1 /* packet-dcerpc-netlogon.c
2 * Routines for SMB \\PIPE\\NETLOGON packet disassembly
3 * Copyright 2001, Tim Potter <tpot@samba.org>
4 * 2002 structure and command dissectors by Ronnie Sahlberg
6 * $Id: packet-dcerpc-netlogon.c,v 1.18 2002/04/29 08:20:06 guy Exp $
8 * Ethereal - Network traffic analyzer
9 * By Gerald Combs <gerald@ethereal.com>
10 * Copyright 1998 Gerald Combs
12 * This program is free software; you can redistribute it and/or
13 * modify it under the terms of the GNU General Public License
14 * as published by the Free Software Foundation; either version 2
15 * of the License, or (at your option) any later version.
17 * This program is distributed in the hope that it will be useful,
18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 * GNU General Public License for more details.
22 * You should have received a copy of the GNU General Public License
23 * along with this program; if not, write to the Free Software
24 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
32 #include <epan/packet.h>
33 #include "packet-dcerpc.h"
34 #include "packet-dcerpc-nt.h"
35 #include "packet-dcerpc-netlogon.h"
36 #include "smb.h" /* for "NT_errors[]" */
37 #include "packet-smb-common.h"
38 #include "packet-dcerpc-lsa.h"
40 static int proto_dcerpc_netlogon = -1;
41 static int hf_netlogon_rc = -1;
42 static int hf_netlogon_len = -1;
43 static int hf_netlogon_status = -1;
44 static int hf_netlogon_attrs = -1;
45 static int hf_netlogon_count = -1;
46 static int hf_netlogon_level = -1;
47 static int hf_netlogon_level_long = -1;
48 static int hf_netlogon_unknown_time = -1;
49 static int hf_netlogon_unknown_string = -1;
50 static int hf_netlogon_unknown_long = -1;
51 static int hf_netlogon_unknown_short = -1;
52 static int hf_netlogon_unknown_char = -1;
53 static int hf_netlogon_logon_time = -1;
54 static int hf_netlogon_logoff_time = -1;
55 static int hf_netlogon_kickoff_time = -1;
56 static int hf_netlogon_pwd_last_set_time = -1;
57 static int hf_netlogon_pwd_can_change_time = -1;
58 static int hf_netlogon_pwd_must_change_time = -1;
59 static int hf_netlogon_timestamp = -1;
60 static int hf_netlogon_nt_chal_resp = -1;
61 static int hf_netlogon_lm_chal_resp = -1;
62 static int hf_netlogon_credential = -1;
63 static int hf_netlogon_cypher_block = -1;
64 static int hf_netlogon_acct_name = -1;
65 static int hf_netlogon_acct_desc = -1;
66 static int hf_netlogon_group_desc = -1;
67 static int hf_netlogon_full_name = -1;
68 static int hf_netlogon_comment = -1;
69 static int hf_netlogon_parameters = -1;
70 static int hf_netlogon_logon_script = -1;
71 static int hf_netlogon_profile_path = -1;
72 static int hf_netlogon_home_dir = -1;
73 static int hf_netlogon_dir_drive = -1;
74 static int hf_netlogon_logon_count = -1;
75 static int hf_netlogon_bad_pw_count = -1;
76 static int hf_netlogon_user_rid = -1;
77 static int hf_netlogon_alias_rid = -1;
78 static int hf_netlogon_group_rid = -1;
79 static int hf_netlogon_logon_srv = -1;
80 static int hf_netlogon_logon_dom = -1;
81 static int hf_netlogon_trusted_domain_name = -1;
82 static int hf_netlogon_num_rids = -1;
83 static int hf_netlogon_num_other_groups = -1;
84 static int hf_netlogon_computer_name = -1;
85 static int hf_netlogon_site_name = -1;
86 static int hf_netlogon_trusted_dc_name = -1;
87 static int hf_netlogon_dc_name = -1;
88 static int hf_netlogon_dc_site_name = -1;
89 static int hf_netlogon_dns_forest_name = -1;
90 static int hf_netlogon_dc_address = -1;
91 static int hf_netlogon_dc_address_type = -1;
92 static int hf_netlogon_client_name = -1;
93 static int hf_netlogon_client_site_name = -1;
94 static int hf_netlogon_workstation_site_name = -1;
95 static int hf_netlogon_workstation_os = -1;
96 static int hf_netlogon_workstations = -1;
97 static int hf_netlogon_workstation_fqdn = -1;
98 static int hf_netlogon_group_name = -1;
99 static int hf_netlogon_alias_name = -1;
100 static int hf_netlogon_cli_name = -1;
101 static int hf_netlogon_country = -1;
102 static int hf_netlogon_codepage = -1;
103 static int hf_netlogon_flags = -1;
104 static int hf_netlogon_user_flags = -1;
105 static int hf_netlogon_pwd_expired = -1;
106 static int hf_netlogon_nt_pwd_present = -1;
107 static int hf_netlogon_lm_pwd_present = -1;
108 static int hf_netlogon_code = -1;
109 static int hf_netlogon_database_id = -1;
110 static int hf_netlogon_max_size = -1;
111 static int hf_netlogon_dns_host = -1;
112 static int hf_netlogon_num_pwd_pairs = -1;
113 static int hf_netlogon_acct_expiry_time = -1;
114 static int hf_netlogon_encrypted_lm_owf_password = -1;
115 static int hf_netlogon_lm_owf_password = -1;
116 static int hf_netlogon_nt_owf_password = -1;
117 static int hf_netlogon_param_ctrl = -1;
118 static int hf_netlogon_logon_id = -1;
119 static int hf_netlogon_num_deltas = -1;
120 static int hf_netlogon_user_session_key = -1;
121 static int hf_netlogon_blob_size = -1;
122 static int hf_netlogon_blob = -1;
123 static int hf_netlogon_logon_attempts = -1;
124 static int hf_netlogon_authoritative = -1;
125 static int hf_netlogon_secure_channel_type = -1;
126 static int hf_netlogon_logonsrv_handle = -1;
128 static gint ett_dcerpc_netlogon = -1;
129 static gint ett_NETLOGON_SECURITY_DESCRIPTOR = -1;
130 static gint ett_TYPE_1 = -1;
131 static gint ett_TYPE_2 = -1;
132 static gint ett_CYPHER_BLOCK = -1;
133 static gint ett_NETLOGON_AUTHENTICATOR = -1;
134 static gint ett_NETLOGON_LOGON_IDENTITY_INFO = -1;
135 static gint ett_NETLOGON_INTERACTIVE_INFO = -1;
136 static gint ett_NETLOGON_NETWORK_INFO = -1;
137 static gint ett_NETLOGON_VALIDATION_SAM_INFO1 = -1;
138 static gint ett_NETLOGON_VALIDATION_SAM_INFO2 = -1;
139 static gint ett_TYPE_16 = -1;
140 static gint ett_NETLOGON_SAM_DOMAIN_INFO = -1;
141 static gint ett_NETLOGON_SAM_GROUP_INFO = -1;
142 static gint ett_TYPE_23 = -1;
143 static gint ett_NETLOGON_SAM_ACCOUNT_INFO = -1;
144 static gint ett_NETLOGON_SAM_GROUP_MEM_INFO = -1;
145 static gint ett_NETLOGON_SAM_ALIAS_INFO = -1;
146 static gint ett_NETLOGON_SAM_ALIAS_MEM_INFO = -1;
147 static gint ett_TYPE_30 = -1;
148 static gint ett_TYPE_29 = -1;
149 static gint ett_TYPE_31 = -1;
150 static gint ett_TYPE_32 = -1;
151 static gint ett_TYPE_33 = -1;
152 static gint ett_TYPE_34 = -1;
153 static gint ett_TYPE_35 = -1;
154 static gint ett_SAM_DELTA = -1;
155 static gint ett_SAM_DELTA_ARRAY = -1;
156 static gint ett_TYPE_36 = -1;
157 static gint ett_NETLOGON_INFO_1 = -1;
158 static gint ett_NETLOGON_INFO_2 = -1;
159 static gint ett_NETLOGON_INFO_3 = -1;
160 static gint ett_NETLOGON_INFO_4 = -1;
161 static gint ett_UNICODE_MULTI = -1;
162 static gint ett_DOMAIN_CONTROLLER_INFO = -1;
163 static gint ett_TYPE_46 = -1;
164 static gint ett_TYPE_48 = -1;
165 static gint ett_UNICODE_STRING_512 = -1;
166 static gint ett_TYPE_50 = -1;
167 static gint ett_TYPE_51 = -1;
168 static gint ett_TYPE_52 = -1;
169 static gint ett_NETLOGON_LEVEL = -1;
170 static gint ett_NETLOGON_VALIDATION = -1;
171 static gint ett_TYPE_19 = -1;
172 static gint ett_NETLOGON_CONTROL_QUERY_INFO = -1;
173 static gint ett_TYPE_44 = -1;
174 static gint ett_TYPE_20 = -1;
175 static gint ett_NETLOGON_INFO = -1;
176 static gint ett_TYPE_45 = -1;
177 static gint ett_TYPE_47 = -1;
178 static gint ett_NETLOGON_CREDENTIAL = -1;
179 static gint ett_GUID = -1;
180 static gint ett_ENC_LM_OWF_PASSWORD = -1;
181 static gint ett_LM_OWF_PASSWORD = -1;
182 static gint ett_NT_OWF_PASSWORD = -1;
183 static gint ett_GROUP_MEMBERSHIP = -1;
184 static gint ett_USER_SESSION_KEY = -1;
185 static gint ett_BLOB = -1;
186 static gint ett_rid_array = -1;
187 static gint ett_attrib_array = -1;
189 static e_uuid_t uuid_dcerpc_netlogon = {
190 0x12345678, 0x1234, 0xabcd,
191 { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0xcf, 0xfb }
194 static guint16 ver_dcerpc_netlogon = 1;
198 netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset,
199 packet_info *pinfo, proto_tree *tree,
204 di=pinfo->private_data;
205 offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
211 netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset,
212 packet_info *pinfo, proto_tree *tree,
217 di=pinfo->private_data;
218 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
224 netlogon_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
225 packet_info *pinfo, proto_tree *tree,
230 di=pinfo->private_data;
231 if(di->conformant_run){
232 /*just a run to handle conformant arrays, nothing to dissect */
236 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
242 netlogon_dissect_UNICODE_STRING(tvbuff_t *tvb, int offset,
243 packet_info *pinfo, proto_tree *parent_tree,
244 char *drep, int type, int hf_index, int levels)
246 proto_item *item=NULL;
247 proto_tree *tree=NULL;
248 int old_offset=offset;
252 di=pinfo->private_data;
253 if(di->conformant_run){
254 /*just a run to handle conformant arrays, nothing to dissect */
258 name = proto_registrar_get_name(hf_index);
260 item = proto_tree_add_text(parent_tree, tvb, offset, -1,
262 tree = proto_item_add_subtree(item, ett_nt_unicode_string);
265 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
266 dissect_ndr_nt_UNICODE_STRING_str, type,
267 name, hf_index, levels);
269 proto_item_set_len(item, offset-old_offset);
275 netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvbuff_t *tvb, int offset,
276 packet_info *pinfo, proto_tree *parent_tree,
279 proto_item *item=NULL;
280 proto_tree *tree=NULL;
281 int old_offset=offset;
284 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
285 "NETLOGON_SECURITY_DESCRIPTOR:");
286 tree = proto_item_add_subtree(item, ett_NETLOGON_SECURITY_DESCRIPTOR);
289 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
290 hf_netlogon_len, NULL);
292 offset = lsa_dissect_LSA_SECURITY_DESCRIPTOR(tvb, offset,
295 proto_item_set_len(item, offset-old_offset);
300 netlogon_dissect_TYPE_1(tvbuff_t *tvb, int offset,
301 packet_info *pinfo, proto_tree *parent_tree,
304 proto_item *item=NULL;
305 proto_tree *tree=NULL;
306 int old_offset=offset;
309 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
311 tree = proto_item_add_subtree(item, ett_TYPE_1);
314 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
315 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
316 "unknown", hf_netlogon_unknown_string, -1);
318 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
319 hf_netlogon_unknown_long, NULL);
321 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
322 hf_netlogon_unknown_long, NULL);
324 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
325 hf_netlogon_unknown_long, NULL);
327 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
328 hf_netlogon_unknown_long, NULL);
330 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
331 hf_netlogon_unknown_long, NULL);
333 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
334 hf_netlogon_unknown_long, NULL);
336 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
337 hf_netlogon_unknown_long, NULL);
339 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
340 hf_netlogon_unknown_long, NULL);
342 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
343 hf_netlogon_unknown_long, NULL);
345 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
346 hf_netlogon_unknown_long, NULL);
348 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
349 hf_netlogon_unknown_long, NULL);
351 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
352 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
353 "unknown", hf_netlogon_unknown_string, -1);
355 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
356 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
357 "unknown", hf_netlogon_unknown_string, -1);
359 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
360 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
361 "unknown", hf_netlogon_unknown_string, -1);
363 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
364 hf_netlogon_unknown_long, NULL);
366 proto_item_set_len(item, offset-old_offset);
371 netlogon_dissect_TYPE_1_ptr(tvbuff_t *tvb, int offset,
372 packet_info *pinfo, proto_tree *tree,
375 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
376 netlogon_dissect_TYPE_1, NDR_POINTER_PTR,
377 "TYPE_1 pointer: ", -1, 0);
382 netlogon_dissect_TYPE_2(tvbuff_t *tvb, int offset,
383 packet_info *pinfo, proto_tree *parent_tree,
386 proto_item *item=NULL;
387 proto_tree *tree=NULL;
388 int old_offset=offset;
391 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
393 tree = proto_item_add_subtree(item, ett_TYPE_2);
396 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
397 hf_netlogon_unknown_long, NULL);
399 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
400 hf_netlogon_unknown_short, NULL);
402 proto_item_set_len(item, offset-old_offset);
407 netlogon_dissect_CYPHER_BLOCK(tvbuff_t *tvb, int offset,
408 packet_info *pinfo, proto_tree *parent_tree,
411 proto_item *item=NULL;
412 proto_tree *tree=NULL;
415 di=pinfo->private_data;
416 if(di->conformant_run){
417 /*just a run to handle conformant arrays, nothing to dissect.*/
422 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
424 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
427 proto_tree_add_item(tree, hf_netlogon_cypher_block, tvb, offset, 8,
436 netlogon_dissect_8_unknown_bytes(tvbuff_t *tvb, int offset,
437 packet_info *pinfo, proto_tree *parent_tree,
440 proto_item *item=NULL;
441 proto_tree *tree=NULL;
444 di=pinfo->private_data;
445 if(di->conformant_run){
446 /*just a run to handle conformant arrays, nothing to dissect.*/
451 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
452 "unknown bytes not in IDL:");
453 tree = proto_item_add_subtree(item, ett_CYPHER_BLOCK);
462 netlogon_dissect_NETLOGON_CREDENTIAL(tvbuff_t *tvb, int offset,
463 packet_info *pinfo, proto_tree *parent_tree,
466 proto_item *item=NULL;
467 proto_tree *tree=NULL;
470 di=pinfo->private_data;
471 if(di->conformant_run){
472 /*just a run to handle conformant arrays, nothing to dissect.*/
477 item = proto_tree_add_text(parent_tree, tvb, offset, 8,
478 "NETLOGON_CREDENTIAL:");
479 tree = proto_item_add_subtree(item, ett_NETLOGON_CREDENTIAL);
482 proto_tree_add_item(tree, hf_netlogon_credential, tvb, offset, 8,
490 netlogon_dissect_NETLOGON_AUTHENTICATOR(tvbuff_t *tvb, int offset,
491 packet_info *pinfo, proto_tree *parent_tree,
494 proto_item *item=NULL;
495 proto_tree *tree=NULL;
496 int old_offset=offset;
499 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
500 "NETLOGON_AUTHENTICATOR:");
501 tree = proto_item_add_subtree(item, ett_NETLOGON_AUTHENTICATOR);
504 offset = netlogon_dissect_NETLOGON_CREDENTIAL(tvb, offset,
507 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
508 hf_netlogon_timestamp, NULL);
510 proto_item_set_len(item, offset-old_offset);
515 netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset,
516 packet_info *pinfo, proto_tree *parent_tree,
519 proto_item *item=NULL;
520 proto_tree *tree=NULL;
523 di=pinfo->private_data;
524 if(di->conformant_run){
525 /*just a run to handle conformant arrays, nothing to dissect.*/
530 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
531 "USER_SESSION_KEY:");
532 tree = proto_item_add_subtree(item, ett_USER_SESSION_KEY);
535 proto_tree_add_item(tree, hf_netlogon_user_session_key, tvb, offset, 16,
543 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
544 packet_info *pinfo, proto_tree *parent_tree,
547 proto_item *item=NULL;
548 proto_tree *tree=NULL;
551 di=pinfo->private_data;
552 if(di->conformant_run){
553 /*just a run to handle conformant arrays, nothing to dissect.*/
558 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
559 "ENCRYPTED_LM_OWF_PASSWORD:");
560 tree = proto_item_add_subtree(item, ett_ENC_LM_OWF_PASSWORD);
563 proto_tree_add_item(tree, hf_netlogon_encrypted_lm_owf_password, tvb, offset, 16,
571 netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset,
572 packet_info *pinfo, proto_tree *parent_tree,
575 proto_item *item=NULL;
576 proto_tree *tree=NULL;
579 di=pinfo->private_data;
580 if(di->conformant_run){
581 /*just a run to handle conformant arrays, nothing to dissect.*/
586 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
588 tree = proto_item_add_subtree(item, ett_LM_OWF_PASSWORD);
591 proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16,
599 netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset,
600 packet_info *pinfo, proto_tree *parent_tree,
603 proto_item *item=NULL;
604 proto_tree *tree=NULL;
607 di=pinfo->private_data;
608 if(di->conformant_run){
609 /*just a run to handle conformant arrays, nothing to dissect.*/
614 item = proto_tree_add_text(parent_tree, tvb, offset, 16,
616 tree = proto_item_add_subtree(item, ett_NT_OWF_PASSWORD);
619 proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16,
628 netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset,
629 packet_info *pinfo, proto_tree *parent_tree,
632 proto_item *item=NULL;
633 proto_tree *tree=NULL;
636 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
637 "NETLOGON_LOGON_IDENTITY_INFO:");
638 tree = proto_item_add_subtree(item, ett_NETLOGON_LOGON_IDENTITY_INFO);
641 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
642 hf_netlogon_logon_dom, 0);
644 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
645 hf_netlogon_param_ctrl, NULL);
647 offset = dissect_ndr_uint64(tvb, offset, pinfo, tree, drep,
648 hf_netlogon_logon_id, NULL);
650 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
651 hf_netlogon_acct_name, 0);
653 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
654 hf_netlogon_computer_name, 0);
656 /* XXX 8 extra bytes here */
657 /* there were 8 extra bytes, either here or in NETWORK_INFO that does not match
658 the idl file. Could be a bug in either the NETLOGON implementation or in the
661 offset = netlogon_dissect_8_unknown_bytes(tvb, offset, pinfo, tree, drep);
667 netlogon_dissect_NETLOGON_INTERACTIVE_INFO(tvbuff_t *tvb, int offset,
668 packet_info *pinfo, proto_tree *parent_tree,
671 proto_item *item=NULL;
672 proto_tree *tree=NULL;
673 int old_offset=offset;
676 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
677 "NETLOGON_INTERACTIVE_INFO:");
678 tree = proto_item_add_subtree(item, ett_NETLOGON_INTERACTIVE_INFO);
681 offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
684 offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
687 offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
690 proto_item_set_len(item, offset-old_offset);
695 netlogon_dissect_NETLOGON_NETWORK_INFO(tvbuff_t *tvb, int offset,
696 packet_info *pinfo, proto_tree *parent_tree,
699 proto_item *item=NULL;
700 proto_tree *tree=NULL;
701 int old_offset=offset;
704 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
705 "NETLOGON_NETWORK_INFO:");
706 tree = proto_item_add_subtree(item, ett_NETLOGON_NETWORK_INFO);
709 offset = netlogon_dissect_NETLOGON_LOGON_IDENTITY_INFO(tvb, offset,
712 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
713 hf_netlogon_nt_chal_resp, 0);
715 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
716 hf_netlogon_lm_chal_resp, 0);
718 proto_item_set_len(item, offset-old_offset);
723 netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset,
724 packet_info *pinfo, proto_tree *parent_tree,
727 proto_item *item=NULL;
728 proto_tree *tree=NULL;
731 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
732 "GROUP_MEMBERSHIP:");
733 tree = proto_item_add_subtree(item, ett_GROUP_MEMBERSHIP);
736 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
737 hf_netlogon_user_rid, NULL);
739 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
740 hf_netlogon_attrs, NULL);
746 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset,
747 packet_info *pinfo, proto_tree *tree,
750 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
751 netlogon_dissect_GROUP_MEMBERSHIP);
757 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1(tvbuff_t *tvb, int offset,
758 packet_info *pinfo, proto_tree *parent_tree,
761 proto_item *item=NULL;
762 proto_tree *tree=NULL;
763 int old_offset=offset;
767 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
768 "NETLOGON_VALIDATION_SAM_INFO1:");
769 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO1);
772 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
773 hf_netlogon_logon_time);
775 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
776 hf_netlogon_logoff_time);
778 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
779 hf_netlogon_kickoff_time);
781 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
782 hf_netlogon_pwd_last_set_time);
784 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
785 hf_netlogon_pwd_can_change_time);
787 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
788 hf_netlogon_pwd_must_change_time);
790 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
791 hf_netlogon_acct_name, 0);
793 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
794 hf_netlogon_full_name, 0);
796 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
797 hf_netlogon_logon_script, 0);
799 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
800 hf_netlogon_profile_path, 0);
802 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
803 hf_netlogon_home_dir, 0);
805 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
806 hf_netlogon_dir_drive, 0);
808 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
809 hf_netlogon_logon_count, NULL);
811 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
812 hf_netlogon_bad_pw_count, NULL);
814 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
815 hf_netlogon_user_rid, NULL);
817 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
818 hf_netlogon_group_rid, NULL);
820 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
821 hf_netlogon_num_rids, NULL);
823 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
824 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_PTR,
825 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
827 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
828 hf_netlogon_user_flags, NULL);
830 offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
833 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
834 hf_netlogon_logon_srv, 0);
836 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
837 hf_netlogon_logon_dom, 0);
839 offset = dissect_ndr_nt_PSID(tvb, offset,
843 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
844 hf_netlogon_unknown_long, NULL);
847 proto_item_set_len(item, offset-old_offset);
852 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset,
853 packet_info *pinfo, proto_tree *parent_tree,
856 proto_item *item=NULL;
857 proto_tree *tree=NULL;
858 int old_offset=offset;
862 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
863 "NETLOGON_VALIDATION_SAM_INFO2:");
864 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION_SAM_INFO2);
867 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
868 hf_netlogon_logon_time);
870 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
871 hf_netlogon_logoff_time);
873 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
874 hf_netlogon_kickoff_time);
876 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
877 hf_netlogon_pwd_last_set_time);
879 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
880 hf_netlogon_pwd_can_change_time);
882 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
883 hf_netlogon_pwd_must_change_time);
885 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
886 hf_netlogon_acct_name, 0);
888 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
889 hf_netlogon_full_name, 0);
891 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
892 hf_netlogon_logon_script, 0);
894 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
895 hf_netlogon_profile_path, 0);
897 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
898 hf_netlogon_home_dir, 0);
900 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
901 hf_netlogon_dir_drive, 0);
903 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
904 hf_netlogon_logon_count, NULL);
906 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
907 hf_netlogon_bad_pw_count, NULL);
909 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
910 hf_netlogon_user_rid, NULL);
912 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
913 hf_netlogon_group_rid, NULL);
915 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
916 hf_netlogon_num_rids, NULL);
918 /* XXX i am not sure about this pointer being UNIQUE, though I am
919 pretty convinced that it is NOT PTR as the idl file suggests.
921 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
922 netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE,
923 "GROUP_MEMBERSHIP_ARRAY", -1, 0);
925 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
926 hf_netlogon_user_flags, NULL);
928 offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset,
931 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
932 hf_netlogon_logon_srv, 0);
934 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
935 hf_netlogon_logon_dom, 0);
937 offset = dissect_ndr_nt_PSID(tvb, offset,
941 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
942 hf_netlogon_unknown_long, NULL);
945 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
946 hf_netlogon_num_other_groups, NULL);
948 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
949 dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_PTR,
950 "SID_AND_ATTRIBUTES_ARRAY:", -1, 0);
952 proto_item_set_len(item, offset-old_offset);
957 netlogon_dissect_TYPE_16(tvbuff_t *tvb, int offset,
958 packet_info *pinfo, proto_tree *parent_tree,
961 proto_item *item=NULL;
962 proto_tree *tree=NULL;
963 int old_offset=offset;
966 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
968 tree = proto_item_add_subtree(item, ett_TYPE_16);
971 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
972 hf_netlogon_unknown_time);
974 proto_item_set_len(item, offset-old_offset);
980 netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO(tvbuff_t *tvb, int offset,
981 packet_info *pinfo, proto_tree *parent_tree,
984 proto_item *item=NULL;
985 proto_tree *tree=NULL;
986 int old_offset=offset;
989 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
990 "NETLOGON_SAM_DOMAIN_INFO:");
991 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_DOMAIN_INFO);
994 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
995 hf_netlogon_unknown_string, 0);
997 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
998 hf_netlogon_unknown_string, 0);
1000 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1001 hf_netlogon_unknown_time);
1003 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1004 hf_netlogon_unknown_short, NULL);
1006 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1007 hf_netlogon_unknown_short, NULL);
1009 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1010 hf_netlogon_unknown_time);
1012 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1013 hf_netlogon_unknown_time);
1015 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1016 hf_netlogon_unknown_time);
1018 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1019 hf_netlogon_unknown_time);
1021 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1022 hf_netlogon_unknown_string, 0);
1024 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1025 hf_netlogon_unknown_string, 0);
1027 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1028 hf_netlogon_unknown_string, 0);
1030 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1031 hf_netlogon_unknown_string, 0);
1033 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1034 hf_netlogon_unknown_string, 0);
1036 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1037 hf_netlogon_unknown_long, NULL);
1039 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1040 hf_netlogon_unknown_long, NULL);
1042 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1043 hf_netlogon_unknown_long, NULL);
1045 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1046 hf_netlogon_unknown_long, NULL);
1048 proto_item_set_len(item, offset-old_offset);
1054 netlogon_dissect_NETLOGON_SAM_GROUP_INFO(tvbuff_t *tvb, int offset,
1055 packet_info *pinfo, proto_tree *parent_tree,
1058 proto_item *item=NULL;
1059 proto_tree *tree=NULL;
1060 int old_offset=offset;
1063 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1064 "NETLOGON_SAM_GROUP_INFO:");
1065 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_INFO);
1068 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1069 hf_netlogon_group_name, 0);
1071 offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset,
1074 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1075 hf_netlogon_group_desc, 0);
1077 offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1080 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1081 hf_netlogon_unknown_string, 0);
1083 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1084 hf_netlogon_unknown_string, 0);
1086 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1087 hf_netlogon_unknown_string, 0);
1089 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1090 hf_netlogon_unknown_string, 0);
1092 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1093 hf_netlogon_unknown_long, NULL);
1095 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1096 hf_netlogon_unknown_long, NULL);
1098 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1099 hf_netlogon_unknown_long, NULL);
1101 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1102 hf_netlogon_unknown_long, NULL);
1104 proto_item_set_len(item, offset-old_offset);
1110 netlogon_dissect_TYPE_23(tvbuff_t *tvb, int offset,
1111 packet_info *pinfo, proto_tree *parent_tree,
1114 proto_item *item=NULL;
1115 proto_tree *tree=NULL;
1116 int old_offset=offset;
1119 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1121 tree = proto_item_add_subtree(item, ett_TYPE_23);
1124 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1125 hf_netlogon_unknown_string, 0);
1127 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1128 hf_netlogon_unknown_string, 0);
1130 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1131 hf_netlogon_unknown_string, 0);
1133 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1134 hf_netlogon_unknown_string, 0);
1136 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1137 hf_netlogon_unknown_string, 0);
1139 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1140 hf_netlogon_unknown_string, 0);
1142 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1143 hf_netlogon_unknown_long, NULL);
1145 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1146 hf_netlogon_unknown_long, NULL);
1148 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1149 hf_netlogon_unknown_long, NULL);
1151 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1152 hf_netlogon_unknown_long, NULL);
1154 proto_item_set_len(item, offset-old_offset);
1160 netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO(tvbuff_t *tvb, int offset,
1161 packet_info *pinfo, proto_tree *parent_tree,
1164 proto_item *item=NULL;
1165 proto_tree *tree=NULL;
1166 int old_offset=offset;
1169 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1170 "NETLOGON_SAM_ACCOUNT_INFO:");
1171 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ACCOUNT_INFO);
1174 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1175 hf_netlogon_acct_name, 0);
1177 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1178 hf_netlogon_full_name, 0);
1180 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1181 hf_netlogon_user_rid, NULL);
1183 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1184 hf_netlogon_group_rid, NULL);
1186 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1187 hf_netlogon_home_dir, 0);
1189 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1190 hf_netlogon_dir_drive, 0);
1192 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1193 hf_netlogon_logon_script, 0);
1195 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1196 hf_netlogon_acct_desc, 0);
1198 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1199 hf_netlogon_workstations, 0);
1201 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1202 hf_netlogon_logon_time);
1204 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1205 hf_netlogon_logoff_time);
1207 offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, drep);
1209 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1210 hf_netlogon_bad_pw_count, NULL);
1212 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1213 hf_netlogon_logon_count, NULL);
1215 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1216 hf_netlogon_pwd_last_set_time);
1218 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1219 hf_netlogon_acct_expiry_time);
1221 offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, drep);
1223 offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset,
1226 offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset,
1229 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1230 hf_netlogon_nt_pwd_present, NULL);
1232 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1233 hf_netlogon_lm_pwd_present, NULL);
1235 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1236 hf_netlogon_pwd_expired, NULL);
1238 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1239 hf_netlogon_comment, 0);
1241 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1242 hf_netlogon_parameters, 0);
1244 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1245 hf_netlogon_country, NULL);
1247 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
1248 hf_netlogon_codepage, NULL);
1250 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1251 hf_netlogon_num_pwd_pairs, NULL);
1253 offset = lsa_dissect_LSA_SECRET(tvb, offset,
1256 offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1259 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1260 hf_netlogon_profile_path, 0);
1262 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1263 hf_netlogon_unknown_string, 0);
1265 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1266 hf_netlogon_unknown_string, 0);
1268 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1269 hf_netlogon_unknown_string, 0);
1271 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1272 hf_netlogon_unknown_long, NULL);
1274 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1275 hf_netlogon_unknown_long, NULL);
1277 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1278 hf_netlogon_unknown_long, NULL);
1280 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1281 hf_netlogon_unknown_long, NULL);
1283 proto_item_set_len(item, offset-old_offset);
1289 netlogon_dissect_rid(tvbuff_t *tvb, int offset,
1290 packet_info *pinfo, proto_tree *tree,
1293 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1294 hf_netlogon_user_rid, NULL);
1300 netlogon_dissect_rids_array(tvbuff_t *tvb, int offset,
1301 packet_info *pinfo, proto_tree *parent_tree,
1304 proto_item *item=NULL;
1305 proto_tree *tree=NULL;
1306 int old_offset=offset;
1309 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1311 tree = proto_item_add_subtree(item, ett_rid_array);
1314 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1315 netlogon_dissect_rid);
1317 proto_item_set_len(item, offset-old_offset);
1322 netlogon_dissect_attrib(tvbuff_t *tvb, int offset,
1323 packet_info *pinfo, proto_tree *tree,
1326 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1327 hf_netlogon_attrs, NULL);
1333 netlogon_dissect_attribs_array(tvbuff_t *tvb, int offset,
1334 packet_info *pinfo, proto_tree *parent_tree,
1337 proto_item *item=NULL;
1338 proto_tree *tree=NULL;
1339 int old_offset=offset;
1342 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1344 tree = proto_item_add_subtree(item, ett_attrib_array);
1347 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1348 netlogon_dissect_attrib);
1350 proto_item_set_len(item, offset-old_offset);
1355 netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO(tvbuff_t *tvb, int offset,
1356 packet_info *pinfo, proto_tree *parent_tree,
1359 proto_item *item=NULL;
1360 proto_tree *tree=NULL;
1361 int old_offset=offset;
1364 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1365 "NETLOGON_SAM_GROUP_MEM_INFO:");
1366 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_GROUP_MEM_INFO);
1369 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1370 netlogon_dissect_rids_array, NDR_POINTER_PTR,
1373 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1374 netlogon_dissect_attribs_array, NDR_POINTER_PTR,
1377 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1378 hf_netlogon_num_rids, NULL);
1380 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1381 hf_netlogon_unknown_long, NULL);
1383 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1384 hf_netlogon_unknown_long, NULL);
1386 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1387 hf_netlogon_unknown_long, NULL);
1389 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1390 hf_netlogon_unknown_long, NULL);
1392 proto_item_set_len(item, offset-old_offset);
1398 netlogon_dissect_NETLOGON_SAM_ALIAS_INFO(tvbuff_t *tvb, int offset,
1399 packet_info *pinfo, proto_tree *parent_tree,
1402 proto_item *item=NULL;
1403 proto_tree *tree=NULL;
1404 int old_offset=offset;
1407 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1408 "NETLOGON_SAM_ALIAS_INFO:");
1409 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_INFO);
1413 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1414 hf_netlogon_alias_name, 0);
1416 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1417 hf_netlogon_alias_rid, NULL);
1419 offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1422 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1423 hf_netlogon_acct_desc, 0);
1425 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1426 hf_netlogon_unknown_string, 0);
1428 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1429 hf_netlogon_unknown_string, 0);
1431 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1432 hf_netlogon_unknown_string, 0);
1434 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1435 hf_netlogon_unknown_long, NULL);
1437 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1438 hf_netlogon_unknown_long, NULL);
1440 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1441 hf_netlogon_unknown_long, NULL);
1443 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1444 hf_netlogon_unknown_long, NULL);
1446 proto_item_set_len(item, offset-old_offset);
1452 netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO(tvbuff_t *tvb, int offset,
1453 packet_info *pinfo, proto_tree *parent_tree,
1456 proto_item *item=NULL;
1457 proto_tree *tree=NULL;
1458 int old_offset=offset;
1461 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1462 "NETLOGON_SAM_ALIAS_MEM_INFO:");
1463 tree = proto_item_add_subtree(item, ett_NETLOGON_SAM_ALIAS_MEM_INFO);
1466 offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, drep);
1468 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1469 hf_netlogon_unknown_long, NULL);
1471 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1472 hf_netlogon_unknown_long, NULL);
1474 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1475 hf_netlogon_unknown_long, NULL);
1477 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1478 hf_netlogon_unknown_long, NULL);
1480 proto_item_set_len(item, offset-old_offset);
1485 netlogon_dissect_TYPE_30(tvbuff_t *tvb, int offset,
1486 packet_info *pinfo, proto_tree *parent_tree,
1489 proto_item *item=NULL;
1490 proto_tree *tree=NULL;
1491 int old_offset=offset;
1494 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1496 tree = proto_item_add_subtree(item, ett_TYPE_30);
1499 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1500 hf_netlogon_unknown_long, NULL);
1502 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1503 hf_netlogon_unknown_long, NULL);
1505 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1506 hf_netlogon_unknown_long, NULL);
1508 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1509 hf_netlogon_unknown_long, NULL);
1511 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1512 hf_netlogon_unknown_long, NULL);
1514 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1515 hf_netlogon_unknown_time);
1517 proto_item_set_len(item, offset-old_offset);
1522 netlogon_dissect_element_422(tvbuff_t *tvb, int offset,
1523 packet_info *pinfo, proto_tree *tree,
1526 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1527 hf_netlogon_unknown_long, NULL);
1533 netlogon_dissect_element_422_array(tvbuff_t *tvb, int offset,
1534 packet_info *pinfo, proto_tree *tree,
1537 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1538 netlogon_dissect_element_422);
1545 netlogon_dissect_TYPE_29(tvbuff_t *tvb, int offset,
1546 packet_info *pinfo, proto_tree *parent_tree,
1549 proto_item *item=NULL;
1550 proto_tree *tree=NULL;
1551 int old_offset=offset;
1554 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1556 tree = proto_item_add_subtree(item, ett_TYPE_29);
1559 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1560 hf_netlogon_unknown_long, NULL);
1562 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1563 hf_netlogon_unknown_time);
1565 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1566 hf_netlogon_unknown_char, NULL);
1568 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1569 hf_netlogon_unknown_long, NULL);
1571 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1572 netlogon_dissect_element_422_array, NDR_POINTER_PTR,
1575 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1576 hf_netlogon_unknown_string, 0);
1578 offset = dissect_ndr_nt_PSID(tvb, offset,
1581 offset = netlogon_dissect_TYPE_30(tvb, offset,
1584 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1585 hf_netlogon_unknown_time);
1587 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1588 hf_netlogon_unknown_time);
1590 offset = netlogon_dissect_NETLOGON_SECURITY_DESCRIPTOR(tvb, offset,
1593 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1594 hf_netlogon_unknown_string, 0);
1596 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1597 hf_netlogon_unknown_string, 0);
1599 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1600 hf_netlogon_unknown_string, 0);
1602 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1603 hf_netlogon_unknown_string, 0);
1605 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1606 hf_netlogon_unknown_long, NULL);
1608 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1609 hf_netlogon_unknown_long, NULL);
1611 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1612 hf_netlogon_unknown_long, NULL);
1614 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1615 hf_netlogon_unknown_long, NULL);
1617 proto_item_set_len(item, offset-old_offset);
1623 netlogon_dissect_TYPE_31(tvbuff_t *tvb, int offset,
1624 packet_info *pinfo, proto_tree *parent_tree,
1627 proto_item *item=NULL;
1628 proto_tree *tree=NULL;
1629 int old_offset=offset;
1632 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1634 tree = proto_item_add_subtree(item, ett_TYPE_31);
1637 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1638 hf_netlogon_unknown_string, 0);
1640 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1641 hf_netlogon_unknown_string, 0);
1643 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1644 hf_netlogon_unknown_long, NULL);
1646 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1647 hf_netlogon_unknown_string, 0);
1649 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1650 hf_netlogon_unknown_string, 0);
1652 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1653 hf_netlogon_unknown_string, 0);
1655 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1656 hf_netlogon_unknown_string, 0);
1658 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1659 hf_netlogon_unknown_string, 0);
1661 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1662 hf_netlogon_unknown_long, NULL);
1664 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1665 hf_netlogon_unknown_long, NULL);
1667 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1668 hf_netlogon_unknown_long, NULL);
1670 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1671 hf_netlogon_unknown_long, NULL);
1673 proto_item_set_len(item, offset-old_offset);
1679 netlogon_dissect_TYPE_32(tvbuff_t *tvb, int offset,
1680 packet_info *pinfo, proto_tree *parent_tree,
1683 proto_item *item=NULL;
1684 proto_tree *tree=NULL;
1685 int old_offset=offset;
1688 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1690 tree = proto_item_add_subtree(item, ett_TYPE_32);
1693 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1694 hf_netlogon_unknown_string, 0);
1696 proto_item_set_len(item, offset-old_offset);
1702 netlogon_dissect_attrs(tvbuff_t *tvb, int offset,
1703 packet_info *pinfo, proto_tree *tree,
1706 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1707 hf_netlogon_attrs, NULL);
1713 netlogon_dissect_attrs_array(tvbuff_t *tvb, int offset,
1714 packet_info *pinfo, proto_tree *tree,
1717 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
1718 netlogon_dissect_attrs);
1725 netlogon_dissect_TYPE_33(tvbuff_t *tvb, int offset,
1726 packet_info *pinfo, proto_tree *parent_tree,
1729 proto_item *item=NULL;
1730 proto_tree *tree=NULL;
1731 int old_offset=offset;
1734 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1736 tree = proto_item_add_subtree(item, ett_TYPE_33);
1740 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1741 hf_netlogon_count, NULL);
1743 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1744 hf_netlogon_unknown_long, NULL);
1746 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1747 netlogon_dissect_attrs_array, NDR_POINTER_PTR,
1748 "ATTRS_ARRAY:", -1, 0);
1750 offset = netlogon_dissect_TYPE_30(tvb, offset,
1753 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1754 hf_netlogon_unknown_long, NULL);
1756 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1757 hf_netlogon_unknown_long, NULL);
1759 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1760 hf_netlogon_unknown_string, 0);
1762 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1763 hf_netlogon_unknown_string, 0);
1765 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1766 hf_netlogon_unknown_string, 0);
1768 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1769 hf_netlogon_unknown_string, 0);
1771 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1772 hf_netlogon_unknown_string, 0);
1774 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1775 hf_netlogon_unknown_long, NULL);
1777 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1778 hf_netlogon_unknown_long, NULL);
1780 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1781 hf_netlogon_unknown_long, NULL);
1783 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1784 hf_netlogon_unknown_long, NULL);
1786 proto_item_set_len(item, offset-old_offset);
1792 netlogon_dissect_TYPE_34(tvbuff_t *tvb, int offset,
1793 packet_info *pinfo, proto_tree *parent_tree,
1796 proto_item *item=NULL;
1797 proto_tree *tree=NULL;
1798 int old_offset=offset;
1801 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1803 tree = proto_item_add_subtree(item, ett_TYPE_34);
1806 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1807 hf_netlogon_unknown_string, 0);
1809 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1810 hf_netlogon_unknown_time);
1812 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1813 hf_netlogon_unknown_string, 0);
1815 offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
1816 hf_netlogon_unknown_time);
1818 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1819 hf_netlogon_unknown_long, NULL);
1821 offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
1822 hf_netlogon_unknown_string, 0);
1824 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1825 hf_netlogon_unknown_string, 0);
1827 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1828 hf_netlogon_unknown_string, 0);
1830 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1831 hf_netlogon_unknown_string, 0);
1833 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1834 hf_netlogon_unknown_string, 0);
1836 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1837 hf_netlogon_unknown_long, NULL);
1839 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1840 hf_netlogon_unknown_long, NULL);
1842 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1843 hf_netlogon_unknown_long, NULL);
1845 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1846 hf_netlogon_unknown_long, NULL);
1848 proto_item_set_len(item, offset-old_offset);
1853 netlogon_dissect_TYPE_35(tvbuff_t *tvb, int offset,
1854 packet_info *pinfo, proto_tree *parent_tree,
1857 proto_item *item=NULL;
1858 proto_tree *tree=NULL;
1859 int old_offset=offset;
1862 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1864 tree = proto_item_add_subtree(item, ett_TYPE_35);
1867 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1868 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1869 "unknown", hf_netlogon_unknown_string, -1);
1871 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1872 hf_netlogon_unknown_string, 0);
1874 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1875 hf_netlogon_unknown_string, 0);
1877 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1878 hf_netlogon_unknown_string, 0);
1880 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
1881 hf_netlogon_unknown_string, 0);
1883 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1884 hf_netlogon_unknown_long, NULL);
1886 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1887 hf_netlogon_unknown_long, NULL);
1889 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1890 hf_netlogon_unknown_long, NULL);
1892 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1893 hf_netlogon_unknown_long, NULL);
1895 proto_item_set_len(item, offset-old_offset);
1900 netlogon_dissect_WCHAR_ptr(tvbuff_t *tvb, int offset,
1901 packet_info *pinfo, proto_tree *tree,
1904 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1905 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1906 "unknown string", hf_netlogon_unknown_string, -1);
1912 netlogon_dissect_TYPE_36(tvbuff_t *tvb, int offset,
1913 packet_info *pinfo, proto_tree *parent_tree,
1916 proto_item *item=NULL;
1917 proto_tree *tree=NULL;
1918 int old_offset=offset;
1922 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1924 tree = proto_item_add_subtree(item, ett_TYPE_36);
1928 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
1929 hf_netlogon_unknown_char, NULL);
1932 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1933 hf_netlogon_unknown_long, NULL);
1935 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1936 hf_netlogon_unknown_long, NULL);
1938 proto_item_set_len(item, offset-old_offset);
1943 netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset,
1944 packet_info *pinfo, proto_tree *parent_tree,
1947 proto_item *item=NULL;
1948 proto_tree *tree=NULL;
1949 int old_offset=offset;
1952 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1953 "NETLOGON_INFO_1:");
1954 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_1);
1957 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1958 hf_netlogon_flags, NULL);
1960 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1961 hf_netlogon_status, NULL);
1963 proto_item_set_len(item, offset-old_offset);
1968 netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset,
1969 packet_info *pinfo, proto_tree *parent_tree,
1972 proto_item *item=NULL;
1973 proto_tree *tree=NULL;
1974 int old_offset=offset;
1977 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
1978 "NETLOGON_INFO_2:");
1979 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_2);
1982 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1983 hf_netlogon_unknown_long, NULL);
1985 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1986 hf_netlogon_unknown_long, NULL);
1988 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
1989 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
1990 "unknown", hf_netlogon_unknown_string, -1);
1992 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
1993 hf_netlogon_unknown_long, NULL);
1995 proto_item_set_len(item, offset-old_offset);
2000 netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset,
2001 packet_info *pinfo, proto_tree *parent_tree,
2004 proto_item *item=NULL;
2005 proto_tree *tree=NULL;
2006 int old_offset=offset;
2009 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2010 "NETLOGON_INFO_3:");
2011 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_3);
2014 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2015 hf_netlogon_flags, NULL);
2017 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2018 hf_netlogon_logon_attempts, NULL);
2020 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2021 hf_netlogon_unknown_long, NULL);
2023 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2024 hf_netlogon_unknown_long, NULL);
2026 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2027 hf_netlogon_unknown_long, NULL);
2029 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2030 hf_netlogon_unknown_long, NULL);
2032 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2033 hf_netlogon_unknown_long, NULL);
2035 proto_item_set_len(item, offset-old_offset);
2040 netlogon_dissect_NETLOGON_INFO_4(tvbuff_t *tvb, int offset,
2041 packet_info *pinfo, proto_tree *parent_tree,
2044 proto_item *item=NULL;
2045 proto_tree *tree=NULL;
2046 int old_offset=offset;
2049 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2050 "NETLOGON_INFO_4:");
2051 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO_4);
2054 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2055 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2056 "unknown", hf_netlogon_trusted_dc_name, -1);
2058 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2059 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2060 "unknown", hf_netlogon_trusted_domain_name, -1);
2062 proto_item_set_len(item, offset-old_offset);
2067 netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset,
2068 packet_info *pinfo, proto_tree *tree,
2071 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2072 hf_netlogon_unknown_char, NULL);
2078 netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset,
2079 packet_info *pinfo, proto_tree *tree,
2082 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2083 netlogon_dissect_UNICODE_MULTI_byte);
2089 netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset,
2090 packet_info *pinfo, proto_tree *tree,
2093 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2094 hf_netlogon_unknown_char, NULL);
2100 netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset,
2101 packet_info *pinfo, proto_tree *tree,
2104 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2105 netlogon_dissect_BYTE_byte);
2111 netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset,
2112 packet_info *pinfo, proto_tree *parent_tree,
2115 proto_item *item=NULL;
2116 proto_tree *tree=NULL;
2117 int old_offset=offset;
2120 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2122 tree = proto_item_add_subtree(item, ett_UNICODE_MULTI);
2125 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2126 hf_netlogon_len, NULL);
2128 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2129 netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_PTR,
2130 "unknown", hf_netlogon_unknown_string, 0);
2132 proto_item_set_len(item, offset-old_offset);
2137 dissect_nt_GUID(tvbuff_t *tvb, int offset,
2138 packet_info *pinfo, proto_tree *parent_tree,
2141 proto_item *item=NULL;
2142 proto_tree *tree=NULL;
2143 int old_offset=offset;
2147 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2149 tree = proto_item_add_subtree(item, ett_GUID);
2152 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2153 hf_netlogon_unknown_long, NULL);
2155 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2156 hf_netlogon_unknown_short, NULL);
2158 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2159 hf_netlogon_unknown_short, NULL);
2162 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2163 hf_netlogon_unknown_char, NULL);
2166 proto_item_set_len(item, offset-old_offset);
2171 netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset,
2172 packet_info *pinfo, proto_tree *parent_tree,
2175 proto_item *item=NULL;
2176 proto_tree *tree=NULL;
2177 int old_offset=offset;
2180 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2181 "DOMAIN_CONTROLLER_INFO:");
2182 tree = proto_item_add_subtree(item, ett_DOMAIN_CONTROLLER_INFO);
2185 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2186 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2187 "unknown", hf_netlogon_dc_name, -1);
2189 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2190 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2191 "unknown", hf_netlogon_dc_address, -1);
2193 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2194 hf_netlogon_dc_address_type, NULL);
2196 offset = dissect_nt_GUID(tvb, offset,
2199 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2200 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2201 "unknown", hf_netlogon_logon_dom, -1);
2203 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2204 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2205 "unknown", hf_netlogon_dns_forest_name, -1);
2207 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2208 hf_netlogon_flags, NULL);
2210 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2211 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2212 "unknown", hf_netlogon_dc_site_name, -1);
2214 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2215 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2216 "unknown", hf_netlogon_client_site_name, -1);
2218 proto_item_set_len(item, offset-old_offset);
2223 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr(tvbuff_t *tvb, int offset,
2224 packet_info *pinfo, proto_tree *tree,
2227 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2228 netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_PTR,
2229 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2235 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr(tvbuff_t *tvb, int offset,
2236 packet_info *pinfo, proto_tree *tree,
2239 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2240 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_PTR,
2241 "DOMAIN_CONTROLLER_INFO pointer: info", -1, 0);
2247 netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset,
2248 packet_info *pinfo, proto_tree *tree,
2254 di=pinfo->private_data;
2255 if(di->conformant_run){
2256 /*just a run to handle conformant arrays, nothing to dissect.*/
2260 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2261 hf_netlogon_blob_size, &len);
2263 proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len,
2271 netlogon_dissect_BLOB(tvbuff_t *tvb, int offset,
2272 packet_info *pinfo, proto_tree *parent_tree,
2275 proto_item *item=NULL;
2276 proto_tree *tree=NULL;
2279 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2281 tree = proto_item_add_subtree(item, ett_BLOB);
2284 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2285 hf_netlogon_blob_size, NULL);
2287 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2288 netlogon_dissect_BLOB_array, NDR_POINTER_PTR,
2295 netlogon_dissect_BLOB_ptr(tvbuff_t *tvb, int offset,
2296 packet_info *pinfo, proto_tree *tree,
2299 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2300 netlogon_dissect_BLOB, NDR_POINTER_PTR,
2301 "BLOB pointer:", -1, 0);
2307 netlogon_dissect_TYPE_46(tvbuff_t *tvb, int offset,
2308 packet_info *pinfo, proto_tree *parent_tree,
2311 proto_item *item=NULL;
2312 proto_tree *tree=NULL;
2313 int old_offset=offset;
2316 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2318 tree = proto_item_add_subtree(item, ett_TYPE_46);
2321 offset = netlogon_dissect_BLOB(tvb, offset,
2324 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2325 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2326 "unknown", hf_netlogon_workstation_fqdn, -1);
2328 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2329 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2330 "unknown", hf_netlogon_workstation_site_name, -1);
2332 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2333 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2334 "unknown", hf_netlogon_workstation_os, -1);
2336 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2337 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2338 "unknown", hf_netlogon_unknown_string, -1);
2340 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2341 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2342 "unknown", hf_netlogon_unknown_string, -1);
2344 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2345 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2346 "unknown", hf_netlogon_unknown_string, -1);
2348 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2349 hf_netlogon_unknown_string, 0);
2351 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2352 hf_netlogon_unknown_string, 0);
2354 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2355 hf_netlogon_unknown_string, 0);
2357 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2358 hf_netlogon_unknown_string, 0);
2360 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2361 hf_netlogon_unknown_long, NULL);
2363 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2364 hf_netlogon_unknown_long, NULL);
2366 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2367 hf_netlogon_unknown_long, NULL);
2369 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2370 hf_netlogon_unknown_long, NULL);
2372 proto_item_set_len(item, offset-old_offset);
2377 netlogon_dissect_TYPE_48(tvbuff_t *tvb, int offset,
2378 packet_info *pinfo, proto_tree *parent_tree,
2381 proto_item *item=NULL;
2382 proto_tree *tree=NULL;
2383 int old_offset=offset;
2386 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2388 tree = proto_item_add_subtree(item, ett_TYPE_48);
2391 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2392 hf_netlogon_unknown_string, 0);
2394 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2395 hf_netlogon_unknown_string, 0);
2397 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2398 hf_netlogon_unknown_string, 0);
2400 offset = dissect_nt_GUID(tvb, offset,
2403 offset = dissect_ndr_nt_PSID(tvb, offset,
2406 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2407 hf_netlogon_unknown_string, 0);
2409 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2410 hf_netlogon_unknown_string, 0);
2412 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2413 hf_netlogon_unknown_string, 0);
2415 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2416 hf_netlogon_unknown_string, 0);
2418 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2419 hf_netlogon_unknown_long, NULL);
2421 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2422 hf_netlogon_unknown_long, NULL);
2424 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2425 hf_netlogon_unknown_long, NULL);
2427 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2428 hf_netlogon_unknown_long, NULL);
2430 offset = netlogon_dissect_BLOB(tvb, offset,
2433 offset = netlogon_dissect_BLOB(tvb, offset,
2436 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2437 hf_netlogon_unknown_string, 0);
2439 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2440 hf_netlogon_unknown_string, 0);
2442 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2443 hf_netlogon_unknown_string, 0);
2445 offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
2446 hf_netlogon_unknown_string, 0);
2448 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2449 hf_netlogon_unknown_long, NULL);
2451 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2452 hf_netlogon_unknown_long, NULL);
2454 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2455 hf_netlogon_unknown_long, NULL);
2457 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2458 hf_netlogon_unknown_long, NULL);
2460 proto_item_set_len(item, offset-old_offset);
2465 netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset,
2466 packet_info *pinfo, proto_tree *parent_tree,
2469 proto_item *item=NULL;
2470 proto_tree *tree=NULL;
2471 int old_offset=offset;
2475 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2476 "UNICODE_STRING_512:");
2477 tree = proto_item_add_subtree(item, ett_UNICODE_STRING_512);
2481 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2482 hf_netlogon_unknown_short, NULL);
2485 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2486 hf_netlogon_unknown_long, NULL);
2488 proto_item_set_len(item, offset-old_offset);
2493 netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset,
2494 packet_info *pinfo, proto_tree *tree,
2497 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2498 hf_netlogon_secure_channel_type, NULL);
2504 netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset,
2505 packet_info *pinfo, proto_tree *tree,
2508 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2509 hf_netlogon_unknown_char, NULL);
2515 netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset,
2516 packet_info *pinfo, proto_tree *tree,
2519 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2520 netlogon_dissect_element_844_byte);
2526 netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset,
2527 packet_info *pinfo, proto_tree *parent_tree,
2530 proto_item *item=NULL;
2531 proto_tree *tree=NULL;
2532 int old_offset=offset;
2535 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2537 tree = proto_item_add_subtree(item, ett_TYPE_50);
2540 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2541 hf_netlogon_unknown_long, NULL);
2543 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2544 netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE,
2545 "unknown", hf_netlogon_unknown_string, 0);
2547 proto_item_set_len(item, offset-old_offset);
2552 netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset,
2553 packet_info *pinfo, proto_tree *tree,
2556 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2557 netlogon_dissect_TYPE_50, NDR_POINTER_PTR,
2558 "TYPE_50 pointer: unknown_TYPE_50", -1, 0);
2564 netlogon_dissect_TYPE_50_ptr_ptr(tvbuff_t *tvb, int offset,
2565 packet_info *pinfo, proto_tree *tree,
2568 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2569 netlogon_dissect_TYPE_50_ptr, NDR_POINTER_PTR,
2570 "TYPE_50* pointer: unknown_TYPE_50", -1, 0);
2576 netlogon_dissect_element_861_byte(tvbuff_t *tvb, int offset,
2577 packet_info *pinfo, proto_tree *tree,
2580 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2581 hf_netlogon_unknown_char, NULL);
2587 netlogon_dissect_element_861_array(tvbuff_t *tvb, int offset,
2588 packet_info *pinfo, proto_tree *tree,
2591 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2592 netlogon_dissect_element_861_byte);
2598 netlogon_dissect_TYPE_51(tvbuff_t *tvb, int offset,
2599 packet_info *pinfo, proto_tree *parent_tree,
2602 proto_item *item=NULL;
2603 proto_tree *tree=NULL;
2604 int old_offset=offset;
2607 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2609 tree = proto_item_add_subtree(item, ett_TYPE_51);
2612 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2613 hf_netlogon_unknown_long, NULL);
2615 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2616 netlogon_dissect_element_861_array, NDR_POINTER_UNIQUE,
2617 "unknown", hf_netlogon_unknown_string, 0);
2619 proto_item_set_len(item, offset-old_offset);
2624 netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset,
2625 packet_info *pinfo, proto_tree *tree,
2628 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2629 hf_netlogon_unknown_char, NULL);
2635 netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset,
2636 packet_info *pinfo, proto_tree *tree,
2639 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2640 netlogon_dissect_element_865_byte);
2646 netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset,
2647 packet_info *pinfo, proto_tree *tree,
2650 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
2651 hf_netlogon_unknown_char, NULL);
2657 netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset,
2658 packet_info *pinfo, proto_tree *tree,
2661 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
2662 netlogon_dissect_element_866_byte);
2668 netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset,
2669 packet_info *pinfo, proto_tree *parent_tree,
2672 proto_item *item=NULL;
2673 proto_tree *tree=NULL;
2674 int old_offset=offset;
2677 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2679 tree = proto_item_add_subtree(item, ett_TYPE_52);
2682 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2683 hf_netlogon_unknown_long, NULL);
2685 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2686 netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE,
2687 "unknown", hf_netlogon_unknown_string, 0);
2689 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2690 netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE,
2691 "unknown", hf_netlogon_unknown_string, 0);
2693 proto_item_set_len(item, offset-old_offset);
2698 netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset,
2699 packet_info *pinfo, proto_tree *tree,
2702 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2703 netlogon_dissect_TYPE_52, NDR_POINTER_PTR,
2704 "TYPE_52 pointer: unknown_TYPE_52", -1, 0);
2709 netlogon_dissect_TYPE_52_ptr_ptr(tvbuff_t *tvb, int offset,
2710 packet_info *pinfo, proto_tree *tree,
2713 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2714 netlogon_dissect_TYPE_52_ptr, NDR_POINTER_PTR,
2715 "TYPE_52* pointer: unknown_TYPE_52", -1, 0);
2720 netlogon_dissect_NETLOGON_LEVEL(tvbuff_t *tvb, int offset,
2721 packet_info *pinfo, proto_tree *parent_tree,
2724 proto_item *item=NULL;
2725 proto_tree *tree=NULL;
2726 int old_offset=offset;
2730 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2732 tree = proto_item_add_subtree(item, ett_NETLOGON_LEVEL);
2735 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2736 hf_netlogon_level, &level);
2741 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2742 netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2743 "INTERACTIVE_INFO pointer:", -1, 0);
2746 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2747 netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2748 "NETWORK_INFO pointer:", -1, 0);
2751 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2752 netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2753 "INTERACTIVE_INFO pointer:", -1, 0);
2756 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2757 netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2758 "INTERACTIVE_INFO pointer:", -1, 0);
2761 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2762 netlogon_dissect_NETLOGON_NETWORK_INFO, NDR_POINTER_PTR,
2763 "NETWORK_INFO pointer:", -1, 0);
2766 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2767 netlogon_dissect_NETLOGON_INTERACTIVE_INFO, NDR_POINTER_PTR,
2768 "INTERACTIVE_INFO pointer:", -1, 0);
2772 proto_item_set_len(item, offset-old_offset);
2777 netlogon_dissect_NETLOGON_VALIDATION(tvbuff_t *tvb, int offset,
2778 packet_info *pinfo, proto_tree *parent_tree,
2781 proto_item *item=NULL;
2782 proto_tree *tree=NULL;
2783 int old_offset=offset;
2787 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2788 "NETLOGON_VALIDATION:");
2789 tree = proto_item_add_subtree(item, ett_NETLOGON_VALIDATION);
2792 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2793 hf_netlogon_level, &level);
2795 /* XXX i am not sure about these pointers being UNIQUE, though I am
2796 pretty convinced that they are NOT PTR as the idl file suggests.
2801 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2802 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO1, NDR_POINTER_UNIQUE,
2803 "NETLOGON_VALIDATION_SAM_INFO1 pointer:", -1, 0);
2806 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2807 netlogon_dissect_NETLOGON_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE,
2808 "NETLOGON_VALIDATION_SAM_INFO2 pointer:", -1, 0);
2811 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2812 netlogon_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
2813 "STRING pointer:", -1, 0);
2816 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2817 netlogon_dissect_BLOB_ptr, NDR_POINTER_UNIQUE,
2818 "BLOB pointer:", -1, 0);
2822 proto_item_set_len(item, offset-old_offset);
2828 netlogon_dissect_TYPE_19(tvbuff_t *tvb, int offset,
2829 packet_info *pinfo, proto_tree *parent_tree,
2832 proto_item *item=NULL;
2833 proto_tree *tree=NULL;
2834 int old_offset=offset;
2838 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2840 tree = proto_item_add_subtree(item, ett_TYPE_19);
2843 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
2844 hf_netlogon_level, &level);
2849 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2850 hf_netlogon_unknown_long, NULL);
2853 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2854 hf_netlogon_unknown_long, NULL);
2857 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2858 hf_netlogon_unknown_long, NULL);
2861 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2862 hf_netlogon_unknown_long, NULL);
2865 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2866 hf_netlogon_unknown_long, NULL);
2869 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2870 hf_netlogon_unknown_long, NULL);
2873 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2874 hf_netlogon_unknown_long, NULL);
2877 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2878 hf_netlogon_unknown_long, NULL);
2881 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2882 hf_netlogon_unknown_long, NULL);
2885 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2886 hf_netlogon_unknown_long, NULL);
2889 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2890 hf_netlogon_unknown_long, NULL);
2893 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2894 hf_netlogon_unknown_long, NULL);
2897 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2898 hf_netlogon_unknown_long, NULL);
2901 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2902 hf_netlogon_unknown_long, NULL);
2905 offset = dissect_ndr_nt_PSID(tvb, offset,
2909 offset = dissect_ndr_nt_PSID(tvb, offset,
2913 offset = dissect_ndr_nt_PSID(tvb, offset,
2917 offset = dissect_ndr_nt_PSID(tvb, offset,
2921 offset = dissect_ndr_nt_PSID(tvb, offset,
2925 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2926 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2927 "unknown", hf_netlogon_unknown_string, -1);
2930 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2931 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2932 "unknown", hf_netlogon_unknown_string, -1);
2936 proto_item_set_len(item, offset-old_offset);
2942 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO(tvbuff_t *tvb, int offset,
2943 packet_info *pinfo, proto_tree *parent_tree,
2946 proto_item *item=NULL;
2947 proto_tree *tree=NULL;
2948 int old_offset=offset;
2952 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
2953 "NETLOGON_CONTROL_QUERY_INFO:");
2954 tree = proto_item_add_subtree(item, ett_NETLOGON_CONTROL_QUERY_INFO);
2957 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2958 hf_netlogon_level_long, &level);
2963 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2964 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2965 "unknown", hf_netlogon_unknown_string, -1);
2968 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2969 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2970 "unknown", hf_netlogon_unknown_string, -1);
2973 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
2974 hf_netlogon_unknown_long, NULL);
2977 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
2978 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
2979 "unknown", hf_netlogon_unknown_string, -1);
2983 proto_item_set_len(item, offset-old_offset);
2989 netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset,
2990 packet_info *pinfo, proto_tree *parent_tree,
2993 proto_item *item=NULL;
2994 proto_tree *tree=NULL;
2995 int old_offset=offset;
2999 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3001 tree = proto_item_add_subtree(item, ett_TYPE_44);
3004 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3005 hf_netlogon_level_long, &level);
3010 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3011 hf_netlogon_unknown_long, NULL);
3015 proto_item_set_len(item, offset-old_offset);
3020 netlogon_dissect_TYPE_20(tvbuff_t *tvb, int offset,
3021 packet_info *pinfo, proto_tree *parent_tree,
3024 proto_item *item=NULL;
3025 proto_tree *tree=NULL;
3026 int old_offset=offset;
3030 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3032 tree = proto_item_add_subtree(item, ett_TYPE_20);
3035 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
3036 hf_netlogon_level, &level);
3041 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3042 netlogon_dissect_NETLOGON_SAM_DOMAIN_INFO, NDR_POINTER_PTR,
3043 "NETLOGON_SAM_DOMAIN_INFO pointer:", -1, 0);
3046 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3047 netlogon_dissect_NETLOGON_SAM_GROUP_INFO, NDR_POINTER_PTR,
3048 "NETLOGON_SAM_GROUP_INFO pointer:", -1, 0);
3051 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3052 netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3053 "TYPE_23 pointer:", -1, 0);
3056 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3057 netlogon_dissect_NETLOGON_SAM_ACCOUNT_INFO, NDR_POINTER_PTR,
3058 "NETLOGON_SAM_ACCOUNT_INFO pointer:", -1, 0);
3061 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3062 netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3063 "TYPE_23 pointer:", -1, 0);
3066 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3067 netlogon_dissect_NETLOGON_SAM_GROUP_MEM_INFO, NDR_POINTER_PTR,
3068 "NETLOGON_SAM_GROUP_MEM_INFO pointer:", -1, 0);
3071 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3072 netlogon_dissect_NETLOGON_SAM_ALIAS_INFO, NDR_POINTER_PTR,
3073 "NETLOGON_SAM_ALIAS_INFO pointer:", -1, 0);
3076 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3077 netlogon_dissect_TYPE_23, NDR_POINTER_PTR,
3078 "TYPE_23 pointer:", -1, 0);
3081 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3082 netlogon_dissect_NETLOGON_SAM_ALIAS_MEM_INFO, NDR_POINTER_PTR,
3083 "NETLOGON_SAM_ALIAS_MEM_INFO pointer:", -1, 0);
3086 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3087 netlogon_dissect_TYPE_29, NDR_POINTER_PTR,
3088 "TYPE_29 pointer:", -1, 0);
3091 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3092 netlogon_dissect_TYPE_31, NDR_POINTER_PTR,
3093 "TYPE_31 pointer:", -1, 0);
3096 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3097 netlogon_dissect_TYPE_33, NDR_POINTER_PTR,
3098 "TYPE_33 pointer:", -1, 0);
3101 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3102 netlogon_dissect_TYPE_34, NDR_POINTER_PTR,
3103 "TYPE_34 pointer:", -1, 0);
3106 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3107 netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3108 "TYPE_35 pointer:", -1, 0);
3111 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3112 netlogon_dissect_TYPE_35, NDR_POINTER_PTR,
3113 "TYPE_35 pointer:", -1, 0);
3116 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3117 netlogon_dissect_TYPE_16, NDR_POINTER_PTR,
3118 "TYPE_16 pointer:", -1, 0);
3122 proto_item_set_len(item, offset-old_offset);
3127 netlogon_dissect_SAM_DELTA(tvbuff_t *tvb, int offset,
3128 packet_info *pinfo, proto_tree *parent_tree,
3131 proto_item *item=NULL;
3132 proto_tree *tree=NULL;
3133 int old_offset=offset;
3136 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3138 tree = proto_item_add_subtree(item, ett_SAM_DELTA);
3141 offset = netlogon_dissect_TYPE_19(tvb, offset,
3144 offset = netlogon_dissect_TYPE_20(tvb, offset,
3147 proto_item_set_len(item, offset-old_offset);
3152 netlogon_dissect_SAM_DELTA_array(tvbuff_t *tvb, int offset,
3153 packet_info *pinfo, proto_tree *tree,
3156 offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
3157 netlogon_dissect_SAM_DELTA);
3163 netlogon_dissect_SAM_DELTA_ARRAY(tvbuff_t *tvb, int offset,
3164 packet_info *pinfo, proto_tree *parent_tree,
3167 proto_item *item=NULL;
3168 proto_tree *tree=NULL;
3169 int old_offset=offset;
3172 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3173 "SAM_DELTA_ARRAY:");
3174 tree = proto_item_add_subtree(item, ett_SAM_DELTA_ARRAY);
3177 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3178 hf_netlogon_num_deltas, NULL);
3180 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3181 netlogon_dissect_SAM_DELTA_array, NDR_POINTER_UNIQUE,
3184 proto_item_set_len(item, offset-old_offset);
3189 netlogon_dissect_SAM_DELTA_ARRAY_ptr(tvbuff_t *tvb, int offset,
3190 packet_info *pinfo, proto_tree *tree,
3193 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3194 netlogon_dissect_SAM_DELTA_ARRAY, NDR_POINTER_PTR,
3195 "SAM_DELTA_ARRAY pointer: deltas", -1, 0);
3201 netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset,
3202 packet_info *pinfo, proto_tree *tree,
3205 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3206 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3207 "Handle", hf_netlogon_logonsrv_handle, 0);
3213 netlogon_dissect_NETLOGON_INFO(tvbuff_t *tvb, int offset,
3214 packet_info *pinfo, proto_tree *parent_tree,
3217 proto_item *item=NULL;
3218 proto_tree *tree=NULL;
3219 int old_offset=offset;
3223 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3225 tree = proto_item_add_subtree(item, ett_NETLOGON_INFO);
3228 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3229 hf_netlogon_level_long, &level);
3234 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3235 netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_PTR,
3236 "NETLOGON_INFO_1 pointer:", -1, 0);
3239 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3240 netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_PTR,
3241 "NETLOGON_INFO_2 pointer:", -1, 0);
3244 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3245 netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_PTR,
3246 "NETLOGON_INFO_3 pointer:", -1, 0);
3249 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3250 netlogon_dissect_NETLOGON_INFO_4, NDR_POINTER_PTR,
3251 "NETLOGON_INFO_4 pointer:", -1, 0);
3255 proto_item_set_len(item, offset-old_offset);
3260 netlogon_dissect_TYPE_45(tvbuff_t *tvb, int offset,
3261 packet_info *pinfo, proto_tree *parent_tree,
3264 proto_item *item=NULL;
3265 proto_tree *tree=NULL;
3266 int old_offset=offset;
3270 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3272 tree = proto_item_add_subtree(item, ett_TYPE_45);
3275 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3276 hf_netlogon_level_long, &level);
3281 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3282 netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3283 "TYPE_46 pointer:", -1, 0);
3286 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3287 netlogon_dissect_TYPE_46, NDR_POINTER_PTR,
3288 "TYPE_46 pointer:", -1, 0);
3292 proto_item_set_len(item, offset-old_offset);
3297 netlogon_dissect_TYPE_47(tvbuff_t *tvb, int offset,
3298 packet_info *pinfo, proto_tree *parent_tree,
3301 proto_item *item=NULL;
3302 proto_tree *tree=NULL;
3303 int old_offset=offset;
3307 item = proto_tree_add_text(parent_tree, tvb, offset, 0,
3309 tree = proto_item_add_subtree(item, ett_TYPE_47);
3312 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3313 hf_netlogon_level_long, &level);
3318 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3319 netlogon_dissect_TYPE_48, NDR_POINTER_PTR,
3320 "TYPE_48 pointer:", -1, 0);
3323 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3324 netlogon_dissect_UNICODE_MULTI, NDR_POINTER_PTR,
3325 "UNICODE_MULTI pointer:", -1, 0);
3329 proto_item_set_len(item, offset-old_offset);
3335 netlogon_dissect_function_00_rqst(tvbuff_t *tvb, int offset,
3336 packet_info *pinfo, proto_tree *tree, char *drep)
3338 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3341 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3342 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3343 "unknown string", hf_netlogon_unknown_string, -1);
3345 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3346 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3347 "unknown string", hf_netlogon_unknown_string, -1);
3354 netlogon_dissect_function_00_reply(tvbuff_t *tvb, int offset,
3355 packet_info *pinfo, proto_tree *tree, char *drep)
3357 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3358 netlogon_dissect_TYPE_1_ptr, NDR_POINTER_REF,
3359 "TYPE_1* pointer: unknown_TYPE_1", -1, 0);
3361 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3362 hf_netlogon_rc, NULL);
3368 netlogon_dissect_function_01_rqst(tvbuff_t *tvb, int offset,
3369 packet_info *pinfo, proto_tree *tree, char *drep)
3371 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3374 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3375 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3376 "unknown string", hf_netlogon_unknown_string, -1);
3378 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3379 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_REF,
3380 "unknown string", hf_netlogon_unknown_string, -1);
3387 netlogon_dissect_function_01_reply(tvbuff_t *tvb, int offset,
3388 packet_info *pinfo, proto_tree *tree, char *drep)
3390 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3391 netlogon_dissect_TYPE_2, NDR_POINTER_REF,
3392 "TYPE_2 pointer: unknown_TYPE_2", -1, 0);
3394 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3395 hf_netlogon_rc, NULL);
3401 netlogon_dissect_netlogonsamlogon_rqst(tvbuff_t *tvb, int offset,
3402 packet_info *pinfo, proto_tree *tree, char *drep)
3404 if (check_col(pinfo->cinfo, COL_INFO))
3405 col_set_str(pinfo->cinfo, COL_INFO, "SamLogon request");
3407 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3410 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3411 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3412 "Computer Name", hf_netlogon_computer_name, 0);
3414 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3415 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3416 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3418 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3419 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3420 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3422 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3423 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3424 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3431 netlogon_dissect_netlogonsamlogon_reply(tvbuff_t *tvb, int offset,
3432 packet_info *pinfo, proto_tree *tree, char *drep)
3434 if (check_col(pinfo->cinfo, COL_INFO))
3435 col_set_str(pinfo->cinfo, COL_INFO, "SamLogon response");
3437 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3438 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3439 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3441 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3442 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_REF,
3443 "NETLOGON_VALIDATION pointer: ctr", -1, 0);
3445 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3446 netlogon_dissect_pointer_char, NDR_POINTER_REF,
3447 "BOOLEAN pointer: Authoritative", hf_netlogon_authoritative, 0);
3449 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3450 hf_netlogon_rc, NULL);
3456 netlogon_dissect_netlogonsamlogoff_rqst(tvbuff_t *tvb, int offset,
3457 packet_info *pinfo, proto_tree *tree, char *drep)
3459 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3462 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3463 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3464 "unknown string", hf_netlogon_unknown_string, 0);
3466 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3467 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3468 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3470 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3471 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3472 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3474 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3475 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_REF,
3476 "NETLOGON_LEVEL pointer: id_ctr", -1, 0);
3483 netlogon_dissect_netlogonsamlogoff_reply(tvbuff_t *tvb, int offset,
3484 packet_info *pinfo, proto_tree *tree, char *drep)
3487 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3488 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_UNIQUE,
3489 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3491 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3492 hf_netlogon_rc, NULL);
3498 netlogon_dissect_netserverreqchallenge_rqst(tvbuff_t *tvb, int offset,
3499 packet_info *pinfo, proto_tree *tree, char *drep)
3501 if (check_col(pinfo->cinfo, COL_INFO))
3502 col_set_str(pinfo->cinfo, COL_INFO,
3503 "RequestChallenge request");
3505 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3508 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3509 NDR_POINTER_REF, hf_netlogon_client_name, 0);
3511 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3512 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3513 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3520 netlogon_dissect_netserverreqchallenge_reply(tvbuff_t *tvb, int offset,
3521 packet_info *pinfo, proto_tree *tree, char *drep)
3523 if (check_col(pinfo->cinfo, COL_INFO))
3524 col_set_str(pinfo->cinfo, COL_INFO,
3525 "RequestChallenge response");
3527 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3528 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3529 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3531 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3532 hf_netlogon_rc, NULL);
3538 netlogon_dissect_netserverauthenticate_rqst(tvbuff_t *tvb, int offset,
3539 packet_info *pinfo, proto_tree *tree, char *drep)
3541 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3544 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3545 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3547 offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3550 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3551 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3553 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3554 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3555 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
3562 netlogon_dissect_netserverauthenticate_reply(tvbuff_t *tvb, int offset,
3563 packet_info *pinfo, proto_tree *tree, char *drep)
3565 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3566 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
3567 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
3569 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3570 hf_netlogon_rc, NULL);
3576 netlogon_dissect_netserverpasswordset_rqst(tvbuff_t *tvb, int offset,
3577 packet_info *pinfo, proto_tree *tree, char *drep)
3579 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3582 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3583 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3585 offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
3588 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3589 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
3591 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3592 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3593 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
3595 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3596 netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF,
3597 "ENCRYPTED_LM_OWF_PASSWORD pointer: hashed_pwd", -1, 0);
3604 netlogon_dissect_netserverpasswordset_reply(tvbuff_t *tvb, int offset,
3605 packet_info *pinfo, proto_tree *tree, char *drep)
3607 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3608 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3609 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
3611 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3612 hf_netlogon_rc, NULL);
3618 netlogon_dissect_netsamdeltas_rqst(tvbuff_t *tvb, int offset,
3619 packet_info *pinfo, proto_tree *tree, char *drep)
3621 /* XXX idl file has LOGONSRV_HANDLE here, ms capture has string srv_name */
3622 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3623 NDR_POINTER_REF, hf_netlogon_logon_srv, 0);
3625 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3626 NDR_POINTER_REF, hf_netlogon_cli_name, 0);
3628 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3629 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3630 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3632 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3633 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3634 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3636 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3637 hf_netlogon_database_id, NULL);
3639 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3640 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3641 "TYPE_16 pointer: dom_mod_count", -1, 0);
3643 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3644 hf_netlogon_max_size, NULL);
3650 netlogon_dissect_netsamdeltas_reply(tvbuff_t *tvb, int offset,
3651 packet_info *pinfo, proto_tree *tree, char *drep)
3653 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3654 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3655 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3657 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3658 netlogon_dissect_TYPE_16, NDR_POINTER_REF,
3659 "TYPE_16 pointer: dom_mod_count", -1, 0);
3661 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3662 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3663 "SAM_DELTA_ARRAY_ptr pointer: deltas", -1, 0);
3665 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3666 hf_netlogon_rc, NULL);
3672 netlogon_dissect_function_08_rqst(tvbuff_t *tvb, int offset,
3673 packet_info *pinfo, proto_tree *tree, char *drep)
3675 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3676 NDR_POINTER_REF, hf_netlogon_logon_srv, 0);
3678 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3679 NDR_POINTER_REF, hf_netlogon_cli_name, 0);
3681 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3682 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3683 "NETLOGON_AUTHENTICATOR pointer: client_creds", -1, 0);
3685 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3686 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3687 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3689 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3690 hf_netlogon_unknown_long, NULL);
3692 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3693 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3694 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3696 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3697 hf_netlogon_unknown_long, NULL);
3703 netlogon_dissect_function_08_reply(tvbuff_t *tvb, int offset,
3704 packet_info *pinfo, proto_tree *tree, char *drep)
3706 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3707 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3708 "NETLOGON_AUTHENTICATOR pointer: server_creds", -1, 0);
3710 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3711 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3712 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3714 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3715 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
3716 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
3718 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3719 hf_netlogon_rc, NULL);
3725 netlogon_dissect_function_09_rqst(tvbuff_t *tvb, int offset,
3726 packet_info *pinfo, proto_tree *tree, char *drep)
3728 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3731 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3732 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3734 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3735 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3736 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3738 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3739 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3740 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3742 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3743 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3744 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3746 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3747 hf_netlogon_unknown_long, NULL);
3749 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3750 hf_netlogon_unknown_long, NULL);
3752 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3753 hf_netlogon_unknown_long, NULL);
3759 netlogon_dissect_function_09_reply(tvbuff_t *tvb, int offset,
3760 packet_info *pinfo, proto_tree *tree, char *drep)
3762 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3763 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3764 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3766 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3767 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3768 "BYTE_array pointer: unknown_BYTE", -1, 0);
3770 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3771 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3772 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3774 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3775 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3776 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3778 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3779 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3780 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3782 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3783 hf_netlogon_rc, NULL);
3789 netlogon_dissect_function_0a_rqst(tvbuff_t *tvb, int offset,
3790 packet_info *pinfo, proto_tree *tree, char *drep)
3792 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3795 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3796 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3798 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3799 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3800 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3802 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3803 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3804 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3806 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3807 hf_netlogon_unknown_long, NULL);
3809 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3810 hf_netlogon_unknown_long, NULL);
3812 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3813 hf_netlogon_unknown_long, NULL);
3820 netlogon_dissect_function_0a_reply(tvbuff_t *tvb, int offset,
3821 packet_info *pinfo, proto_tree *tree, char *drep)
3823 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3824 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
3825 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
3827 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3828 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
3829 "BYTE_array pointer: unknown_BYTE", -1, 0);
3831 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3832 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3833 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3835 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3836 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3837 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3839 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3840 netlogon_dissect_pointer_long, NDR_POINTER_REF,
3841 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
3843 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3844 netlogon_dissect_TYPE_36, NDR_POINTER_REF,
3845 "TYPE_36 pointer: unknown_TYPE_36", -1, 0);
3847 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3848 hf_netlogon_rc, NULL);
3854 netlogon_dissect_function_0b_rqst(tvbuff_t *tvb, int offset,
3855 packet_info *pinfo, proto_tree *tree, char *drep)
3858 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3859 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
3861 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3862 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3863 "unknown string", hf_netlogon_unknown_string, 0);
3865 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3866 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3867 "WCHAR* pointer: unknown string", -1, 0);
3873 netlogon_dissect_function_0b_reply(tvbuff_t *tvb, int offset,
3874 packet_info *pinfo, proto_tree *tree, char *drep)
3876 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3877 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3878 "WCHAR* pointer: unknown string", -1, 0);
3880 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3881 hf_netlogon_rc, NULL);
3887 netlogon_dissect_netlogoncontrol_rqst(tvbuff_t *tvb, int offset,
3888 packet_info *pinfo, proto_tree *tree, char *drep)
3890 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3893 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3894 hf_netlogon_code, NULL);
3896 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3897 hf_netlogon_level, NULL);
3904 netlogon_dissect_netlogoncontrol_reply(tvbuff_t *tvb, int offset,
3905 packet_info *pinfo, proto_tree *tree, char *drep)
3907 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3908 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3909 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3911 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3912 hf_netlogon_rc, NULL);
3918 netlogon_dissect_function_0d_rqst(tvbuff_t *tvb, int offset,
3919 packet_info *pinfo, proto_tree *tree, char *drep)
3921 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3924 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3925 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
3926 "unknown string", hf_netlogon_unknown_string, 0);
3928 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3929 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3930 "WCHAR* pointer: unknown string", -1, 0);
3936 netlogon_dissect_function_0d_reply(tvbuff_t *tvb, int offset,
3937 packet_info *pinfo, proto_tree *tree, char *drep)
3939 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3940 netlogon_dissect_WCHAR_ptr, NDR_POINTER_REF,
3941 "WCHAR* pointer: unknown string", -1, 0);
3943 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3944 hf_netlogon_rc, NULL);
3950 netlogon_dissect_netlogoncontrol2_rqst(tvbuff_t *tvb, int offset,
3951 packet_info *pinfo, proto_tree *tree, char *drep)
3953 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3956 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3957 hf_netlogon_code, NULL);
3959 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
3960 hf_netlogon_level, NULL);
3962 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3963 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
3964 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
3971 netlogon_dissect_netlogoncontrol2_reply(tvbuff_t *tvb, int offset,
3972 packet_info *pinfo, proto_tree *tree, char *drep)
3974 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
3975 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
3976 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
3978 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
3979 hf_netlogon_rc, NULL);
3985 netlogon_dissect_netserverauthenticate2_rqst(tvbuff_t *tvb, int offset,
3986 packet_info *pinfo, proto_tree *tree, char *drep)
3988 if (check_col(pinfo->cinfo, COL_INFO))
3989 col_set_str(pinfo->cinfo, COL_INFO, "Auth2 request");
3991 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
3994 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
3995 NDR_POINTER_REF, hf_netlogon_acct_name, 0);
3997 offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4000 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4001 NDR_POINTER_REF, hf_netlogon_computer_name, 0);
4003 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4004 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4005 "NETLOGON_CREDENTIAL pointer: client_chal", -1, 0);
4007 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4008 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4009 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4015 netlogon_dissect_netserverauthenticate2_reply(tvbuff_t *tvb, int offset,
4016 packet_info *pinfo, proto_tree *tree, char *drep)
4018 if (check_col(pinfo->cinfo, COL_INFO))
4019 col_set_str(pinfo->cinfo, COL_INFO, "Auth2 response");
4021 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4022 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4023 "NETLOGON_CREDENTIAL pointer: server_chal", -1, 0);
4025 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4026 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4027 "ULONG pointer: neg_flags", hf_netlogon_unknown_long, 0);
4029 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4030 hf_netlogon_rc, NULL);
4036 netlogon_dissect_netdatabasesync2_rqst(tvbuff_t *tvb, int offset,
4037 packet_info *pinfo, proto_tree *tree, char *drep)
4039 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4042 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4043 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4045 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4046 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4047 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4049 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4050 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4051 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4053 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4054 hf_netlogon_unknown_long, NULL);
4056 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4057 hf_netlogon_unknown_short, NULL);
4059 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4060 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4061 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4063 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4064 hf_netlogon_unknown_long, NULL);
4071 netlogon_dissect_netdatabasesync2_reply(tvbuff_t *tvb, int offset,
4072 packet_info *pinfo, proto_tree *tree, char *drep)
4074 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4075 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4076 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4078 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4079 netlogon_dissect_pointer_long, NDR_POINTER_REF,
4080 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4082 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4083 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4084 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4086 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4087 hf_netlogon_rc, NULL);
4093 netlogon_dissect_function_11_rqst(tvbuff_t *tvb, int offset,
4094 packet_info *pinfo, proto_tree *tree, char *drep)
4096 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4097 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4099 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4100 NDR_POINTER_REF, hf_netlogon_unknown_string, 0);
4102 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4103 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4104 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4106 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4107 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4108 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4110 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4111 netlogon_dissect_BYTE_array, NDR_POINTER_REF,
4112 "BYTE pointer: unknown_BYTE", -1, 0);
4114 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4115 hf_netlogon_unknown_long, NULL);
4122 netlogon_dissect_function_11_reply(tvbuff_t *tvb, int offset,
4123 packet_info *pinfo, proto_tree *tree, char *drep)
4125 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4126 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4127 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4129 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4130 netlogon_dissect_SAM_DELTA_ARRAY_ptr, NDR_POINTER_REF,
4131 "SAM_DELTA_ARRAY* pointer: unknown_SAM_DELTA_ARRAY", -1, 0);
4133 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4134 hf_netlogon_rc, NULL);
4140 netlogon_dissect_function_12_rqst(tvbuff_t *tvb, int offset,
4141 packet_info *pinfo, proto_tree *tree, char *drep)
4143 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4146 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4147 hf_netlogon_unknown_long, NULL);
4149 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4150 hf_netlogon_level, NULL);
4152 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4153 netlogon_dissect_NETLOGON_CONTROL_QUERY_INFO, NDR_POINTER_REF,
4154 "NETLOGON_CONTROL_QUERY_INFO pointer: unknown_NETLOGON_CONTROL_QUERY_INFO", -1, 0);
4161 netlogon_dissect_function_12_reply(tvbuff_t *tvb, int offset,
4162 packet_info *pinfo, proto_tree *tree, char *drep)
4164 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4165 netlogon_dissect_NETLOGON_INFO, NDR_POINTER_REF,
4166 "NETLOGON_INFO pointer: unknown_NETLOGON_INFO", -1, 0);
4168 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4169 hf_netlogon_rc, NULL);
4175 netlogon_dissect_nettrusteddomainlist_rqst(tvbuff_t *tvb, int offset,
4176 packet_info *pinfo, proto_tree *tree, char *drep)
4178 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4186 netlogon_dissect_nettrusteddomainlist_reply(tvbuff_t *tvb, int offset,
4187 packet_info *pinfo, proto_tree *tree, char *drep)
4189 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4190 netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF,
4191 "UNICODE_MULTI pointer: trust_dom_name_list", -1, 0);
4193 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4194 hf_netlogon_rc, NULL);
4200 netlogon_dissect_dsrgetdcname2_rqst(tvbuff_t *tvb, int offset,
4201 packet_info *pinfo, proto_tree *tree, char *drep)
4203 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4206 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4207 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4208 "Domain", hf_netlogon_logon_dom, 0);
4210 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4211 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4212 "GUID pointer: domain_guid", -1, 0);
4214 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4215 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4216 "GUID pointer: site_guid", -1, 0);
4218 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4219 hf_netlogon_flags, NULL);
4226 netlogon_dissect_dsrgetdcname2_reply(tvbuff_t *tvb, int offset,
4227 packet_info *pinfo, proto_tree *tree, char *drep)
4229 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4230 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4231 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4233 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4234 hf_netlogon_rc, NULL);
4240 netlogon_dissect_function_15_rqst(tvbuff_t *tvb, int offset,
4241 packet_info *pinfo, proto_tree *tree, char *drep)
4243 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4246 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4247 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4248 "unknown string", hf_netlogon_unknown_string, 0);
4250 offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4253 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4254 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4255 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4257 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4258 hf_netlogon_unknown_long, NULL);
4265 netlogon_dissect_function_15_reply(tvbuff_t *tvb, int offset,
4266 packet_info *pinfo, proto_tree *tree, char *drep)
4268 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4269 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4270 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4272 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4273 netlogon_dissect_TYPE_44, NDR_POINTER_PTR,
4274 "TYPE_44 pointer: unknown_TYPE_44", -1, 0);
4276 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4277 hf_netlogon_rc, NULL);
4283 netlogon_dissect_function_16_rqst(tvbuff_t *tvb, int offset,
4284 packet_info *pinfo, proto_tree *tree, char *drep)
4286 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4289 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4290 hf_netlogon_unknown_long, NULL);
4292 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4293 hf_netlogon_unknown_long, NULL);
4300 netlogon_dissect_function_16_reply(tvbuff_t *tvb, int offset,
4301 packet_info *pinfo, proto_tree *tree, char *drep)
4303 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4304 hf_netlogon_rc, NULL);
4310 netlogon_dissect_function_17_rqst(tvbuff_t *tvb, int offset,
4311 packet_info *pinfo, proto_tree *tree, char *drep)
4313 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4316 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4317 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4318 "unknown string", hf_netlogon_unknown_string, 0);
4325 netlogon_dissect_function_17_reply(tvbuff_t *tvb, int offset,
4326 packet_info *pinfo, proto_tree *tree, char *drep)
4328 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4329 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4330 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4332 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4333 hf_netlogon_rc, NULL);
4339 netlogon_dissect_function_18_rqst(tvbuff_t *tvb, int offset,
4340 packet_info *pinfo, proto_tree *tree, char *drep)
4342 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4345 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4346 hf_netlogon_unknown_long, NULL);
4348 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4349 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4350 "BYTE pointer: unknown_BYTE", -1, 0);
4352 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4353 hf_netlogon_unknown_long, NULL);
4359 netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset,
4360 packet_info *pinfo, proto_tree *tree, char *drep)
4365 offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, drep,
4366 hf_netlogon_unknown_char, NULL);
4373 netlogon_dissect_function_18_reply(tvbuff_t *tvb, int offset,
4374 packet_info *pinfo, proto_tree *tree, char *drep)
4376 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4377 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4378 "BYTE pointer: unknown_BYTE", -1, 0);
4380 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4381 hf_netlogon_rc, NULL);
4387 netlogon_dissect_function_19_rqst(tvbuff_t *tvb, int offset,
4388 packet_info *pinfo, proto_tree *tree, char *drep)
4390 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4393 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4394 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4395 "unknown string", hf_netlogon_unknown_string, 0);
4397 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4398 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4399 "BYTE pointer: unknown_BYTE", -1, 0);
4401 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4402 hf_netlogon_unknown_long, NULL);
4409 netlogon_dissect_function_19_reply(tvbuff_t *tvb, int offset,
4410 packet_info *pinfo, proto_tree *tree, char *drep)
4412 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4413 netlogon_dissect_BYTE_16_array, NDR_POINTER_PTR,
4414 "BYTE pointer: unknown_BYTE", -1, 0);
4416 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4417 hf_netlogon_rc, NULL);
4423 netlogon_dissect_netserverauthenticate3_rqst(tvbuff_t *tvb, int offset,
4424 packet_info *pinfo, proto_tree *tree, char *drep)
4426 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4429 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4430 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4431 "Acct Name", hf_netlogon_acct_name, 0);
4433 offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4436 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4437 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4438 "Computer Name", hf_netlogon_computer_name, 0);
4440 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4441 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4442 "NETLOGON_CREDENTIAL pointer: authenticator", -1, 0);
4444 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4445 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4446 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4453 netlogon_dissect_netserverauthenticate3_reply(tvbuff_t *tvb, int offset,
4454 packet_info *pinfo, proto_tree *tree, char *drep)
4456 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4457 netlogon_dissect_NETLOGON_CREDENTIAL, NDR_POINTER_REF,
4458 "NETLOGON_CREDENTIAL pointer: unknown_NETLOGON_CREDENTIAL", -1, 0);
4460 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4461 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4462 "ULONG pointer: negotiate_flags", hf_netlogon_unknown_long, 0);
4464 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4465 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4466 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4468 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4469 hf_netlogon_rc, NULL);
4475 netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset,
4476 packet_info *pinfo, proto_tree *tree, char *drep)
4478 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4481 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4482 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4483 "Domain", hf_netlogon_logon_dom, 0);
4485 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4486 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4487 "GUID pointer: domain_guid", -1, 0);
4489 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4490 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4491 "Site Name", hf_netlogon_site_name, 0);
4493 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4494 hf_netlogon_flags, NULL);
4501 netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset,
4502 packet_info *pinfo, proto_tree *tree, char *drep)
4504 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4505 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr, NDR_POINTER_REF,
4506 "DOMAIN_CONTROLLER_INFO* pointer: info", -1, 0);
4508 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4509 hf_netlogon_rc, NULL);
4515 netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset,
4516 packet_info *pinfo, proto_tree *tree, char *drep)
4518 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4526 netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset,
4527 packet_info *pinfo, proto_tree *tree, char *drep)
4530 offset = netlogon_dissect_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
4531 NDR_POINTER_REF, hf_netlogon_site_name, 0);
4533 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4534 hf_netlogon_rc, NULL);
4540 netlogon_dissect_function_1d_rqst(tvbuff_t *tvb, int offset,
4541 packet_info *pinfo, proto_tree *tree, char *drep)
4543 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4546 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4547 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4548 "Computer Name", hf_netlogon_computer_name, 0);
4550 offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4553 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4554 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4555 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4557 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4558 hf_netlogon_unknown_long, NULL);
4560 offset = netlogon_dissect_TYPE_45(tvb, offset,
4568 netlogon_dissect_function_1d_reply(tvbuff_t *tvb, int offset,
4569 packet_info *pinfo, proto_tree *tree, char *drep)
4571 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4572 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4573 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4575 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4576 netlogon_dissect_TYPE_47, NDR_POINTER_PTR,
4577 "TYPE_47 pointer: unknown_TYPE_47", -1, 0);
4579 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4580 hf_netlogon_rc, NULL);
4586 netlogon_dissect_function_1e_rqst(tvbuff_t *tvb, int offset,
4587 packet_info *pinfo, proto_tree *tree, char *drep)
4589 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4592 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4593 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4594 "unknown string", hf_netlogon_unknown_string, 0);
4596 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4597 hf_netlogon_unknown_short, NULL);
4599 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4600 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4601 "unknown string", hf_netlogon_unknown_string, 0);
4603 offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4606 offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset,
4614 netlogon_dissect_function_1e_reply(tvbuff_t *tvb, int offset,
4615 packet_info *pinfo, proto_tree *tree, char *drep)
4617 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4618 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4619 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4621 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4622 hf_netlogon_rc, NULL);
4628 netlogon_dissect_netserverpasswordset2_rqst(tvbuff_t *tvb, int offset,
4629 packet_info *pinfo, proto_tree *tree, char *drep)
4631 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4634 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4635 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4636 "Acct Name", hf_netlogon_acct_name, 0);
4638 offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset,
4641 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4642 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4643 "Computer Name", hf_netlogon_computer_name, 0);
4645 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4646 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4647 "NETLOGON_AUTHENTICATOR pointer: client_cred", -1, 0);
4654 netlogon_dissect_netserverpasswordset2_reply(tvbuff_t *tvb, int offset,
4655 packet_info *pinfo, proto_tree *tree, char *drep)
4657 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4658 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_REF,
4659 "NETLOGON_AUTHENTICATOR pointer: server_cred", -1, 0);
4661 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4662 netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF,
4663 "LM_OWF_PASSWORD pointer: server_pwd", -1, 0);
4665 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4666 hf_netlogon_rc, NULL);
4672 netlogon_dissect_function_20_rqst(tvbuff_t *tvb, int offset,
4673 packet_info *pinfo, proto_tree *tree, char *drep)
4675 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4678 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4679 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4680 "unknown string", hf_netlogon_unknown_string, -1);
4682 offset = netlogon_dissect_NETLOGON_AUTHENTICATOR(tvb, offset,
4685 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4686 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4687 "BYTE pointer: unknown_BYTE", -1, 0);
4689 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4690 hf_netlogon_unknown_long, NULL);
4697 netlogon_dissect_function_20_reply(tvbuff_t *tvb, int offset,
4698 packet_info *pinfo, proto_tree *tree, char *drep)
4700 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4701 netlogon_dissect_NETLOGON_AUTHENTICATOR, NDR_POINTER_PTR,
4702 "NETLOGON_AUTHENTICATOR pointer: unknown_NETLOGON_AUTHENTICATOR", -1, 0);
4704 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4705 hf_netlogon_rc, NULL);
4711 netlogon_dissect_function_21_rqst(tvbuff_t *tvb, int offset,
4712 packet_info *pinfo, proto_tree *tree, char *drep)
4714 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4717 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4718 hf_netlogon_unknown_long, NULL);
4720 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4721 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4722 "BYTE pointer: unknown_BYTE", -1, 0);
4729 netlogon_dissect_function_21_reply(tvbuff_t *tvb, int offset,
4730 packet_info *pinfo, proto_tree *tree, char *drep)
4732 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4733 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4734 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4736 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4737 hf_netlogon_rc, NULL);
4743 netlogon_dissect_function_22_rqst(tvbuff_t *tvb, int offset,
4744 packet_info *pinfo, proto_tree *tree, char *drep)
4746 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4749 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4750 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4751 "unknown string", hf_netlogon_unknown_string, 0);
4753 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4754 hf_netlogon_unknown_long, NULL);
4756 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4757 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4758 "unknown string", hf_netlogon_unknown_string, 0);
4760 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4761 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4762 "GUID pointer: unknown_GUID", -1, 0);
4764 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4765 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4766 "unknown string", hf_netlogon_unknown_string, 0);
4768 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4769 hf_netlogon_unknown_long, NULL);
4776 netlogon_dissect_function_22_reply(tvbuff_t *tvb, int offset,
4777 packet_info *pinfo, proto_tree *tree, char *drep)
4779 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4780 netlogon_dissect_DOMAIN_CONTROLLER_INFO_ptr_ptr, NDR_POINTER_REF,
4781 "DOMAIN_CONTROLLER_INFO** pointer: unknown_DOMAIN_CONTROLLER_INFO", -1, 0);
4783 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4784 hf_netlogon_rc, NULL);
4790 netlogon_dissect_function_23_rqst(tvbuff_t *tvb, int offset,
4791 packet_info *pinfo, proto_tree *tree, char *drep)
4793 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4801 netlogon_dissect_function_23_reply(tvbuff_t *tvb, int offset,
4802 packet_info *pinfo, proto_tree *tree, char *drep)
4804 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4805 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
4806 "unknown string", hf_netlogon_unknown_string, -1);
4808 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4809 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4810 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4812 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4813 hf_netlogon_rc, NULL);
4819 netlogon_dissect_function_24_rqst(tvbuff_t *tvb, int offset,
4820 packet_info *pinfo, proto_tree *tree, char *drep)
4822 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4830 netlogon_dissect_function_24_reply(tvbuff_t *tvb, int offset,
4831 packet_info *pinfo, proto_tree *tree, char *drep)
4833 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4834 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4835 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4837 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4838 hf_netlogon_rc, NULL);
4844 netlogon_dissect_function_25_rqst(tvbuff_t *tvb, int offset,
4845 packet_info *pinfo, proto_tree *tree, char *drep)
4847 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4850 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4851 hf_netlogon_unknown_long, NULL);
4853 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4854 netlogon_dissect_BYTE_array, NDR_POINTER_PTR,
4855 "BYTE pointer: unknown_BYTE", -1, 0);
4862 netlogon_dissect_function_25_reply(tvbuff_t *tvb, int offset,
4863 packet_info *pinfo, proto_tree *tree, char *drep)
4865 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4866 netlogon_dissect_TYPE_52_ptr_ptr, NDR_POINTER_REF,
4867 "TYPE_52** pointer: unknown_TYPE_52", -1, 0);
4869 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4870 hf_netlogon_rc, NULL);
4877 netlogon_dissect_function_26_rqst(tvbuff_t *tvb, int offset,
4878 packet_info *pinfo, proto_tree *tree, char *drep)
4880 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4881 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4882 "unknown string", hf_netlogon_unknown_string, 0);
4889 netlogon_dissect_function_26_reply(tvbuff_t *tvb, int offset,
4890 packet_info *pinfo, proto_tree *tree, char *drep)
4892 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4893 netlogon_dissect_TYPE_50_ptr_ptr, NDR_POINTER_REF,
4894 "TYPE_50** pointer: unknown_TYPE_50", -1, 0);
4896 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4897 hf_netlogon_rc, NULL);
4903 netlogon_dissect_function_27_rqst(tvbuff_t *tvb, int offset,
4904 packet_info *pinfo, proto_tree *tree, char *drep)
4906 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4907 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4908 "unknown string", hf_netlogon_unknown_string, 0);
4910 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4911 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4912 "unknown string", hf_netlogon_unknown_string, 0);
4914 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4915 hf_netlogon_unknown_short, NULL);
4917 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4918 netlogon_dissect_NETLOGON_LEVEL, NDR_POINTER_PTR,
4919 "NETLOGON_LEVEL pointer: unknown_NETLOGON_LEVEL", -1, 0);
4921 offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
4922 hf_netlogon_unknown_short, NULL);
4924 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4925 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4926 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4932 netlogon_dissect_function_27_reply(tvbuff_t *tvb, int offset,
4933 packet_info *pinfo, proto_tree *tree, char *drep)
4935 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4936 netlogon_dissect_NETLOGON_VALIDATION, NDR_POINTER_PTR,
4937 "NETLOGON_VALIDATION pointer: unknown_NETLOGON_VALIDATION", -1, 0);
4939 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4940 netlogon_dissect_pointer_char, NDR_POINTER_PTR,
4941 "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char, 0);
4943 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4944 netlogon_dissect_pointer_long, NDR_POINTER_PTR,
4945 "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long, 0);
4947 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4948 hf_netlogon_rc, NULL);
4954 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst(tvbuff_t *tvb, int offset,
4955 packet_info *pinfo, proto_tree *tree, char *drep)
4957 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4960 offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
4961 hf_netlogon_unknown_long, NULL);
4968 netlogon_dissect_dsrrolegetprimarydomaininformation_reply(tvbuff_t *tvb, int offset,
4969 packet_info *pinfo, proto_tree *tree, char *drep)
4971 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4972 netlogon_dissect_TYPE_51, NDR_POINTER_PTR,
4973 "TYPE_51 pointer: unknown_TYPE_51", -1, 0);
4975 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
4976 hf_netlogon_rc, NULL);
4982 netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset,
4983 packet_info *pinfo, proto_tree *tree, char *drep)
4985 offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset,
4988 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4989 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
4990 "Domain", hf_netlogon_logon_dom, 0);
4992 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4993 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4994 "GUID pointer: domain_guid", -1, 0);
4996 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
4997 dissect_nt_GUID, NDR_POINTER_UNIQUE,
4998 "GUID pointer: dsa_guid", -1, 0);
5000 offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
5001 dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_PTR,
5002 "dns_host", hf_netlogon_dns_host, -1);
5009 netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset,
5010 packet_info *pinfo, proto_tree *tree, char *drep)
5012 offset = dissect_ntstatus(tvb, offset, pinfo, tree, drep,
5013 hf_netlogon_rc, NULL);
5020 static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = {
5021 { NETLOGON_FUNCTION_00, "FUNCTION_00",
5022 netlogon_dissect_function_00_rqst,
5023 netlogon_dissect_function_00_reply },
5024 { NETLOGON_FUNCTION_01, "FUNCTION_01",
5025 netlogon_dissect_function_01_rqst,
5026 netlogon_dissect_function_01_reply },
5027 { NETLOGON_NETLOGONSAMLOGON, "NETLOGONSAMLOGON",
5028 netlogon_dissect_netlogonsamlogon_rqst,
5029 netlogon_dissect_netlogonsamlogon_reply },
5030 { NETLOGON_NETLOGONSAMLOGOFF, "NETLOGONSAMLOGOFF",
5031 netlogon_dissect_netlogonsamlogoff_rqst,
5032 netlogon_dissect_netlogonsamlogoff_reply },
5033 { NETLOGON_NETSERVERREQCHALLENGE, "NETSERVERREQCHALLENGE",
5034 netlogon_dissect_netserverreqchallenge_rqst,
5035 netlogon_dissect_netserverreqchallenge_reply },
5036 { NETLOGON_NETSERVERAUTHENTICATE, "NETSERVERAUTHENTICATE",
5037 netlogon_dissect_netserverauthenticate_rqst,
5038 netlogon_dissect_netserverauthenticate_reply },
5039 { NETLOGON_NETSERVERPASSWORDSET, "NETSERVERPASSWORDSET",
5040 netlogon_dissect_netserverpasswordset_rqst,
5041 netlogon_dissect_netserverpasswordset_reply },
5042 { NETLOGON_NETSAMDELTAS, "NETSAMDELTAS",
5043 netlogon_dissect_netsamdeltas_rqst,
5044 netlogon_dissect_netsamdeltas_reply },
5045 { NETLOGON_FUNCTION_08, "FUNCTION_08",
5046 netlogon_dissect_function_08_rqst,
5047 netlogon_dissect_function_08_reply },
5048 { NETLOGON_FUNCTION_09, "FUNCTION_09",
5049 netlogon_dissect_function_09_rqst,
5050 netlogon_dissect_function_09_reply },
5051 { NETLOGON_FUNCTION_0A, "FUNCTION_0A",
5052 netlogon_dissect_function_0a_rqst,
5053 netlogon_dissect_function_0a_reply },
5054 { NETLOGON_FUNCTION_0B, "FUNCTION_0B",
5055 netlogon_dissect_function_0b_rqst,
5056 netlogon_dissect_function_0b_reply },
5057 { NETLOGON_NETLOGONCONTROL, "NETLOGONCONTROL",
5058 netlogon_dissect_netlogoncontrol_rqst,
5059 netlogon_dissect_netlogoncontrol_reply },
5060 { NETLOGON_FUNCTION_0D, "FUNCTION_0D",
5061 netlogon_dissect_function_0d_rqst,
5062 netlogon_dissect_function_0d_reply },
5063 { NETLOGON_NETLOGONCONTROL2, "NETLOGONCONTROL2",
5064 netlogon_dissect_netlogoncontrol2_rqst,
5065 netlogon_dissect_netlogoncontrol2_reply },
5066 { NETLOGON_NETSERVERAUTHENTICATE2, "NETSERVERAUTHENTICATE2",
5067 netlogon_dissect_netserverauthenticate2_rqst,
5068 netlogon_dissect_netserverauthenticate2_reply },
5069 { NETLOGON_NETDATABASESYNC2, "NETDATABASESYNC2",
5070 netlogon_dissect_netdatabasesync2_rqst,
5071 netlogon_dissect_netdatabasesync2_reply },
5072 { NETLOGON_FUNCTION_11, "FUNCTION_11",
5073 netlogon_dissect_function_11_rqst,
5074 netlogon_dissect_function_11_reply },
5075 { NETLOGON_FUNCTION_12, "FUNCTION_12",
5076 netlogon_dissect_function_12_rqst,
5077 netlogon_dissect_function_12_reply },
5078 { NETLOGON_NETTRUSTEDDOMAINLIST, "NETTRUSTEDDOMAINLIST",
5079 netlogon_dissect_nettrusteddomainlist_rqst,
5080 netlogon_dissect_nettrusteddomainlist_reply },
5081 { NETLOGON_DSRGETDCNAME2, "DSRGETDCNAME2",
5082 netlogon_dissect_dsrgetdcname2_rqst,
5083 netlogon_dissect_dsrgetdcname2_reply },
5084 { NETLOGON_FUNCTION_15, "FUNCTION_15",
5085 netlogon_dissect_function_15_rqst,
5086 netlogon_dissect_function_15_reply },
5087 { NETLOGON_FUNCTION_16, "FUNCTION_16",
5088 netlogon_dissect_function_16_rqst,
5089 netlogon_dissect_function_16_reply },
5090 { NETLOGON_FUNCTION_17, "FUNCTION_17",
5091 netlogon_dissect_function_17_rqst,
5092 netlogon_dissect_function_17_reply },
5093 { NETLOGON_FUNCTION_18, "FUNCTION_18",
5094 netlogon_dissect_function_18_rqst,
5095 netlogon_dissect_function_18_reply },
5096 { NETLOGON_FUNCTION_19, "FUNCTION_19",
5097 netlogon_dissect_function_19_rqst,
5098 netlogon_dissect_function_19_reply },
5099 { NETLOGON_NETSERVERAUTHENTICATE3, "NETSERVERAUTHENTICATE3",
5100 netlogon_dissect_netserverauthenticate3_rqst,
5101 netlogon_dissect_netserverauthenticate3_reply },
5102 { NETLOGON_DSRGETDCNAME, "DSRGETDCNAME",
5103 netlogon_dissect_dsrgetdcname_rqst,
5104 netlogon_dissect_dsrgetdcname_reply },
5105 { NETLOGON_DSRGETSITENAME, "DSRGETSITENAME",
5106 netlogon_dissect_dsrgetsitename_rqst,
5107 netlogon_dissect_dsrgetsitename_reply },
5108 { NETLOGON_FUNCTION_1D, "FUNCTION_1D",
5109 netlogon_dissect_function_1d_rqst,
5110 netlogon_dissect_function_1d_reply },
5111 { NETLOGON_FUNCTION_1E, "FUNCTION_1E",
5112 netlogon_dissect_function_1e_rqst,
5113 netlogon_dissect_function_1e_reply },
5114 { NETLOGON_NETSERVERPASSWORDSET2, "NETSERVERPASSWORDSET2",
5115 netlogon_dissect_netserverpasswordset2_rqst,
5116 netlogon_dissect_netserverpasswordset2_reply },
5117 { NETLOGON_FUNCTION_20, "FUNCTION_20",
5118 netlogon_dissect_function_20_rqst,
5119 netlogon_dissect_function_20_reply },
5120 { NETLOGON_FUNCTION_21, "FUNCTION_21",
5121 netlogon_dissect_function_21_rqst,
5122 netlogon_dissect_function_21_reply },
5123 { NETLOGON_FUNCTION_22, "FUNCTION_22",
5124 netlogon_dissect_function_22_rqst,
5125 netlogon_dissect_function_22_reply },
5126 { NETLOGON_FUNCTION_23, "FUNCTION_23",
5127 netlogon_dissect_function_23_rqst,
5128 netlogon_dissect_function_23_reply },
5129 { NETLOGON_FUNCTION_24, "FUNCTION_24",
5130 netlogon_dissect_function_24_rqst,
5131 netlogon_dissect_function_24_reply },
5132 { NETLOGON_FUNCTION_25, "FUNCTION_25",
5133 netlogon_dissect_function_25_rqst,
5134 netlogon_dissect_function_25_reply },
5135 { NETLOGON_FUNCTION_26, "FUNCTION_26",
5136 netlogon_dissect_function_26_rqst,
5137 netlogon_dissect_function_26_reply },
5138 { NETLOGON_FUNCTION_27, "FUNCTION_27",
5139 netlogon_dissect_function_27_rqst,
5140 netlogon_dissect_function_27_reply },
5141 { NETLOGON_DSRROLEGETPRIMARYDOMAININFORMATION, "DSRROLEGETPRIMARYDOMAININFORMATION",
5142 netlogon_dissect_dsrrolegetprimarydomaininformation_rqst,
5143 netlogon_dissect_dsrrolegetprimarydomaininformation_reply },
5144 { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DSRDEREGISTERDNSHOSTRECORDS",
5145 netlogon_dissect_dsrderegisterdnshostrecords_rqst,
5146 netlogon_dissect_dsrderegisterdnshostrecords_reply },
5147 {0, NULL, NULL, NULL },
5151 proto_register_dcerpc_netlogon(void)
5154 static hf_register_info hf[] = {
5155 { &hf_netlogon_rc, {
5156 "Return code", "netlogon.rc", FT_UINT32, BASE_HEX,
5157 VALS(NT_errors), 0x0, "Netlogon return code", HFILL }},
5159 { &hf_netlogon_param_ctrl, {
5160 "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX,
5161 NULL, 0x0, "Param ctrl", HFILL }},
5163 { &hf_netlogon_logon_id, {
5164 "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC,
5165 NULL, 0x0, "Logon ID", HFILL }},
5167 { &hf_netlogon_count, {
5168 "Count", "netlogon.count", FT_UINT16, BASE_DEC,
5169 NULL, 0x0, "", HFILL }},
5171 { &hf_netlogon_credential, {
5172 "Credential", "netlogon.credential", FT_BYTES, BASE_HEX,
5173 NULL, 0x0, "Netlogon credential", HFILL }},
5175 { &hf_netlogon_cypher_block, {
5176 "Cypher Block", "netlogon.cypher_block", FT_BYTES, BASE_HEX,
5177 NULL, 0x0, "Netlogon cypher block", HFILL }},
5179 { &hf_netlogon_lm_owf_password, {
5180 "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_HEX,
5181 NULL, 0x0, "LanManager OWF Password", HFILL }},
5183 { &hf_netlogon_user_session_key, {
5184 "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_HEX,
5185 NULL, 0x0, "User Session Key", HFILL }},
5187 { &hf_netlogon_encrypted_lm_owf_password, {
5188 "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_HEX,
5189 NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }},
5191 { &hf_netlogon_nt_owf_password, {
5192 "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_HEX,
5193 NULL, 0x0, "NT OWF Password", HFILL }},
5195 { &hf_netlogon_blob, {
5196 "BLOB", "netlogon.blob", FT_BYTES, BASE_HEX,
5197 NULL, 0x0, "BLOB", HFILL }},
5199 { &hf_netlogon_len, {
5200 "Len", "netlogon.len", FT_UINT32, BASE_DEC,
5201 NULL, 0, "Length", HFILL }},
5203 { &hf_netlogon_status, {
5204 "Status", "netlogon.status", FT_UINT32, BASE_DEC,
5205 NULL, 0, "Status", HFILL }},
5207 { &hf_netlogon_attrs, {
5208 "Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX,
5209 NULL, 0, "Attributes", HFILL }},
5211 { &hf_netlogon_unknown_string,
5212 { "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE,
5213 NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
5214 { &hf_netlogon_unknown_long,
5215 { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX,
5216 NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
5217 { &hf_netlogon_unknown_short,
5218 { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX,
5219 NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
5221 { &hf_netlogon_unknown_char,
5222 { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX,
5223 NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
5225 { &hf_netlogon_unknown_time,
5226 { "Unknown time", "netlogon.unknown.time", FT_ABSOLUTE_TIME, BASE_NONE,
5227 NULL, 0x0, "Unknown time. If you know what this is, contact ethereal developers.", HFILL }},
5229 { &hf_netlogon_acct_expiry_time,
5230 { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, BASE_NONE,
5231 NULL, 0x0, "When this account will expire", HFILL }},
5233 { &hf_netlogon_nt_pwd_present,
5234 { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX,
5235 NULL, 0x0, "Is NT password present for this account?", HFILL }},
5237 { &hf_netlogon_lm_pwd_present,
5238 { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX,
5239 NULL, 0x0, "Is LanManager password present for this account?", HFILL }},
5241 { &hf_netlogon_pwd_expired,
5242 { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX,
5243 NULL, 0x0, "Whether this password has expired or not", HFILL }},
5245 { &hf_netlogon_num_pwd_pairs,
5246 { "Num PWD Pairs", "netlogon.num_pwd_pairs", FT_UINT8, BASE_DEC,
5247 NULL, 0x0, "Number of password pairs. Password history length?", HFILL }},
5249 { &hf_netlogon_authoritative,
5250 { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC,
5251 NULL, 0x0, "", HFILL }},
5253 { &hf_netlogon_nt_chal_resp,
5254 { "NT Chal resp", "netlogon.nt_chal_resp", FT_BYTES, BASE_HEX,
5255 NULL, 0, "Challenge response for NT authentication", HFILL }},
5257 { &hf_netlogon_lm_chal_resp,
5258 { "LM Chal resp", "netlogon.lm_chal_resp", FT_BYTES, BASE_HEX,
5259 NULL, 0, "Challenge response for LM authentication", HFILL }},
5261 { &hf_netlogon_acct_name,
5262 { "Acct Name", "netlogon.acct_name", FT_STRING, BASE_NONE,
5263 NULL, 0, "Account Name", HFILL }},
5265 { &hf_netlogon_acct_desc,
5266 { "Acct Desc", "netlogon.acct_desc", FT_STRING, BASE_NONE,
5267 NULL, 0, "Account Description", HFILL }},
5269 { &hf_netlogon_group_desc,
5270 { "Group Desc", "netlogon.group_desc", FT_STRING, BASE_NONE,
5271 NULL, 0, "Group Description", HFILL }},
5273 { &hf_netlogon_full_name,
5274 { "Full Name", "netlogon.full_name", FT_STRING, BASE_NONE,
5275 NULL, 0, "Full Name", HFILL }},
5277 { &hf_netlogon_comment,
5278 { "Comment", "netlogon.comment", FT_STRING, BASE_NONE,
5279 NULL, 0, "Comment", HFILL }},
5281 { &hf_netlogon_parameters,
5282 { "Parameters", "netlogon.parameters", FT_STRING, BASE_NONE,
5283 NULL, 0, "Parameters", HFILL }},
5285 { &hf_netlogon_logon_script,
5286 { "Logon Script", "netlogon.logon_script", FT_STRING, BASE_NONE,
5287 NULL, 0, "Logon Script", HFILL }},
5289 { &hf_netlogon_profile_path,
5290 { "Profile Path", "netlogon.profile_path", FT_STRING, BASE_NONE,
5291 NULL, 0, "Profile Path", HFILL }},
5293 { &hf_netlogon_home_dir,
5294 { "Home Dir", "netlogon.home_dir", FT_STRING, BASE_NONE,
5295 NULL, 0, "Home Directory", HFILL }},
5297 { &hf_netlogon_dir_drive,
5298 { "Dir Drive", "netlogon.dir_drive", FT_STRING, BASE_NONE,
5299 NULL, 0, "Drive letter for home directory", HFILL }},
5301 { &hf_netlogon_logon_srv,
5302 { "Server", "netlogon.server", FT_STRING, BASE_NONE,
5303 NULL, 0, "Server", HFILL }},
5305 { &hf_netlogon_logon_dom,
5306 { "Domain", "netlogon.domain", FT_STRING, BASE_NONE,
5307 NULL, 0, "Domain", HFILL }},
5309 { &hf_netlogon_computer_name,
5310 { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE,
5311 NULL, 0, "Computer Name", HFILL }},
5313 { &hf_netlogon_site_name,
5314 { "Site Name", "netlogon.site_name", FT_STRING, BASE_NONE,
5315 NULL, 0, "Site Name", HFILL }},
5317 { &hf_netlogon_dc_name,
5318 { "DC Name", "netlogon.dc.name", FT_STRING, BASE_NONE,
5319 NULL, 0, "DC Name", HFILL }},
5321 { &hf_netlogon_dc_site_name,
5322 { "DC Site Name", "netlogon.dc.site_name", FT_STRING, BASE_NONE,
5323 NULL, 0, "DC Site Name", HFILL }},
5325 { &hf_netlogon_dns_forest_name,
5326 { "DNS Forest Name", "netlogon.dns.forest_name", FT_STRING, BASE_NONE,
5327 NULL, 0, "DNS Forest Name", HFILL }},
5329 { &hf_netlogon_dc_address,
5330 { "DC Address", "netlogon.dc.address", FT_STRING, BASE_NONE,
5331 NULL, 0, "DC Address", HFILL }},
5333 { &hf_netlogon_dc_address_type,
5334 { "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC,
5335 NULL, 0, "DC Address Type", HFILL }},
5337 { &hf_netlogon_client_name,
5338 { "Client Name", "netlogon.client.name", FT_STRING, BASE_NONE,
5339 NULL, 0, "Client Name", HFILL }},
5341 { &hf_netlogon_client_site_name,
5342 { "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE,
5343 NULL, 0, "Client Site Name", HFILL }},
5345 { &hf_netlogon_workstation_site_name,
5346 { "Wkst Site Name", "netlogon.wkst.site_name", FT_STRING, BASE_NONE,
5347 NULL, 0, "Workstation Site Name", HFILL }},
5349 { &hf_netlogon_workstation_os,
5350 { "Wkst OS", "netlogon.wkst.os", FT_STRING, BASE_NONE,
5351 NULL, 0, "Workstation OS", HFILL }},
5353 { &hf_netlogon_workstations,
5354 { "Workstations", "netlogon.wksts", FT_STRING, BASE_NONE,
5355 NULL, 0, "Workstations", HFILL }},
5357 { &hf_netlogon_workstation_fqdn,
5358 { "Wkst FQDN", "netlogon.wkst.fqdn", FT_STRING, BASE_NONE,
5359 NULL, 0, "Workstation FQDN", HFILL }},
5361 { &hf_netlogon_group_name,
5362 { "Group Name", "netlogon.group_name", FT_STRING, BASE_NONE,
5363 NULL, 0, "Group Name", HFILL }},
5365 { &hf_netlogon_alias_name,
5366 { "Alias Name", "netlogon.alias_name", FT_STRING, BASE_NONE,
5367 NULL, 0, "Alias Name", HFILL }},
5369 { &hf_netlogon_cli_name,
5370 { "CLI Name", "netlogon.cli_name", FT_STRING, BASE_NONE,
5371 NULL, 0, "CLI Name", HFILL }},
5373 { &hf_netlogon_dns_host,
5374 { "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE,
5375 NULL, 0, "DNS Host", HFILL }},
5377 { &hf_netlogon_trusted_domain_name,
5378 { "Trusted Domain", "netlogon.trusted_domain", FT_STRING, BASE_NONE,
5379 NULL, 0, "Trusted Domain Name", HFILL }},
5381 { &hf_netlogon_trusted_dc_name,
5382 { "Trusted DC", "netlogon.trusted_dc", FT_STRING, BASE_NONE,
5383 NULL, 0, "Trusted DC", HFILL }},
5385 { &hf_netlogon_logonsrv_handle,
5386 { "Handle", "netlogon.handle", FT_STRING, BASE_NONE,
5387 NULL, 0, "Logon Srv Handle", HFILL }},
5389 { &hf_netlogon_logon_count,
5390 { "Logon Count", "netlogon.logon_count", FT_UINT16, BASE_DEC,
5391 NULL, 0x0, "Number of successful logins", HFILL }},
5393 { &hf_netlogon_bad_pw_count,
5394 { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT16, BASE_DEC,
5395 NULL, 0x0, "Number of failed logins", HFILL }},
5397 { &hf_netlogon_country,
5398 { "Country", "netlogon.country", FT_UINT16, BASE_DEC,
5399 VALS(ms_country_codes), 0x0, "Country setting for this account", HFILL }},
5401 { &hf_netlogon_codepage,
5402 { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC,
5403 NULL, 0x0, "Codepage setting for this account", HFILL }},
5405 { &hf_netlogon_level,
5406 { "Level", "netlogon.level", FT_UINT16, BASE_DEC,
5407 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5409 { &hf_netlogon_secure_channel_type,
5410 { "Sec Chn Type", "netlogon.sec_chn_type", FT_UINT16, BASE_DEC,
5411 NULL, 0x0, "Secure Channel Type", HFILL }},
5413 { &hf_netlogon_blob_size,
5414 { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC,
5415 NULL, 0x0, "Size in bytes of BLOB", HFILL }},
5417 { &hf_netlogon_code,
5418 { "Code", "netlogon.code", FT_UINT32, BASE_HEX,
5419 NULL, 0x0, "Code", HFILL }},
5421 { &hf_netlogon_level_long,
5422 { "Level", "netlogon.level32", FT_UINT32, BASE_DEC,
5423 NULL, 0x0, "Which option of the union is represented here", HFILL }},
5425 { &hf_netlogon_timestamp,
5426 { "Timestamp", "netlogon.timestamp", FT_UINT32, BASE_HEX,
5427 NULL, 0x0, "Some sort of timestamp", HFILL }},
5429 { &hf_netlogon_user_rid,
5430 { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC,
5431 NULL, 0x0, "", HFILL }},
5433 { &hf_netlogon_alias_rid,
5434 { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC,
5435 NULL, 0x0, "", HFILL }},
5437 { &hf_netlogon_group_rid,
5438 { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC,
5439 NULL, 0x0, "", HFILL }},
5441 { &hf_netlogon_num_rids,
5442 { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC,
5443 NULL, 0x0, "Number of RIDs", HFILL }},
5445 { &hf_netlogon_num_other_groups,
5446 { "Num Other Groups", "netlogon.num_other_groups", FT_UINT32, BASE_DEC,
5447 NULL, 0x0, "", HFILL }},
5449 { &hf_netlogon_flags,
5450 { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX,
5451 NULL, 0x0, "", HFILL }},
5453 { &hf_netlogon_user_flags,
5454 { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX,
5455 NULL, 0x0, "", HFILL }},
5457 { &hf_netlogon_database_id,
5458 { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC,
5459 NULL, 0x0, "Database Id", HFILL }},
5461 { &hf_netlogon_max_size,
5462 { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC,
5463 NULL, 0x0, "Max Size of database", HFILL }},
5465 { &hf_netlogon_num_deltas,
5466 { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC,
5467 NULL, 0x0, "Number of SAM Deltas in array", HFILL }},
5469 { &hf_netlogon_logon_attempts,
5470 { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC,
5471 NULL, 0x0, "Number of logon attempts", HFILL }},
5473 { &hf_netlogon_logon_time,
5474 { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, BASE_NONE,
5475 NULL, 0, "Time for last time this user logged on", HFILL }},
5477 { &hf_netlogon_kickoff_time,
5478 { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5479 NULL, 0, "Time when this user will be kicked off", HFILL }},
5481 { &hf_netlogon_logoff_time,
5482 { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, BASE_NONE,
5483 NULL, 0, "Time for last time this user logged off", HFILL }},
5485 { &hf_netlogon_pwd_last_set_time,
5486 { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, BASE_NONE,
5487 NULL, 0, "Last time this users password was changed", HFILL }},
5489 { &hf_netlogon_pwd_can_change_time,
5490 { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5491 NULL, 0, "When this users password may be changed", HFILL }},
5493 { &hf_netlogon_pwd_must_change_time,
5494 { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, BASE_NONE,
5495 NULL, 0, "When this users password must be changed", HFILL }},
5499 static gint *ett[] = {
5500 &ett_dcerpc_netlogon,
5501 &ett_NETLOGON_SECURITY_DESCRIPTOR,
5505 &ett_NETLOGON_AUTHENTICATOR,
5506 &ett_NETLOGON_LOGON_IDENTITY_INFO,
5507 &ett_NETLOGON_INTERACTIVE_INFO,
5508 &ett_NETLOGON_NETWORK_INFO,
5509 &ett_NETLOGON_VALIDATION_SAM_INFO1,
5510 &ett_NETLOGON_VALIDATION_SAM_INFO2,
5512 &ett_NETLOGON_SAM_DOMAIN_INFO,
5513 &ett_NETLOGON_SAM_GROUP_INFO,
5515 &ett_NETLOGON_SAM_ACCOUNT_INFO,
5516 &ett_NETLOGON_SAM_GROUP_MEM_INFO,
5517 &ett_NETLOGON_SAM_ALIAS_INFO,
5518 &ett_NETLOGON_SAM_ALIAS_MEM_INFO,
5527 &ett_SAM_DELTA_ARRAY,
5529 &ett_NETLOGON_INFO_1,
5530 &ett_NETLOGON_INFO_2,
5531 &ett_NETLOGON_INFO_3,
5532 &ett_NETLOGON_INFO_4,
5534 &ett_DOMAIN_CONTROLLER_INFO,
5537 &ett_UNICODE_STRING_512,
5541 &ett_NETLOGON_LEVEL,
5542 &ett_NETLOGON_VALIDATION,
5544 &ett_NETLOGON_CONTROL_QUERY_INFO,
5550 &ett_NETLOGON_CREDENTIAL,
5552 &ett_ENC_LM_OWF_PASSWORD,
5553 &ett_LM_OWF_PASSWORD,
5554 &ett_NT_OWF_PASSWORD,
5555 &ett_GROUP_MEMBERSHIP,
5556 &ett_USER_SESSION_KEY,
5562 proto_dcerpc_netlogon = proto_register_protocol(
5563 "Microsoft Network Logon", "NETLOGON", "rpc_netlogon");
5565 proto_register_field_array(proto_dcerpc_netlogon, hf,
5567 proto_register_subtree_array(ett, array_length(ett));
5571 proto_reg_handoff_dcerpc_netlogon(void)
5573 /* Register protocol as dcerpc */
5575 dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon,
5576 &uuid_dcerpc_netlogon, ver_dcerpc_netlogon,
5577 dcerpc_netlogon_dissectors);