/* packet-dcerpc-lsa.c
* Routines for SMB \PIPE\lsarpc packet disassembly
- * Copyright 2001, Tim Potter <tpot@samba.org>
+ * Copyright 2001,2003 Tim Potter <tpot@samba.org>
* 2002 Added LSA command dissectors Ronnie Sahlberg
*
- * $Id: packet-dcerpc-lsa.c,v 1.26 2002/04/28 10:09:25 sahlberg Exp $
+ * $Id: packet-dcerpc-lsa.c,v 1.72 2003/02/08 09:41:43 guy Exp $
*
* Ethereal - Network traffic analyzer
* By Gerald Combs <gerald@ethereal.com>
* Copyright 1998 Gerald Combs
- *
+ *
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
- *
+ *
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
- *
+ *
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
static int proto_dcerpc_lsa = -1;
+static int hf_lsa_opnum = -1;
static int hf_lsa_rc = -1;
static int hf_lsa_hnd = -1;
static int hf_lsa_server = -1;
static int hf_lsa_paei_settings = -1;
static int hf_lsa_count = -1;
static int hf_lsa_size = -1;
+static int hf_lsa_size16 = -1;
+static int hf_lsa_size_needed = -1;
static int hf_lsa_max_count = -1;
static int hf_lsa_index = -1;
static int hf_lsa_domain = -1;
static int hf_lsa_quota_pagefile = -1;
static int hf_lsa_mod_seq_no = -1;
static int hf_lsa_mod_mtime = -1;
+static int hf_lsa_cur_mtime = -1;
+static int hf_lsa_old_mtime = -1;
static int hf_lsa_name = -1;
+static int hf_lsa_key = -1;
static int hf_lsa_flat_name = -1;
static int hf_lsa_forest = -1;
static int hf_lsa_info_type = -1;
static int hf_lsa_auth_type = -1;
static int hf_lsa_auth_len = -1;
static int hf_lsa_auth_blob = -1;
+static int hf_lsa_rights = -1;
+static int hf_lsa_remove_all = -1;
static int hf_lsa_unknown_hyper = -1;
static int hf_lsa_unknown_long = -1;
static int hf_lsa_unknown_short = -1;
static int hf_lsa_unknown_char = -1;
static int hf_lsa_unknown_string = -1;
+#ifdef LSA_UNUSED_HANDLES
static int hf_lsa_unknown_time = -1;
+#endif
static gint ett_dcerpc_lsa = -1;
static int
-lsa_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
+lsa_dissect_pointer_NTTIME(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ char *drep)
+{
+ dcerpc_info *di;
+
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect */
+ return offset;
+ }
+
+ offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, drep,
+ di->hf_index);
+
+ return offset;
+}
+
+static int
+lsa_dissect_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ char *drep)
+{
+ dcerpc_info *di;
+
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect */
+ return offset;
+ }
+
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ di->hf_index, 0);
+ return offset;
+}
+
+static int
+lsa_dissect_pointer_pointer_UNICODE_STRING(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
char *drep)
{
dcerpc_info *di;
return offset;
}
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- di->hf_index, di->levels);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
+ "DOMAIN pointer: ", di->hf_index);
+
return offset;
}
static int
-lsa_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
- packet_info *pinfo, proto_tree *tree,
+lsa_dissect_pointer_STRING(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
char *drep)
{
dcerpc_info *di;
return offset;
}
- offset = dissect_ndr_nt_STRING(tvb, offset, pinfo, tree, drep,
- di->hf_index, di->levels);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ di->hf_index, 0);
return offset;
}
static int
-lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
+lsa_dissect_LSA_SECRET_data(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
hf_lsa_sd_size, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_SECRET_data, NDR_POINTER_UNIQUE,
- "LSA SECRET data:", -1, 0);
+ "LSA SECRET data:", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
}
static int
-lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
+lsa_dissect_LSA_SECRET_pointer(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree,
+ char *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
+ "LSA_SECRET pointer: data", -1);
+
+ return offset;
+}
+
+/* Dissect LSA specific access rights */
+
+static gint hf_view_local_info = -1;
+static gint hf_view_audit_info = -1;
+static gint hf_get_private_info = -1;
+static gint hf_trust_admin = -1;
+static gint hf_create_account = -1;
+static gint hf_create_secret = -1;
+static gint hf_create_priv = -1;
+static gint hf_set_default_quota_limits = -1;
+static gint hf_set_audit_requirements = -1;
+static gint hf_server_admin = -1;
+static gint hf_lookup_names = -1;
+
+static void
+lsa_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree,
+ guint32 access)
+{
+ proto_tree_add_boolean(
+ tree, hf_lookup_names, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_server_admin, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_set_audit_requirements, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_set_default_quota_limits, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_create_priv, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_create_secret, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_create_account, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_trust_admin, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_get_private_info, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_view_audit_info, tvb, offset, 4, access);
+
+ proto_tree_add_boolean(
+ tree, hf_view_local_info, tvb, offset, 4, access);
+}
+
+int
+lsa_dissect_LSA_SECURITY_DESCRIPTOR_data(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree,
char *drep)
{
guint32 len;
dcerpc_info *di;
-
+
di=pinfo->private_data;
if(di->conformant_run){
/*just a run to handle conformant arrays, nothing to dissect */
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_lsa_sd_size, &len);
- dissect_nt_sec_desc(tvb, pinfo, offset, tree, len);
+ dissect_nt_sec_desc(
+ tvb, offset, pinfo, tree, drep, len, lsa_specific_rights);
+
offset += len;
return offset;
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_SECURITY_DESCRIPTOR_data, NDR_POINTER_UNIQUE,
- "LSA SECURITY DESCRIPTOR data:", -1, 0);
+ "LSA SECURITY DESCRIPTOR data:", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
lsa_dissect_ACCESS_MASK(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree, char *drep)
{
- /* XXX is this some bitmask ?*/
- offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
- hf_lsa_access_mask, NULL);
+ offset = dissect_nt_access_mask(
+ tvb, offset, pinfo, tree, drep, hf_lsa_access_mask,
+ lsa_specific_rights);
return offset;
}
packet_info *pinfo, proto_tree *tree, char *drep)
{
offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
- hf_lsa_hnd, NULL);
+ hf_lsa_hnd, NULL, FALSE, FALSE);
+
+ return offset;
+}
+
+static int
+lsa_dissect_LSA_HANDLE_open(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
+ hf_lsa_hnd, NULL, TRUE, FALSE);
+
+ return offset;
+}
+
+static int
+lsa_dissect_LSA_HANDLE_close(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_nt_policy_hnd(tvb, offset, pinfo, tree, drep,
+ hf_lsa_hnd, NULL, FALSE, TRUE);
return offset;
}
/* LPSTR */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LPSTR, NDR_POINTER_UNIQUE,
- "LSPTR pointer: ", -1, 0);
+ "LSPTR pointer: ", -1);
- /* attribute name */
+ /* attribute name */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_pointer_STRING, NDR_POINTER_UNIQUE,
- "NAME pointer: ", hf_lsa_obj_attr_name, 0);
+ "NAME pointer: ", hf_lsa_obj_attr_name);
/* Attr */
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
/* security descriptor */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
- "LSA_SECURITY_DESCRIPTOR pointer: ", -1, 0);
+ "LSA_SECURITY_DESCRIPTOR pointer: ", -1);
- /* security quality of service */
+ /* security quality of service */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_SECURITY_QUALITY_OF_SERVICE, NDR_POINTER_UNIQUE,
- "LSA_SECURITY_QUALITY_OF_SERVICE pointer: ", -1, 0);
+ "LSA_SECURITY_QUALITY_OF_SERVICE pointer: ", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
packet_info *pinfo, proto_tree *tree, char *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
- "LSA_HANDLE pointer: hnd", -1, 0);
+ lsa_dissect_LSA_HANDLE_close, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
return offset;
}
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
- "LSA_HANDLE pointer: hnd", -1, 0);
+ "LSA_HANDLE", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
character of the server name which is always '\'. This is fixed in lsa
openpolicy2 but the function remains for backwards compatibility. */
-static int dissect_lsa_openpolicy_server(tvbuff_t *tvb, int offset,
- packet_info *pinfo,
+static int dissect_lsa_openpolicy_server(tvbuff_t *tvb, int offset,
+ packet_info *pinfo,
proto_tree *tree, char *drep)
{
- return dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ return dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_lsa_server, NULL);
}
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
- "Server:", hf_lsa_server, 0);
+ "Server:", hf_lsa_server);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
- "", -1, 0);
+ "OBJECT_ATTRIBUTES", -1);
offset = lsa_dissect_ACCESS_MASK(tvb, offset,
pinfo, tree, drep);
return offset;
}
-
static int
lsa_dissect_lsaopenpolicy_reply(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree, char *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
- "LSA_HANDLE pointer: hnd", -1, 0);
+ lsa_dissect_LSA_HANDLE_open, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
lsa_dissect_lsaopenpolicy2_rqst(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree, char *drep)
{
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- dissect_ndr_nt_UNICODE_STRING_str, NDR_POINTER_UNIQUE,
- "Server", hf_lsa_server, 0);
+ offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, drep,
+ dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Server",
+ hf_lsa_server, cb_str_postprocess,
+ GINT_TO_POINTER(CB_STR_COL_INFO | CB_STR_SAVE | 1));
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_OBJECT_ATTRIBUTES, NDR_POINTER_REF,
- "", -1, 0);
+ "OBJECT_ATTRIBUTES", -1);
offset = lsa_dissect_ACCESS_MASK(tvb, offset,
pinfo, tree, drep);
packet_info *pinfo, proto_tree *tree, char *drep)
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
- "LSA_HANDLE pointer: hnd", -1, 0);
+ lsa_dissect_LSA_HANDLE_open, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
lsa_dissect_lsaqueryinformationpolicy_rqst(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree, char *drep)
{
+ guint16 level;
+
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
- "LSA_HANDLE pointer: hnd", -1, 0);
+ "LSA_HANDLE", -1);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_lsa_policy_information_class, NULL);
+ hf_lsa_policy_information_class, &level);
+
+ if (check_col(pinfo->cinfo, COL_INFO))
+ col_append_fstr(
+ pinfo->cinfo, COL_INFO, ", %s",
+ val_to_str(level, policy_information_class_vals,
+ "Unknown (%d)"));
return offset;
}
/* settings */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_POLICY_AUDIT_EVENTS_INFO_settings_array, NDR_POINTER_UNIQUE,
- "Settings", -1, 0);
+ "Settings", -1);
/* count */
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
}
/* domain */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_domain, 0);
/* sid */
}
/* account */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_acct, 0);
/* sid */
}
/* source */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_source, 0);
/* account */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_acct, 0);
proto_item_set_len(item, offset-old_offset);
}
-static int
+int
lsa_dissect_POLICY_DNS_DOMAIN_INFO(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *parent_tree, char *drep)
{
}
/* name */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_name, 0);
/* domain */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_domain, 0);
/* forest */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_forest, 0);
/* GUID */
ALIGN_TO_4_BYTES; /* all union arms aligned to 4 bytes, case 7 and 9 need this */
switch(level){
- case 1:
+ case 1:
offset = lsa_dissect_POLICY_AUDIT_LOG_INFO(
tvb, offset, pinfo, tree, drep);
break;
tvb, offset, pinfo, tree, drep);
break;
case 4:
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- hf_lsa_acct, 0);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo,
+ tree, drep, hf_lsa_acct, 0);
break;
case 5:
offset = lsa_dissect_POLICY_ACCOUNT_DOMAIN_INFO(
so we just ignore that one */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
- "POLICY_INFORMATION pointer: info", -1, 0);
+ "POLICY_INFORMATION pointer: info", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
- "LSA_HANDLE pointer: hnd", -1, 0);
+ "LSA_HANDLE", -1);
return offset;
}
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
- "LSA_SECURITY_DESCRIPTOR pointer: sec_info", -1, 0);
+ "LSA_SECURITY_DESCRIPTOR pointer: sec_info", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
- "LSA_SECURITY_DESCRIPTOR: sec_info", -1, 0);
+ "LSA_SECURITY_DESCRIPTOR: sec_info", -1);
return offset;
}
packet_info *pinfo, proto_tree *tree, char *drep)
{
/* server */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_server, 0);
/* domain */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_domain, 0);
/* account */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_acct, 0);
/* old password */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_old_pwd, 0);
/* new password */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_new_pwd, 0);
return offset;
hf_lsa_sid_type, NULL);
/* name */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_name, 0);
/* index */
/* settings */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRANSLATED_NAME_array, NDR_POINTER_UNIQUE,
- "TRANSLATED_NAME_ARRAY", -1, 0);
+ "TRANSLATED_NAME_ARRAY", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
- "", -1, 0);
+ "PSID_ARRAY", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
- "LSA_TRANSLATED_NAMES pointer: names", -1, 0);
+ "LSA_TRANSLATED_NAMES pointer: names", -1);
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
hf_lsa_info_level, NULL);
}
/* name */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_name, 0);
/* sid */
"Tree root is NOT set"
};
static int
-lsa_dissect_trust_attr(tvbuff_t *tvb, int offset, packet_info *pinfo,
+lsa_dissect_trust_attr(tvbuff_t *tvb, int offset, packet_info *pinfo,
proto_tree *parent_tree, char *drep)
{
guint32 mask;
}
/* name */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_name, 0);
/* flat name */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_flat_name, 0);
/* sid */
/* type */
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
hf_lsa_trust_type, NULL);
-
+
/* attributes */
offset = lsa_dissect_trust_attr(tvb, offset, pinfo, tree, drep);
/* auth info blob */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_auth_info_blob, NDR_POINTER_UNIQUE,
- "AUTH INFO blob:", -1, 0);
+ "AUTH INFO blob:", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
/* trust information */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRUST_INFORMATION_array, NDR_POINTER_UNIQUE,
- "TRUST INFORMATION array:", -1, 0);
+ "TRUST INFORMATION array:", -1);
/* max count */
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
- "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1, 0);
+ "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRANSLATED_NAMES, NDR_POINTER_REF,
- "LSA_TRANSLATED_NAMES pointer: names", -1, 0);
+ "LSA_TRANSLATED_NAMES pointer: names", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_num_mapped, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
- "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1, 0);
+ "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
return offset;
}
{
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_POLICY_DEFAULT_QUOTA_INFO, NDR_POINTER_REF,
- "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1, 0);
+ "POLICY_DEFAULT_QUOTA_INFO pointer: quotas", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
- "POLICY_INFORMATION pointer: info", -1, 0);
+ "POLICY_INFORMATION pointer: info", -1);
return offset;
}
tree = proto_item_add_subtree(item, ett_LSA_PRIVILEGE);
}
- /* privilege name */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ /* privilege name */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_privilege_name, 0);
/* LUID */
/* privileges */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_PRIVILEGE_array, NDR_POINTER_UNIQUE,
- "LSA_PRIVILEGE array:", -1, 0);
+ "LSA_PRIVILEGE array:", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_PRIVILEGES, NDR_POINTER_REF,
- "LSA_PRIVILEGES pointer: privs", -1, 0);
+ "LSA_PRIVILEGES pointer: privs", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
offset = lsa_dissect_LSA_HANDLE(tvb, offset,
pinfo, tree, drep);
- /* privilege name */
+ /* privilege name */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
- "NAME pointer: ", hf_lsa_privilege_name, 0);
+ "NAME pointer: ", hf_lsa_privilege_name);
return offset;
}
/* LUID */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_nt_LUID, NDR_POINTER_REF,
- "LUID pointer: value", -1, 0);
+ "LUID pointer: value", -1);
return offset;
}
/* [out, ref] LSA_UNICODE_STRING **name */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
- "PRIVILEGE NAME pointer:", hf_lsa_privilege_name, 0);
+ "PRIVILEGE NAME pointer:", hf_lsa_privilege_name);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
/* luid and attributes */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LUID_AND_ATTRIBUTES_array, NDR_POINTER_UNIQUE,
- "LUID_AND_ATTRIBUTES array:", -1, 0);
+ "LUID_AND_ATTRIBUTES array:", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
/* [out, ref] LUID_AND_ATTRIBUTES_ARRAY * *privs */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
- "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1, 0);
+ "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
/* [in, unique] LUID_AND_ATTRIBUTES_ARRAY *privs */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LUID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE,
- "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1, 0);
+ "LUID_AND_ATTRIBUTES_ARRAY pointer: privs", -1);
return offset;
}
/* [out, ref] PSID_ARRAY **accounts */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
- "", -1, 0);
+ "PSID_ARRAY", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
/* [in, ref] LSA_TRUST_INFORMATION *domain */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRUST_INFORMATION, NDR_POINTER_REF,
- "LSA_TRUST_INFORMATION pointer: domain", -1, 0);
+ "LSA_TRUST_INFORMATION pointer: domain", -1);
/* [in] ACCESS_MASK access */
offset = lsa_dissect_ACCESS_MASK(tvb, offset,
}
/* domain */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_domain, 0);
/* sid */
/* privileges */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRUSTED_DOMAIN_array, NDR_POINTER_UNIQUE,
- "TRUSTED_DOMAIN array:", -1, 0);
+ "TRUSTED_DOMAIN array:", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
/* [out, ref] LSA_REFERENCED_DOMAIN_LIST *domains */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRUSTED_DOMAIN_LIST, NDR_POINTER_REF,
- "LSA_TRUSTED_DOMAIN_LIST pointer: domains", -1, 0);
+ "LSA_TRUSTED_DOMAIN_LIST pointer: domains", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
return offset;
}
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
- di->hf_index, di->levels);
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ di->hf_index, 0);
return offset;
}
return offset;
}
+static int
+lsa_dissect_LSA_UNICODE_STRING_ARRAY(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ dcerpc_info *di;
+
+ di=pinfo->private_data;
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_count, NULL);
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
+ "UNICODE_STRING pointer: ", di->hf_index);
+
+ return offset;
+}
static int
lsa_dissect_LSA_TRANSLATED_SID(tvbuff_t *tvb, int offset,
/* settings */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRANSLATED_SIDS_array, NDR_POINTER_UNIQUE,
- "Translated SIDS", -1, 0);
+ "Translated SIDS", -1);
proto_item_set_len(item, offset-old_offset);
return offset;
/* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
- "Account pointer: names", hf_lsa_acct, 0);
+ "Account pointer: names", hf_lsa_acct);
/* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
- "LSA_TRANSLATED_SIDS pointer: rids", -1, 0);
+ "LSA_TRANSLATED_SIDS pointer: rids", -1);
/* [in] USHORT level */
offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
lsa_dissect_lsalookupnames_reply(tvbuff_t *tvb, int offset,
packet_info *pinfo, proto_tree *tree, char *drep)
{
- /* [out, ref] LSA_REFERENCED_DOMAIN_LIST *domains */
+ /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_REF,
- "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1, 0);
+ lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
+ "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
/* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
- "LSA_TRANSLATED_SIDS pointer: rids", -1, 0);
+ "LSA_TRANSLATED_SIDS pointer: rids", -1);
/* [in, out, ref] ULONG *num_mapped */
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
pinfo, tree, drep);
/* [in, ref] LSA_UNICODE_STRING *name */
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_name, 0);
/* [in] ACCESS_MASK access */
ALIGN_TO_4_BYTES; /* all union arms aligned to 4 bytes, case 7 and 9 need this */
switch(level){
- case 1:
- offset = dissect_ndr_nt_UNICODE_STRING(tvb, offset, pinfo, tree, drep,
+ case 1:
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
hf_lsa_domain, 0);
break;
case 2:
hf_lsa_count, NULL);
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_UNIQUE,
- "Controllers pointer: ", hf_lsa_controller, 0);
+ "Controllers pointer: ", hf_lsa_controller);
break;
case 3:
offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
/* [out, ref] TRUSTED_DOMAIN_INFORMATION *info */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
- "TRUSTED_DOMAIN_INFORMATION pointer: info", -1, 0);
+ "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
hf_lsa_rc, NULL);
/* [in, ref] TRUSTED_DOMAIN_INFORMATION *info */
offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
- "TRUSTED_DOMAIN_INFORMATION pointer: info", -1, 0);
+ "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
return offset;
}
return offset;
}
+static int
+lsa_dissect_lsaopensecret_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd_pol */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+ /* [in, ref] LSA_UNICODE_STRING *name */
+ offset = dissect_ndr_counted_string_cb(
+ tvb, offset, pinfo, tree, drep, hf_lsa_name,
+ cb_str_postprocess,
+ GINT_TO_POINTER(CB_STR_COL_INFO | 1));
-static dcerpc_sub_dissector dcerpc_lsa_dissectors[] = {
- { LSA_LSACLOSE, "LSACLOSE",
- lsa_dissect_lsaclose_rqst,
- lsa_dissect_lsaclose_reply },
- { LSA_LSADELETE, "LSADELETE",
- lsa_dissect_lsadelete_rqst,
- lsa_dissect_lsadelete_reply },
- { LSA_LSAENUMERATEPRIVILEGES, "LSAENUMERATEPRIVILEGES",
- lsa_dissect_lsaenumerateprivileges_rqst,
- lsa_dissect_lsaenumerateprivileges_reply },
- { LSA_LSAQUERYSECURITYOBJECT, "LSAQUERYSECURITYOBJECT",
- lsa_dissect_lsaquerysecurityobject_rqst,
- lsa_dissect_lsaquerysecurityobject_reply },
- { LSA_LSASETSECURITYOBJECT, "LSASETSECURITYOBJECT",
- lsa_dissect_lsasetsecurityobject_rqst,
- lsa_dissect_lsasetsecurityobject_reply },
- { LSA_LSACHANGEPASSWORD, "LSACHANGEPASSWORD",
- lsa_dissect_lsachangepassword_rqst,
- lsa_dissect_lsachangepassword_reply },
- { LSA_LSAOPENPOLICY, "LSAOPENPOLICY",
- lsa_dissect_lsaopenpolicy_rqst,
- lsa_dissect_lsaopenpolicy_reply },
- { LSA_LSAQUERYINFORMATIONPOLICY, "LSAQUERYINFORMATIONPOLICY",
- lsa_dissect_lsaqueryinformationpolicy_rqst,
- lsa_dissect_lsaqueryinformationpolicy_reply },
- { LSA_LSASETINFORMATIONPOLICY, "LSASETINFORMATIONPOLICY",
- lsa_dissect_lsasetinformationpolicy_rqst,
- lsa_dissect_lsasetinformationpolicy_reply },
- { LSA_LSACLEARAUDITLOG, "LSACLEARAUDITLOG",
- lsa_dissect_lsaclearauditlog_rqst,
- lsa_dissect_lsaclearauditlog_reply },
- { LSA_LSACREATEACCOUNT, "LSACREATEACCOUNT",
- NULL, NULL }, /* 0x0a */
-#ifdef REMOVED
- lsa_dissect_lsacreateaccount_rqst,
- lsa_dissect_lsacreateaccount_reply },
-#endif
- { LSA_LSAENUMERATEACCOUNTS, "LSAENUMERATEACCOUNTS",
- lsa_dissect_lsaenumerateaccounts_rqst,
- lsa_dissect_lsaenumerateaccounts_reply },
- { LSA_LSACREATETRUSTEDDOMAIN, "LSACREATETRUSTEDDOMAIN",
- lsa_dissect_lsacreatetrusteddomain_rqst,
- lsa_dissect_lsacreatetrusteddomain_reply },
- { LSA_LSAENUMERATETRUSTEDDOMAINS, "LSAENUMERATETRUSTEDDOMAINS",
- lsa_dissect_lsaenumeratetrusteddomains_rqst,
- lsa_dissect_lsaenumeratetrusteddomains_reply },
- { LSA_LSALOOKUPNAMES, "LSALOOKUPNAMES",
- lsa_dissect_lsalookupnames_rqst,
- lsa_dissect_lsalookupnames_reply },
- { LSA_LSALOOKUPSIDS, "LSALOOKUPSIDS",
- lsa_dissect_lsalookupsids_rqst,
- lsa_dissect_lsalookupsids_reply },
- { LSA_LSACREATESECRET, "LSACREATESECRET", /*0x10*/
- lsa_dissect_lsacreatesecret_rqst,
- lsa_dissect_lsacreatesecret_reply },
- { LSA_LSAOPENACCOUNT, "LSAOPENACCOUNT",
- lsa_dissect_lsaopenaccount_rqst,
- lsa_dissect_lsaopenaccount_reply },
- { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "LSAENUMERATEPRIVILEGESACCOUNT",
- lsa_dissect_lsaenumerateprivilegesaccount_rqst,
- lsa_dissect_lsaenumerateprivilegesaccount_reply },
- { LSA_LSAADDPRIVILEGESTOACCOUNT, "LSAADDPRIVILEGESTOACCOUNT",
- lsa_dissect_lsaaddprivilegestoaccount_rqst,
- lsa_dissect_lsaaddprivilegestoaccount_reply },
- { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "LSAREMOVEPRIVILEGESFROMACCOUNT",
- lsa_dissect_lsaremoveprivilegesfromaccount_rqst,
- lsa_dissect_lsaremoveprivilegesfromaccount_reply },
- { LSA_LSAGETQUOTASFORACCOUNT, "LSAGETQUOTASFORACCOUNT",
- lsa_dissect_lsagetquotasforaccount_rqst,
- lsa_dissect_lsagetquotasforaccount_reply },
- { LSA_LSASETQUOTASFORACCOUNT, "LSASETQUOTASFORACCOUNT",
- lsa_dissect_lsasetquotasforaccount_rqst,
- lsa_dissect_lsasetquotasforaccount_reply },
- { LSA_LSAGETSYSTEMACCESSACCOUNT, "LSAGETSYSTEMACCESSACCOUNT",
- lsa_dissect_lsagetsystemaccessaccount_rqst,
- lsa_dissect_lsagetsystemaccessaccount_reply },
- { LSA_LSASETSYSTEMACCESSACCOUNT, "LSASETSYSTEMACCESSACCOUNT",
- lsa_dissect_lsasetsystemaccessaccount_rqst,
- lsa_dissect_lsasetsystemaccessaccount_reply },
- { LSA_LSAOPENTRUSTEDDOMAIN, "LSAOPENTRUSTEDDOMAIN",
- lsa_dissect_lsaopentrusteddomain_rqst,
- lsa_dissect_lsaopentrusteddomain_reply },
- { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "LSAQUERYINFOTRUSTEDDOMAIN",
- lsa_dissect_lsaqueryinfotrusteddomain_rqst,
- lsa_dissect_lsaqueryinfotrusteddomain_reply },
- { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "LSASETINFORMATIONTRUSTEDDOMAIN",
- lsa_dissect_lsasetinformationtrusteddomain_rqst,
- lsa_dissect_lsasetinformationtrusteddomain_reply },
- { LSA_LSAOPENSECRET, "LSAOPENSECRET",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaopensecret_rqst,
- lsa_dissect_lsaopensecret_reply },
-#endif
- { LSA_LSASETSECRET, "LSASETSECRET",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsasetsecret_rqst,
- lsa_dissect_lsasetsecret_reply },
-#endif
- { LSA_LSAQUERYSECRET, "LSAQUERYSECRET",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaquerysecret_rqst,
- lsa_dissect_lsaquerysecret_reply },
-#endif
- { LSA_LSALOOKUPPRIVILEGEVALUE, "LSALOOKUPPRIVILEGEVALUE",
- lsa_dissect_lsalookupprivilegevalue_rqst,
- lsa_dissect_lsalookupprivilegevalue_reply },
- { LSA_LSALOOKUPPRIVILEGENAME, "LSALOOKUPPRIVILEGENAME",
- lsa_dissect_lsalookupprivilegename_rqst,
- lsa_dissect_lsalookupprivilegename_reply },
- { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LSALOOKUPPRIVILEGEDISPLAYNAME",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsalookupprivilegedisplayname_rqst,
- lsa_dissect_lsalookupprivilegedisplayname_reply },
-#endif
- { LSA_LSADELETEOBJECT, "LSADELETEOBJECT",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsadeleteobject_rqst,
- lsa_dissect_lsadeleteobject_reply },
-#endif
- { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "LSAENUMERATEACCOUNTSWITHUSERRIGHT",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaenumerateaccountswithuserright_rqst,
- lsa_dissect_lsaenumerateaccountswithuserright_reply },
-#endif
- { LSA_LSAENUMERATEACCOUNTRIGHTS, "LSAENUMERATEACCOUNTRIGHTS",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaenumerateaccountrights_rqst,
- lsa_dissect_lsaenumerateaccountrights_reply },
-#endif
- { LSA_LSAADDACCOUNTRIGHTS, "LSAADDACCOUNTRIGHTS",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaaddaccountrights_rqst,
- lsa_dissect_lsaaddaccountrights_reply },
-#endif
- { LSA_LSAREMOVEACCOUNTRIGHTS, "LSAREMOVEACCOUNTRIGHTS",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaremoveaccountrights_rqst,
- lsa_dissect_lsaremoveaccountrights_reply },
-#endif
- { LSA_LSAQUERYTRUSTEDDOMAININFO, "LSAQUERYTRUSTEDDOMAININFO",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaquerytrusteddomaininfo_rqst,
- lsa_dissect_lsaquerytrusteddomaininfo_reply },
-#endif
- { LSA_LSASETTRUSTEDDOMAININFO, "LSASETTRUSTEDDOMAININFO",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsasettrusteddomaininfo_rqst,
- lsa_dissect_lsasettrusteddomaininfo_reply },
-#endif
- { LSA_LSADELETETRUSTEDDOMAIN, "LSADELETETRUSTEDDOMAIN",
- lsa_dissect_lsadeletetrusteddomain_rqst,
- lsa_dissect_lsadeletetrusteddomain_reply },
- { LSA_LSASTOREPRIVATEDATA, "LSASTOREPRIVATEDATA",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsastoreprivatedata_rqst,
- lsa_dissect_lsastoreprivatedata_reply },
-#endif
- { LSA_LSARETRIEVEPRIVATEDATA, "LSARETRIEVEPRIVATEDATA",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaretrieveprivatedata_rqst,
- lsa_dissect_lsaretrieveprivatedata_reply },
-#endif
- { LSA_LSAOPENPOLICY2, "LSAOPENPOLICY2",
- lsa_dissect_lsaopenpolicy2_rqst,
- lsa_dissect_lsaopenpolicy2_reply },
- { LSA_LSAGETUSERNAME, "LSAGETUSERNAME",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsagetusername_rqst,
- lsa_dissect_lsagetusername_reply },
-#endif
- { LSA_LSAFUNCTION_2E, "LSAFUNCTION_2E",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsafunction_2e_rqst,
- lsa_dissect_lsafunction_2e_reply },
-#endif
- { LSA_LSAFUNCTION_2F, "LSAFUNCTION_2F",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsafunction_2f_rqst,
- lsa_dissect_lsafunction_2f_reply },
-#endif
- { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "LSAQUERYTRUSTEDDOMAININFOBYNAME",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaquerytrusteddomaininfobyname_rqst,
- lsa_dissect_lsaquerytrusteddomaininfobyname_reply },
-#endif
- { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "LSASETTRUSTEDDOMAININFOBYNAME",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsasettrusteddomaininfobyname_rqst,
- lsa_dissect_lsasettrusteddomaininfobyname_reply },
-#endif
- { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "LSAENUMERATETRUSTEDDOMAINSEX",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaenumeratetrusteddomainsex_rqst,
- lsa_dissect_lsaenumeratetrusteddomainsex_reply },
-#endif
- { LSA_LSACREATETRUSTEDDOMAINEX, "LSACREATETRUSTEDDOMAINEX",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsacreatetrusteddomainex_rqst,
- lsa_dissect_lsacreatetrusteddomainex_reply },
-#endif
- { LSA_LSACLOSETRUSTEDDOMAINEX, "LSACLOSETRUSTEDDOMAINEX",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaclosetrusteddomainex_rqst,
- lsa_dissect_lsaclosetrusteddomainex_reply },
-#endif
- { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "LSAQUERYDOMAININFORMATIONPOLICY",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaquerydomaininformationpolicy_rqst,
- lsa_dissect_lsaquerydomaininformationpolicy_reply },
-#endif
- { LSA_LSASETDOMAININFORMATIONPOLICY, "LSASETDOMAININFORMATIONPOLICY",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsasetdomaininformationpolicy_rqst,
- lsa_dissect_lsasetdomaininformationpolicy_reply },
-#endif
- { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "LSAOPENTRUSTEDDOMAINBYNAME",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsaopentrusteddomainbyname_rqst,
- lsa_dissect_lsaopentrusteddomainbyname_reply },
-#endif
- { LSA_LSAFUNCTION_38, "LSAFUNCTION_38",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsafunction_38_rqst,
- lsa_dissect_lsafunction_38_reply },
-#endif
- { LSA_LSALOOKUPSIDS2, "LSALOOKUPSIDS2",
- NULL, NULL },
-#ifdef REMOVED
- lsa_dissect_lsalookupsids2_rqst,
- lsa_dissect_lsalookupsids2_reply },
-#endif
- { LSA_LSALOOKUPNAMES2, "LSALOOKUPNAMES2",
- NULL, NULL },
-#ifdef REMOVED
+ /* [in] ACCESS_MASK access */
+ offset = lsa_dissect_ACCESS_MASK(tvb, offset,
+ pinfo, tree, drep);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaopensecret_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out] LSA_HANDLE *hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsasetsecret_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, unique] LSA_SECRET *new_val */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
+ "LSA_SECRET pointer: new_val", -1);
+
+ /* [in, unique] LSA_SECRET *old_val */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
+ "LSA_SECRET pointer: old_val", -1);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsasetsecret_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaquerysecret_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, out, unique] LSA_SECRET **curr_val */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
+ "LSA_SECRET pointer: curr_val", -1);
+
+ /* [in, out, unique] LARGE_INTEGER *curr_mtime */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
+ "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
+
+ /* [in, out, unique] LSA_SECRET **old_val */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
+ "LSA_SECRET pointer: old_val", -1);
+
+ /* [in, out, unique] LARGE_INTEGER *old_mtime */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
+ "NTIME pointer: old_mtime", hf_lsa_old_mtime);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaquerysecret_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in, out, unique] LSA_SECRET **curr_val */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
+ "LSA_SECRET pointer: curr_val", -1);
+
+ /* [in, out, unique] LARGE_INTEGER *curr_mtime */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
+ "NTIME pointer: old_mtime", hf_lsa_cur_mtime);
+
+ /* [in, out, unique] LSA_SECRET **old_val */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET, NDR_POINTER_UNIQUE,
+ "LSA_SECRET pointer: old_val", -1);
+
+ /* [in, out, unique] LARGE_INTEGER *old_mtime */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_NTTIME, NDR_POINTER_UNIQUE,
+ "NTIME pointer: old_mtime", hf_lsa_old_mtime);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsadeleteobject_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsadeleteobject_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaenumerateaccountswithuserright_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, unique] LSA_UNICODE_STRING *rights */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
+ "LSA_UNICODE_STRING pointer: rights", hf_lsa_rights);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaenumerateaccountswithuserright_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out, ref] LSA_UNICODE_STRING_ARRAY *accounts */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
+ "Account pointer: names", hf_lsa_acct);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaenumerateaccountrights_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] SID *account */
+ offset = dissect_ndr_nt_SID(tvb, offset,
+ pinfo, tree, drep);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaenumerateaccountrights_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out, ref] LSA_UNICODE_STRING_ARRAY *rights */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
+ "Account pointer: rights", hf_lsa_rights);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaaddaccountrights_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] SID *account */
+ offset = dissect_ndr_nt_SID(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
+ "Account pointer: rights", hf_lsa_rights);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaaddaccountrights_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaremoveaccountrights_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] SID *account */
+ offset = dissect_ndr_nt_SID(tvb, offset,
+ pinfo, tree, drep);
+
+ /* remove all */
+ offset = dissect_ndr_uint8 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_remove_all, NULL);
+
+ /* [in, ref] LSA_UNICODE_STRING_ARRAY *rights */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_UNICODE_STRING_ARRAY, NDR_POINTER_REF,
+ "Account pointer: rights", hf_lsa_rights);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaremoveaccountrights_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaquerytrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE handle */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] LSA_UNICODE_STRING *name */
+ /* domain */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_lsa_domain, 0);
+
+ /* [in] TRUSTED_INFORMATION_CLASS level */
+ offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_trusted_info_level, NULL);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaquerytrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
+ "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsasettrusteddomaininfobyname_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE handle */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] LSA_UNICODE_STRING *name */
+ /* domain */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_lsa_domain, 0);
+
+ /* [in] TRUSTED_INFORMATION_CLASS level */
+ offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_trusted_info_level, NULL);
+
+ /* [in, ref] TRUSTED_DOMAIN_INFORMATION *info) */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
+ "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsasettrusteddomaininfobyname_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaquerytrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE handle */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] SID *sid */
+ offset = dissect_ndr_nt_SID(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in] TRUSTED_INFORMATION_CLASS level */
+ offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_trusted_info_level, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaopentrusteddomainbyname_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE handle */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] LSA_UNICODE_STRING *name */
+ /* domain */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_lsa_domain, 0);
+
+ /* [in] ACCESS_MASK access */
+ offset = lsa_dissect_ACCESS_MASK(tvb, offset,
+ pinfo, tree, drep);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaopentrusteddomainbyname_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out] LSA_HANDLE handle */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+
+
+static int
+lsa_dissect_lsaquerytrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out, ref] TRUSTED_DOMAIN_INFORMATION *info) */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
+ "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsasettrusteddomaininfo_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE handle */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] SID *sid */
+ offset = dissect_ndr_nt_SID(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in] TRUSTED_INFORMATION_CLASS level */
+ offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_trusted_info_level, NULL);
+
+ /* [ref, ref] TRUSTED_DOMAIN_INFORMATION *info) */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_TRUSTED_DOMAIN_INFORMATION, NDR_POINTER_REF,
+ "TRUSTED_DOMAIN_INFORMATION pointer: info", -1);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsasettrusteddomaininfo_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaqueryinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_policy_information_class, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaqueryinformationpolicy2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* This is really a pointer to a pointer though the first level is REF
+ so we just ignore that one */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_POLICY_INFORMATION, NDR_POINTER_UNIQUE,
+ "POLICY_INFORMATION pointer: info", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsasetinformationpolicy2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_policy_information_class, NULL);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
+ "POLICY_INFORMATION pointer: info", -1);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsasetinformationpolicy2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaquerydomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_policy_information_class, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaquerydomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
+ "POLICY_INFORMATION pointer: info", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsasetdomaininformationpolicy_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_policy_information_class, NULL);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_POLICY_INFORMATION, NDR_POINTER_REF,
+ "POLICY_INFORMATION pointer: info", -1);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsasetdomaininformationpolicy_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsalookupnames2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in] ULONG count */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_count, NULL);
+
+ /* [in, size_is(count), ref] LSA_UNICODE_STRING *names */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_UNICODE_STRING_array, NDR_POINTER_REF,
+ "Account pointer: names", hf_lsa_acct);
+
+ /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
+ "LSA_TRANSLATED_SIDS pointer: rids", -1);
+
+ /* [in] USHORT level */
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_info_level, NULL);
+
+ /* [in, out, ref] ULONG *num_mapped */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_num_mapped, NULL);
+
+ /* unknown */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_unknown_long, NULL);
+
+ /* unknown */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_unknown_long, NULL);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsalookupnames2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out] LSA_REFERENCED_DOMAIN_LIST *domains */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
+ "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
+
+ /* [in, out, ref] LSA_TRANSLATED_SIDS *rids */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRANSLATED_SIDS, NDR_POINTER_REF,
+ "LSA_TRANSLATED_SIDS pointer: rids", -1);
+
+ /* [in, out, ref] ULONG *num_mapped */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_num_mapped, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsacreateaccount_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = dissect_ndr_nt_SID(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = lsa_dissect_ACCESS_MASK(tvb, offset,
+ pinfo, tree, drep);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsacreateaccount_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsalookupprivilegedisplayname_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] LSA_UNICODE_STRING *name */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_lsa_name, 0);
+
+ /* [in] USHORT unknown */
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_unknown_short, NULL);
+
+ /* [in] USHORT size */
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_size16, NULL);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsalookupprivilegedisplayname_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out, ref] LSA_UNICODE_STRING **disp_name */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
+ "NAME pointer: ", hf_lsa_privilege_name);
+
+ /* [out, ref] USHORT *size_needed */
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_size_needed, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsastoreprivatedata_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] LSA_UNICODE_STRING *key */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_lsa_key, 0);
+
+ /* [in, unique] LSA_SECRET **data */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_UNIQUE,
+ "LSA_SECRET* pointer: data", -1);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsastoreprivatedata_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaretrieveprivatedata_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] LSA_UNICODE_STRING *key */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_lsa_key, 0);
+
+ /* [in, out, ref] LSA_SECRET **data */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
+ "LSA_SECRET* pointer: data", -1);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaretrieveprivatedata_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in, out, ref] LSA_SECRET **data */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECRET_pointer, NDR_POINTER_REF,
+ "LSA_SECRET* pointer: data", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaclosetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+
+ /* [in, out] LSA_HANDLE *tdHnd */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsaclosetrusteddomainex_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+
+ /* [in, out] LSA_HANDLE *tdHnd */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_HANDLE, NDR_POINTER_REF,
+ "LSA_HANDLE", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_LSA_TRANSLATED_NAME_EX(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *parent_tree, char *drep)
+{
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, -1,
+ "LSA_TRANSLATED_NAME:");
+ tree = proto_item_add_subtree(item, ett_lsa_translated_name);
+ }
+
+ /* sid type */
+ offset = dissect_ndr_uint16 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_sid_type, NULL);
+
+ /* name */
+ offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+ hf_lsa_name, 0);
+
+ /* index */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_index, NULL);
+
+ /* unknown */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_unknown_long, NULL);
+
+ proto_item_set_len(item, offset-old_offset);
+ return offset;
+}
+
+static int
+lsa_dissect_LSA_TRANSLATED_NAME_EX_array(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRANSLATED_NAME_EX);
+
+ return offset;
+}
+static int
+lsa_dissect_LSA_TRANSLATED_NAMES_EX(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* count */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_count, NULL);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRANSLATED_NAME_EX_array, NDR_POINTER_UNIQUE,
+ "LSA_TRANSLATED_NAME_EX: pointer", -1);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsalookupsids2_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ dissect_ndr_nt_PSID_ARRAY, NDR_POINTER_REF,
+ "PSID_ARRAY", -1);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
+ "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_info_level, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_num_mapped, NULL);
+
+ /* unknown */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_unknown_long, NULL);
+
+ /* unknown */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_unknown_long, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsalookupsids2_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_REFERENCED_DOMAIN_LIST, NDR_POINTER_UNIQUE,
+ "LSA_REFERENCED_DOMAIN_LIST pointer: domains", -1);
+
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRANSLATED_NAMES_EX, NDR_POINTER_REF,
+ "LSA_TRANSLATED_NAMES_EX pointer: names", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_num_mapped, NULL);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsagetusername_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+
+ /* [in, unique, string] WCHAR *server */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ dissect_lsa_openpolicy_server, NDR_POINTER_UNIQUE,
+ "Server:", hf_lsa_server);
+
+ /* [in, out, ref] LSA_UNICODE_STRING **user */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
+ "ACCOUNT pointer: ", hf_lsa_acct);
+
+ /* [in, out, unique] LSA_UNICODE_STRING **domain */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
+ "DOMAIN pointer: ", hf_lsa_domain);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsagetusername_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in, out, ref] LSA_UNICODE_STRING **user */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
+ "ACCOUNT pointer: ", hf_lsa_acct);
+
+ /* [in, out, unique] LSA_UNICODE_STRING **domain */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_pointer_pointer_UNICODE_STRING, NDR_POINTER_UNIQUE,
+ "DOMAIN pointer: ", hf_lsa_domain);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsacreatetrusteddomainex_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
+ "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
+
+ /* [in, ref] TRUSTED_DOMAIN_AUTH_INFORMATION *auth */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRUSTED_DOMAIN_AUTH_INFORMATION, NDR_POINTER_REF,
+ "TRUSTED_DOMAIN_AUTH_INFORMATION pointer: auth", -1);
+
+ /* [in] ACCESS_MASK mask */
+ offset = lsa_dissect_ACCESS_MASK(tvb, offset,
+ pinfo, tree, drep);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsacreatetrusteddomainex_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out] LSA_HANDLE *tdHnd) */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_resume_handle, NULL);
+
+ /* [in] ULONG pref_maxlen */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_max_count, NULL);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRUST_INFORMATION_EX);
+
+ return offset;
+}
+
+static int
+lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* count */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_count, NULL);
+
+ /* trust information */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_EX_array, NDR_POINTER_UNIQUE,
+ "TRUST INFORMATION array:", -1);
+
+ /* max count */
+ offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, drep,
+ hf_lsa_max_count, NULL);
+
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsaenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in, out, ref] LSA_ENUMERATION_HANDLE *resume_hnd */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_resume_handle, NULL);
+
+ /* [out, ref] TRUSTED_DOMAIN_INFORMATION_LIST_EX *domains */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRUSTED_DOMAIN_INFORMATION_LIST_EX, NDR_POINTER_REF,
+ "TRUSTED_DOMAIN_INFORMATION_LIST_EX pointer: domains", -1);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsafunction_38_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE handle */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in] USHORT flag */
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_lsa_unknown_short, NULL);
+
+ /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
+ "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsafunction_38_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out, ref] LSA_SECURITY_DESCRIPTOR **psd) */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_UNIQUE,
+ "LSA_SECURITY_DESCRIPTOR pointer: psd)", -1);
+
+ return offset;
+}
+
+static int
+lsa_dissect_lsafunction_3b_rqst(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [in] LSA_HANDLE hnd */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ /* [in, ref] TRUSTED_DOMAIN_INFORMATION_EX *info */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_TRUST_INFORMATION_EX, NDR_POINTER_REF,
+ "TRUSTED_DOMAIN_INFORMATION_EX pointer: info", -1);
+
+ /* [in, ref] LSA_SECURITY_DESCRIPTOR *sd */
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ lsa_dissect_LSA_SECURITY_DESCRIPTOR, NDR_POINTER_REF,
+ "LSA_SECURITY_DESCRIPTOR pointer: sd", -1);
+
+ /* [in] ULONG unknown */
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_unknown_long, NULL);
+
+ return offset;
+}
+
+
+static int
+lsa_dissect_lsafunction_3b_reply(tvbuff_t *tvb, int offset,
+ packet_info *pinfo, proto_tree *tree, char *drep)
+{
+ /* [out] LSA_HANDLE *h2) */
+ offset = lsa_dissect_LSA_HANDLE(tvb, offset,
+ pinfo, tree, drep);
+
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_lsa_rc, NULL);
+
+ return offset;
+}
+
+
+static dcerpc_sub_dissector dcerpc_lsa_dissectors[] = {
+ { LSA_LSACLOSE, "Close",
+ lsa_dissect_lsaclose_rqst,
+ lsa_dissect_lsaclose_reply },
+ { LSA_LSADELETE, "Delete",
+ lsa_dissect_lsadelete_rqst,
+ lsa_dissect_lsadelete_reply },
+ { LSA_LSAENUMERATEPRIVILEGES, "EnumPrivs",
+ lsa_dissect_lsaenumerateprivileges_rqst,
+ lsa_dissect_lsaenumerateprivileges_reply },
+ { LSA_LSAQUERYSECURITYOBJECT, "QuerySecObject",
+ lsa_dissect_lsaquerysecurityobject_rqst,
+ lsa_dissect_lsaquerysecurityobject_reply },
+ { LSA_LSASETSECURITYOBJECT, "SetSecObject",
+ lsa_dissect_lsasetsecurityobject_rqst,
+ lsa_dissect_lsasetsecurityobject_reply },
+ { LSA_LSACHANGEPASSWORD, "ChangePassword",
+ lsa_dissect_lsachangepassword_rqst,
+ lsa_dissect_lsachangepassword_reply },
+ { LSA_LSAOPENPOLICY, "OpenPolicy",
+ lsa_dissect_lsaopenpolicy_rqst,
+ lsa_dissect_lsaopenpolicy_reply },
+ { LSA_LSAQUERYINFORMATIONPOLICY, "QueryInfoPolicy",
+ lsa_dissect_lsaqueryinformationpolicy_rqst,
+ lsa_dissect_lsaqueryinformationpolicy_reply },
+ { LSA_LSASETINFORMATIONPOLICY, "SetInfoPolicy",
+ lsa_dissect_lsasetinformationpolicy_rqst,
+ lsa_dissect_lsasetinformationpolicy_reply },
+ { LSA_LSACLEARAUDITLOG, "ClearAuditLog",
+ lsa_dissect_lsaclearauditlog_rqst,
+ lsa_dissect_lsaclearauditlog_reply },
+ { LSA_LSACREATEACCOUNT, "CreateAccount",
+ lsa_dissect_lsacreateaccount_rqst,
+ lsa_dissect_lsacreateaccount_reply },
+ { LSA_LSAENUMERATEACCOUNTS, "EnumAccounts",
+ lsa_dissect_lsaenumerateaccounts_rqst,
+ lsa_dissect_lsaenumerateaccounts_reply },
+ { LSA_LSACREATETRUSTEDDOMAIN, "CreateTrustedDomain",
+ lsa_dissect_lsacreatetrusteddomain_rqst,
+ lsa_dissect_lsacreatetrusteddomain_reply },
+ { LSA_LSAENUMERATETRUSTEDDOMAINS, "EnumTrustedDomains",
+ lsa_dissect_lsaenumeratetrusteddomains_rqst,
+ lsa_dissect_lsaenumeratetrusteddomains_reply },
+ { LSA_LSALOOKUPNAMES, "LookupNames",
+ lsa_dissect_lsalookupnames_rqst,
+ lsa_dissect_lsalookupnames_reply },
+ { LSA_LSALOOKUPSIDS, "LookupSIDs",
+ lsa_dissect_lsalookupsids_rqst,
+ lsa_dissect_lsalookupsids_reply },
+ { LSA_LSACREATESECRET, "CreateSecret",
+ lsa_dissect_lsacreatesecret_rqst,
+ lsa_dissect_lsacreatesecret_reply },
+ { LSA_LSAOPENACCOUNT, "OpenAccount",
+ lsa_dissect_lsaopenaccount_rqst,
+ lsa_dissect_lsaopenaccount_reply },
+ { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "EnumPrivsAccount",
+ lsa_dissect_lsaenumerateprivilegesaccount_rqst,
+ lsa_dissect_lsaenumerateprivilegesaccount_reply },
+ { LSA_LSAADDPRIVILEGESTOACCOUNT, "AddPrivsToAccount",
+ lsa_dissect_lsaaddprivilegestoaccount_rqst,
+ lsa_dissect_lsaaddprivilegestoaccount_reply },
+ { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "MovePrivsFromAccount",
+ lsa_dissect_lsaremoveprivilegesfromaccount_rqst,
+ lsa_dissect_lsaremoveprivilegesfromaccount_reply },
+ { LSA_LSAGETQUOTASFORACCOUNT, "GetQuotasForAccount",
+ lsa_dissect_lsagetquotasforaccount_rqst,
+ lsa_dissect_lsagetquotasforaccount_reply },
+ { LSA_LSASETQUOTASFORACCOUNT, "SetQuotasForAccount",
+ lsa_dissect_lsasetquotasforaccount_rqst,
+ lsa_dissect_lsasetquotasforaccount_reply },
+ { LSA_LSAGETSYSTEMACCESSACCOUNT, "GetSystemAccessAccount",
+ lsa_dissect_lsagetsystemaccessaccount_rqst,
+ lsa_dissect_lsagetsystemaccessaccount_reply },
+ { LSA_LSASETSYSTEMACCESSACCOUNT, "SetSystemAccessAccount",
+ lsa_dissect_lsasetsystemaccessaccount_rqst,
+ lsa_dissect_lsasetsystemaccessaccount_reply },
+ { LSA_LSAOPENTRUSTEDDOMAIN, "OpenTrustedDomain",
+ lsa_dissect_lsaopentrusteddomain_rqst,
+ lsa_dissect_lsaopentrusteddomain_reply },
+ { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "QueryInfoTrustedDomain",
+ lsa_dissect_lsaqueryinfotrusteddomain_rqst,
+ lsa_dissect_lsaqueryinfotrusteddomain_reply },
+ { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "SetInfoTrustedDomain",
+ lsa_dissect_lsasetinformationtrusteddomain_rqst,
+ lsa_dissect_lsasetinformationtrusteddomain_reply },
+ { LSA_LSAOPENSECRET, "OpenSecret",
+ lsa_dissect_lsaopensecret_rqst,
+ lsa_dissect_lsaopensecret_reply },
+ { LSA_LSASETSECRET, "SetSecret",
+ lsa_dissect_lsasetsecret_rqst,
+ lsa_dissect_lsasetsecret_reply },
+ { LSA_LSAQUERYSECRET, "QuerySecret",
+ lsa_dissect_lsaquerysecret_rqst,
+ lsa_dissect_lsaquerysecret_reply },
+ { LSA_LSALOOKUPPRIVILEGEVALUE, "LookupPrivValue",
+ lsa_dissect_lsalookupprivilegevalue_rqst,
+ lsa_dissect_lsalookupprivilegevalue_reply },
+ { LSA_LSALOOKUPPRIVILEGENAME, "LookupPrivName",
+ lsa_dissect_lsalookupprivilegename_rqst,
+ lsa_dissect_lsalookupprivilegename_reply },
+ { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LookupPrivDispName",
+ lsa_dissect_lsalookupprivilegedisplayname_rqst,
+ lsa_dissect_lsalookupprivilegedisplayname_reply },
+ { LSA_LSADELETEOBJECT, "DeleteObject",
+ lsa_dissect_lsadeleteobject_rqst,
+ lsa_dissect_lsadeleteobject_reply },
+ { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "EnumAccountsWithUserRight",
+ lsa_dissect_lsaenumerateaccountswithuserright_rqst,
+ lsa_dissect_lsaenumerateaccountswithuserright_reply },
+ { LSA_LSAENUMERATEACCOUNTRIGHTS, "EnumAccountRights",
+ lsa_dissect_lsaenumerateaccountrights_rqst,
+ lsa_dissect_lsaenumerateaccountrights_reply },
+ { LSA_LSAADDACCOUNTRIGHTS, "AddAccountRights",
+ lsa_dissect_lsaaddaccountrights_rqst,
+ lsa_dissect_lsaaddaccountrights_reply },
+ { LSA_LSAREMOVEACCOUNTRIGHTS, "RemoveAccountRights",
+ lsa_dissect_lsaremoveaccountrights_rqst,
+ lsa_dissect_lsaremoveaccountrights_reply },
+ { LSA_LSAQUERYTRUSTEDDOMAININFO, "QueryTrustedDomainInfo",
+ lsa_dissect_lsaquerytrusteddomaininfo_rqst,
+ lsa_dissect_lsaquerytrusteddomaininfo_reply },
+ { LSA_LSASETTRUSTEDDOMAININFO, "SetTrustedDomainInfo",
+ lsa_dissect_lsasettrusteddomaininfo_rqst,
+ lsa_dissect_lsasettrusteddomaininfo_reply },
+ { LSA_LSADELETETRUSTEDDOMAIN, "DeleteTrsutedDomain",
+ lsa_dissect_lsadeletetrusteddomain_rqst,
+ lsa_dissect_lsadeletetrusteddomain_reply },
+ { LSA_LSASTOREPRIVATEDATA, "StorePrivateData",
+ lsa_dissect_lsastoreprivatedata_rqst,
+ lsa_dissect_lsastoreprivatedata_reply },
+ { LSA_LSARETRIEVEPRIVATEDATA, "RetrievePrivateData",
+ lsa_dissect_lsaretrieveprivatedata_rqst,
+ lsa_dissect_lsaretrieveprivatedata_reply },
+ { LSA_LSAOPENPOLICY2, "OpenPolicy2",
+ lsa_dissect_lsaopenpolicy2_rqst,
+ lsa_dissect_lsaopenpolicy2_reply },
+ { LSA_LSAGETUSERNAME, "GetUsername",
+ lsa_dissect_lsagetusername_rqst,
+ lsa_dissect_lsagetusername_reply },
+ { LSA_LSAQUERYINFORMATIONPOLICY2, "QueryInformationPolicy2",
+ lsa_dissect_lsaqueryinformationpolicy2_rqst,
+ lsa_dissect_lsaqueryinformationpolicy2_reply },
+ { LSA_LSASETINFORMATIONPOLICY2, "SetInformationPolicy2",
+ lsa_dissect_lsasetinformationpolicy2_rqst,
+ lsa_dissect_lsasetinformationpolicy2_reply },
+ { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "QueryTrustedDomainInfoByName",
+ lsa_dissect_lsaquerytrusteddomaininfobyname_rqst,
+ lsa_dissect_lsaquerytrusteddomaininfobyname_reply },
+ { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "SetTrustedDomainInfoByName",
+ lsa_dissect_lsasettrusteddomaininfobyname_rqst,
+ lsa_dissect_lsasettrusteddomaininfobyname_reply },
+ { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "EnumTrustedDomainsEx",
+ lsa_dissect_lsaenumeratetrusteddomainsex_rqst,
+ lsa_dissect_lsaenumeratetrusteddomainsex_reply },
+ { LSA_LSACREATETRUSTEDDOMAINEX, "CreateTrustedDomainEx",
+ lsa_dissect_lsacreatetrusteddomainex_rqst,
+ lsa_dissect_lsacreatetrusteddomainex_reply },
+ { LSA_LSACLOSETRUSTEDDOMAINEX, "CloseTrustedDomainEx",
+ lsa_dissect_lsaclosetrusteddomainex_rqst,
+ lsa_dissect_lsaclosetrusteddomainex_reply },
+ { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "QueryDomainInfoPolicy",
+ lsa_dissect_lsaquerydomaininformationpolicy_rqst,
+ lsa_dissect_lsaquerydomaininformationpolicy_reply },
+ { LSA_LSASETDOMAININFORMATIONPOLICY, "SetDomainInfoPolicy",
+ lsa_dissect_lsasetdomaininformationpolicy_rqst,
+ lsa_dissect_lsasetdomaininformationpolicy_reply },
+ { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "OpenTrustedDomainByName",
+ lsa_dissect_lsaopentrusteddomainbyname_rqst,
+ lsa_dissect_lsaopentrusteddomainbyname_reply },
+ { LSA_LSAFUNCTION_38, "LSAFUNCTION_38",
+ lsa_dissect_lsafunction_38_rqst,
+ lsa_dissect_lsafunction_38_reply },
+ { LSA_LSALOOKUPSIDS2, "LookupSIDs2",
+ lsa_dissect_lsalookupsids2_rqst,
+ lsa_dissect_lsalookupsids2_reply },
+ { LSA_LSALOOKUPNAMES2, "LookupNames2",
lsa_dissect_lsalookupnames2_rqst,
lsa_dissect_lsalookupnames2_reply },
-#endif
{ LSA_LSAFUNCTION_3B, "LSAFUNCTION_3B",
- NULL, NULL },
-#ifdef REMOVED
lsa_dissect_lsafunction_3b_rqst,
lsa_dissect_lsafunction_3b_reply },
-#endif
- {0, NULL, NULL, NULL},
+ {0, NULL, NULL, NULL}
};
-void
+static const value_string lsa_opnum_vals[] = {
+ { LSA_LSACLOSE, "Close" },
+ { LSA_LSADELETE, "Delete" },
+ { LSA_LSAENUMERATEPRIVILEGES, "EnumPrivs" },
+ { LSA_LSAQUERYSECURITYOBJECT, "QuerySecObject" },
+ { LSA_LSASETSECURITYOBJECT, "SetSecObject" },
+ { LSA_LSACHANGEPASSWORD, "ChangePassword" },
+ { LSA_LSAOPENPOLICY, "OpenPolicy" },
+ { LSA_LSAQUERYINFORMATIONPOLICY, "QueryInfoPolicy" },
+ { LSA_LSASETINFORMATIONPOLICY, "SetInfoPolicy" },
+ { LSA_LSACLEARAUDITLOG, "ClearAuditLog" },
+ { LSA_LSACREATEACCOUNT, "CreateAccount" },
+ { LSA_LSAENUMERATEACCOUNTS, "EnumAccounts" },
+ { LSA_LSACREATETRUSTEDDOMAIN, "CreateTrustedDomain" },
+ { LSA_LSAENUMERATETRUSTEDDOMAINS, "EnumTrustedDomains" },
+ { LSA_LSALOOKUPNAMES, "LookupNames" },
+ { LSA_LSALOOKUPSIDS, "LookupSIDs" },
+ { LSA_LSACREATESECRET, "CreateSecret" },
+ { LSA_LSAOPENACCOUNT, "OpenAccount" },
+ { LSA_LSAENUMERATEPRIVILEGESACCOUNT, "EnumPrivsAccount" },
+ { LSA_LSAADDPRIVILEGESTOACCOUNT, "AddPrivsToAccount" },
+ { LSA_LSAREMOVEPRIVILEGESFROMACCOUNT, "MovePrivsFromAccount" },
+ { LSA_LSAGETQUOTASFORACCOUNT, "GetQuotasForAccount" },
+ { LSA_LSASETQUOTASFORACCOUNT, "SetQuotasForAccount" },
+ { LSA_LSAGETSYSTEMACCESSACCOUNT, "GetSystemAccessAccount" },
+ { LSA_LSASETSYSTEMACCESSACCOUNT, "SetSystemAccessAccount" },
+ { LSA_LSAOPENTRUSTEDDOMAIN, "OpenTrustedDomain" },
+ { LSA_LSAQUERYINFOTRUSTEDDOMAIN, "QueryInfoTrustedDomain" },
+ { LSA_LSASETINFORMATIONTRUSTEDDOMAIN, "SetInfoTrustedDomain" },
+ { LSA_LSAOPENSECRET, "OpenSecret" },
+ { LSA_LSASETSECRET, "SetSecret" },
+ { LSA_LSAQUERYSECRET, "QuerySecret" },
+ { LSA_LSALOOKUPPRIVILEGEVALUE, "LookupPrivValue" },
+ { LSA_LSALOOKUPPRIVILEGENAME, "LookupPrivName" },
+ { LSA_LSALOOKUPPRIVILEGEDISPLAYNAME, "LookupPrivDispName" },
+ { LSA_LSADELETEOBJECT, "DeleteObject" },
+ { LSA_LSAENUMERATEACCOUNTSWITHUSERRIGHT, "EnumAccountsWithUserRight" },
+ { LSA_LSAENUMERATEACCOUNTRIGHTS, "EnumAccountRights" },
+ { LSA_LSAADDACCOUNTRIGHTS, "AddAccountRights" },
+ { LSA_LSAREMOVEACCOUNTRIGHTS, "RemoveAccountRights" },
+ { LSA_LSAQUERYTRUSTEDDOMAININFO, "QueryTrustedDomainInfo" },
+ { LSA_LSASETTRUSTEDDOMAININFO, "SetTrustedDomainInfo" },
+ { LSA_LSADELETETRUSTEDDOMAIN, "DeleteTrsutedDomain" },
+ { LSA_LSASTOREPRIVATEDATA, "StorePrivateData" },
+ { LSA_LSARETRIEVEPRIVATEDATA, "RetrievePrivateData" },
+ { LSA_LSAOPENPOLICY2, "OpenPolicy2" },
+ { LSA_LSAGETUSERNAME, "GetUsername" },
+ { LSA_LSAQUERYINFORMATIONPOLICY2, "QueryInformationPolicy2" },
+ { LSA_LSASETINFORMATIONPOLICY2, "SetInformationPolicy2" },
+ { LSA_LSAQUERYTRUSTEDDOMAININFOBYNAME, "QueryTrustedDomainInfoByName" },
+ { LSA_LSASETTRUSTEDDOMAININFOBYNAME, "SetTrustedDomainInfoByName" },
+ { LSA_LSAENUMERATETRUSTEDDOMAINSEX, "EnumTrustedDomainsEx" },
+ { LSA_LSACREATETRUSTEDDOMAINEX, "CreateTrustedDomainEx" },
+ { LSA_LSACLOSETRUSTEDDOMAINEX, "CloseTrustedDomainEx" },
+ { LSA_LSAQUERYDOMAININFORMATIONPOLICY, "QueryDomainInfoPolicy" },
+ { LSA_LSASETDOMAININFORMATIONPOLICY, "SetDomainInfoPolicy" },
+ { LSA_LSAOPENTRUSTEDDOMAINBYNAME, "OpenTrustedDomainByName" },
+ { LSA_LSAFUNCTION_38, "LSAFUNCTION_38" },
+ { LSA_LSALOOKUPSIDS2, "LookupSIDs2" },
+ { LSA_LSALOOKUPNAMES2, "LookupNames2" },
+ { LSA_LSAFUNCTION_3B, "LSAFUNCTION_3B" },
+ { 0, NULL }
+};
+
+void
proto_register_dcerpc_lsa(void)
{
static hf_register_info hf[] = {
+
+ { &hf_lsa_opnum,
+ { "Operation", "lsa.opnum", FT_UINT16, BASE_DEC,
+ VALS(lsa_opnum_vals), 0x0, "Operation", HFILL }},
+
{ &hf_lsa_unknown_string,
{ "Unknown string", "lsa.unknown_string", FT_STRING, BASE_NONE,
NULL, 0, "Unknown string. If you know what this is, contact ethereal developers.", HFILL }},
{ &hf_lsa_hnd,
- { "Context Handle", "lsa.hnd", FT_BYTES, BASE_NONE,
+ { "Context Handle", "lsa.hnd", FT_BYTES, BASE_NONE,
NULL, 0x0, "LSA policy handle", HFILL }},
{ &hf_lsa_server,
NULL, 0, "Name of Domain Controller", HFILL }},
{ &hf_lsa_unknown_hyper,
- { "Unknown hyper", "lsa.unknown.hyper", FT_UINT64, BASE_HEX,
+ { "Unknown hyper", "lsa.unknown.hyper", FT_UINT64, BASE_HEX,
NULL, 0x0, "Unknown hyper. If you know what this is, contact ethereal developers.", HFILL }},
{ &hf_lsa_unknown_long,
- { "Unknown long", "lsa.unknown.long", FT_UINT32, BASE_HEX,
+ { "Unknown long", "lsa.unknown.long", FT_UINT32, BASE_HEX,
NULL, 0x0, "Unknown long. If you know what this is, contact ethereal developers.", HFILL }},
{ &hf_lsa_unknown_short,
- { "Unknown short", "lsa.unknown.short", FT_UINT16, BASE_HEX,
+ { "Unknown short", "lsa.unknown.short", FT_UINT16, BASE_HEX,
NULL, 0x0, "Unknown short. If you know what this is, contact ethereal developers.", HFILL }},
{ &hf_lsa_unknown_char,
- { "Unknown char", "lsa.unknown.char", FT_UINT8, BASE_HEX,
+ { "Unknown char", "lsa.unknown.char", FT_UINT8, BASE_HEX,
NULL, 0x0, "Unknown char. If you know what this is, contact ethereal developers.", HFILL }},
{ &hf_lsa_rc,
- { "Return code", "lsa.rc", FT_UINT32, BASE_HEX,
+ { "Return code", "lsa.rc", FT_UINT32, BASE_HEX,
VALS (NT_errors), 0x0, "LSA return status code", HFILL }},
{ &hf_lsa_obj_attr,
- { "Attributes", "lsa.obj_attr", FT_UINT32, BASE_HEX,
+ { "Attributes", "lsa.obj_attr", FT_UINT32, BASE_HEX,
NULL, 0x0, "LSA Attributes", HFILL }},
{ &hf_lsa_obj_attr_len,
- { "Length", "lsa.obj_attr.len", FT_UINT32, BASE_DEC,
+ { "Length", "lsa.obj_attr.len", FT_UINT32, BASE_DEC,
NULL, 0x0, "Length of object attribute structure", HFILL }},
{ &hf_lsa_obj_attr_name,
- { "Name", "lsa.obj_attr.name", FT_STRING, BASE_NONE,
+ { "Name", "lsa.obj_attr.name", FT_STRING, BASE_NONE,
NULL, 0x0, "Name of object attribute", HFILL }},
{ &hf_lsa_access_mask,
- { "Access Mask", "lsa.access_mask", FT_UINT32, BASE_HEX,
+ { "Access Mask", "lsa.access_mask", FT_UINT32, BASE_HEX,
NULL, 0x0, "LSA Access Mask", HFILL }},
{ &hf_lsa_info_level,
- { "Level", "lsa.info.level", FT_UINT16, BASE_DEC,
+ { "Level", "lsa.info.level", FT_UINT16, BASE_DEC,
NULL, 0x0, "Information level of requested data", HFILL }},
{ &hf_lsa_trusted_info_level,
- { "Info Level", "lsa.trusted.info_level", FT_UINT16, BASE_DEC,
+ { "Info Level", "lsa.trusted.info_level", FT_UINT16, BASE_DEC,
VALS(trusted_info_level_vals), 0x0, "Information level of requested Trusted Domain Information", HFILL }},
{ &hf_lsa_sd_size,
- { "Size", "lsa.sd_size", FT_UINT32, BASE_DEC,
+ { "Size", "lsa.sd_size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of lsa security descriptor", HFILL }},
{ &hf_lsa_qos_len,
- { "Length", "lsa.qos.len", FT_UINT32, BASE_DEC,
+ { "Length", "lsa.qos.len", FT_UINT32, BASE_DEC,
NULL, 0x0, "Length of quality of service structure", HFILL }},
{ &hf_lsa_qos_impersonation_level,
- { "Impersonation level", "lsa.qos.imp_lev", FT_UINT16, BASE_DEC,
+ { "Impersonation level", "lsa.qos.imp_lev", FT_UINT16, BASE_DEC,
VALS(lsa_impersonation_level_vals), 0x0, "QOS Impersonation Level", HFILL }},
{ &hf_lsa_qos_track_context,
- { "Context Tracking", "lsa.qos.track_ctx", FT_UINT8, BASE_DEC,
+ { "Context Tracking", "lsa.qos.track_ctx", FT_UINT8, BASE_DEC,
NULL, 0x0, "QOS Context Tracking Mode", HFILL }},
{ &hf_lsa_qos_effective_only,
- { "Effective only", "lsa.qos.effective_only", FT_UINT8, BASE_DEC,
+ { "Effective only", "lsa.qos.effective_only", FT_UINT8, BASE_DEC,
NULL, 0x0, "QOS Flag whether this is Effective Only or not", HFILL }},
{ &hf_lsa_pali_percent_full,
- { "Percent Full", "lsa.pali.percent_full", FT_UINT32, BASE_DEC,
+ { "Percent Full", "lsa.pali.percent_full", FT_UINT32, BASE_DEC,
NULL, 0x0, "How full audit log is in percentage", HFILL }},
{ &hf_lsa_pali_log_size,
- { "Log Size", "lsa.pali.log_size", FT_UINT32, BASE_DEC,
+ { "Log Size", "lsa.pali.log_size", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of audit log", HFILL }},
{ &hf_lsa_pali_retention_period,
- { "Retention Period", "lsa.pali.retention_period", FT_RELATIVE_TIME, BASE_NONE,
+ { "Retention Period", "lsa.pali.retention_period", FT_RELATIVE_TIME, BASE_NONE,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_pali_time_to_shutdown,
- { "Time to shutdown", "lsa.pali.time_to_shutdown", FT_RELATIVE_TIME, BASE_NONE,
+ { "Time to shutdown", "lsa.pali.time_to_shutdown", FT_RELATIVE_TIME, BASE_NONE,
NULL, 0x0, "Time to shutdown", HFILL }},
- { &hf_lsa_pali_shutdown_in_progress,
- { "Shutdown in progress", "lsa.pali.shutdown_in_progress", FT_UINT8, BASE_DEC,
+ { &hf_lsa_pali_shutdown_in_progress,
+ { "Shutdown in progress", "lsa.pali.shutdown_in_progress", FT_UINT8, BASE_DEC,
NULL, 0x0, "Flag whether shutdown is in progress or not", HFILL }},
{ &hf_lsa_pali_next_audit_record,
- { "Next Audit Record", "lsa.pali.next_audit_record", FT_UINT32, BASE_HEX,
+ { "Next Audit Record", "lsa.pali.next_audit_record", FT_UINT32, BASE_HEX,
NULL, 0x0, "Next audit record", HFILL }},
{ &hf_lsa_paei_enabled,
- { "Enabled", "lsa.paei.enabled", FT_UINT8, BASE_DEC,
+ { "Enabled", "lsa.paei.enabled", FT_UINT8, BASE_DEC,
NULL, 0x0, "If Audit Events Information is Enabled or not", HFILL }},
{ &hf_lsa_paei_settings,
- { "Settings", "lsa.paei.settings", FT_UINT32, BASE_HEX,
+ { "Settings", "lsa.paei.settings", FT_UINT32, BASE_HEX,
NULL, 0x0, "Audit Events Information settings", HFILL }},
{ &hf_lsa_count,
- { "Count", "lsa.count", FT_UINT32, BASE_DEC,
+ { "Count", "lsa.count", FT_UINT32, BASE_DEC,
NULL, 0x0, "Count of objects", HFILL }},
{ &hf_lsa_max_count,
- { "Max Count", "lsa.max_count", FT_UINT32, BASE_DEC,
+ { "Max Count", "lsa.max_count", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_domain,
- { "Domain", "lsa.domain", FT_STRING, BASE_NONE,
+ { "Domain", "lsa.domain", FT_STRING, BASE_NONE,
NULL, 0x0, "Domain", HFILL }},
{ &hf_lsa_acct,
- { "Account", "lsa.acct", FT_STRING, BASE_NONE,
+ { "Account", "lsa.acct", FT_STRING, BASE_NONE,
NULL, 0x0, "Account", HFILL }},
{ &hf_lsa_source,
- { "Source", "lsa.source", FT_STRING, BASE_NONE,
+ { "Source", "lsa.source", FT_STRING, BASE_NONE,
NULL, 0x0, "Replica Source", HFILL }},
{ &hf_lsa_server_role,
- { "Role", "lsa.server_role", FT_UINT16, BASE_DEC,
+ { "Role", "lsa.server_role", FT_UINT16, BASE_DEC,
VALS(server_role_vals), 0x0, "LSA Server Role", HFILL }},
{ &hf_lsa_quota_paged_pool,
- { "Paged Pool", "lsa.quota.paged_pool", FT_UINT32, BASE_DEC,
+ { "Paged Pool", "lsa.quota.paged_pool", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of Quota Paged Pool", HFILL }},
{ &hf_lsa_quota_non_paged_pool,
- { "Non Paged Pool", "lsa.quota.non_paged_pool", FT_UINT32, BASE_DEC,
+ { "Non Paged Pool", "lsa.quota.non_paged_pool", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of Quota non-Paged Pool", HFILL }},
{ &hf_lsa_quota_min_wss,
- { "Min WSS", "lsa.quota.min_wss", FT_UINT32, BASE_DEC,
+ { "Min WSS", "lsa.quota.min_wss", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of Quota Min WSS", HFILL }},
{ &hf_lsa_quota_max_wss,
- { "Max WSS", "lsa.quota.max_wss", FT_UINT32, BASE_DEC,
+ { "Max WSS", "lsa.quota.max_wss", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of Quota Max WSS", HFILL }},
{ &hf_lsa_quota_pagefile,
- { "Pagefile", "lsa.quota.pagefile", FT_UINT32, BASE_DEC,
+ { "Pagefile", "lsa.quota.pagefile", FT_UINT32, BASE_DEC,
NULL, 0x0, "Size of quota pagefile usage", HFILL }},
{ &hf_lsa_mod_seq_no,
- { "Seq No", "lsa.mod.seq_no", FT_UINT64, BASE_DEC,
+ { "Seq No", "lsa.mod.seq_no", FT_UINT64, BASE_DEC,
NULL, 0x0, "Sequence number for this modification", HFILL }},
{ &hf_lsa_mod_mtime,
- { "MTime", "lsa.mod.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
+ { "MTime", "lsa.mod.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
NULL, 0x0, "Time when this modification occured", HFILL }},
+ { &hf_lsa_cur_mtime,
+ { "Current MTime", "lsa.cur.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
+ NULL, 0x0, "Current MTime to set", HFILL }},
+
+ { &hf_lsa_old_mtime,
+ { "Old MTime", "lsa.old.mtime", FT_ABSOLUTE_TIME, BASE_NONE,
+ NULL, 0x0, "Old MTime for this object", HFILL }},
+
{ &hf_lsa_name,
- { "Name", "lsa.name", FT_STRING, BASE_NONE,
+ { "Name", "lsa.name", FT_STRING, BASE_NONE,
+ NULL, 0x0, "", HFILL }},
+
+ { &hf_lsa_key,
+ { "Key", "lsa.key", FT_STRING, BASE_NONE,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_flat_name,
- { "Flat Name", "lsa.flat_name", FT_STRING, BASE_NONE,
+ { "Flat Name", "lsa.flat_name", FT_STRING, BASE_NONE,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_forest,
- { "Forest", "lsa.forest", FT_STRING, BASE_NONE,
+ { "Forest", "lsa.forest", FT_STRING, BASE_NONE,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_info_type,
- { "Info Type", "lsa.info_type", FT_UINT32, BASE_DEC,
+ { "Info Type", "lsa.info_type", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_new_pwd,
- { "New Password", "lsa.new_pwd", FT_BYTES, BASE_HEX,
+ { "New Password", "lsa.new_pwd", FT_BYTES, BASE_HEX,
NULL, 0x0, "New password", HFILL }},
{ &hf_lsa_old_pwd,
- { "Old Password", "lsa.old_pwd", FT_BYTES, BASE_HEX,
+ { "Old Password", "lsa.old_pwd", FT_BYTES, BASE_HEX,
NULL, 0x0, "Old password", HFILL }},
{ &hf_lsa_sid_type,
- { "SID Type", "lsa.sid_type", FT_UINT16, BASE_DEC,
+ { "SID Type", "lsa.sid_type", FT_UINT16, BASE_DEC,
VALS(sid_type_vals), 0x0, "Type of SID", HFILL }},
{ &hf_lsa_rid,
- { "RID", "lsa.rid", FT_UINT32, BASE_HEX,
+ { "RID", "lsa.rid", FT_UINT32, BASE_HEX,
NULL, 0x0, "RID", HFILL }},
{ &hf_lsa_rid_offset,
- { "RID Offset", "lsa.rid.offset", FT_UINT32, BASE_HEX,
+ { "RID Offset", "lsa.rid.offset", FT_UINT32, BASE_HEX,
NULL, 0x0, "RID Offset", HFILL }},
{ &hf_lsa_index,
- { "Index", "lsa.index", FT_UINT32, BASE_DEC,
+ { "Index", "lsa.index", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_num_mapped,
- { "Num Mapped", "lsa.num_mapped", FT_UINT32, BASE_DEC,
+ { "Num Mapped", "lsa.num_mapped", FT_UINT32, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_policy_information_class,
- { "Info Class", "lsa.policy.info", FT_UINT16, BASE_DEC,
+ { "Info Class", "lsa.policy.info", FT_UINT16, BASE_DEC,
VALS(policy_information_class_vals), 0x0, "Policy information class", HFILL }},
{ &hf_lsa_secret,
NULL, 0, "", HFILL }},
{ &hf_nt_luid_high,
- { "High", "nt.luid.high", FT_UINT32, BASE_HEX,
+ { "High", "nt.luid.high", FT_UINT32, BASE_HEX,
NULL, 0x0, "LUID High component", HFILL }},
{ &hf_nt_luid_low,
- { "Low", "nt.luid.low", FT_UINT32, BASE_HEX,
+ { "Low", "nt.luid.low", FT_UINT32, BASE_HEX,
NULL, 0x0, "LUID Low component", HFILL }},
{ &hf_lsa_size,
- { "Size", "lsa.size", FT_UINT32, BASE_DEC,
+ { "Size", "lsa.size", FT_UINT32, BASE_DEC,
+ NULL, 0x0, "", HFILL }},
+
+ { &hf_lsa_size16,
+ { "Size", "lsa.size", FT_UINT16, BASE_DEC,
+ NULL, 0x0, "", HFILL }},
+
+ { &hf_lsa_size_needed,
+ { "Size Needed", "lsa.size_needed", FT_UINT16, BASE_DEC,
NULL, 0x0, "", HFILL }},
{ &hf_lsa_privilege_name,
- { "Name", "lsa.privilege.name", FT_STRING, BASE_NONE,
+ { "Name", "lsa.privilege.name", FT_STRING, BASE_NONE,
NULL, 0x0, "LSA Privilege Name", HFILL }},
+ { &hf_lsa_rights,
+ { "Rights", "lsa.rights", FT_STRING, BASE_NONE,
+ NULL, 0x0, "Account Rights", HFILL }},
+
{ &hf_lsa_attr,
- { "Attr", "lsa.attr", FT_UINT64, BASE_HEX,
+ { "Attr", "lsa.attr", FT_UINT64, BASE_HEX,
NULL, 0x0, "LSA Attributes", HFILL }},
{ &hf_lsa_auth_update,
- { "Update", "lsa.auth.update", FT_UINT64, BASE_HEX,
+ { "Update", "lsa.auth.update", FT_UINT64, BASE_HEX,
NULL, 0x0, "LSA Auth Info update", HFILL }},
{ &hf_lsa_resume_handle,
- { "Resume Handle", "lsa.resume_handle", FT_UINT32, BASE_DEC,
+ { "Resume Handle", "lsa.resume_handle", FT_UINT32, BASE_DEC,
NULL, 0x0, "Resume Handle", HFILL }},
{ &hf_lsa_trust_direction,
- { "Trust Direction", "lsa.trust.direction", FT_UINT32, BASE_DEC,
+ { "Trust Direction", "lsa.trust.direction", FT_UINT32, BASE_DEC,
VALS(trusted_direction_vals), 0x0, "Trust direction", HFILL }},
{ &hf_lsa_trust_type,
- { "Trust Type", "lsa.trust.type", FT_UINT32, BASE_DEC,
+ { "Trust Type", "lsa.trust.type", FT_UINT32, BASE_DEC,
VALS(trusted_type_vals), 0x0, "Trust type", HFILL }},
{ &hf_lsa_trust_attr,
- { "Trust Attr", "lsa.trust.attr", FT_UINT32, BASE_HEX,
+ { "Trust Attr", "lsa.trust.attr", FT_UINT32, BASE_HEX,
NULL, 0x0, "Trust attributes", HFILL }},
{ &hf_lsa_trust_attr_non_trans,
TFS(&tfs_trust_attr_tree_root), 0x00800000, "Tree Root trust", HFILL }},
{ &hf_lsa_auth_type,
- { "Auth Type", "lsa.auth.type", FT_UINT32, BASE_DEC,
+ { "Auth Type", "lsa.auth.type", FT_UINT32, BASE_DEC,
NULL, 0x0, "Auth Info type", HFILL }},
{ &hf_lsa_auth_len,
- { "Auth Len", "lsa.auth.len", FT_UINT32, BASE_DEC,
+ { "Auth Len", "lsa.auth.len", FT_UINT32, BASE_DEC,
NULL, 0x0, "Auth Info len", HFILL }},
-
- };
+ { &hf_lsa_remove_all,
+ { "Remove All", "lsa.remove_all", FT_UINT8, BASE_DEC,
+ NULL, 0x0, "Flag whether all rights should be removed or only the specified ones", HFILL }},
+
+ { &hf_view_local_info,
+ { "View local info", "lsa.access_mask.view_local_info",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_LOCAL_INFORMATION,
+ "View local info", HFILL }},
+
+ { &hf_view_audit_info,
+ { "View audit info", "lsa.access_mask.view_audit_info",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_VIEW_AUDIT_INFORMATION,
+ "View audit info", HFILL }},
+
+ { &hf_get_private_info,
+ { "Get private info", "lsa.access_mask.get_privateinfo",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_GET_PRIVATE_INFORMATION,
+ "Get private info", HFILL }},
+
+ { &hf_trust_admin,
+ { "Trust admin", "lsa.access_mask.trust_admin",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_TRUST_ADMIN,
+ "Trust admin", HFILL }},
+
+ { &hf_create_account,
+ { "Create account", "lsa.access_mask.create_account",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_ACCOUNT,
+ "Create account", HFILL }},
+
+ { &hf_create_secret,
+ { "Create secret", "lsa.access_mask.create_secret",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_SECRET,
+ "Create secret", HFILL }},
+
+ { &hf_create_priv,
+ { "Create privilege", "lsa.access_mask.create_priv",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_CREATE_PRIVILEGE,
+ "Create privilege", HFILL }},
+
+ { &hf_set_default_quota_limits,
+ { "Set default quota limits", "lsa.access_mask.set_default_quota_limits",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_DEFAULT_QUOTA_LIMITS,
+ "Set default quota limits", HFILL }},
+
+ { &hf_set_audit_requirements,
+ { "Set audit requirements", "lsa.access_mask.set_audit_requirements",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SET_AUDIT_REQUIREMENTS,
+ "Set audit requirements", HFILL }},
+
+ { &hf_server_admin,
+ { "Server admin", "lsa.access_mask.server_admin",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_SERVER_ADMIN,
+ "Server admin", HFILL }},
+
+ { &hf_lookup_names,
+ { "Lookup names", "lsa.access_mask.lookup_names",
+ FT_BOOLEAN, 32, TFS(&flags_set_truth), POLICY_LOOKUP_NAMES,
+ "Lookup names", HFILL }}
+};
static gint *ett[] = {
&ett_dcerpc_lsa,
&ett_lsa_trusted_domain_info,
&ett_lsa_trust_attr,
&ett_lsa_trusted_domain_auth_information,
- &ett_lsa_auth_information,
+ &ett_lsa_auth_information
};
proto_dcerpc_lsa = proto_register_protocol(
/* Protocol handoff */
static e_uuid_t uuid_dcerpc_lsa = {
- 0x12345778, 0x1234, 0xabcd,
+ 0x12345778, 0x1234, 0xabcd,
{ 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab}
};
/* Register protocol as dcerpc */
dcerpc_init_uuid(proto_dcerpc_lsa, ett_dcerpc_lsa, &uuid_dcerpc_lsa,
- ver_dcerpc_lsa, dcerpc_lsa_dissectors);
+ ver_dcerpc_lsa, dcerpc_lsa_dissectors, hf_lsa_opnum);
}
git.samba.org / obnox / wireshark / wip.git / blobdiff