static int
2377 netlogon_dissect_TYPE_48(tvbuff_t *tvb, int offset,
2378                         packet_info *pinfo, proto_tree *parent_tree,
2379                         char *drep)
2380 {
2381         proto_item *item=NULL;
2382         proto_tree *tree=NULL;
2383         int old_offset=offset;
2384
2385         if(parent_tree){
2386                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2387                         "TYPE_48:");
2388                 tree = proto_item_add_subtree(item, ett_TYPE_48);
2389         }
2390
2391         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2392                 hf_netlogon_unknown_string, 0);
2393
2394         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2395                 hf_netlogon_unknown_string, 0);
2396
2397         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2398                 hf_netlogon_unknown_string, 0);
2399
2400         offset = dissect_nt_GUID(tvb, offset,
2401                 pinfo, tree, drep);
2402
2403         offset = dissect_ndr_nt_PSID(tvb, offset,
2404                 pinfo, tree, drep);
2405
2406         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2407                 hf_netlogon_unknown_string, 0);
2408
2409         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2410                 hf_netlogon_unknown_string, 0);
2411
2412         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2413                 hf_netlogon_unknown_string, 0);
2414
2415         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2416                 hf_netlogon_unknown_string, 0);
2417
2418         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2419                 hf_netlogon_unknown_long, NULL);
2420
2421         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2422                 hf_netlogon_unknown_long, NULL);
2423
2424         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2425                 hf_netlogon_unknown_long, NULL);
2426
2427         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2428                 hf_netlogon_unknown_long, NULL);
2429
2430         offset = netlogon_dissect_BLOB(tvb, offset,
2431                 pinfo, tree, drep);
2432
2433         offset = netlogon_dissect_BLOB(tvb, offset,
2434                 pinfo, tree, drep);
2435
2436         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2437                 hf_netlogon_unknown_string, 0);
2438
2439         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2440                 hf_netlogon_unknown_string, 0);
2441
2442         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2443                 hf_netlogon_unknown_string, 0);
2444
2445         offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2446                 hf_netlogon_unknown_string, 0);
2447
2448         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2449                 hf_netlogon_unknown_long, NULL);
2450
2451         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2452                 hf_netlogon_unknown_long, NULL);
2453
2454         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2455                 hf_netlogon_unknown_long, NULL);
2456
2457         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2458                 hf_netlogon_unknown_long, NULL);
2459
2460         proto_item_set_len(item, offset-old_offset);
2461         return offset;
2462 }
2463
2464 static int
2465 netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
2466                         packet_info *pinfo, proto_tree *parent_tree,
2467                         char *drep)
2468 {
2469         proto_item *item=NULL;
2470         proto_tree *tree=NULL;
2471         int old_offset=offset;
2472         int i;
2473
2474         if(parent_tree){
2475                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2476                         "UNICODE_STRING_512:");
2477                 tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
2478         }
2479
2480         for(i=0;i<512;i++){
2481                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2482                         hf_netlogon_unknown_short, NULL);
2483         }
2484
2485         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2486                 hf_netlogon_unknown_long, NULL);
2487
2488         proto_item_set_len(item, offset-old_offset);
2489         return offset;
2490 }
2491
2492 static int
2493 netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset,
2494                         packet_info *pinfo, proto_tree *tree,
2495                         char *drep)
2496 {
2497                 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2498                         hf_netlogon_secure_channel_type, NULL);
2499
2500         return offset;
2501 }
2502
2503 static int
2504 netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
2505                         packet_info *pinfo, proto_tree *tree,
2506                         char *drep)
2507 {
2508                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2509                         hf_netlogon_unknown_char, NULL);
2510
2511         return offset;
2512 }
2513
2514 static int
2515 netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
2516                         packet_info *pinfo, proto_tree *tree,
2517                         char *drep)
2518 {
2519         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2520                 netlogon_dissect_element_844_byte);
2521
2522         return offset;
2523 }
2524
2525 static int
2526 netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
2527                         packet_info *pinfo, proto_tree *parent_tree,
2528                         char *drep)
2529 {
2530         proto_item *item=NULL;
2531         proto_tree *tree=NULL;
2532         int old_offset=offset;
2533
2534         if(parent_tree){
2535                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2536                         "TYPE_50:");
2537                 tree = proto_item_add_subtree(item, ett_TYPE_50);
2538         }
2539
2540         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2541                 hf_netlogon_unknown_long, NULL);
2542
2543         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2544                 netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
2545                 "unknown", hf_netlogon_unknown_string, 0);
2546
2547         proto_item_set_len(item, offset-old_offset);
2548         return offset;
2549 }
2550
2551 static int
2552 netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
2553                         packet_info *pinfo, proto_tree *tree,
2554                         char *drep)
2555 {
2556         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2557                 netlogon_dissect_TYPE_50, NDR_POINTER_PTR,
2558                 "TYPE_50 pointer: unknown_TYPE_50", -1, 0);
2559
2560         return offset;
2561 }
2562
2563 static int
2564 netlogon_dissect_TYPE_50_ptr_ptr(tvbuff_t *tvb, int offset,
2565                         packet_info *pinfo, proto_tree *tree,
2566                         char *drep)
2567 {
2568         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2569                 netlogon_dissect_TYPE_50_ptr, NDR_POINTER_PTR,
2570                 "TYPE_50* pointer: unknown_TYPE_50", -1, 0);
2571
2572         return offset;
2573 }
2574
2575 static int
2576 netlogon_dissect_element_861_byte(tvbuff_t *tvb, int offset,
2577                         packet_info *pinfo, proto_tree *tree,
2578                         char *drep)
2579 {
2580                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2581                         hf_netlogon_unknown_char, NULL);
2582
2583         return offset;
2584 }
2585
2586 static int
2587 netlogon_dissect_element_861_array(tvbuff_t *tvb, int offset,
2588                         packet_info *pinfo, proto_tree *tree,
2589                         char *drep)
2590 {
2591         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2592                 netlogon_dissect_element_861_byte);
2593
2594         return offset;
2595 }
2596
2597 static int
2598 netlogon_dissect_TYPE_51(tvbuff_t *tvb, int offset,
2599                         packet_info *pinfo, proto_tree *parent_tree,
2600                         char *drep)
2601 {
2602         proto_item *item=NULL;
2603         proto_tree *tree=NULL;
2604         int old_offset=offset;
2605
2606         if(parent_tree){
2607                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2608                         "TYPE_51:");
2609                 tree = proto_item_add_subtree(item, ett_TYPE_51);
2610         }
2611
2612         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2613                 hf_netlogon_unknown_long, NULL);
2614
2615         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2616                 netlogon_dissect_element_861_array, NDR_POINTER_UNIQUE,
2617                 "unknown", hf_netlogon_unknown_string, 0);
2618
2619         proto_item_set_len(item, offset-old_offset);
2620         return offset;
2621 }
2622
2623 static int
2624 netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
2625                         packet_info *pinfo, proto_tree *tree,
2626                         char *drep)
2627 {
2628                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2629                         hf_netlogon_unknown_char, NULL);
2630
2631         return offset;
2632 }
2633
2634 static int
2635 netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
2636                         packet_info *pinfo, proto_tree *tree,
2637                         char *drep)
2638 {
2639         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2640                 netlogon_dissect_element_865_byte);
2641
2642         return offset;
2643 }
2644
2645 static int
2646 netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
2647                         packet_info *pinfo, proto_tree *tree,
2648                         char *drep)
2649 {
2650                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2651                         hf_netlogon_unknown_char, NULL);
2652
2653         return offset;
2654 }
2655
2656 static int
2657 netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
2658                         packet_info *pinfo, proto_tree *tree,
2659                         char *drep)
2660 {
2661         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2662                 netlogon_dissect_element_866_byte);
2663
2664         return offset;
2665 }
2666
2667 static int
2668 netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
2669                         packet_info *pinfo, proto_tree *parent_tree,
2670                         char *drep)
2671 {
2672         proto_item *item=NULL;
2673         proto_tree *tree=NULL;
2674         int old_offset=offset;
2675
2676         if(parent_tree){
2677                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2678                         "TYPE_52:");
2679                 tree = proto_item_add_subtree(item, ett_TYPE_52);
2680         }
2681
2682         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2683                 hf_netlogon_unknown_long, NULL);
2684
2685         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2686                 netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
2687                 "unknown", hf_netlogon_unknown_string, 0);
2688
2689         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2690                 netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
2691                 "unknown", hf_netlogon_unknown_string, 0);
2692
2693         proto_item_set_len(item, offset-old_offset);
2694         return offset;
2695 }
2696
2697 static int
2698 netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
2699                         packet_info *pinfo, proto_tree *tree,
2700                         char *drep)
2701 {
2702         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2703                 netlogon_dissect_TYPE_52, NDR_POINTER_PTR,
2704                 "TYPE_52 pointer: unknown_TYPE_52", -1, 0);
2705         return offset;
2706 }
2707
2708 static int
2709 netlogon_dissect_TYPE_52_ptr_ptr(tvbuff_t *tvb, int offset,
2710                         packet_info *pinfo, proto_tree *tree,
2711                         char *drep)
2712 {
2713         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2714                 netlogon_dissect_TYPE_52_ptr, NDR_POINTER_PTR,
2715                 "TYPE_52* pointer: unknown_TYPE_52", -1, 0);
2716         return offset;
2717 }
2718
2719 static int
2720 netlogon_dissect_NETLOGON_LEVEL(tvbuff_t *tvb, int offset,
2721                         packet_info *pinfo, proto_tree *parent_tree,
2722                         char *drep)
2723 {
2724         proto_item *item=NULL;
2725         proto_tree *tree=NULL;
2726         int old_offset=offset;
2727         guint16 level;
2728
2729         if(parent_tree){
2730                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2731                         "NETLOGON_LEVEL:");
2732                 tree = proto_item_add_subtree(item, ett_NETLOGON_LEVEL);
2733         }
2734
2735         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2736                 hf_netlogon_level, &level);
2737
2738         ALIGN_TO_4_BYTES;
2739         switch(level){
2740         case 1:
2741                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2742                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2743                         "INTERACTIVE_INFO pointer:", -1, 0);
2744                 break;
2745         case 2:
2746                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2747                         netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2748                         "NETWORK_INFO pointer:", -1, 0);
2749                 break;
2750         case 3:
2751                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2752                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2753                         "INTERACTIVE_INFO pointer:", -1, 0);
2754                 break;
2755         case 5:
2756                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2757                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2758                         "INTERACTIVE_INFO pointer:", -1, 0);
2759                 break;
2760         case 6:
2761                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2762                         netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2763                         "NETWORK_INFO pointer:", -1, 0);
2764                 break;
2765         case 7:
2766                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2767                         netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2768                         "INTERACTIVE_INFO pointer:", -1, 0);
2769                 break;
2770         }
2771
2772         proto_item_set_len(item, offset-old_offset);
2773         return offset;
2774 }
2775
2776 static int
2777 netlogon_dissect_NETLOGON_VALIDATION(tvbuff_t *tvb, int offset,
2778                         packet_info *pinfo, proto_tree *parent_tree,
2779                         char *drep)
2780 {
2781         proto_item *item=NULL;
2782         proto_tree *tree=NULL;
2783         int old_offset=offset;
2784         guint16 level;
2785
2786         if(parent_tree){
2787                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2788                         "NETLOGON_VALIDATION:");
2789                 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION);
2790         }
2791
2792         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2793                 hf_netlogon_level, &level);
2794
2795         /* XXX i am not sure about these pointers being UNIQUE, though I am
2796            pretty convinced that they are NOT PTR as the idl file suggests.
2797         */
2798         ALIGN_TO_4_BYTES;
2799         switch(level){
2800         case 2:
2801                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2802                         netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1, NDR_POINTER_UNIQUE,
2803                         "NETLOGON_VALIDATION_SAM_INFO1 pointer:", -1, 0);
2804                 break;
2805         case 3:
2806                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2807                         netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE,
2808                         "NETLOGON_VALIDATION_SAM_INFO2 pointer:", -1, 0);
2809                 break;
2810         case 4:
2811                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2812                         netlogon_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
2813                         "STRING pointer:", -1, 0);
2814                 break;
2815         case 5:
2816                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2817                         netlogon_dissect_BLOB_ptr, NDR_POINTER_UNIQUE,
2818                         "BLOB pointer:", -1, 0);
2819                 break;
2820         }
2821
2822         proto_item_set_len(item, offset-old_offset);
2823         return offset;
2824 }
2825
2826
2827 static int
2828 netlogon_dissect_TYPE_19(tvbuff_t *tvb, int offset,
2829                         packet_info *pinfo, proto_tree *parent_tree,
2830                         char *drep)
2831 {
2832         proto_item *item=NULL;
2833         proto_tree *tree=NULL;
2834         int old_offset=offset;
2835         guint16 level;
2836
2837         if(parent_tree){
2838                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2839                         "TYPE_19:");
2840                 tree = proto_item_add_subtree(item, ett_TYPE_19);
2841         }
2842
2843         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2844                 hf_netlogon_level, &level);
2845
2846         ALIGN_TO_4_BYTES;
2847         switch(level){
2848         case 1:
2849                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2850                         hf_netlogon_unknown_long, NULL);
2851                 break;
2852         case 2:
2853                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2854                         hf_netlogon_unknown_long, NULL);
2855                 break;
2856         case 3:
2857                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2858                         hf_netlogon_unknown_long, NULL);
2859                 break;
2860         case 4:
2861                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2862                         hf_netlogon_unknown_long, NULL);
2863                 break;
2864         case 5:
2865                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2866                         hf_netlogon_unknown_long, NULL);
2867                 break;
2868         case 6:
2869                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2870                         hf_netlogon_unknown_long, NULL);
2871                 break;
2872         case 7:
2873                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2874                         hf_netlogon_unknown_long, NULL);
2875                 break;
2876         case 8:
2877                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2878                         hf_netlogon_unknown_long, NULL);
2879                 break;
2880         case 9:
2881                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2882                         hf_netlogon_unknown_long, NULL);
2883                 break;
2884         case 10:
2885                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2886                         hf_netlogon_unknown_long, NULL);
2887                 break;
2888         case 11:
2889                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2890                         hf_netlogon_unknown_long, NULL);
2891                 break;
2892         case 12:
2893                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2894                         hf_netlogon_unknown_long, NULL);
2895                 break;
2896         case 20:
2897                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2898                         hf_netlogon_unknown_long, NULL);
2899                 break;
2900         case 21:
2901                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2902                         hf_netlogon_unknown_long, NULL);
2903                 break;
2904         case 13:
2905                 offset = dissect_ndr_nt_PSID(tvb, offset,
2906                         pinfo, tree, drep);
2907                 break;
2908         case 14:
2909                 offset = dissect_ndr_nt_PSID(tvb, offset,
2910                         pinfo, tree, drep);
2911                 break;
2912         case 15:
2913                 offset = dissect_ndr_nt_PSID(tvb, offset,
2914                         pinfo, tree, drep);
2915                 break;
2916         case 16:
2917                 offset = dissect_ndr_nt_PSID(tvb, offset,
2918                         pinfo, tree, drep);
2919                 break;
2920         case 17:
2921                 offset = dissect_ndr_nt_PSID(tvb, offset,
2922                         pinfo, tree, drep);
2923                 break;
2924         case 18:
2925                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2926                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2927                         "unknown", hf_netlogon_unknown_string, -1);
2928                 break;
2929         case 19:
2930                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2931                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2932                         "unknown", hf_netlogon_unknown_string, -1);
2933                 break;
2934         }
2935
2936         proto_item_set_len(item, offset-old_offset);
2937         return offset;
2938 }
2939
2940
2941 static int
2942 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO(tvbuff_t *tvb, int offset,
2943                         packet_info *pinfo, proto_tree *parent_tree,
2944                         char *drep)
2945 {
2946         proto_item *item=NULL;
2947         proto_tree *tree=NULL;
2948         int old_offset=offset;
2949         guint32 level;
2950
2951         if(parent_tree){
2952                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2953                         "NETLOGON_CONTROL_QUERY_INFO:");
2954                 tree = proto_item_add_subtree(item, ett_NETLOGON_CONTROL_QUERY_INFO);
2955         }
2956
2957         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2958                 hf_netlogon_level_long, &level);
2959
2960         ALIGN_TO_4_BYTES;
2961         switch(level){
2962         case 5:
2963                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2964                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2965                         "unknown", hf_netlogon_unknown_string, -1);
2966                 break;
2967         case 6:
2968                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2969                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2970                         "unknown", hf_netlogon_unknown_string, -1);
2971                 break;
2972         case 0xfffe:
2973                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2974                         hf_netlogon_unknown_long, NULL);
2975                 break;
2976         case 8:
2977                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2978                         dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2979                         "unknown", hf_netlogon_unknown_string, -1);
2980                 break;
2981         }
2982
2983         proto_item_set_len(item, offset-old_offset);
2984         return offset;
2985 }
2986
2987
2988 static int
2989 netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
2990                         packet_info *pinfo, proto_tree *parent_tree,
2991                         char *drep)
2992 {
2993         proto_item *item=NULL;
2994         proto_tree *tree=NULL;
2995         int old_offset=offset;
2996         guint32 level;
2997
2998         if(parent_tree){
2999                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3000                         "TYPE_44:");
3001                 tree = proto_item_add_subtree(item, ett_TYPE_44);
3002         }
3003
3004         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3005                 hf_netlogon_level_long, &level);
3006
3007         ALIGN_TO_4_BYTES;
3008         switch(level){
3009         case 1:
3010                 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3011                         hf_netlogon_unknown_long, NULL);
3012                 break;
3013         }
3014
3015         proto_item_set_len(item, offset-old_offset);
3016         return offset;
3017 }
3018
3019 static int
3020 netlogon_dissect_TYPE_20(tvbuff_t *tvb, int offset,
3021                         packet_info *pinfo, proto_tree *parent_tree,
3022                         char *drep)
3023 {
3024         proto_item *item=NULL;
3025         proto_tree *tree=NULL;
3026         int old_offset=offset;
3027         guint16 level;
3028
3029         if(parent_tree){
3030                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3031                         "TYPE_20:");
3032                 tree = proto_item_add_subtree(item, ett_TYPE_20);
3033         }
3034
3035         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3036                 hf_netlogon_level, &level);
3037
3038         ALIGN_TO_4_BYTES;
3039         switch(level){
3040         case 1:
3041                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3042                         netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO, NDR_POINTER_PTR,
3043                         "NETLOGON_SAM_DOMAIN_INFO pointer:", -1, 0);
3044                 break;
3045         case 2:
3046                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3047                         netlogon_dissect_NETLOGON_SAM_GROUP_INFO, NDR_POINTER_PTR,
3048                         "NETLOGON_SAM_GROUP_INFO pointer:", -1, 0);
3049                 break;
3050         case 4:
3051                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3052                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3053                         "TYPE_23 pointer:", -1, 0);
3054                 break;
3055         case 5:
3056                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3057                         netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO, NDR_POINTER_PTR,
3058                         "NETLOGON_SAM_ACCOUNT_INFO pointer:", -1, 0);
3059                 break;
3060         case 7:
3061                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3062                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3063                         "TYPE_23 pointer:", -1, 0);
3064                 break;
3065         case 8:
3066                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3067                         netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO, NDR_POINTER_PTR,
3068                         "NETLOGON_SAM_GROUP_MEM_INFO pointer:", -1, 0);
3069                 break;
3070         case 9:
3071                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3072                         netlogon_dissect_NETLOGON_SAM_ALIAS_INFO, NDR_POINTER_PTR,
3073                         "NETLOGON_SAM_ALIAS_INFO pointer:", -1, 0);
3074                 break;
3075         case 11:
3076                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3077                         netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3078                         "TYPE_23 pointer:", -1, 0);
3079                 break;
3080         case 12:
3081                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3082                         netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO, NDR_POINTER_PTR,
3083                         "NETLOGON_SAM_ALIAS_MEM_INFO pointer:", -1, 0);
3084                 break;
3085         case 13:
3086                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3087                         netlogon_dissect_TYPE_29, NDR_POINTER_PTR,
3088                         "TYPE_29 pointer:", -1, 0);
3089                 break;
3090         case 14:
3091                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3092                         netlogon_dissect_TYPE_31, NDR_POINTER_PTR,
3093                         "TYPE_31 pointer:", -1, 0);
3094                 break;
3095         case 16:
3096                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3097                         netlogon_dissect_TYPE_33, NDR_POINTER_PTR,
3098                         "TYPE_33 pointer:", -1, 0);
3099                 break;
3100         case 18:
3101                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3102                         netlogon_dissect_TYPE_34, NDR_POINTER_PTR,
3103                         "TYPE_34 pointer:", -1, 0);
3104                 break;
3105         case 20:
3106                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3107                         netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3108                         "TYPE_35 pointer:", -1, 0);
3109                 break;
3110         case 21:
3111                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3112                         netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3113                         "TYPE_35 pointer:", -1, 0);
3114                 break;
3115         case 22:
3116                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3117                         netlogon_dissect_TYPE_16, NDR_POINTER_PTR,
3118                         "TYPE_16 pointer:", -1, 0);
3119                 break;
3120         }
3121
3122         proto_item_set_len(item, offset-old_offset);
3123         return offset;
3124 }
3125
3126 static int
3127 netlogon_dissect_SAM_DELTA(tvbuff_t *tvb, int offset,
3128                         packet_info *pinfo, proto_tree *parent_tree,
3129                         char *drep)
3130 {
3131         proto_item *item=NULL;
3132         proto_tree *tree=NULL;
3133         int old_offset=offset;
3134
3135         if(parent_tree){
3136                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3137                         "SAM_DELTA:");
3138                 tree = proto_item_add_subtree(item, ett_SAM_DELTA);
3139         }
3140
3141         offset = netlogon_dissect_TYPE_19(tvb, offset,
3142                 pinfo, tree, drep);
3143
3144         offset = netlogon_dissect_TYPE_20(tvb, offset,
3145                 pinfo, tree, drep);
3146
3147         proto_item_set_len(item, offset-old_offset);
3148         return offset;
3149 }
3150
3151 static int
3152 netlogon_dissect_SAM_DELTA_array(tvbuff_t *tvb, int offset,
3153                         packet_info *pinfo, proto_tree *tree,
3154                         char *drep)
3155 {
3156         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3157                 netlogon_dissect_SAM_DELTA);
3158
3159         return offset;
3160 }
3161
3162 static int
3163 netlogon_dissect_SAM_DELTA_ARRAY(tvbuff_t *tvb, int offset,
3164                         packet_info *pinfo, proto_tree *parent_tree,
3165                         char *drep)
3166 {
3167         proto_item *item=NULL;
3168         proto_tree *tree=NULL;
3169         int old_offset=offset;
3170
3171         if(parent_tree){
3172                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3173                         "SAM_DELTA_ARRAY:");
3174                 tree = proto_item_add_subtree(item, ett_SAM_DELTA_ARRAY);
3175         }
3176
3177         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3178                 hf_netlogon_num_deltas, NULL);
3179
3180         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3181                 netlogon_dissect_SAM_DELTA_array, NDR_POINTER_UNIQUE,
3182                 "unknown", -1, 0);
3183
3184         proto_item_set_len(item, offset-old_offset);
3185         return offset;
3186 }
3187
3188 static int
3189 netlogon_dissect_SAM_DELTA_ARRAY_ptr(tvbuff_t *tvb, int offset,
3190                         packet_info *pinfo, proto_tree *tree,
3191                         char *drep)
3192 {
3193         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3194                 netlogon_dissect_SAM_DELTA_ARRAY, NDR_POINTER_PTR,
3195                 "SAM_DELTA_ARRAY pointer: deltas", -1, 0);
3196
3197         return offset;
3198 }
3199
3200 static int
3201 netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset,
3202                         packet_info *pinfo, proto_tree *tree,
3203                         char *drep)
3204 {
3205         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3206                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3207                 "Handle", hf_netlogon_logonsrv_handle, 0);
3208
3209         return offset;
3210 }
3211
3212 static int
3213 netlogon_dissect_NETLOGON_INFO(tvbuff_t *tvb, int offset,
3214                         packet_info *pinfo, proto_tree *parent_tree,
3215                         char *drep)
3216 {
3217         proto_item *item=NULL;
3218         proto_tree *tree=NULL;
3219         int old_offset=offset;
3220         guint32 level;
3221
3222         if(parent_tree){
3223                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3224                         "NETLOGON_INFO:");
3225                 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO);
3226         }
3227
3228         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3229                 hf_netlogon_level_long, &level);
3230
3231         ALIGN_TO_4_BYTES;
3232         switch(level){
3233         case 1:
3234                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3235                         netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_PTR,
3236                         "NETLOGON_INFO_1 pointer:", -1, 0);
3237                 break;
3238         case 2:
3239                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3240                         netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_PTR,
3241                         "NETLOGON_INFO_2 pointer:", -1, 0);
3242                 break;
3243         case 3:
3244                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3245                         netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_PTR,
3246                         "NETLOGON_INFO_3 pointer:", -1, 0);
3247                 break;
3248         case 4:
3249                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3250                         netlogon_dissect_NETLOGON_INFO_4, NDR_POINTER_PTR,
3251                         "NETLOGON_INFO_4 pointer:", -1, 0);
3252                 break;
3253         }
3254
3255         proto_item_set_len(item, offset-old_offset);
3256         return offset;
3257 }
3258
3259 static int
3260 netlogon_dissect_TYPE_45(tvbuff_t *tvb, int offset,
3261                         packet_info *pinfo, proto_tree *parent_tree,
3262                         char *drep)
3263 {
3264         proto_item *item=NULL;
3265         proto_tree *tree=NULL;
3266         int old_offset=offset;
3267         guint32 level;
3268
3269         if(parent_tree){
3270                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3271                         "TYPE_45:");
3272                 tree = proto_item_add_subtree(item, ett_TYPE_45);
3273         }
3274
3275         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3276                 hf_netlogon_level_long, &level);
3277
3278         ALIGN_TO_4_BYTES;
3279         switch(level){
3280         case 1:
3281                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3282                         netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3283                         "TYPE_46 pointer:", -1, 0);
3284                 break;
3285         case 2:
3286                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3287                         netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3288                         "TYPE_46 pointer:", -1, 0);
3289                 break;
3290         }
3291
3292         proto_item_set_len(item, offset-old_offset);
3293         return offset;
3294 }
3295
3296 static int
3297 netlogon_dissect_TYPE_47(tvbuff_t *tvb, int offset,
3298                         packet_info *pinfo, proto_tree *parent_tree,
3299                         char *drep)
3300 {
3301         proto_item *item=NULL;
3302         proto_tree *tree=NULL;
3303         int old_offset=offset;
3304         guint32 level;
3305
3306         if(parent_tree){
3307                 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3308                         "TYPE_47:");
3309                 tree = proto_item_add_subtree(item, ett_TYPE_47);
3310         }
3311
3312         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3313                 hf_netlogon_level_long, &level);
3314
3315         ALIGN_TO_4_BYTES;
3316         switch(level){
3317         case 1:
3318                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3319                         netlogon_dissect_TYPE_48, NDR_POINTER_PTR,
3320                         "TYPE_48 pointer:", -1, 0);
3321                 break;
3322         case 2:
3323                 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3324                         netlogon_dissect_UNICODE_MULTI, NDR_POINTER_PTR,
3325                         "UNICODE_MULTI pointer:", -1, 0);
3326                 break;
3327         }
3328
3329         proto_item_set_len(item, offset-old_offset);
3330         return offset;
3331 }
3332
3333
3334 static int
3335 netlogon_dissect_function_00_rqst(tvbuff_t *tvb, int offset,
3336         packet_info *pinfo, proto_tree *tree, char *drep)
3337 {
3338         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3339                 pinfo, tree, drep);
3340
3341         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3342                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3343                 "unknown string", hf_netlogon_unknown_string, -1);
3344
3345         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3346                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3347                 "unknown string", hf_netlogon_unknown_string, -1);
3348
3349         return offset;
3350 }
3351
3352
3353 static int
3354 netlogon_dissect_function_00_reply(tvbuff_t *tvb, int offset,
3355         packet_info *pinfo, proto_tree *tree, char *drep)
3356 {
3357         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3358                 netlogon_dissect_TYPE_1_ptr, NDR_POINTER_REF,
3359                 "TYPE_1* pointer: unknown_TYPE_1", -1, 0);
3360
3361         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3362                                   hf_netlogon_rc, NULL);
3363
3364         return offset;
3365 }
3366
3367 static int
3368 netlogon_dissect_function_01_rqst(tvbuff_t *tvb, int offset,
3369         packet_info *pinfo, proto_tree *tree, char *drep)
3370 {
3371         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3372                 pinfo, tree, drep);
3373
3374         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3375                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3376                 "unknown string", hf_netlogon_unknown_string, -1);
3377
3378         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3379                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3380                 "unknown string", hf_netlogon_unknown_string, -1);
3381
3382         return offset;
3383 }
3384
3385
3386 static int
3387 netlogon_dissect_function_01_reply(tvbuff_t *tvb, int offset,
3388         packet_info *pinfo, proto_tree *tree, char *drep)
3389 {
3390         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3391                 netlogon_dissect_TYPE_2, NDR_POINTER_REF,
3392                 "TYPE_2 pointer: unknown_TYPE_2", -1, 0);
3393
3394         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3395                                   hf_netlogon_rc, NULL);
3396
3397         return offset;
3398 }
3399
3400 static int
3401 netlogon_dissect_netlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
3402         packet_info *pinfo, proto_tree *tree, char *drep)
3403 {
3404         if (check_col(pinfo->cinfo, COL_INFO))
3405                 col_set_str(pinfo->cinfo, COL_INFO, "SamLogon request");
3406
3407         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3408                 pinfo, tree, drep);
3409
3410         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3411                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3412                 "Computer Name", hf_netlogon_computer_name, 0);
3413
3414         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3415                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3416                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3417
3418         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3419                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3420                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3421
3422         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3423                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3424                 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3425
3426         return offset;
3427 }
3428
3429
3430 static int
3431 netlogon_dissect_netlogonsamlogon_reply(tvbuff_t *tvb, int offset,
3432         packet_info *pinfo, proto_tree *tree, char *drep)
3433 {
3434         if (check_col(pinfo->cinfo, COL_INFO))
3435                 col_set_str(pinfo->cinfo, COL_INFO, "SamLogon response");
3436
3437         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3438                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3439                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3440
3441         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3442                 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_REF,
3443                 "NETLOGON_VALIDATION pointer: ctr", -1, 0);
3444
3445         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3446                 netlogon_dissect_pointer_char, NDR_POINTER_REF,
3447                 "BOOLEAN pointer: Authoritative", hf_netlogon_authoritative, 0);
3448
3449         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3450                                   hf_netlogon_rc, NULL);
3451
3452         return offset;
3453 }
3454
3455 static int
3456 netlogon_dissect_netlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
3457         packet_info *pinfo, proto_tree *tree, char *drep)
3458 {
3459         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3460                 pinfo, tree, drep);
3461
3462         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3463                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3464                 "unknown string", hf_netlogon_unknown_string, 0);
3465
3466         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3467                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3468                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3469
3470         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3471                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3472                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3473
3474         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3475                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3476                 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3477
3478         return offset;
3479 }
3480
3481
3482 static int
3483 netlogon_dissect_netlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
3484         packet_info *pinfo, proto_tree *tree, char *drep)
3485 {
3486
3487         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3488                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3489                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3490
3491         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3492                                   hf_netlogon_rc, NULL);
3493
3494         return offset;
3495 }
3496
3497 static int
3498 netlogon_dissect_netserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
3499         packet_info *pinfo, proto_tree *tree, char *drep)
3500 {
3501         if (check_col(pinfo->cinfo, COL_INFO))
3502                 col_set_str(pinfo->cinfo, COL_INFO,
3503                             "RequestChallenge request");
3504
3505         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3506                 pinfo, tree, drep);
3507
3508         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3509                 NDR_POINTER_REF, hf_netlogon_client_name, 0);
3510
3511         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3512                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3513                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3514
3515         return offset;
3516 }
3517
3518
3519 static int
3520 netlogon_dissect_netserverreqchallenge_reply(tvbuff_t *tvb, int offset,
3521         packet_info *pinfo, proto_tree *tree, char *drep)
3522 {
3523         if (check_col(pinfo->cinfo, COL_INFO))
3524                 col_set_str(pinfo->cinfo, COL_INFO,
3525                             "RequestChallenge response");
3526
3527         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3528                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3529                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3530
3531         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3532                                   hf_netlogon_rc, NULL);
3533
3534         return offset;
3535 }
3536
3537 static int
3538 netlogon_dissect_netserverauthenticate_rqst(tvbuff_t *tvb, int offset,
3539         packet_info *pinfo, proto_tree *tree, char *drep)
3540 {
3541         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3542                 pinfo, tree, drep);
3543
3544         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3545                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3546
3547         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3548                 pinfo, tree, drep);
3549
3550         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3551                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3552
3553         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3554                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3555                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3556
3557         return offset;
3558 }
3559
3560
3561 static int
3562 netlogon_dissect_netserverauthenticate_reply(tvbuff_t *tvb, int offset,
3563         packet_info *pinfo, proto_tree *tree, char *drep)
3564 {
3565         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3566                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3567                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3568
3569         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3570                                   hf_netlogon_rc, NULL);
3571
3572         return offset;
3573 }
3574
3575 static int
3576 netlogon_dissect_netserverpasswordset_rqst(tvbuff_t *tvb, int offset,
3577         packet_info *pinfo, proto_tree *tree, char *drep)
3578 {
3579         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3580                 pinfo, tree, drep);
3581
3582         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3583                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3584
3585         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3586                 pinfo, tree, drep);
3587
3588         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3589                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3590
3591         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3592                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3593                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3594
3595         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3596                 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF,
3597                 "ENCRYPTED_LM_OWF_PASSWORD pointer: hashed_pwd", -1, 0);
3598
3599         return offset;
3600 }
3601
3602
3603 static int
3604 netlogon_dissect_netserverpasswordset_reply(tvbuff_t *tvb, int offset,
3605         packet_info *pinfo, proto_tree *tree, char *drep)
3606 {
3607         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3608                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3609                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3610
3611         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3612                                   hf_netlogon_rc, NULL);
3613
3614         return offset;
3615 }
3616
3617 static int
3618 netlogon_dissect_netsamdeltas_rqst(tvbuff_t *tvb, int offset,
3619         packet_info *pinfo, proto_tree *tree, char *drep)
3620 {
3621         /* XXX idl file has LOGONSRV_HANDLE here, ms capture has string srv_name */
3622         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3623                 NDR_POINTER_REF, hf_netlogon_logon_srv, 0);
3624
3625         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3626                 NDR_POINTER_REF, hf_netlogon_cli_name, 0);
3627
3628         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3629                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3630                 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3631
3632         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3633                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3634                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3635
3636         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3637                 hf_netlogon_database_id, NULL);
3638
3639         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3640                 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3641                 "TYPE_16 pointer: dom_mod_count", -1, 0);
3642
3643         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3644                 hf_netlogon_max_size, NULL);
3645         return offset;
3646 }
3647
3648
3649 static int
3650 netlogon_dissect_netsamdeltas_reply(tvbuff_t *tvb, int offset,
3651         packet_info *pinfo, proto_tree *tree, char *drep)
3652 {
3653         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3654                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3655                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3656
3657         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3658                 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3659                 "TYPE_16 pointer: dom_mod_count", -1, 0);
3660
3661         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3662                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3663                 "SAM_DELTA_ARRAY_ptr pointer: deltas", -1, 0);
3664
3665         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3666                                   hf_netlogon_rc, NULL);
3667
3668         return offset;
3669 }
3670
3671 static int
3672 netlogon_dissect_function_08_rqst(tvbuff_t *tvb, int offset,
3673         packet_info *pinfo, proto_tree *tree, char *drep)
3674 {
3675         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3676                 NDR_POINTER_REF, hf_netlogon_logon_srv, 0);
3677
3678         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3679                 NDR_POINTER_REF, hf_netlogon_cli_name, 0);
3680
3681         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3682                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3683                 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3684
3685         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3686                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3687                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3688
3689         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3690                 hf_netlogon_unknown_long, NULL);
3691
3692         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3693                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3694                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3695
3696         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3697                 hf_netlogon_unknown_long, NULL);
3698         return offset;
3699 }
3700
3701
3702 static int
3703 netlogon_dissect_function_08_reply(tvbuff_t *tvb, int offset,
3704         packet_info *pinfo, proto_tree *tree, char *drep)
3705 {
3706         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3707                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3708                 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3709
3710         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3711                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3712                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3713
3714         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3715                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3716                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
3717
3718         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3719                                   hf_netlogon_rc, NULL);
3720
3721         return offset;
3722 }
3723
3724 static int
3725 netlogon_dissect_function_09_rqst(tvbuff_t *tvb, int offset,
3726         packet_info *pinfo, proto_tree *tree, char *drep)
3727 {
3728         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3729                 pinfo, tree, drep);
3730
3731         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3732                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3733
3734         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3735                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3736                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3737
3738         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3739                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3740                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3741
3742         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3743                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3744                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3745
3746         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3747                 hf_netlogon_unknown_long, NULL);
3748
3749         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3750                 hf_netlogon_unknown_long, NULL);
3751
3752         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3753                 hf_netlogon_unknown_long, NULL);
3754         return offset;
3755 }
3756
3757
3758 static int
3759 netlogon_dissect_function_09_reply(tvbuff_t *tvb, int offset,
3760         packet_info *pinfo, proto_tree *tree, char *drep)
3761 {
3762         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3763                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3764                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3765
3766         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3767                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3768                 "BYTE_array pointer: unknown_BYTE", -1, 0);
3769
3770         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3771                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3772                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3773
3774         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3775                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3776                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3777
3778         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3779                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3780                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3781
3782         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3783                                   hf_netlogon_rc, NULL);
3784
3785         return offset;
3786 }
3787
3788 static int
3789 netlogon_dissect_function_0a_rqst(tvbuff_t *tvb, int offset,
3790         packet_info *pinfo, proto_tree *tree, char *drep)
3791 {
3792         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3793                 pinfo, tree, drep);
3794
3795         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3796                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3797
3798         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3799                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3800                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3801
3802         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3803                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3804                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3805
3806         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3807                 hf_netlogon_unknown_long, NULL);
3808
3809         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3810                 hf_netlogon_unknown_long, NULL);
3811
3812         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3813                 hf_netlogon_unknown_long, NULL);
3814
3815         return offset;
3816 }
3817
3818
3819 static int
3820 netlogon_dissect_function_0a_reply(tvbuff_t *tvb, int offset,
3821         packet_info *pinfo, proto_tree *tree, char *drep)
3822 {
3823         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3824                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3825                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3826
3827         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3828                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3829                 "BYTE_array pointer: unknown_BYTE", -1, 0);
3830
3831         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3832                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3833                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3834
3835         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3836                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3837                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3838
3839         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3840                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3841                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3842
3843         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3844                 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3845                 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3846
3847         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3848                                   hf_netlogon_rc, NULL);
3849
3850         return offset;
3851 }
3852
3853 static int
3854 netlogon_dissect_function_0b_rqst(tvbuff_t *tvb, int offset,
3855         packet_info *pinfo, proto_tree *tree, char *drep)
3856 {
3857
3858         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3859                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3860
3861         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3862                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3863                 "unknown string", hf_netlogon_unknown_string, 0);
3864
3865         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3866                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3867                 "WCHAR* pointer: unknown string", -1, 0);
3868         return offset;
3869 }
3870
3871
3872 static int
3873 netlogon_dissect_function_0b_reply(tvbuff_t *tvb, int offset,
3874         packet_info *pinfo, proto_tree *tree, char *drep)
3875 {
3876         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3877                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3878                 "WCHAR* pointer: unknown string", -1, 0);
3879
3880         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3881                                   hf_netlogon_rc, NULL);
3882
3883         return offset;
3884 }
3885
3886 static int
3887 netlogon_dissect_netlogoncontrol_rqst(tvbuff_t *tvb, int offset,
3888         packet_info *pinfo, proto_tree *tree, char *drep)
3889 {
3890         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3891                 pinfo, tree, drep);
3892
3893         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3894                 hf_netlogon_code, NULL);
3895
3896         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3897                 hf_netlogon_level, NULL);
3898
3899         return offset;
3900 }
3901
3902
3903 static int
3904 netlogon_dissect_netlogoncontrol_reply(tvbuff_t *tvb, int offset,
3905         packet_info *pinfo, proto_tree *tree, char *drep)
3906 {
3907         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3908                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3909                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3910
3911         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3912                                   hf_netlogon_rc, NULL);
3913
3914         return offset;
3915 }
3916
3917 static int
3918 netlogon_dissect_function_0d_rqst(tvbuff_t *tvb, int offset,
3919         packet_info *pinfo, proto_tree *tree, char *drep)
3920 {
3921         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3922                 pinfo, tree, drep);
3923
3924         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3925                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3926                 "unknown string", hf_netlogon_unknown_string, 0);
3927
3928         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3929                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3930                 "WCHAR* pointer: unknown string", -1, 0);
3931         return offset;
3932 }
3933
3934
3935 static int
3936 netlogon_dissect_function_0d_reply(tvbuff_t *tvb, int offset,
3937         packet_info *pinfo, proto_tree *tree, char *drep)
3938 {
3939         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3940                 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3941                 "WCHAR* pointer: unknown string", -1, 0);
3942
3943         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3944                                   hf_netlogon_rc, NULL);
3945
3946         return offset;
3947 }
3948
3949 static int
3950 netlogon_dissect_netlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
3951         packet_info *pinfo, proto_tree *tree, char *drep)
3952 {
3953         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3954                 pinfo, tree, drep);
3955
3956         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3957                 hf_netlogon_code, NULL);
3958
3959         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3960                 hf_netlogon_level, NULL);
3961
3962         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3963                 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
3964                 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
3965
3966         return offset;
3967 }
3968
3969
3970 static int
3971 netlogon_dissect_netlogoncontrol2_reply(tvbuff_t *tvb, int offset,
3972         packet_info *pinfo, proto_tree *tree, char *drep)
3973 {
3974         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3975                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3976                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3977
3978         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3979                                   hf_netlogon_rc, NULL);
3980
3981         return offset;
3982 }
3983
3984 static int
3985 netlogon_dissect_netserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
3986         packet_info *pinfo, proto_tree *tree, char *drep)
3987 {
3988         if (check_col(pinfo->cinfo, COL_INFO))
3989                 col_set_str(pinfo->cinfo, COL_INFO, "Auth2 request");
3990
3991         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3992                 pinfo, tree, drep);
3993
3994         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3995                 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3996
3997         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3998                 pinfo, tree, drep);
3999
4000         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4001                 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
4002
4003         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4004                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4005                 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
4006
4007         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4008                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4009                 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4010         return offset;
4011 }
4012
4013
4014 static int
4015 netlogon_dissect_netserverauthenticate2_reply(tvbuff_t *tvb, int offset,
4016         packet_info *pinfo, proto_tree *tree, char *drep)
4017 {
4018         if (check_col(pinfo->cinfo, COL_INFO))
4019                 col_set_str(pinfo->cinfo, COL_INFO, "Auth2 response");
4020
4021         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4022                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4023                 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
4024
4025         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4026                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4027                 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4028
4029         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4030                                   hf_netlogon_rc, NULL);
4031
4032         return offset;
4033 }
4034
4035 static int
4036 netlogon_dissect_netdatabasesync2_rqst(tvbuff_t *tvb, int offset,
4037         packet_info *pinfo, proto_tree *tree, char *drep)
4038 {
4039         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4040                 pinfo, tree, drep);
4041
4042         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4043                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4044
4045         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4046                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4047                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4048
4049         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4050                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4051                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4052
4053         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4054                 hf_netlogon_unknown_long, NULL);
4055
4056         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4057                 hf_netlogon_unknown_short, NULL);
4058
4059         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4060                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4061                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4062
4063         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4064                 hf_netlogon_unknown_long, NULL);
4065
4066         return offset;
4067 }
4068
4069
4070 static int
4071 netlogon_dissect_netdatabasesync2_reply(tvbuff_t *tvb, int offset,
4072         packet_info *pinfo, proto_tree *tree, char *drep)
4073 {
4074         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4075                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4076                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4077
4078         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4079                 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4080                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4081
4082         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4083                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4084                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4085
4086         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4087                                   hf_netlogon_rc, NULL);
4088
4089         return offset;
4090 }
4091
4092 static int
4093 netlogon_dissect_function_11_rqst(tvbuff_t *tvb, int offset,
4094         packet_info *pinfo, proto_tree *tree, char *drep)
4095 {
4096         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4097                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4098
4099         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4100                 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4101
4102         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4103                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4104                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4105
4106         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4107                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4108                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4109
4110         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4111                 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
4112                 "BYTE pointer: unknown_BYTE", -1, 0);
4113
4114         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4115                 hf_netlogon_unknown_long, NULL);
4116
4117         return offset;
4118 }
4119
4120
4121 static int
4122 netlogon_dissect_function_11_reply(tvbuff_t *tvb, int offset,
4123         packet_info *pinfo, proto_tree *tree, char *drep)
4124 {
4125         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4126                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4127                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4128
4129         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4130                 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4131                 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4132
4133         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4134                                   hf_netlogon_rc, NULL);
4135
4136         return offset;
4137 }
4138
4139 static int
4140 netlogon_dissect_function_12_rqst(tvbuff_t *tvb, int offset,
4141         packet_info *pinfo, proto_tree *tree, char *drep)
4142 {
4143         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4144                 pinfo, tree, drep);
4145
4146         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4147                 hf_netlogon_unknown_long, NULL);
4148
4149         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4150                 hf_netlogon_level, NULL);
4151
4152         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4153                 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
4154                 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
4155
4156         return offset;
4157 }
4158
4159
4160 static int
4161 netlogon_dissect_function_12_reply(tvbuff_t *tvb, int offset,
4162         packet_info *pinfo, proto_tree *tree, char *drep)
4163 {
4164         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4165                 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
4166                 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
4167
4168         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4169                                   hf_netlogon_rc, NULL);
4170
4171         return offset;
4172 }
4173
4174 static int
4175 netlogon_dissect_nettrusteddomainlist_rqst(tvbuff_t *tvb, int offset,
4176         packet_info *pinfo, proto_tree *tree, char *drep)
4177 {
4178         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4179                 pinfo, tree, drep);
4180
4181         return offset;
4182 }
4183
4184
4185 static int
4186 netlogon_dissect_nettrusteddomainlist_reply(tvbuff_t *tvb, int offset,
4187         packet_info *pinfo, proto_tree *tree, char *drep)
4188 {
4189         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4190                 netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF,
4191                 "UNICODE_MULTI pointer: trust_dom_name_list", -1, 0);
4192
4193         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4194                                   hf_netlogon_rc, NULL);
4195
4196         return offset;
4197 }
4198
4199 static int
4200 netlogon_dissect_dsrgetdcname2_rqst(tvbuff_t *tvb, int offset,
4201         packet_info *pinfo, proto_tree *tree, char *drep)
4202 {
4203         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4204                 pinfo, tree, drep);
4205
4206         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4207                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4208                 "Domain", hf_netlogon_logon_dom, 0);
4209
4210         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4211                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4212                 "GUID pointer: domain_guid", -1, 0);
4213
4214         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4215                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4216                 "GUID pointer: site_guid", -1, 0);
4217
4218         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4219                 hf_netlogon_flags, NULL);
4220
4221         return offset;
4222 }
4223
4224
4225 static int
4226 netlogon_dissect_dsrgetdcname2_reply(tvbuff_t *tvb, int offset,
4227         packet_info *pinfo, proto_tree *tree, char *drep)
4228 {
4229         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4230                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4231                 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4232
4233         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4234                                   hf_netlogon_rc, NULL);
4235
4236         return offset;
4237 }
4238
4239 static int
4240 netlogon_dissect_function_15_rqst(tvbuff_t *tvb, int offset,
4241         packet_info *pinfo, proto_tree *tree, char *drep)
4242 {
4243         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4244                 pinfo, tree, drep);
4245
4246         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4247                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4248                 "unknown string", hf_netlogon_unknown_string, 0);
4249
4250         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4251                 pinfo, tree, drep);
4252
4253         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4254                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4255                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4256
4257         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4258                 hf_netlogon_unknown_long, NULL);
4259
4260         return offset;
4261 }
4262
4263
4264 static int
4265 netlogon_dissect_function_15_reply(tvbuff_t *tvb, int offset,
4266         packet_info *pinfo, proto_tree *tree, char *drep)
4267 {
4268         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4269                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4270                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4271
4272         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4273                 netlogon_dissect_TYPE_44, NDR_POINTER_PTR,
4274                 "TYPE_44 pointer: unknown_TYPE_44", -1, 0);
4275
4276         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4277                                   hf_netlogon_rc, NULL);
4278
4279         return offset;
4280 }
4281
4282 static int
4283 netlogon_dissect_function_16_rqst(tvbuff_t *tvb, int offset,
4284         packet_info *pinfo, proto_tree *tree, char *drep)
4285 {
4286         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4287                 pinfo, tree, drep);
4288
4289         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4290                 hf_netlogon_unknown_long, NULL);
4291
4292         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4293                 hf_netlogon_unknown_long, NULL);
4294
4295         return offset;
4296 }
4297
4298
4299 static int
4300 netlogon_dissect_function_16_reply(tvbuff_t *tvb, int offset,
4301         packet_info *pinfo, proto_tree *tree, char *drep)
4302 {
4303         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4304                                   hf_netlogon_rc, NULL);
4305
4306         return offset;
4307 }
4308
4309 static int
4310 netlogon_dissect_function_17_rqst(tvbuff_t *tvb, int offset,
4311         packet_info *pinfo, proto_tree *tree, char *drep)
4312 {
4313         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4314                 pinfo, tree, drep);
4315
4316         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4317                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4318                 "unknown string", hf_netlogon_unknown_string, 0);
4319
4320         return offset;
4321 }
4322
4323
4324 static int
4325 netlogon_dissect_function_17_reply(tvbuff_t *tvb, int offset,
4326         packet_info *pinfo, proto_tree *tree, char *drep)
4327 {
4328         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4329                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4330                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4331
4332         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4333                                   hf_netlogon_rc, NULL);
4334
4335         return offset;
4336 }
4337
4338 static int
4339 netlogon_dissect_function_18_rqst(tvbuff_t *tvb, int offset,
4340         packet_info *pinfo, proto_tree *tree, char *drep)
4341 {
4342         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4343                 pinfo, tree, drep);
4344
4345         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4346                 hf_netlogon_unknown_long, NULL);
4347
4348         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4349                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4350                 "BYTE pointer: unknown_BYTE", -1, 0);
4351
4352         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4353                 hf_netlogon_unknown_long, NULL);
4354
4355         return offset;
4356 }
4357
4358 static int
4359 netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset,
4360         packet_info *pinfo, proto_tree *tree, char *drep)
4361 {
4362         int i;
4363
4364         for(i=0;i<16;i++){
4365                 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4366                         hf_netlogon_unknown_char, NULL);
4367         }
4368
4369         return offset;
4370 }
4371
4372 static int
4373 netlogon_dissect_function_18_reply(tvbuff_t *tvb, int offset,
4374         packet_info *pinfo, proto_tree *tree, char *drep)
4375 {
4376         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4377                 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4378                 "BYTE pointer: unknown_BYTE", -1, 0);
4379
4380         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4381                                   hf_netlogon_rc, NULL);
4382
4383         return offset;
4384 }
4385
4386 static int
4387 netlogon_dissect_function_19_rqst(tvbuff_t *tvb, int offset,
4388         packet_info *pinfo, proto_tree *tree, char *drep)
4389 {
4390         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4391                 pinfo, tree, drep);
4392
4393         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4394                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4395                 "unknown string", hf_netlogon_unknown_string, 0);
4396
4397         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4398                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4399                 "BYTE pointer: unknown_BYTE", -1, 0);
4400
4401         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4402                 hf_netlogon_unknown_long, NULL);
4403
4404         return offset;
4405 }
4406
4407
4408 static int
4409 netlogon_dissect_function_19_reply(tvbuff_t *tvb, int offset,
4410         packet_info *pinfo, proto_tree *tree, char *drep)
4411 {
4412         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4413                 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4414                 "BYTE pointer: unknown_BYTE", -1, 0);
4415
4416         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4417                                   hf_netlogon_rc, NULL);
4418
4419         return offset;
4420 }
4421
4422 static int
4423 netlogon_dissect_netserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
4424         packet_info *pinfo, proto_tree *tree, char *drep)
4425 {
4426         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4427                 pinfo, tree, drep);
4428
4429         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4430                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4431                 "Acct Name", hf_netlogon_acct_name, 0);
4432
4433         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4434                 pinfo, tree, drep);
4435
4436         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4437                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4438                 "Computer Name", hf_netlogon_computer_name, 0);
4439
4440         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4441                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4442                 "NETLOGON_CREDENTIAL pointer: authenticator", -1, 0);
4443
4444         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4445                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4446                 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4447
4448         return offset;
4449 }
4450
4451
4452 static int
4453 netlogon_dissect_netserverauthenticate3_reply(tvbuff_t *tvb, int offset,
4454         packet_info *pinfo, proto_tree *tree, char *drep)
4455 {
4456         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4457                 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4458                 "NETLOGON_CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1, 0);
4459
4460         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4461                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4462                 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4463
4464         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4465                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4466                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4467
4468         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4469                                   hf_netlogon_rc, NULL);
4470
4471         return offset;
4472 }
4473
4474 static int
4475 netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
4476         packet_info *pinfo, proto_tree *tree, char *drep)
4477 {
4478         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4479                 pinfo, tree, drep);
4480
4481         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4482                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4483                 "Domain", hf_netlogon_logon_dom, 0);
4484
4485         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4486                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4487                 "GUID pointer: domain_guid", -1, 0);
4488
4489         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4490                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4491                 "Site Name", hf_netlogon_site_name, 0);
4492
4493         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4494                 hf_netlogon_flags, NULL);
4495
4496         return offset;
4497 }
4498
4499
4500 static int
4501 netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
4502         packet_info *pinfo, proto_tree *tree, char *drep)
4503 {
4504         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4505                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4506                 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4507
4508         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4509                                   hf_netlogon_rc, NULL);
4510
4511         return offset;
4512 }
4513
4514 static int
4515 netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset,
4516         packet_info *pinfo, proto_tree *tree, char *drep)
4517 {
4518         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4519                 pinfo, tree, drep);
4520
4521         return offset;
4522 }
4523
4524
4525 static int
4526 netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset,
4527         packet_info *pinfo, proto_tree *tree, char *drep)
4528 {
4529
4530         offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4531                 NDR_POINTER_REF, hf_netlogon_site_name, 0);
4532
4533         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4534                                   hf_netlogon_rc, NULL);
4535
4536         return offset;
4537 }
4538
4539 static int
4540 netlogon_dissect_function_1d_rqst(tvbuff_t *tvb, int offset,
4541         packet_info *pinfo, proto_tree *tree, char *drep)
4542 {
4543         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4544                 pinfo, tree, drep);
4545
4546         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4547                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4548                 "Computer Name", hf_netlogon_computer_name, 0);
4549
4550         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4551                 pinfo, tree, drep);
4552
4553         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4554                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4555                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4556
4557         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4558                 hf_netlogon_unknown_long, NULL);
4559
4560         offset = netlogon_dissect_TYPE_45(tvb, offset,
4561                 pinfo, tree, drep);
4562
4563         return offset;
4564 }
4565
4566
4567 static int
4568 netlogon_dissect_function_1d_reply(tvbuff_t *tvb, int offset,
4569         packet_info *pinfo, proto_tree *tree, char *drep)
4570 {
4571         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4572                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4573                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4574
4575         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4576                 netlogon_dissect_TYPE_47, NDR_POINTER_PTR,
4577                 "TYPE_47 pointer: unknown_TYPE_47", -1, 0);
4578
4579         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4580                                   hf_netlogon_rc, NULL);
4581
4582         return offset;
4583 }
4584
4585 static int
4586 netlogon_dissect_function_1e_rqst(tvbuff_t *tvb, int offset,
4587         packet_info *pinfo, proto_tree *tree, char *drep)
4588 {
4589         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4590                 pinfo, tree, drep);
4591
4592         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4593                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4594                 "unknown string", hf_netlogon_unknown_string, 0);
4595
4596         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4597                 hf_netlogon_unknown_short, NULL);
4598
4599         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4600                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4601                 "unknown string", hf_netlogon_unknown_string, 0);
4602
4603         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4604                 pinfo, tree, drep);
4605
4606         offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset,
4607                 pinfo, tree, drep);
4608
4609         return offset;
4610 }
4611
4612
4613 static int
4614 netlogon_dissect_function_1e_reply(tvbuff_t *tvb, int offset,
4615         packet_info *pinfo, proto_tree *tree, char *drep)
4616 {
4617         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4618                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4619                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4620
4621         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4622                                   hf_netlogon_rc, NULL);
4623
4624         return offset;
4625 }
4626
4627 static int
4628 netlogon_dissect_netserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
4629         packet_info *pinfo, proto_tree *tree, char *drep)
4630 {
4631         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4632                 pinfo, tree, drep);
4633
4634         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4635                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4636                 "Acct Name", hf_netlogon_acct_name, 0);
4637
4638         offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4639                 pinfo, tree, drep);
4640
4641         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4642                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4643                 "Computer Name", hf_netlogon_computer_name, 0);
4644
4645         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4646                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4647                 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
4648
4649         return offset;
4650 }
4651
4652
4653 static int
4654 netlogon_dissect_netserverpasswordset2_reply(tvbuff_t *tvb, int offset,
4655         packet_info *pinfo, proto_tree *tree, char *drep)
4656 {
4657         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4658                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4659                 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
4660
4661         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4662                 netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF,
4663                 "LM_OWF_PASSWORD pointer: server_pwd", -1, 0);
4664
4665         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4666                                   hf_netlogon_rc, NULL);
4667
4668         return offset;
4669 }
4670
4671 static int
4672 netlogon_dissect_function_20_rqst(tvbuff_t *tvb, int offset,
4673         packet_info *pinfo, proto_tree *tree, char *drep)
4674 {
4675         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4676                 pinfo, tree, drep);
4677
4678         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4679                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4680                 "unknown string", hf_netlogon_unknown_string, -1);
4681
4682         offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4683                 pinfo, tree, drep);
4684
4685         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4686                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4687                 "BYTE pointer: unknown_BYTE", -1, 0);
4688
4689         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4690                 hf_netlogon_unknown_long, NULL);
4691
4692         return offset;
4693 }
4694
4695
4696 static int
4697 netlogon_dissect_function_20_reply(tvbuff_t *tvb, int offset,
4698         packet_info *pinfo, proto_tree *tree, char *drep)
4699 {
4700         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4701                 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4702                 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4703
4704         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4705                                   hf_netlogon_rc, NULL);
4706
4707         return offset;
4708 }
4709
4710 static int
4711 netlogon_dissect_function_21_rqst(tvbuff_t *tvb, int offset,
4712         packet_info *pinfo, proto_tree *tree, char *drep)
4713 {
4714         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4715                 pinfo, tree, drep);
4716
4717         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4718                 hf_netlogon_unknown_long, NULL);
4719
4720         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4721                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4722                 "BYTE pointer: unknown_BYTE", -1, 0);
4723
4724         return offset;
4725 }
4726
4727
4728 static int
4729 netlogon_dissect_function_21_reply(tvbuff_t *tvb, int offset,
4730         packet_info *pinfo, proto_tree *tree, char *drep)
4731 {
4732         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4733                 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4734                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4735
4736         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4737                                   hf_netlogon_rc, NULL);
4738
4739         return offset;
4740 }
4741
4742 static int
4743 netlogon_dissect_function_22_rqst(tvbuff_t *tvb, int offset,
4744         packet_info *pinfo, proto_tree *tree, char *drep)
4745 {
4746         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4747                 pinfo, tree, drep);
4748
4749         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4750                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4751                 "unknown string", hf_netlogon_unknown_string, 0);
4752
4753         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4754                 hf_netlogon_unknown_long, NULL);
4755
4756         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4757                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4758                 "unknown string", hf_netlogon_unknown_string, 0);
4759
4760         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4761                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4762                 "GUID pointer: unknown_GUID", -1, 0);
4763
4764         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4765                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4766                 "unknown string", hf_netlogon_unknown_string, 0);
4767
4768         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4769                 hf_netlogon_unknown_long, NULL);
4770
4771         return offset;
4772 }
4773
4774
4775 static int
4776 netlogon_dissect_function_22_reply(tvbuff_t *tvb, int offset,
4777         packet_info *pinfo, proto_tree *tree, char *drep)
4778 {
4779         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4780                 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr, NDR_POINTER_REF,
4781                 "DOMAIN_CONTROLLER_INFO** pointer: unknown_DOMAIN_CONTROLLER_INFO", -1, 0);
4782
4783         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4784                                   hf_netlogon_rc, NULL);
4785
4786         return offset;
4787 }
4788
4789 static int
4790 netlogon_dissect_function_23_rqst(tvbuff_t *tvb, int offset,
4791         packet_info *pinfo, proto_tree *tree, char *drep)
4792 {
4793         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4794                 pinfo, tree, drep);
4795
4796         return offset;
4797 }
4798
4799
4800 static int
4801 netlogon_dissect_function_23_reply(tvbuff_t *tvb, int offset,
4802         packet_info *pinfo, proto_tree *tree, char *drep)
4803 {
4804         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4805                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4806                 "unknown string", hf_netlogon_unknown_string, -1);
4807
4808         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4809                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4810                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4811
4812         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4813                                   hf_netlogon_rc, NULL);
4814
4815         return offset;
4816 }
4817
4818 static int
4819 netlogon_dissect_function_24_rqst(tvbuff_t *tvb, int offset,
4820         packet_info *pinfo, proto_tree *tree, char *drep)
4821 {
4822         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4823                 pinfo, tree, drep);
4824
4825         return offset;
4826 }
4827
4828
4829 static int
4830 netlogon_dissect_function_24_reply(tvbuff_t *tvb, int offset,
4831         packet_info *pinfo, proto_tree *tree, char *drep)
4832 {
4833         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4834                 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4835                 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4836
4837         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4838                                   hf_netlogon_rc, NULL);
4839
4840         return offset;
4841 }
4842
4843 static int
4844 netlogon_dissect_function_25_rqst(tvbuff_t *tvb, int offset,
4845         packet_info *pinfo, proto_tree *tree, char *drep)
4846 {
4847         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4848                 pinfo, tree, drep);
4849
4850         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4851                 hf_netlogon_unknown_long, NULL);
4852
4853         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4854                 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4855                 "BYTE pointer: unknown_BYTE", -1, 0);
4856
4857         return offset;
4858 }
4859
4860
4861 static int
4862 netlogon_dissect_function_25_reply(tvbuff_t *tvb, int offset,
4863         packet_info *pinfo, proto_tree *tree, char *drep)
4864 {
4865         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4866                 netlogon_dissect_TYPE_52_ptr_ptr, NDR_POINTER_REF,
4867                 "TYPE_52** pointer: unknown_TYPE_52", -1, 0);
4868
4869         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4870                                   hf_netlogon_rc, NULL);
4871
4872         return offset;
4873 }
4874
4875
4876 static int
4877 netlogon_dissect_function_26_rqst(tvbuff_t *tvb, int offset,
4878         packet_info *pinfo, proto_tree *tree, char *drep)
4879 {
4880         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4881                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4882                 "unknown string", hf_netlogon_unknown_string, 0);
4883
4884         return offset;
4885 }
4886
4887
4888 static int
4889 netlogon_dissect_function_26_reply(tvbuff_t *tvb, int offset,
4890         packet_info *pinfo, proto_tree *tree, char *drep)
4891 {
4892         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4893                 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4894                 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4895
4896         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4897                                   hf_netlogon_rc, NULL);
4898
4899         return offset;
4900 }
4901
4902 static int
4903 netlogon_dissect_function_27_rqst(tvbuff_t *tvb, int offset,
4904         packet_info *pinfo, proto_tree *tree, char *drep)
4905 {
4906         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4907                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4908                 "unknown string", hf_netlogon_unknown_string, 0);
4909
4910         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4911                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4912                 "unknown string", hf_netlogon_unknown_string, 0);
4913
4914         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4915                 hf_netlogon_unknown_short, NULL);
4916
4917         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4918                 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_PTR,
4919                 "NETLOGON_LEVEL pointer: unknown_NETLOGON_LEVEL", -1, 0);
4920
4921         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4922                 hf_netlogon_unknown_short, NULL);
4923
4924         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4925                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4926                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4927         return offset;
4928 }
4929
4930
4931 static int
4932 netlogon_dissect_function_27_reply(tvbuff_t *tvb, int offset,
4933         packet_info *pinfo, proto_tree *tree, char *drep)
4934 {
4935         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4936                 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_PTR,
4937                 "NETLOGON_VALIDATION pointer: unknown_NETLOGON_VALIDATION", -1, 0);
4938
4939         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4940                 netlogon_dissect_pointer_char, NDR_POINTER_PTR,
4941                 "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char, 0);
4942
4943         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4944                 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4945                 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4946
4947         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4948                                   hf_netlogon_rc, NULL);
4949
4950         return offset;
4951 }
4952
4953 static int
4954 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst(tvbuff_t *tvb, int offset,
4955         packet_info *pinfo, proto_tree *tree, char *drep)
4956 {
4957         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4958                 pinfo, tree, drep);
4959
4960         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4961                 hf_netlogon_unknown_long, NULL);
4962
4963         return offset;
4964 }
4965
4966
4967 static int
4968 netlogon_dissect_dsrrolegetprimarydomaininformation_reply(tvbuff_t *tvb, int offset,
4969         packet_info *pinfo, proto_tree *tree, char *drep)
4970 {
4971         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4972                 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4973                 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4974
4975         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4976                                   hf_netlogon_rc, NULL);
4977
4978         return offset;
4979 }
4980
4981 static int
4982 netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset,
4983         packet_info *pinfo, proto_tree *tree, char *drep)
4984 {
4985         offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4986                 pinfo, tree, drep);
4987
4988         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4989                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4990                 "Domain", hf_netlogon_logon_dom, 0);
4991
4992         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4993                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4994                 "GUID pointer: domain_guid", -1, 0);
4995
4996         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4997                 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4998                 "GUID pointer: dsa_guid", -1, 0);
4999
5000         offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5001                 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
5002                 "dns_host", hf_netlogon_dns_host, -1);
5003
5004         return offset;
5005 }
5006
5007
5008 static int
5009 netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset,
5010         packet_info *pinfo, proto_tree *tree, char *drep)
5011 {
5012         offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5013                                   hf_netlogon_rc, NULL);
5014
5015         return offset;
5016 }
5017
5018
5019
5020 static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = {
5021         { NETLOGON_FUNCTION_00, "FUNCTION_00",
5022                 netlogon_dissect_function_00_rqst,
5023                 netlogon_dissect_function_00_reply },
5024         { NETLOGON_FUNCTION_01, "FUNCTION_01",
5025                 netlogon_dissect_function_01_rqst,
5026                 netlogon_dissect_function_01_reply },
5027         { NETLOGON_NETLOGONSAMLOGON, "NETLOGONSAMLOGON",
5028                 netlogon_dissect_netlogonsamlogon_rqst,
5029                 netlogon_dissect_netlogonsamlogon_reply },
5030         { NETLOGON_NETLOGONSAMLOGOFF, "NETLOGONSAMLOGOFF",
5031                 netlogon_dissect_netlogonsamlogoff_rqst,
5032                 netlogon_dissect_netlogonsamlogoff_reply },
5033         { NETLOGON_NETSERVERREQCHALLENGE, "NETSERVERREQCHALLENGE",
5034                 netlogon_dissect_netserverreqchallenge_rqst,
5035                 netlogon_dissect_netserverreqchallenge_reply },
5036         { NETLOGON_NETSERVERAUTHENTICATE, "NETSERVERAUTHENTICATE",
5037                 netlogon_dissect_netserverauthenticate_rqst,
5038                 netlogon_dissect_netserverauthenticate_reply },
5039         { NETLOGON_NETSERVERPASSWORDSET, "NETSERVERPASSWORDSET",
5040                 netlogon_dissect_netserverpasswordset_rqst,
5041                 netlogon_dissect_netserverpasswordset_reply },
5042         { NETLOGON_NETSAMDELTAS, "NETSAMDELTAS",
5043                 netlogon_dissect_netsamdeltas_rqst,
5044                 netlogon_dissect_netsamdeltas_reply },
5045         { NETLOGON_FUNCTION_08, "FUNCTION_08",
5046                 netlogon_dissect_function_08_rqst,
5047                 netlogon_dissect_function_08_reply },
5048         { NETLOGON_FUNCTION_09, "FUNCTION_09",
5049                 netlogon_dissect_function_09_rqst,
5050                 netlogon_dissect_function_09_reply },
5051         { NETLOGON_FUNCTION_0A, "FUNCTION_0A",
5052                 netlogon_dissect_function_0a_rqst,
5053                 netlogon_dissect_function_0a_reply },
5054         { NETLOGON_FUNCTION_0B, "FUNCTION_0B",
5055                 netlogon_dissect_function_0b_rqst,
5056                 netlogon_dissect_function_0b_reply },
5057         { NETLOGON_NETLOGONCONTROL, "NETLOGONCONTROL",
5058                 netlogon_dissect_netlogoncontrol_rqst,
5059                 netlogon_dissect_netlogoncontrol_reply },
5060         { NETLOGON_FUNCTION_0D, "FUNCTION_0D",
5061                 netlogon_dissect_function_0d_rqst,
5062                 netlogon_dissect_function_0d_reply },
5063         { NETLOGON_NETLOGONCONTROL2, "NETLOGONCONTROL2",
5064                 netlogon_dissect_netlogoncontrol2_rqst,
5065                 netlogon_dissect_netlogoncontrol2_reply },
5066         { NETLOGON_NETSERVERAUTHENTICATE2, "NETSERVERAUTHENTICATE2",
5067                 netlogon_dissect_netserverauthenticate2_rqst,
5068                 netlogon_dissect_netserverauthenticate2_reply },
5069         { NETLOGON_NETDATABASESYNC2, "NETDATABASESYNC2",
5070                 netlogon_dissect_netdatabasesync2_rqst,
5071                 netlogon_dissect_netdatabasesync2_reply },
5072         { NETLOGON_FUNCTION_11, "FUNCTION_11",
5073                 netlogon_dissect_function_11_rqst,
5074                 netlogon_dissect_function_11_reply },
5075         { NETLOGON_FUNCTION_12, "FUNCTION_12",
5076                 netlogon_dissect_function_12_rqst,
5077                 netlogon_dissect_function_12_reply },
5078         { NETLOGON_NETTRUSTEDDOMAINLIST, "NETTRUSTEDDOMAINLIST",
5079                 netlogon_dissect_nettrusteddomainlist_rqst,
5080                 netlogon_dissect_nettrusteddomainlist_reply },
5081         { NETLOGON_DSRGETDCNAME2, "DSRGETDCNAME2",
5082                 netlogon_dissect_dsrgetdcname2_rqst,
5083                 netlogon_dissect_dsrgetdcname2_reply },
5084         { NETLOGON_FUNCTION_15, "FUNCTION_15",
5085                 netlogon_dissect_function_15_rqst,
5086                 netlogon_dissect_function_15_reply },
5087         { NETLOGON_FUNCTION_16, "FUNCTION_16",
5088                 netlogon_dissect_function_16_rqst,
5089                 netlogon_dissect_function_16_reply },
5090         { NETLOGON_FUNCTION_17, "FUNCTION_17",
5091                 netlogon_dissect_function_17_rqst,
5092                 netlogon_dissect_function_17_reply },
5093         { NETLOGON_FUNCTION_18, "FUNCTION_18",
5094                 netlogon_dissect_function_18_rqst,
5095                 netlogon_dissect_function_18_reply },
5096         { NETLOGON_FUNCTION_19, "FUNCTION_19",
5097                 netlogon_dissect_function_19_rqst,
5098                 netlogon_dissect_function_19_reply },
5099         { NETLOGON_NETSERVERAUTHENTICATE3, "NETSERVERAUTHENTICATE3",
5100                 netlogon_dissect_netserverauthenticate3_rqst,
5101                 netlogon_dissect_netserverauthenticate3_reply },
5102         { NETLOGON_DSRGETDCNAME, "DSRGETDCNAME",
5103                 netlogon_dissect_dsrgetdcname_rqst,
5104                 netlogon_dissect_dsrgetdcname_reply },
5105         { NETLOGON_DSRGETSITENAME, "DSRGETSITENAME",
5106                 netlogon_dissect_dsrgetsitename_rqst,
5107                 netlogon_dissect_dsrgetsitename_reply },
5108         { NETLOGON_FUNCTION_1D, "FUNCTION_1D",
5109                 netlogon_dissect_function_1d_rqst,
5110                 netlogon_dissect_function_1d_reply },
5111         { NETLOGON_FUNCTION_1E, "FUNCTION_1E",
5112                 netlogon_dissect_function_1e_rqst,
5113                 netlogon_dissect_function_1e_reply },
5114         { NETLOGON_NETSERVERPASSWORDSET2, "NETSERVERPASSWORDSET2",
5115                 netlogon_dissect_netserverpasswordset2_rqst,
5116                 netlogon_dissect_netserverpasswordset2_reply },
5117         { NETLOGON_FUNCTION_20, "FUNCTION_20",
5118                 netlogon_dissect_function_20_rqst,
5119                 netlogon_dissect_function_20_reply },
5120         { NETLOGON_FUNCTION_21, "FUNCTION_21",
5121                 netlogon_dissect_function_21_rqst,
5122                 netlogon_dissect_function_21_reply },
5123         { NETLOGON_FUNCTION_22, "FUNCTION_22",
5124                 netlogon_dissect_function_22_rqst,
5125                 netlogon_dissect_function_22_reply },
5126         { NETLOGON_FUNCTION_23, "FUNCTION_23",
5127                 netlogon_dissect_function_23_rqst,
5128                 netlogon_dissect_function_23_reply },
5129         { NETLOGON_FUNCTION_24, "FUNCTION_24",
5130                 netlogon_dissect_function_24_rqst,
5131                 netlogon_dissect_function_24_reply },
5132         { NETLOGON_FUNCTION_25, "FUNCTION_25",
5133                 netlogon_dissect_function_25_rqst,
5134                 netlogon_dissect_function_25_reply },
5135         { NETLOGON_FUNCTION_26, "FUNCTION_26",
5136                 netlogon_dissect_function_26_rqst,
5137                 netlogon_dissect_function_26_reply },
5138         { NETLOGON_FUNCTION_27, "FUNCTION_27",
5139                 netlogon_dissect_function_27_rqst,
5140                 netlogon_dissect_function_27_reply },
5141         { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DSRROLEGETPRIMARYDOMAININFORMATION",
5142                 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst,
5143                 netlogon_dissect_dsrrolegetprimarydomaininformation_reply },
5144         { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DSRDEREGISTERDNSHOSTRECORDS",
5145                 netlogon_dissect_dsrderegisterdnshostrecords_rqst,
5146                 netlogon_dissect_dsrderegisterdnshostrecords_reply },
5147         {0, NULL, NULL,  NULL },
5148 };
5149
5150 void
5151 proto_register_dcerpc_netlogon(void)
5152 {
5153
5154 static hf_register_info hf[] = {
5155         { &hf_netlogon_rc, {
5156                 "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
5157                 VALS(NT_errors), 0x0, "Netlogon return code", HFILL }},
5158
5159         { &hf_netlogon_param_ctrl, {
5160                 "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
5161                 NULL, 0x0, "Param ctrl", HFILL }},
5162
5163         { &hf_netlogon_logon_id, {
5164                 "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
5165                 NULL, 0x0, "Logon ID", HFILL }},
5166
5167         { &hf_netlogon_count, {
5168                 "Count", "netlogon.count", FT_UINT16, BASE_DEC,
5169                 NULL, 0x0, "", HFILL }},
5170
5171         { &hf_netlogon_credential, {
5172                 "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
5173                 NULL, 0x0, "Netlogon credential", HFILL }},
5174
5175         { &hf_netlogon_cypher_block, {
5176                 "Cypher Block", "netlogon.cypher_block", FT_BYTES, BASE_HEX,
5177                 NULL, 0x0, "Netlogon cypher block", HFILL }},
5178
5179         { &hf_netlogon_lm_owf_password, {
5180                 "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
5181                 NULL, 0x0, "LanManager OWF Password", HFILL }},
5182
5183         { &hf_netlogon_user_session_key, {
5184                 "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
5185                 NULL, 0x0, "User Session Key", HFILL }},
5186
5187         { &hf_netlogon_encrypted_lm_owf_password, {
5188                 "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
5189                 NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }},
5190
5191         { &hf_netlogon_nt_owf_password, {
5192                 "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
5193                 NULL, 0x0, "NT OWF Password", HFILL }},
5194
5195         { &hf_netlogon_blob, {
5196                 "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
5197                 NULL, 0x0, "BLOB", HFILL }},
5198
5199         { &hf_netlogon_len, {
5200                 "Len", "netlogon.len", FT_UINT32, BASE_DEC,
5201                 NULL, 0, "Length", HFILL }},
5202
5203         { &hf_netlogon_status, {
5204                 "Status", "netlogon.status", FT_UINT32, BASE_DEC,
5205                 NULL, 0, "Status", HFILL }},
5206
5207         { &hf_netlogon_attrs, {
5208                 "Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX,
5209                 NULL, 0, "Attributes", HFILL }},
5210
5211         { &hf_netlogon_unknown_string,
5212                 { "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE,
5213                 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
5214         { &hf_netlogon_unknown_long,
5215                 { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
5216                 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
5217         { &hf_netlogon_unknown_short,
5218                 { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
5219                 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
5220
5221         { &hf_netlogon_unknown_char,
5222                 { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
5223                 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
5224
5225         { &hf_netlogon_unknown_time,
5226                 { "Unknown time", "netlogon.unknown.time", FT_ABSOLUTE_TIME, BASE_NONE,
5227                 NULL, 0x0, "Unknown time. If you know what this is, contact ethereal developers.", HFILL }},
5228
5229         { &hf_netlogon_acct_expiry_time,
5230                 { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
5231                 NULL, 0x0, "When this account will expire", HFILL }},
5232
5233         { &hf_netlogon_nt_pwd_present,
5234                 { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
5235                 NULL, 0x0, "Is NT password present for this account?", HFILL }},
5236
5237         { &hf_netlogon_lm_pwd_present,
5238                 { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
5239                 NULL, 0x0, "Is LanManager password present for this account?", HFILL }},
5240
5241         { &hf_netlogon_pwd_expired,
5242                 { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
5243                 NULL, 0x0, "Whether this password has expired or not", HFILL }},
5244
5245         { &hf_netlogon_num_pwd_pairs,
5246                 { "Num PWD Pairs", "netlogon.num_pwd_pairs", FT_UINT8, BASE_DEC,
5247                 NULL, 0x0, "Number of password pairs. Password history length?", HFILL }},
5248
5249         { &hf_netlogon_authoritative,
5250                 { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
5251                 NULL, 0x0, "", HFILL }},
5252
5253         { &hf_netlogon_nt_chal_resp,
5254                 { "NT Chal resp", "netlogon.nt_chal_resp", FT_BYTES, BASE_HEX,
5255                 NULL, 0, "Challenge response for NT authentication", HFILL }},
5256
5257         { &hf_netlogon_lm_chal_resp,
5258                 { "LM Chal resp", "netlogon.lm_chal_resp", FT_BYTES, BASE_HEX,
5259                 NULL, 0, "Challenge response for LM authentication", HFILL }},
5260
5261         { &hf_netlogon_acct_name,
5262                 { "Acct Name", "netlogon.acct_name", FT_STRING, BASE_NONE,
5263                 NULL, 0, "Account Name", HFILL }},
5264
5265         { &hf_netlogon_acct_desc,
5266                 { "Acct Desc", "netlogon.acct_desc", FT_STRING, BASE_NONE,
5267                 NULL, 0, "Account Description", HFILL }},
5268
5269         { &hf_netlogon_group_desc,
5270                 { "Group Desc", "netlogon.group_desc", FT_STRING, BASE_NONE,
5271                 NULL, 0, "Group Description", HFILL }},
5272
5273         { &hf_netlogon_full_name,
5274                 { "Full Name", "netlogon.full_name", FT_STRING, BASE_NONE,
5275                 NULL, 0, "Full Name", HFILL }},
5276
5277         { &hf_netlogon_comment,
5278                 { "Comment", "netlogon.comment", FT_STRING, BASE_NONE,
5279                 NULL, 0, "Comment", HFILL }},
5280
5281         { &hf_netlogon_parameters,
5282                 { "Parameters", "netlogon.parameters", FT_STRING, BASE_NONE,
5283                 NULL, 0, "Parameters", HFILL }},
5284
5285         { &hf_netlogon_logon_script,
5286                 { "Logon Script", "netlogon.logon_script", FT_STRING, BASE_NONE,
5287                 NULL, 0, "Logon Script", HFILL }},
5288
5289         { &hf_netlogon_profile_path,
5290                 { "Profile Path", "netlogon.profile_path", FT_STRING, BASE_NONE,
5291                 NULL, 0, "Profile Path", HFILL }},
5292
5293         { &hf_netlogon_home_dir,
5294                 { "Home Dir", "netlogon.home_dir", FT_STRING, BASE_NONE,
5295                 NULL, 0, "Home Directory", HFILL }},
5296
5297         { &hf_netlogon_dir_drive,
5298                 { "Dir Drive", "netlogon.dir_drive", FT_STRING, BASE_NONE,
5299                 NULL, 0, "Drive letter for home directory", HFILL }},
5300
5301         { &hf_netlogon_logon_srv,
5302                 { "Server", "netlogon.server", FT_STRING, BASE_NONE,
5303                 NULL, 0, "Server", HFILL }},
5304
5305         { &hf_netlogon_logon_dom,
5306                 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
5307                 NULL, 0, "Domain", HFILL }},
5308
5309         { &hf_netlogon_computer_name,
5310                 { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
5311                 NULL, 0, "Computer Name", HFILL }},
5312
5313         { &hf_netlogon_site_name,
5314                 { "Site Name", "netlogon.site_name", FT_STRING, BASE_NONE,
5315                 NULL, 0, "Site Name", HFILL }},
5316
5317         { &hf_netlogon_dc_name,
5318                 { "DC Name", "netlogon.dc.name", FT_STRING, BASE_NONE,
5319                 NULL, 0, "DC Name", HFILL }},
5320
5321         { &hf_netlogon_dc_site_name,
5322                 { "DC Site Name", "netlogon.dc.site_name", FT_STRING, BASE_NONE,
5323                 NULL, 0, "DC Site Name", HFILL }},
5324
5325         { &hf_netlogon_dns_forest_name,
5326                 { "DNS Forest Name", "netlogon.dns.forest_name", FT_STRING, BASE_NONE,
5327                 NULL, 0, "DNS Forest Name", HFILL }},
5328
5329         { &hf_netlogon_dc_address,
5330                 { "DC Address", "netlogon.dc.address", FT_STRING, BASE_NONE,
5331                 NULL, 0, "DC Address", HFILL }},
5332
5333         { &hf_netlogon_dc_address_type,
5334                 { "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC,
5335                 NULL, 0, "DC Address Type", HFILL }},
5336
5337         { &hf_netlogon_client_name,
5338                 { "Client Name", "netlogon.client.name", FT_STRING, BASE_NONE,
5339                 NULL, 0, "Client Name", HFILL }},
5340
5341         { &hf_netlogon_client_site_name,
5342                 { "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE,
5343                 NULL, 0, "Client Site Name", HFILL }},
5344
5345         { &hf_netlogon_workstation_site_name,
5346                 { "Wkst Site Name", "netlogon.wkst.site_name", FT_STRING, BASE_NONE,
5347                 NULL, 0, "Workstation Site Name", HFILL }},
5348
5349         { &hf_netlogon_workstation_os,
5350                 { "Wkst OS", "netlogon.wkst.os", FT_STRING, BASE_NONE,
5351                 NULL, 0, "Workstation OS", HFILL }},
5352
5353         { &hf_netlogon_workstations,
5354                 { "Workstations", "netlogon.wksts", FT_STRING, BASE_NONE,
5355                 NULL, 0, "Workstations", HFILL }},
5356
5357         { &hf_netlogon_workstation_fqdn,
5358                 { "Wkst FQDN", "netlogon.wkst.fqdn", FT_STRING, BASE_NONE,
5359                 NULL, 0, "Workstation FQDN", HFILL }},
5360
5361         { &hf_netlogon_group_name,
5362                 { "Group Name", "netlogon.group_name", FT_STRING, BASE_NONE,
5363                 NULL, 0, "Group Name", HFILL }},
5364
5365         { &hf_netlogon_alias_name,
5366                 { "Alias Name", "netlogon.alias_name", FT_STRING, BASE_NONE,
5367                 NULL, 0, "Alias Name", HFILL }},
5368
5369         { &hf_netlogon_cli_name,
5370                 { "CLI Name", "netlogon.cli_name", FT_STRING, BASE_NONE,
5371                 NULL, 0, "CLI Name", HFILL }},
5372
5373         { &hf_netlogon_dns_host,
5374                 { "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE,
5375                 NULL, 0, "DNS Host", HFILL }},
5376
5377         { &hf_netlogon_trusted_domain_name,
5378                 { "Trusted Domain", "netlogon.trusted_domain", FT_STRING, BASE_NONE,
5379                 NULL, 0, "Trusted Domain Name", HFILL }},
5380
5381         { &hf_netlogon_trusted_dc_name,
5382                 { "Trusted DC", "netlogon.trusted_dc", FT_STRING, BASE_NONE,
5383                 NULL, 0, "Trusted DC", HFILL }},
5384
5385         { &hf_netlogon_logonsrv_handle,
5386                 { "Handle", "netlogon.handle", FT_STRING, BASE_NONE,
5387                 NULL, 0, "Logon Srv Handle", HFILL }},
5388
5389         { &hf_netlogon_logon_count,
5390                 { "Logon Count", "netlogon.logon_count", FT_UINT16, BASE_DEC,
5391                 NULL, 0x0, "Number of successful logins", HFILL }},
5392
5393         { &hf_netlogon_bad_pw_count,
5394                 { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT16, BASE_DEC,
5395                 NULL, 0x0, "Number of failed logins", HFILL }},
5396
5397         { &hf_netlogon_country,
5398                 { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
5399                 VALS(ms_country_codes), 0x0, "Country setting for this account", HFILL }},
5400
5401         { &hf_netlogon_codepage,
5402                 { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
5403                 NULL, 0x0, "Codepage setting for this account", HFILL }},
5404
5405         { &hf_netlogon_level,
5406                 { "Level", "netlogon.level", FT_UINT16, BASE_DEC,
5407                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5408
5409         { &hf_netlogon_secure_channel_type,
5410                 { "Sec Chn Type", "netlogon.sec_chn_type", FT_UINT16, BASE_DEC,
5411                 NULL, 0x0, "Secure Channel Type", HFILL }},
5412
5413         { &hf_netlogon_blob_size,
5414                 { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
5415                 NULL, 0x0, "Size in bytes of BLOB", HFILL }},
5416
5417         { &hf_netlogon_code,
5418                 { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
5419                 NULL, 0x0, "Code", HFILL }},
5420
5421         { &hf_netlogon_level_long,
5422                 { "Level", "netlogon.level32", FT_UINT32, BASE_DEC,
5423                 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5424
5425         { &hf_netlogon_timestamp,
5426                 { "Timestamp", "netlogon.timestamp", FT_UINT32, BASE_HEX,
5427                 NULL, 0x0, "Some sort of timestamp", HFILL }},
5428
5429         { &hf_netlogon_user_rid,
5430                 { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
5431                 NULL, 0x0, "", HFILL }},
5432
5433         { &hf_netlogon_alias_rid,
5434                 { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
5435                 NULL, 0x0, "", HFILL }},
5436
5437         { &hf_netlogon_group_rid,
5438                 { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
5439                 NULL, 0x0, "", HFILL }},
5440
5441         { &hf_netlogon_num_rids,
5442                 { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
5443                 NULL, 0x0, "Number of RIDs", HFILL }},
5444
5445         { &hf_netlogon_num_other_groups,
5446                 { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
5447                 NULL, 0x0, "", HFILL }},
5448
5449         { &hf_netlogon_flags,
5450                 { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
5451                 NULL, 0x0, "", HFILL }},
5452
5453         { &hf_netlogon_user_flags,
5454                 { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
5455                 NULL, 0x0, "", HFILL }},
5456
5457         { &hf_netlogon_database_id,
5458                 { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
5459                 NULL, 0x0, "Database Id", HFILL }},
5460
5461         { &hf_netlogon_max_size,
5462                 { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
5463                 NULL, 0x0, "Max Size of database", HFILL }},
5464
5465         { &hf_netlogon_num_deltas,
5466                 { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
5467                 NULL, 0x0, "Number of SAM Deltas in array", HFILL }},
5468
5469         { &hf_netlogon_logon_attempts,
5470                 { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
5471                 NULL, 0x0, "Number of logon attempts", HFILL }},
5472
5473         { &hf_netlogon_logon_time,
5474                 { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
5475                 NULL, 0, "Time for last time this user logged on", HFILL }},
5476
5477         { &hf_netlogon_kickoff_time,
5478                 { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5479                 NULL, 0, "Time when this user will be kicked off", HFILL }},
5480
5481         { &hf_netlogon_logoff_time,
5482                 { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5483                 NULL, 0, "Time for last time this user logged off", HFILL }},
5484
5485         { &hf_netlogon_pwd_last_set_time,
5486                 { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
5487                 NULL, 0, "Last time this users password was changed", HFILL }},
5488
5489         { &hf_netlogon_pwd_can_change_time,
5490                 { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5491                 NULL, 0, "When this users password may be changed", HFILL }},
5492
5493         { &hf_netlogon_pwd_must_change_time,
5494                 { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5495                 NULL, 0, "When this users password must be changed", HFILL }},
5496
5497         };
5498
5499         static gint *ett[] = {
5500                 &ett_dcerpc_netlogon,
5501                 &ett_NETLOGON_SECURITY_DESCRIPTOR,
5502                 &ett_TYPE_1,
5503                 &ett_TYPE_2,
5504                 &ett_CYPHER_BLOCK,
5505                 &ett_NETLOGON_AUTHENTICATOR,
5506                 &ett_NETLOGON_LOGON_IDENTITY_INFO,
5507                 &ett_NETLOGON_INTERACTIVE_INFO,
5508                 &ett_NETLOGON_NETWORK_INFO,
5509                 &ett_NETLOGON_VALIDATION_SAM_INFO1,
5510                 &ett_NETLOGON_VALIDATION_SAM_INFO2,
5511                 &ett_TYPE_16,
5512                 &ett_NETLOGON_SAM_DOMAIN_INFO,
5513                 &ett_NETLOGON_SAM_GROUP_INFO,
5514                 &ett_TYPE_23,
5515                 &ett_NETLOGON_SAM_ACCOUNT_INFO,
5516                 &ett_NETLOGON_SAM_GROUP_MEM_INFO,
5517                 &ett_NETLOGON_SAM_ALIAS_INFO,
5518                 &ett_NETLOGON_SAM_ALIAS_MEM_INFO,
5519                 &ett_TYPE_30,
5520                 &ett_TYPE_29,
5521                 &ett_TYPE_31,
5522                 &ett_TYPE_32,
5523                 &ett_TYPE_33,
5524                 &ett_TYPE_34,
5525                 &ett_TYPE_35,
5526                 &ett_SAM_DELTA,
5527                 &ett_SAM_DELTA_ARRAY,
5528                 &ett_TYPE_36,
5529                 &ett_NETLOGON_INFO_1,
5530                 &ett_NETLOGON_INFO_2,
5531                 &ett_NETLOGON_INFO_3,
5532                 &ett_NETLOGON_INFO_4,
5533                 &ett_UNICODE_MULTI,
5534                 &ett_DOMAIN_CONTROLLER_INFO,
5535                 &ett_TYPE_46,
5536                 &ett_TYPE_48,
5537                 &ett_UNICODE_STRING_512,
5538                 &ett_TYPE_50,
5539                 &ett_TYPE_51,
5540                 &ett_TYPE_52,
5541                 &ett_NETLOGON_LEVEL,
5542                 &ett_NETLOGON_VALIDATION,
5543                 &ett_TYPE_19,
5544                 &ett_NETLOGON_CONTROL_QUERY_INFO,
5545                 &ett_TYPE_44,
5546                 &ett_TYPE_20,
5547                 &ett_NETLOGON_INFO,
5548                 &ett_TYPE_45,
5549                 &ett_TYPE_47,
5550                 &ett_NETLOGON_CREDENTIAL,
5551                 &ett_GUID,
5552                 &ett_ENC_LM_OWF_PASSWORD,
5553                 &ett_LM_OWF_PASSWORD,
5554                 &ett_NT_OWF_PASSWORD,
5555                 &ett_GROUP_MEMBERSHIP,
5556                 &ett_USER_SESSION_KEY,
5557                 &ett_BLOB,
5558                 &ett_rid_array,
5559                 &ett_attrib_array,
5560         };
5561
5562         proto_dcerpc_netlogon = proto_register_protocol(
5563                 "Microsoft Network Logon", "NETLOGON", "rpc_netlogon");
5564
5565         proto_register_field_array(proto_dcerpc_netlogon, hf,
5566                                    array_length(hf));
5567         proto_register_subtree_array(ett, array_length(ett));
5568 }
5569
5570 void
5571 proto_reg_handoff_dcerpc_netlogon(void)
5572 {
5573         /* Register protocol as dcerpc */
5574
5575         dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
5576                          &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
5577                          dcerpc_netlogon_dissectors);
5578 }