- packet_info *pinfo, proto_tree *parent_tree,
- guint8 *drep)
-{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
- guint16 level;
-
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "DELTA_UNION:");
- tree = proto_item_add_subtree(item, ett_DELTA_UNION);
- }
-
- offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_netlogon_delta_type, &level);
-
- ALIGN_TO_4_BYTES;
- switch(level){
- case 1:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_DOMAIN, NDR_POINTER_UNIQUE,
- "DELTA_DOMAIN:", -1);
- break;
- case 2:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_GROUP, NDR_POINTER_UNIQUE,
- "DELTA_GROUP:", -1);
- break;
- case 4:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
- "DELTA_RENAME_GROUP:", hf_netlogon_group_name);
- break;
- case 5:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_USER, NDR_POINTER_UNIQUE,
- "DELTA_USER:", -1);
- break;
- case 7:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
- "DELTA_RENAME_USER:", hf_netlogon_acct_name);
- break;
- case 8:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_GROUP_MEMBER, NDR_POINTER_UNIQUE,
- "DELTA_GROUP_MEMBER:", -1);
- break;
- case 9:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_ALIAS, NDR_POINTER_UNIQUE,
- "DELTA_ALIAS:", -1);
- break;
- case 11:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
- "DELTA_RENAME_ALIAS:", hf_netlogon_alias_name);
- break;
- case 12:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_ALIAS_MEMBER, NDR_POINTER_UNIQUE,
- "DELTA_ALIAS_MEMBER:", -1);
- break;
- case 13:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_POLICY, NDR_POINTER_UNIQUE,
- "DELTA_POLICY:", -1);
- break;
- case 14:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_TRUSTED_DOMAINS, NDR_POINTER_UNIQUE,
- "DELTA_TRUSTED_DOMAINS:", -1);
- break;
- case 16:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_ACCOUNTS, NDR_POINTER_UNIQUE,
- "DELTA_ACCOUNTS:", -1);
- break;
- case 18:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_SECRET, NDR_POINTER_UNIQUE,
- "DELTA_SECRET:", -1);
- break;
- case 20:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
- "DELTA_DELETE_GROUP:", -1);
- break;
- case 21:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
- "DELTA_DELETE_USER:", -1);
- break;
- case 22:
- offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
- netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_UNIQUE,
- "MODIFIED_COUNT:", -1);
- break;
- }
-
- proto_item_set_len(item, offset-old_offset);
- return offset;
+ packet_info *pinfo, proto_tree *parent_tree,
+ guint8 *drep)
+{
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+ guint16 level;
+
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+ "DELTA_UNION:");
+ tree = proto_item_add_subtree(item, ett_DELTA_UNION);
+ }
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_delta_type, &level);
+
+ ALIGN_TO_4_BYTES;
+ switch(level){
+ case 1:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_DOMAIN, NDR_POINTER_UNIQUE,
+ "DELTA_DOMAIN:", -1);
+ break;
+ case 2:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_GROUP, NDR_POINTER_UNIQUE,
+ "DELTA_GROUP:", -1);
+ break;
+ case 4:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
+ "DELTA_RENAME_GROUP:", hf_netlogon_group_name);
+ break;
+ case 5:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_USER, NDR_POINTER_UNIQUE,
+ "DELTA_USER:", -1);
+ break;
+ case 7:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
+ "DELTA_RENAME_USER:", hf_netlogon_acct_name);
+ break;
+ case 8:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_GROUP_MEMBER, NDR_POINTER_UNIQUE,
+ "DELTA_GROUP_MEMBER:", -1);
+ break;
+ case 9:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_ALIAS, NDR_POINTER_UNIQUE,
+ "DELTA_ALIAS:", -1);
+ break;
+ case 11:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE,
+ "DELTA_RENAME_ALIAS:", hf_netlogon_alias_name);
+ break;
+ case 12:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_ALIAS_MEMBER, NDR_POINTER_UNIQUE,
+ "DELTA_ALIAS_MEMBER:", -1);
+ break;
+ case 13:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_POLICY, NDR_POINTER_UNIQUE,
+ "DELTA_POLICY:", -1);
+ break;
+ case 14:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_TRUSTED_DOMAINS, NDR_POINTER_UNIQUE,
+ "DELTA_TRUSTED_DOMAINS:", -1);
+ break;
+ case 16:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_ACCOUNTS, NDR_POINTER_UNIQUE,
+ "DELTA_ACCOUNTS:", -1);
+ break;
+ case 18:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_SECRET, NDR_POINTER_UNIQUE,
+ "DELTA_SECRET:", -1);
+ break;
+ case 20:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
+ "DELTA_DELETE_GROUP:", -1);
+ break;
+ case 21:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE,
+ "DELTA_DELETE_USER:", -1);
+ break;
+ case 22:
+ offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+ netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_UNIQUE,
+ "MODIFIED_COUNT:", -1);
+ break;
+ }
+
+ proto_item_set_len(item, offset-old_offset);
+ return offset;
- packet_info *pinfo, proto_tree *parent_tree,
- guint8 *drep)
-{
- proto_item *item=NULL;
- proto_tree *tree=NULL;
- int old_offset=offset;
- guint16 level;
-
- if(parent_tree){
- item = proto_tree_add_text(parent_tree, tvb, offset, 0,
- "DELTA_ID_UNION:");
- tree = proto_item_add_subtree(item, ett_DELTA_ID_UNION);
- }
-
- offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
- hf_netlogon_delta_type, &level);
-
- ALIGN_TO_4_BYTES;
- switch(level){
- case 1:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_group_rid, NULL);
- break;
- case 2:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 3:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 4:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 5:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 6:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 7:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 8:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 9:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 10:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 11:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 12:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 13:
- offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
- break;
- case 14:
- offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
- break;
- case 15:
- offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
- break;
- case 16:
- offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
- break;
- case 17:
- offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
- break;
- case 18:
- offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
- tree, drep, NDR_POINTER_UNIQUE, "unknown",
- hf_netlogon_unknown_string, 0);
- break;
- case 19:
- offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
- tree, drep, NDR_POINTER_UNIQUE, "unknown",
- hf_netlogon_unknown_string, 0);
- break;
- case 20:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- case 21:
- offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
- hf_netlogon_user_rid, NULL);
- break;
- }
-
- proto_item_set_len(item, offset-old_offset);
- return offset;
+ packet_info *pinfo, proto_tree *parent_tree,
+ guint8 *drep)
+{
+ proto_item *item=NULL;
+ proto_tree *tree=NULL;
+ int old_offset=offset;
+ guint16 level;
+
+ if(parent_tree){
+ item = proto_tree_add_text(parent_tree, tvb, offset, 0,
+ "DELTA_ID_UNION:");
+ tree = proto_item_add_subtree(item, ett_DELTA_ID_UNION);
+ }
+
+ offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_delta_type, &level);
+
+ ALIGN_TO_4_BYTES;
+ switch(level){
+ case 1:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_group_rid, NULL);
+ break;
+ case 2:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 3:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 4:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 5:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 6:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 7:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 8:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 9:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 10:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 11:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 12:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 13:
+ offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
+ break;
+ case 14:
+ offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
+ break;
+ case 15:
+ offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
+ break;
+ case 16:
+ offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
+ break;
+ case 17:
+ offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, drep);
+ break;
+ case 18:
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
+ tree, drep, NDR_POINTER_UNIQUE, "unknown",
+ hf_netlogon_unknown_string, 0);
+ break;
+ case 19:
+ offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo,
+ tree, drep, NDR_POINTER_UNIQUE, "unknown",
+ hf_netlogon_unknown_string, 0);
+ break;
+ case 20:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ case 21:
+ offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+ hf_netlogon_user_rid, NULL);
+ break;
+ }
+
+ proto_item_set_len(item, offset-old_offset);
+ return offset;
- packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
-{
- guint32 mask;
- proto_item *item = NULL;
- proto_tree *tree = NULL;
- dcerpc_info *di;
-
- di=pinfo->private_data;
- if(di->conformant_run){
- /*just a run to handle conformant arrays, nothing to dissect */
- return offset;
- }
-
- offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
- hf_netlogon_get_dcname_request_flags, &mask);
-
- if(parent_tree){
- item = proto_tree_add_uint(parent_tree, hf_netlogon_get_dcname_request_flags,
- tvb, offset-4, 4, mask);
- tree = proto_item_add_subtree(item, ett_get_dcname_request_flags);
- }
-
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_return_flat_name,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_return_dns_name,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_is_flat_name,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_is_dns_name,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_only_ldap_needed,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_avoid_self,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_good_timeserv_preferred,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_writable_required,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_timeserv_required,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_kdc_required,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_ip_required,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_background_only,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_pdc_required,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_gc_server_required,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_directory_service_preferred,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_directory_service_required,
- tvb, offset-4, 4, mask);
- proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_force_rediscovery,
- tvb, offset-4, 4, mask);
-
- return offset;
-}
-
-
-
-#define DS_PDC_FLAG 0x00000001
-#define DS_GC_FLAG 0x00000004
-#define DS_LDAP_FLAG 0x00000008
-#define DS_DS_FLAG 0x00000010
-#define DS_KDC_FLAG 0x00000020
-#define DS_TIMESERV_FLAG 0x00000040
-#define DS_CLOSEST_FLAG 0x00000080
-#define DS_WRITABLE_FLAG 0x00000100
-#define DS_GOOD_TIMESERV_FLAG 0x00000200
-#define DS_NDNC_FLAG 0x00000400
-#define DS_DNS_CONTROLLER_FLAG 0x20000000
-#define DS_DNS_DOMAIN_FLAG 0x40000000
-#define DS_DNS_FOREST_FLAG 0x80000000
+ packet_info *pinfo, proto_tree *parent_tree, guint8 *drep)
+{
+ guint32 mask;
+ proto_item *item = NULL;
+ proto_tree *tree = NULL;
+ dcerpc_info *di;
+
+ di=pinfo->private_data;
+ if(di->conformant_run){
+ /*just a run to handle conformant arrays, nothing to dissect */
+ return offset;
+ }
+
+ offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, drep,
+ hf_netlogon_get_dcname_request_flags, &mask);
+
+ if(parent_tree){
+ item = proto_tree_add_uint(parent_tree, hf_netlogon_get_dcname_request_flags,
+ tvb, offset-4, 4, mask);
+ tree = proto_item_add_subtree(item, ett_get_dcname_request_flags);
+ }
+
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_return_flat_name,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_return_dns_name,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_is_flat_name,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_is_dns_name,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_only_ldap_needed,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_avoid_self,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_good_timeserv_preferred,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_writable_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_timeserv_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_kdc_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_ip_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_background_only,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_pdc_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_gc_server_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_directory_service_preferred,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_directory_service_required,
+ tvb, offset-4, 4, mask);
+ proto_tree_add_boolean(tree, hf_netlogon_get_dcname_request_flags_force_rediscovery,
+ tvb, offset-4, 4, mask);
+
+ return offset;
+}
+
+
+
+#define DS_PDC_FLAG 0x00000001
+#define DS_GC_FLAG 0x00000004
+#define DS_LDAP_FLAG 0x00000008
+#define DS_DS_FLAG 0x00000010
+#define DS_KDC_FLAG 0x00000020
+#define DS_TIMESERV_FLAG 0x00000040
+#define DS_CLOSEST_FLAG 0x00000080
+#define DS_WRITABLE_FLAG 0x00000100
+#define DS_GOOD_TIMESERV_FLAG 0x00000200
+#define DS_NDNC_FLAG 0x00000400
+#define DS_DNS_CONTROLLER_FLAG 0x20000000
+#define DS_DNS_DOMAIN_FLAG 0x40000000
+#define DS_DNS_FOREST_FLAG 0x80000000
+
- if (tree) {
- proto_tree *negotiate_flags_tree = NULL;
- proto_item *tf = NULL;
- tf = proto_tree_add_uint (tree,
- hf_netlogon_neg_flags,
- tvb, offset, 4,flags);
- negotiate_flags_tree = proto_item_add_subtree (tf,ett_authenticate_flags);
-
- /*proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_80000000,
- tvb, offset, 4, flags);*/
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_40000000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_20000000,
- tvb, offset, 4, flags);
- /*
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_10000000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_8000000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_4000000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_2000000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_1000000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_800000,
- tvb, offset, 4, flags);*/
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_400000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_200000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_100000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_80000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_40000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_20000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_10000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_8000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_4000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_2000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_1000,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_800,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_400,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_200,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_100,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_80,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_40,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_20,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_10,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_8,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_4,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_2,
- tvb, offset, 4, flags);
- proto_tree_add_boolean (negotiate_flags_tree,
- hf_netlogon_neg_flags_1,
- tvb, offset, 4, flags);
- }
- return 0;
+ if (tree) {
+ proto_tree *negotiate_flags_tree = NULL;
+ proto_item *tf = NULL;
+ tf = proto_tree_add_uint (tree,
+ hf_netlogon_neg_flags,
+ tvb, offset, 4,flags);
+ negotiate_flags_tree = proto_item_add_subtree (tf,ett_authenticate_flags);
+
+ /*proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_80000000,
+ tvb, offset, 4, flags);*/
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_40000000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_20000000,
+ tvb, offset, 4, flags);
+ /*
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_10000000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_8000000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_4000000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_2000000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_1000000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_800000,
+ tvb, offset, 4, flags);*/
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_400000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_200000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_100000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_80000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_40000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_20000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_10000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_8000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_4000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_2000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_1000,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_800,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_400,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_200,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_100,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_80,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_40,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_20,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_10,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_8,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_4,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_2,
+ tvb, offset, 4, flags);
+ proto_tree_add_boolean (negotiate_flags_tree,
+ hf_netlogon_neg_flags_1,
+ tvb, offset, 4, flags);
+ }
+ return 0;
- { NETLOGON_NETRLOGONUASLOGON, "NetrLogonUasLogon",
- netlogon_dissect_netrlogonuaslogon_rqst,
- netlogon_dissect_netrlogonuaslogon_reply },
- { NETLOGON_NETRLOGONUASLOGOFF, "NetrLogonUasLogoff",
- netlogon_dissect_netrlogonuaslogoff_rqst,
- netlogon_dissect_netrlogonuaslogoff_reply },
- { NETLOGON_NETRLOGONSAMLOGON, "NetrLogonSamLogon",
- netlogon_dissect_netrlogonsamlogon_rqst,
- netlogon_dissect_netrlogonsamlogon_reply },
- { NETLOGON_NETRLOGONSAMLOGOFF, "NetrLogonSamLogoff",
- netlogon_dissect_netrlogonsamlogoff_rqst,
- netlogon_dissect_netrlogonsamlogoff_reply },
- { NETLOGON_NETRSERVERREQCHALLENGE, "NetrServerReqChallenge",
- netlogon_dissect_netrserverreqchallenge_rqst,
- netlogon_dissect_netrserverreqchallenge_reply },
- { NETLOGON_NETRSERVERAUTHENTICATE, "NetrServerAuthenticate",
- netlogon_dissect_netrserverauthenticate_rqst,
- netlogon_dissect_netrserverauthenticate_reply },
- { NETLOGON_NETRSERVERPASSWORDSET, "NetrServerPasswordSet",
- netlogon_dissect_netrserverpasswordset_rqst,
- netlogon_dissect_netrserverpasswordset_reply },
- { NETLOGON_NETRDATABASEDELTAS, "NetrDatabaseDeltas",
- netlogon_dissect_netrdatabasedeltas_rqst,
- netlogon_dissect_netrdatabasedeltas_reply },
- { NETLOGON_NETRDATABASESYNC, "NetrDatabaseSync",
- netlogon_dissect_netrdatabasesync_rqst,
- netlogon_dissect_netrdatabasesync_reply },
- { NETLOGON_NETRACCOUNTDELTAS, "NetrAccountDeltas",
- netlogon_dissect_netraccountdeltas_rqst,
- netlogon_dissect_netraccountdeltas_reply },
- { NETLOGON_NETRACCOUNTSYNC, "NetrAccountSync",
- netlogon_dissect_netraccountsync_rqst,
- netlogon_dissect_netraccountsync_reply },
- { NETLOGON_NETRGETDCNAME, "NetrGetDCName",
- netlogon_dissect_netrgetdcname_rqst,
- netlogon_dissect_netrgetdcname_reply },
- { NETLOGON_NETRLOGONCONTROL, "NetrLogonControl",
- netlogon_dissect_netrlogoncontrol_rqst,
- netlogon_dissect_netrlogoncontrol_reply },
- { NETLOGON_NETRGETANYDCNAME, "NetrGetAnyDCName",
- netlogon_dissect_netrgetanydcname_rqst,
- netlogon_dissect_netrgetanydcname_reply },
- { NETLOGON_NETRLOGONCONTROL2, "NetrLogonControl2",
- netlogon_dissect_netrlogoncontrol2_rqst,
- netlogon_dissect_netrlogoncontrol2_reply },
- { NETLOGON_NETRSERVERAUTHENTICATE2, "NetrServerAuthenticate2",
- netlogon_dissect_netrserverauthenticate2_rqst,
- netlogon_dissect_netrserverauthenticate2_reply },
- { NETLOGON_NETRDATABASESYNC2, "NetrDatabaseSync2",
- netlogon_dissect_netrdatabasesync2_rqst,
- netlogon_dissect_netrdatabasesync2_reply },
- { NETLOGON_NETRDATABASEREDO, "NetrDatabaseRedo",
- netlogon_dissect_netrdatabaseredo_rqst,
- netlogon_dissect_netrdatabaseredo_reply },
- { NETLOGON_NETRLOGONCONTROL2EX, "NetrLogonControl2Ex",
- netlogon_dissect_netrlogoncontrol2ex_rqst,
- netlogon_dissect_netrlogoncontrol2ex_reply },
- { NETLOGON_NETRENUMERATETRUSTEDDOMAINS, "NetrEnumerateTrustedDomains",
- netlogon_dissect_netrenumeratetrusteddomains_rqst,
- netlogon_dissect_netrenumeratetrusteddomains_reply },
- { NETLOGON_DSRGETDCNAME, "DsrGetDcName",
- netlogon_dissect_dsrgetdcname_rqst,
- netlogon_dissect_dsrgetdcname_reply },
- { NETLOGON_NETRLOGONDUMMYROUTINE1, "NetrLogonDummyRoutine1",
- netlogon_dissect_netrlogondummyroutine1_rqst,
- netlogon_dissect_netrlogondummyroutine1_reply },
- { NETLOGON_NETRLOGONSETSERVICEBITS, "NetrLogonSetServiceBits",
- netlogon_dissect_netrlogonsetservicebits_rqst,
- netlogon_dissect_netrlogonsetservicebits_reply },
- { NETLOGON_NETRLOGONGETTRUSTRID, "NetrLogonGetTrustRid",
- netlogon_dissect_netrlogongettrustrid_rqst,
- netlogon_dissect_netrlogongettrustrid_reply },
- { NETLOGON_NETRLOGONCOMPUTESERVERDIGEST, "NetrLogonComputeServerDigest",
- netlogon_dissect_netrlogoncomputeserverdigest_rqst,
- netlogon_dissect_netrlogoncomputeserverdigest_reply },
- { NETLOGON_NETRLOGONCOMPUTECLIENTDIGEST, "NetrLogonComputeClientDigest",
- netlogon_dissect_netrlogoncomputeclientdigest_rqst,
- netlogon_dissect_netrlogoncomputeclientdigest_reply },
- { NETLOGON_NETRSERVERAUTHENTICATE3, "NetrServerAuthenticate3",
- netlogon_dissect_netrserverauthenticate3_rqst,
- netlogon_dissect_netrserverauthenticate3_reply },
- { NETLOGON_DSRGETDCNAMEX, "DsrGetDcNameEx",
- netlogon_dissect_dsrgetdcnameex_rqst,
- netlogon_dissect_dsrgetdcnameex_reply },
- { NETLOGON_DSRGETSITENAME, "DsrGetSiteName",
- netlogon_dissect_dsrgetsitename_rqst,
- netlogon_dissect_dsrgetsitename_reply },
- { NETLOGON_NETRLOGONGETDOMAININFO, "NetrLogonGetDomainInfo",
- netlogon_dissect_netrlogongetdomaininfo_rqst,
- netlogon_dissect_netrlogongetdomaininfo_reply },
- { NETLOGON_NETRSERVERPASSWORDSET2, "NetrServerPasswordSet2",
- netlogon_dissect_netrserverpasswordset2_rqst,
- netlogon_dissect_netrserverpasswordset2_reply },
- { NETLOGON_NETRSERVERPASSWORDGET, "NetrServerPasswordGet",
- netlogon_dissect_netrserverpasswordget_rqst,
- netlogon_dissect_netrserverpasswordget_reply },
- { NETLOGON_NETRLOGONSENDTOSAM, "NetrLogonSendToSam",
- netlogon_dissect_netrlogonsendtosam_rqst,
- netlogon_dissect_netrlogonsendtosam_reply },
- { NETLOGON_DSRADDRESSTOSITENAMESW, "DsrAddressToSiteNamesW",
- netlogon_dissect_dsraddresstositenamesw_rqst,
- netlogon_dissect_dsraddresstositenamesw_reply },
- { NETLOGON_DSRGETDCNAMEEX2, "DsrGetDcNameEx2",
- netlogon_dissect_dsrgetdcnameex2_rqst,
- netlogon_dissect_dsrgetdcnameex2_reply },
- { NETLOGON_NETRLOGONGETTIMESERVICEPARENTDOMAIN,
- "NetrLogonGetTimeServiceParentDomain",
- netlogon_dissect_netrlogongettimeserviceparentdomain_rqst,
- netlogon_dissect_netrlogongettimeserviceparentdomain_reply },
- { NETLOGON_NETRENUMERATETRUSTEDDOMAINSEX, "NetrEnumerateTrustedDomainsEx",
- netlogon_dissect_netrenumeratetrusteddomainsex_rqst,
- netlogon_dissect_netrenumeratetrusteddomainsex_reply },
- { NETLOGON_DSRADDRESSTOSITENAMESEXW, "DsrAddressToSiteNamesExW",
- netlogon_dissect_dsraddresstositenamesexw_rqst,
- netlogon_dissect_dsraddresstositenamesexw_reply },
- { NETLOGON_DSRGETDCSITECOVERAGEW, "DsrGetDcSiteCoverageW",
- netlogon_dissect_dsrgetdcsitecoveragew_rqst,
- netlogon_dissect_dsrgetdcsitecoveragew_reply },
- { NETLOGON_NETRLOGONSAMLOGONEX, "NetrLogonSamLogonEx",
- netlogon_dissect_netrlogonsamlogonex_rqst,
- netlogon_dissect_netrlogonsamlogonex_reply },
- { NETLOGON_DSRENUMERATEDOMAINTRUSTS, "DsrEnumerateDomainTrusts",
- netlogon_dissect_dsrenumeratedomaintrusts_rqst,
- netlogon_dissect_dsrenumeratedomaintrusts_reply },
- { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DsrDeregisterDnsHostRecords",
- netlogon_dissect_dsrderegisterdnshostrecords_rqst,
- netlogon_dissect_dsrderegisterdnshostrecords_reply },
- { NETLOGON_NETRSERVERTRUSTPASSWORDSGET, "NetrServerTrustPasswordsGet",
- NULL, NULL },
- { NETLOGON_DSRGETFORESTTRUSTINFORMATION, "DsrGetForestTrustInformation",
- NULL, NULL },
- { NETLOGON_NETRGETFORESTTRUSTINFORMATION, "NetrGetForestTrustInformation",
- NULL, NULL },
- { NETLOGON_NETRLOGONSAMLOGONWITHFLAGS, "NetrLogonSamLogonWithFlags",
- netlogon_dissect_netrlogonsamlogonflags_rqst,
- netlogon_dissect_netrlogonsamlogonflags_reply },
- { NETLOGON_NETRSERVERGETTRUSTINFO, "NetrServerGetTrustInfo",
- NULL, NULL },
- {0, NULL, NULL, NULL }
+ { NETLOGON_NETRLOGONUASLOGON, "NetrLogonUasLogon",
+ netlogon_dissect_netrlogonuaslogon_rqst,
+ netlogon_dissect_netrlogonuaslogon_reply },
+ { NETLOGON_NETRLOGONUASLOGOFF, "NetrLogonUasLogoff",
+ netlogon_dissect_netrlogonuaslogoff_rqst,
+ netlogon_dissect_netrlogonuaslogoff_reply },
+ { NETLOGON_NETRLOGONSAMLOGON, "NetrLogonSamLogon",
+ netlogon_dissect_netrlogonsamlogon_rqst,
+ netlogon_dissect_netrlogonsamlogon_reply },
+ { NETLOGON_NETRLOGONSAMLOGOFF, "NetrLogonSamLogoff",
+ netlogon_dissect_netrlogonsamlogoff_rqst,
+ netlogon_dissect_netrlogonsamlogoff_reply },
+ { NETLOGON_NETRSERVERREQCHALLENGE, "NetrServerReqChallenge",
+ netlogon_dissect_netrserverreqchallenge_rqst,
+ netlogon_dissect_netrserverreqchallenge_reply },
+ { NETLOGON_NETRSERVERAUTHENTICATE, "NetrServerAuthenticate",
+ netlogon_dissect_netrserverauthenticate_rqst,
+ netlogon_dissect_netrserverauthenticate_reply },
+ { NETLOGON_NETRSERVERPASSWORDSET, "NetrServerPasswordSet",
+ netlogon_dissect_netrserverpasswordset_rqst,
+ netlogon_dissect_netrserverpasswordset_reply },
+ { NETLOGON_NETRDATABASEDELTAS, "NetrDatabaseDeltas",
+ netlogon_dissect_netrdatabasedeltas_rqst,
+ netlogon_dissect_netrdatabasedeltas_reply },
+ { NETLOGON_NETRDATABASESYNC, "NetrDatabaseSync",
+ netlogon_dissect_netrdatabasesync_rqst,
+ netlogon_dissect_netrdatabasesync_reply },
+ { NETLOGON_NETRACCOUNTDELTAS, "NetrAccountDeltas",
+ netlogon_dissect_netraccountdeltas_rqst,
+ netlogon_dissect_netraccountdeltas_reply },
+ { NETLOGON_NETRACCOUNTSYNC, "NetrAccountSync",
+ netlogon_dissect_netraccountsync_rqst,
+ netlogon_dissect_netraccountsync_reply },
+ { NETLOGON_NETRGETDCNAME, "NetrGetDCName",
+ netlogon_dissect_netrgetdcname_rqst,
+ netlogon_dissect_netrgetdcname_reply },
+ { NETLOGON_NETRLOGONCONTROL, "NetrLogonControl",
+ netlogon_dissect_netrlogoncontrol_rqst,
+ netlogon_dissect_netrlogoncontrol_reply },
+ { NETLOGON_NETRGETANYDCNAME, "NetrGetAnyDCName",
+ netlogon_dissect_netrgetanydcname_rqst,
+ netlogon_dissect_netrgetanydcname_reply },
+ { NETLOGON_NETRLOGONCONTROL2, "NetrLogonControl2",
+ netlogon_dissect_netrlogoncontrol2_rqst,
+ netlogon_dissect_netrlogoncontrol2_reply },
+ { NETLOGON_NETRSERVERAUTHENTICATE2, "NetrServerAuthenticate2",
+ netlogon_dissect_netrserverauthenticate2_rqst,
+ netlogon_dissect_netrserverauthenticate2_reply },
+ { NETLOGON_NETRDATABASESYNC2, "NetrDatabaseSync2",
+ netlogon_dissect_netrdatabasesync2_rqst,
+ netlogon_dissect_netrdatabasesync2_reply },
+ { NETLOGON_NETRDATABASEREDO, "NetrDatabaseRedo",
+ netlogon_dissect_netrdatabaseredo_rqst,
+ netlogon_dissect_netrdatabaseredo_reply },
+ { NETLOGON_NETRLOGONCONTROL2EX, "NetrLogonControl2Ex",
+ netlogon_dissect_netrlogoncontrol2ex_rqst,
+ netlogon_dissect_netrlogoncontrol2ex_reply },
+ { NETLOGON_NETRENUMERATETRUSTEDDOMAINS, "NetrEnumerateTrustedDomains",
+ netlogon_dissect_netrenumeratetrusteddomains_rqst,
+ netlogon_dissect_netrenumeratetrusteddomains_reply },
+ { NETLOGON_DSRGETDCNAME, "DsrGetDcName",
+ netlogon_dissect_dsrgetdcname_rqst,
+ netlogon_dissect_dsrgetdcname_reply },
+ { NETLOGON_NETRLOGONDUMMYROUTINE1, "NetrLogonDummyRoutine1",
+ netlogon_dissect_netrlogondummyroutine1_rqst,
+ netlogon_dissect_netrlogondummyroutine1_reply },
+ { NETLOGON_NETRLOGONSETSERVICEBITS, "NetrLogonSetServiceBits",
+ netlogon_dissect_netrlogonsetservicebits_rqst,
+ netlogon_dissect_netrlogonsetservicebits_reply },
+ { NETLOGON_NETRLOGONGETTRUSTRID, "NetrLogonGetTrustRid",
+ netlogon_dissect_netrlogongettrustrid_rqst,
+ netlogon_dissect_netrlogongettrustrid_reply },
+ { NETLOGON_NETRLOGONCOMPUTESERVERDIGEST, "NetrLogonComputeServerDigest",
+ netlogon_dissect_netrlogoncomputeserverdigest_rqst,
+ netlogon_dissect_netrlogoncomputeserverdigest_reply },
+ { NETLOGON_NETRLOGONCOMPUTECLIENTDIGEST, "NetrLogonComputeClientDigest",
+ netlogon_dissect_netrlogoncomputeclientdigest_rqst,
+ netlogon_dissect_netrlogoncomputeclientdigest_reply },
+ { NETLOGON_NETRSERVERAUTHENTICATE3, "NetrServerAuthenticate3",
+ netlogon_dissect_netrserverauthenticate3_rqst,
+ netlogon_dissect_netrserverauthenticate3_reply },
+ { NETLOGON_DSRGETDCNAMEX, "DsrGetDcNameEx",
+ netlogon_dissect_dsrgetdcnameex_rqst,
+ netlogon_dissect_dsrgetdcnameex_reply },
+ { NETLOGON_DSRGETSITENAME, "DsrGetSiteName",
+ netlogon_dissect_dsrgetsitename_rqst,
+ netlogon_dissect_dsrgetsitename_reply },
+ { NETLOGON_NETRLOGONGETDOMAININFO, "NetrLogonGetDomainInfo",
+ netlogon_dissect_netrlogongetdomaininfo_rqst,
+ netlogon_dissect_netrlogongetdomaininfo_reply },
+ { NETLOGON_NETRSERVERPASSWORDSET2, "NetrServerPasswordSet2",
+ netlogon_dissect_netrserverpasswordset2_rqst,
+ netlogon_dissect_netrserverpasswordset2_reply },
+ { NETLOGON_NETRSERVERPASSWORDGET, "NetrServerPasswordGet",
+ netlogon_dissect_netrserverpasswordget_rqst,
+ netlogon_dissect_netrserverpasswordget_reply },
+ { NETLOGON_NETRLOGONSENDTOSAM, "NetrLogonSendToSam",
+ netlogon_dissect_netrlogonsendtosam_rqst,
+ netlogon_dissect_netrlogonsendtosam_reply },
+ { NETLOGON_DSRADDRESSTOSITENAMESW, "DsrAddressToSiteNamesW",
+ netlogon_dissect_dsraddresstositenamesw_rqst,
+ netlogon_dissect_dsraddresstositenamesw_reply },
+ { NETLOGON_DSRGETDCNAMEEX2, "DsrGetDcNameEx2",
+ netlogon_dissect_dsrgetdcnameex2_rqst,
+ netlogon_dissect_dsrgetdcnameex2_reply },
+ { NETLOGON_NETRLOGONGETTIMESERVICEPARENTDOMAIN,
+ "NetrLogonGetTimeServiceParentDomain",
+ netlogon_dissect_netrlogongettimeserviceparentdomain_rqst,
+ netlogon_dissect_netrlogongettimeserviceparentdomain_reply },
+ { NETLOGON_NETRENUMERATETRUSTEDDOMAINSEX, "NetrEnumerateTrustedDomainsEx",
+ netlogon_dissect_netrenumeratetrusteddomainsex_rqst,
+ netlogon_dissect_netrenumeratetrusteddomainsex_reply },
+ { NETLOGON_DSRADDRESSTOSITENAMESEXW, "DsrAddressToSiteNamesExW",
+ netlogon_dissect_dsraddresstositenamesexw_rqst,
+ netlogon_dissect_dsraddresstositenamesexw_reply },
+ { NETLOGON_DSRGETDCSITECOVERAGEW, "DsrGetDcSiteCoverageW",
+ netlogon_dissect_dsrgetdcsitecoveragew_rqst,
+ netlogon_dissect_dsrgetdcsitecoveragew_reply },
+ { NETLOGON_NETRLOGONSAMLOGONEX, "NetrLogonSamLogonEx",
+ netlogon_dissect_netrlogonsamlogonex_rqst,
+ netlogon_dissect_netrlogonsamlogonex_reply },
+ { NETLOGON_DSRENUMERATEDOMAINTRUSTS, "DsrEnumerateDomainTrusts",
+ netlogon_dissect_dsrenumeratedomaintrusts_rqst,
+ netlogon_dissect_dsrenumeratedomaintrusts_reply },
+ { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DsrDeregisterDnsHostRecords",
+ netlogon_dissect_dsrderegisterdnshostrecords_rqst,
+ netlogon_dissect_dsrderegisterdnshostrecords_reply },
+ { NETLOGON_NETRSERVERTRUSTPASSWORDSGET, "NetrServerTrustPasswordsGet",
+ NULL, NULL },
+ { NETLOGON_DSRGETFORESTTRUSTINFORMATION, "DsrGetForestTrustInformation",
+ NULL, NULL },
+ { NETLOGON_NETRGETFORESTTRUSTINFORMATION, "NetrGetForestTrustInformation",
+ NULL, NULL },
+ { NETLOGON_NETRLOGONSAMLOGONWITHFLAGS, "NetrLogonSamLogonWithFlags",
+ netlogon_dissect_netrlogonsamlogonflags_rqst,
+ netlogon_dissect_netrlogonsamlogonflags_reply },
+ { NETLOGON_NETRSERVERGETTRUSTINFO, "NetrServerGetTrustInfo",
+ NULL, NULL },
+ {0, NULL, NULL, NULL }
- { &hf_netlogon_dc_flags_timeserv_flag,
- { "Timeserv", "netlogon.dc.flags.timeserv",
- FT_BOOLEAN, 32, TFS(&dc_flags_timeserv_flag), DS_TIMESERV_FLAG,
- "If this server is a TimeServer", HFILL }},
-
- { &hf_netlogon_dc_flags_closest_flag,
- { "Closest", "netlogon.dc.flags.closest",
- FT_BOOLEAN, 32, TFS(&dc_flags_closest_flag), DS_CLOSEST_FLAG,
- "If this is the closest server", HFILL }},
-
- { &hf_netlogon_dc_flags_writable_flag,
- { "Writable", "netlogon.dc.flags.writable",
- FT_BOOLEAN, 32, TFS(&dc_flags_writable_flag), DS_WRITABLE_FLAG,
- "If this server can do updates to the database", HFILL }},
-
- { &hf_netlogon_dc_flags_good_timeserv_flag,
- { "Good Timeserv", "netlogon.dc.flags.good_timeserv",
- FT_BOOLEAN, 32, TFS(&dc_flags_good_timeserv_flag), DS_GOOD_TIMESERV_FLAG,
- "If this is a Good TimeServer", HFILL }},
-
- { &hf_netlogon_dc_flags_ndnc_flag,
- { "NDNC", "netlogon.dc.flags.ndnc",
- FT_BOOLEAN, 32, TFS(&dc_flags_ndnc_flag), DS_NDNC_FLAG,
- "If this is an NDNC server", HFILL }},
-
- { &hf_netlogon_dc_flags_dns_controller_flag,
- { "DNS Controller", "netlogon.dc.flags.dns_controller",
- FT_BOOLEAN, 32, TFS(&dc_flags_dns_controller_flag), DS_DNS_CONTROLLER_FLAG,
- "If this server is a DNS Controller", HFILL }},
-
- { &hf_netlogon_dc_flags_dns_domain_flag,
- { "DNS Domain", "netlogon.dc.flags.dns_domain",
- FT_BOOLEAN, 32, TFS(&dc_flags_dns_domain_flag), DS_DNS_DOMAIN_FLAG,
- NULL, HFILL }},
-
- { &hf_netlogon_dc_flags_dns_forest_flag,
- { "DNS Forest", "netlogon.dc.flags.dns_forest",
- FT_BOOLEAN, 32, TFS(&dc_flags_dns_forest_flag), DS_DNS_FOREST_FLAG,
- NULL, HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags,
- { "Flags", "netlogon.get_dcname.request.flags", FT_UINT32, BASE_HEX,
- NULL, 0x0, "Flags for DSGetDCName request", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_force_rediscovery,
- { "Force Rediscovery", "netlogon.get_dcname.request.flags.force_rediscovery",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_force_rediscovery), DS_FORCE_REDISCOVERY,
- "Whether to allow the server to returned cached information or not", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_directory_service_required,
- { "DS Required", "netlogon.get_dcname.request.flags.ds_required",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_required), DS_DIRECTORY_SERVICE_REQUIRED,
- "Whether we require that the returned DC supports w2k or not", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_directory_service_preferred,
- { "DS Preferred", "netlogon.get_dcname.request.flags.ds_preferred",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_preferred), DS_DIRECTORY_SERVICE_PREFERRED,
- "Whether we prefer the call to return a w2k server (if available)", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_gc_server_required,
- { "GC Required", "netlogon.get_dcname.request.flags.gc_server_required",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_gc_server_required), DS_GC_SERVER_REQUIRED,
- "Whether we require that the returned DC is a Global Catalog server", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_pdc_required,
- { "PDC Required", "netlogon.get_dcname.request.flags.pdc_required",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_pdc_required), DS_PDC_REQUIRED,
- "Whether we require the returned DC to be the PDC", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_background_only,
- { "Background Only", "netlogon.get_dcname.request.flags.background_only",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_background_only), DS_BACKGROUND_ONLY,
- "If we want cached data, even if it may have expired", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_ip_required,
- { "IP Required", "netlogon.get_dcname.request.flags.ip_required",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_ip_required), DS_IP_REQUIRED,
- "If we requre the IP of the DC in the reply", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_kdc_required,
- { "KDC Required", "netlogon.get_dcname.request.flags.kdc_required",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_kdc_required), DS_KDC_REQUIRED,
- "If we require that the returned server is a KDC", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_timeserv_required,
- { "Timeserv Required", "netlogon.get_dcname.request.flags.timeserv_required",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_timeserv_required), DS_TIMESERV_REQUIRED,
- "If we require the returned server to be a WindowsTimeServ server", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_writable_required,
- { "Writable Required", "netlogon.get_dcname.request.flags.writable_required",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_writable_required), DS_WRITABLE_REQUIRED,
- "If we require that the returned server is writable", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_good_timeserv_preferred,
- { "Timeserv Preferred", "netlogon.get_dcname.request.flags.good_timeserv_preferred",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_good_timeserv_preferred), DS_GOOD_TIMESERV_PREFERRED,
- "If we prefer Windows Time Servers", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_avoid_self,
- { "Avoid Self", "netlogon.get_dcname.request.flags.avoid_self",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_avoid_self), DS_AVOID_SELF,
- "Return another DC than the one we ask", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_only_ldap_needed,
- { "Only LDAP Needed", "netlogon.get_dcname.request.flags.only_ldap_needed",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_only_ldap_needed), DS_ONLY_LDAP_NEEDED,
- "We just want an LDAP server, it does not have to be a DC", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_is_flat_name,
- { "Is Flat Name", "netlogon.get_dcname.request.flags.is_flat_name",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_flat_name), DS_IS_FLAT_NAME,
- "If the specified domain name is a NetBIOS name", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_is_dns_name,
- { "Is DNS Name", "netlogon.get_dcname.request.flags.is_dns_name",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_dns_name), DS_IS_DNS_NAME,
- "If the specified domain name is a DNS name", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_return_dns_name,
- { "Return DNS Name", "netlogon.get_dcname.request.flags.return_dns_name",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_dns_name), DS_RETURN_DNS_NAME,
- "Only return a DNS name (or an error)", HFILL }},
-
- { &hf_netlogon_get_dcname_request_flags_return_flat_name,
- { "Return Flat Name", "netlogon.get_dcname.request.flags.return_flat_name",
- FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_flat_name), DS_RETURN_FLAT_NAME,
- "Only return a NetBIOS name (or an error)", HFILL }},
-
- { &hf_netlogon_trust_attribs,
- { "Trust Attributes", "netlogon.trust_attribs", FT_UINT32, BASE_HEX,
- NULL, 0x0, NULL, HFILL }},
-
- { &hf_netlogon_trust_attribs_non_transitive,
- { "Non Transitive", "netlogon.trust.attribs.non_transitive", FT_BOOLEAN, 32,
- TFS(&trust_attribs_non_transitive), 0x00000001, NULL, HFILL }},
-
- { &hf_netlogon_trust_attribs_uplevel_only,
- { "Uplevel Only", "netlogon.trust.attribs.uplevel_only", FT_BOOLEAN, 32,
- TFS(&trust_attribs_uplevel_only), 0x00000002, NULL, HFILL }},
-
- { &hf_netlogon_trust_attribs_quarantined_domain,
- { "Quarantined Domain", "netlogon.trust.attribs.quarantined_domain", FT_BOOLEAN, 32,
- TFS(&trust_attribs_quarantined_domain), 0x00000004, NULL, HFILL }},
-
- { &hf_netlogon_trust_attribs_forest_transitive,
- { "Forest Transitive", "netlogon.trust.attribs.forest_transitive", FT_BOOLEAN, 32,
- TFS(&trust_attribs_forest_transitive), 0x00000008, NULL, HFILL }},
-
- { &hf_netlogon_trust_attribs_cross_organization,
- { "Cross Organization", "netlogon.trust.attribs.cross_organization", FT_BOOLEAN, 32,
- TFS(&trust_attribs_cross_organization), 0x00000010, NULL, HFILL }},
-
- { &hf_netlogon_trust_attribs_within_forest,
- { "Within Forest", "netlogon.trust.attribs.within_forest", FT_BOOLEAN, 32,
- TFS(&trust_attribs_within_forest), 0x00000020, NULL, HFILL }},
-
- { &hf_netlogon_trust_attribs_treat_as_external,
- { "Treat As External", "netlogon.trust.attribs.treat_as_external", FT_BOOLEAN, 32,
- TFS(&trust_attribs_treat_as_external), 0x00000040, NULL, HFILL }},
-
- { &hf_netlogon_trust_type,
- { "Trust Type", "netlogon.trust_type", FT_UINT32, BASE_DEC,
- VALS(trust_type_vals), 0x0, NULL, HFILL }},
-
- { &hf_netlogon_extraflags,
- { "Extra Flags", "netlogon.extra_flags", FT_UINT32, BASE_HEX,
- NULL, 0x0, NULL, HFILL }},
-
- { &hf_netlogon_extra_flags_root_forest,
- { "Request passed to DC of root forest", "netlogon.extra.flags.rootdc",
- FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_ROOT_FOREST,
- NULL, HFILL }},
-
- { &hf_netlogon_trust_flags_dc_firsthop,
- { " DC at the end of the first hop of cross forest", "netlogon.extra.flags.dc_firsthop",
- FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_DC_XFOREST,
- NULL, HFILL }},
-
- { &hf_netlogon_trust_flags_rodc_to_dc,
- { "Request from a RODC to a DC from another domain", "netlogon.extra.flags.rodc_to_dc",
- FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_RODC_DIF_DOMAIN,
- NULL, HFILL }},
-
- { &hf_netlogon_trust_flags_rodc_ntlm,
- { "Request is a NTLM auth passed by a RODC", "netlogon.extra.flags.rodc_ntlm",
- FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_NTLM_FROM_RODC,
- NULL, HFILL }},
-
- { &hf_netlogon_trust_flags,
- { "Trust Flags", "netlogon.trust_flags", FT_UINT32, BASE_HEX,
- NULL, 0x0, NULL, HFILL }},
-
- { &hf_netlogon_trust_flags_inbound,
- { "Inbound Trust", "netlogon.trust.flags.inbound",
- FT_BOOLEAN, 32, TFS(&trust_inbound), DS_DOMAIN_DIRECT_INBOUND,
- "Inbound trust. Whether the domain directly trusts the queried servers domain", HFILL }},
-
- { &hf_netlogon_trust_flags_outbound,
- { "Outbound Trust", "netlogon.trust.flags.outbound",
- FT_BOOLEAN, 32, TFS(&trust_outbound), DS_DOMAIN_DIRECT_OUTBOUND,
- "Outbound Trust. Whether the domain is directly trusted by the servers domain", HFILL }},
-
- { &hf_netlogon_trust_flags_in_forest,
- { "In Forest", "netlogon.trust.flags.in_forest",
- FT_BOOLEAN, 32, TFS(&trust_in_forest), DS_DOMAIN_IN_FOREST,
- "Whether this domain is a member of the same forest as the servers domain", HFILL }},
-
- { &hf_netlogon_trust_flags_native_mode,
- { "Native Mode", "netlogon.trust.flags.native_mode",
- FT_BOOLEAN, 32, TFS(&trust_native_mode), DS_DOMAIN_NATIVE_MODE,
- "Whether the domain is a w2k native mode domain or not", HFILL }},
-
- { &hf_netlogon_trust_flags_primary,
- { "Primary", "netlogon.trust.flags.primary",
- FT_BOOLEAN, 32, TFS(&trust_primary), DS_DOMAIN_PRIMARY,
- "Whether the domain is the primary domain for the queried server or not", HFILL }},
-
- { &hf_netlogon_trust_flags_tree_root,
- { "Tree Root", "netlogon.trust.flags.tree_root",
- FT_BOOLEAN, 32, TFS(&trust_tree_root), DS_DOMAIN_TREE_ROOT,
- "Whether the domain is the root of the tree for the queried server", HFILL }},
-
- { &hf_netlogon_trust_parent_index,
- { "Parent Index", "netlogon.parent_index", FT_UINT32, BASE_HEX,
- NULL, 0x0, NULL, HFILL }},
-
- { &hf_netlogon_logon_time,
- { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time for last time this user logged on", HFILL }},
-
- { &hf_netlogon_kickoff_time,
- { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time when this user will be kicked off", HFILL }},
-
- { &hf_netlogon_logoff_time,
- { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time for last time this user logged off", HFILL }},
-
- { &hf_netlogon_last_logoff_time,
- { "Last Logoff Time", "netlogon.last_logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time for last time this user logged off", HFILL }},
-
- { &hf_netlogon_pwd_last_set_time,
- { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Last time this users password was changed", HFILL }},
-
- { &hf_netlogon_pwd_age,
- { "PWD Age", "netlogon.pwd_age", FT_RELATIVE_TIME, BASE_NONE,
- NULL, 0, "Time since this users password was changed", HFILL }},
-
- { &hf_netlogon_pwd_can_change_time,
- { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "When this users password may be changed", HFILL }},
-
- { &hf_netlogon_pwd_must_change_time,
- { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "When this users password must be changed", HFILL }},
-
- { &hf_netlogon_domain_create_time,
- { "Domain Create Time", "netlogon.domain_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time when this domain was created", HFILL }},
-
- { &hf_netlogon_domain_modify_time,
- { "Domain Modify Time", "netlogon.domain_modify_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time when this domain was last modified", HFILL }},
-
- { &hf_netlogon_db_modify_time,
- { "DB Modify Time", "netlogon.db_modify_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time when last modified", HFILL }},
-
- { &hf_netlogon_db_create_time,
- { "DB Create Time", "netlogon.db_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time when created", HFILL }},
-
- { &hf_netlogon_cipher_current_set_time,
- { "Cipher Current Set Time", "netlogon.cipher_current_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time when current cipher was initiated", HFILL }},
-
- { &hf_netlogon_cipher_old_set_time,
- { "Cipher Old Set Time", "netlogon.cipher_old_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
- NULL, 0, "Time when previous cipher was initiated", HFILL }},
-
- { &hf_netlogon_audit_retention_period,
- { "Audit Retention Period", "netlogon.audit_retention_period", FT_RELATIVE_TIME, BASE_NONE,
- NULL, 0, "Audit retention period", HFILL }},
-
- { &hf_netlogon_timelimit,
- { "Time Limit", "netlogon.time_limit", FT_RELATIVE_TIME, BASE_NONE,
- NULL, 0, NULL, HFILL }},
+ { &hf_netlogon_dc_flags_timeserv_flag,
+ { "Timeserv", "netlogon.dc.flags.timeserv",
+ FT_BOOLEAN, 32, TFS(&dc_flags_timeserv_flag), DS_TIMESERV_FLAG,
+ "If this server is a TimeServer", HFILL }},
+
+ { &hf_netlogon_dc_flags_closest_flag,
+ { "Closest", "netlogon.dc.flags.closest",
+ FT_BOOLEAN, 32, TFS(&dc_flags_closest_flag), DS_CLOSEST_FLAG,
+ "If this is the closest server", HFILL }},
+
+ { &hf_netlogon_dc_flags_writable_flag,
+ { "Writable", "netlogon.dc.flags.writable",
+ FT_BOOLEAN, 32, TFS(&dc_flags_writable_flag), DS_WRITABLE_FLAG,
+ "If this server can do updates to the database", HFILL }},
+
+ { &hf_netlogon_dc_flags_good_timeserv_flag,
+ { "Good Timeserv", "netlogon.dc.flags.good_timeserv",
+ FT_BOOLEAN, 32, TFS(&dc_flags_good_timeserv_flag), DS_GOOD_TIMESERV_FLAG,
+ "If this is a Good TimeServer", HFILL }},
+
+ { &hf_netlogon_dc_flags_ndnc_flag,
+ { "NDNC", "netlogon.dc.flags.ndnc",
+ FT_BOOLEAN, 32, TFS(&dc_flags_ndnc_flag), DS_NDNC_FLAG,
+ "If this is an NDNC server", HFILL }},
+
+ { &hf_netlogon_dc_flags_dns_controller_flag,
+ { "DNS Controller", "netlogon.dc.flags.dns_controller",
+ FT_BOOLEAN, 32, TFS(&dc_flags_dns_controller_flag), DS_DNS_CONTROLLER_FLAG,
+ "If this server is a DNS Controller", HFILL }},
+
+ { &hf_netlogon_dc_flags_dns_domain_flag,
+ { "DNS Domain", "netlogon.dc.flags.dns_domain",
+ FT_BOOLEAN, 32, TFS(&dc_flags_dns_domain_flag), DS_DNS_DOMAIN_FLAG,
+ NULL, HFILL }},
+
+ { &hf_netlogon_dc_flags_dns_forest_flag,
+ { "DNS Forest", "netlogon.dc.flags.dns_forest",
+ FT_BOOLEAN, 32, TFS(&dc_flags_dns_forest_flag), DS_DNS_FOREST_FLAG,
+ NULL, HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags,
+ { "Flags", "netlogon.get_dcname.request.flags", FT_UINT32, BASE_HEX,
+ NULL, 0x0, "Flags for DSGetDCName request", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_force_rediscovery,
+ { "Force Rediscovery", "netlogon.get_dcname.request.flags.force_rediscovery",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_force_rediscovery), DS_FORCE_REDISCOVERY,
+ "Whether to allow the server to returned cached information or not", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_directory_service_required,
+ { "DS Required", "netlogon.get_dcname.request.flags.ds_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_required), DS_DIRECTORY_SERVICE_REQUIRED,
+ "Whether we require that the returned DC supports w2k or not", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_directory_service_preferred,
+ { "DS Preferred", "netlogon.get_dcname.request.flags.ds_preferred",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_preferred), DS_DIRECTORY_SERVICE_PREFERRED,
+ "Whether we prefer the call to return a w2k server (if available)", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_gc_server_required,
+ { "GC Required", "netlogon.get_dcname.request.flags.gc_server_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_gc_server_required), DS_GC_SERVER_REQUIRED,
+ "Whether we require that the returned DC is a Global Catalog server", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_pdc_required,
+ { "PDC Required", "netlogon.get_dcname.request.flags.pdc_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_pdc_required), DS_PDC_REQUIRED,
+ "Whether we require the returned DC to be the PDC", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_background_only,
+ { "Background Only", "netlogon.get_dcname.request.flags.background_only",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_background_only), DS_BACKGROUND_ONLY,
+ "If we want cached data, even if it may have expired", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_ip_required,
+ { "IP Required", "netlogon.get_dcname.request.flags.ip_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_ip_required), DS_IP_REQUIRED,
+ "If we requre the IP of the DC in the reply", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_kdc_required,
+ { "KDC Required", "netlogon.get_dcname.request.flags.kdc_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_kdc_required), DS_KDC_REQUIRED,
+ "If we require that the returned server is a KDC", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_timeserv_required,
+ { "Timeserv Required", "netlogon.get_dcname.request.flags.timeserv_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_timeserv_required), DS_TIMESERV_REQUIRED,
+ "If we require the returned server to be a WindowsTimeServ server", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_writable_required,
+ { "Writable Required", "netlogon.get_dcname.request.flags.writable_required",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_writable_required), DS_WRITABLE_REQUIRED,
+ "If we require that the returned server is writable", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_good_timeserv_preferred,
+ { "Timeserv Preferred", "netlogon.get_dcname.request.flags.good_timeserv_preferred",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_good_timeserv_preferred), DS_GOOD_TIMESERV_PREFERRED,
+ "If we prefer Windows Time Servers", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_avoid_self,
+ { "Avoid Self", "netlogon.get_dcname.request.flags.avoid_self",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_avoid_self), DS_AVOID_SELF,
+ "Return another DC than the one we ask", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_only_ldap_needed,
+ { "Only LDAP Needed", "netlogon.get_dcname.request.flags.only_ldap_needed",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_only_ldap_needed), DS_ONLY_LDAP_NEEDED,
+ "We just want an LDAP server, it does not have to be a DC", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_is_flat_name,
+ { "Is Flat Name", "netlogon.get_dcname.request.flags.is_flat_name",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_flat_name), DS_IS_FLAT_NAME,
+ "If the specified domain name is a NetBIOS name", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_is_dns_name,
+ { "Is DNS Name", "netlogon.get_dcname.request.flags.is_dns_name",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_dns_name), DS_IS_DNS_NAME,
+ "If the specified domain name is a DNS name", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_return_dns_name,
+ { "Return DNS Name", "netlogon.get_dcname.request.flags.return_dns_name",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_dns_name), DS_RETURN_DNS_NAME,
+ "Only return a DNS name (or an error)", HFILL }},
+
+ { &hf_netlogon_get_dcname_request_flags_return_flat_name,
+ { "Return Flat Name", "netlogon.get_dcname.request.flags.return_flat_name",
+ FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_flat_name), DS_RETURN_FLAT_NAME,
+ "Only return a NetBIOS name (or an error)", HFILL }},
+
+ { &hf_netlogon_trust_attribs,
+ { "Trust Attributes", "netlogon.trust_attribs", FT_UINT32, BASE_HEX,
+ NULL, 0x0, NULL, HFILL }},
+
+ { &hf_netlogon_trust_attribs_non_transitive,
+ { "Non Transitive", "netlogon.trust.attribs.non_transitive", FT_BOOLEAN, 32,
+ TFS(&trust_attribs_non_transitive), 0x00000001, NULL, HFILL }},
+
+ { &hf_netlogon_trust_attribs_uplevel_only,
+ { "Uplevel Only", "netlogon.trust.attribs.uplevel_only", FT_BOOLEAN, 32,
+ TFS(&trust_attribs_uplevel_only), 0x00000002, NULL, HFILL }},
+
+ { &hf_netlogon_trust_attribs_quarantined_domain,
+ { "Quarantined Domain", "netlogon.trust.attribs.quarantined_domain", FT_BOOLEAN, 32,
+ TFS(&trust_attribs_quarantined_domain), 0x00000004, NULL, HFILL }},
+
+ { &hf_netlogon_trust_attribs_forest_transitive,
+ { "Forest Transitive", "netlogon.trust.attribs.forest_transitive", FT_BOOLEAN, 32,
+ TFS(&trust_attribs_forest_transitive), 0x00000008, NULL, HFILL }},
+
+ { &hf_netlogon_trust_attribs_cross_organization,
+ { "Cross Organization", "netlogon.trust.attribs.cross_organization", FT_BOOLEAN, 32,
+ TFS(&trust_attribs_cross_organization), 0x00000010, NULL, HFILL }},
+
+ { &hf_netlogon_trust_attribs_within_forest,
+ { "Within Forest", "netlogon.trust.attribs.within_forest", FT_BOOLEAN, 32,
+ TFS(&trust_attribs_within_forest), 0x00000020, NULL, HFILL }},
+
+ { &hf_netlogon_trust_attribs_treat_as_external,
+ { "Treat As External", "netlogon.trust.attribs.treat_as_external", FT_BOOLEAN, 32,
+ TFS(&trust_attribs_treat_as_external), 0x00000040, NULL, HFILL }},
+
+ { &hf_netlogon_trust_type,
+ { "Trust Type", "netlogon.trust_type", FT_UINT32, BASE_DEC,
+ VALS(trust_type_vals), 0x0, NULL, HFILL }},
+
+ { &hf_netlogon_extraflags,
+ { "Extra Flags", "netlogon.extra_flags", FT_UINT32, BASE_HEX,
+ NULL, 0x0, NULL, HFILL }},
+
+ { &hf_netlogon_extra_flags_root_forest,
+ { "Request passed to DC of root forest", "netlogon.extra.flags.rootdc",
+ FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_ROOT_FOREST,
+ NULL, HFILL }},
+
+ { &hf_netlogon_trust_flags_dc_firsthop,
+ { " DC at the end of the first hop of cross forest", "netlogon.extra.flags.dc_firsthop",
+ FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_DC_XFOREST,
+ NULL, HFILL }},
+
+ { &hf_netlogon_trust_flags_rodc_to_dc,
+ { "Request from a RODC to a DC from another domain", "netlogon.extra.flags.rodc_to_dc",
+ FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_RODC_DIF_DOMAIN,
+ NULL, HFILL }},
+
+ { &hf_netlogon_trust_flags_rodc_ntlm,
+ { "Request is a NTLM auth passed by a RODC", "netlogon.extra.flags.rodc_ntlm",
+ FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_NTLM_FROM_RODC,
+ NULL, HFILL }},
+
+ { &hf_netlogon_trust_flags,
+ { "Trust Flags", "netlogon.trust_flags", FT_UINT32, BASE_HEX,
+ NULL, 0x0, NULL, HFILL }},
+
+ { &hf_netlogon_trust_flags_inbound,
+ { "Inbound Trust", "netlogon.trust.flags.inbound",
+ FT_BOOLEAN, 32, TFS(&trust_inbound), DS_DOMAIN_DIRECT_INBOUND,
+ "Inbound trust. Whether the domain directly trusts the queried servers domain", HFILL }},
+
+ { &hf_netlogon_trust_flags_outbound,
+ { "Outbound Trust", "netlogon.trust.flags.outbound",
+ FT_BOOLEAN, 32, TFS(&trust_outbound), DS_DOMAIN_DIRECT_OUTBOUND,
+ "Outbound Trust. Whether the domain is directly trusted by the servers domain", HFILL }},
+
+ { &hf_netlogon_trust_flags_in_forest,
+ { "In Forest", "netlogon.trust.flags.in_forest",
+ FT_BOOLEAN, 32, TFS(&trust_in_forest), DS_DOMAIN_IN_FOREST,
+ "Whether this domain is a member of the same forest as the servers domain", HFILL }},
+
+ { &hf_netlogon_trust_flags_native_mode,
+ { "Native Mode", "netlogon.trust.flags.native_mode",
+ FT_BOOLEAN, 32, TFS(&trust_native_mode), DS_DOMAIN_NATIVE_MODE,
+ "Whether the domain is a w2k native mode domain or not", HFILL }},
+
+ { &hf_netlogon_trust_flags_primary,
+ { "Primary", "netlogon.trust.flags.primary",
+ FT_BOOLEAN, 32, TFS(&trust_primary), DS_DOMAIN_PRIMARY,
+ "Whether the domain is the primary domain for the queried server or not", HFILL }},
+
+ { &hf_netlogon_trust_flags_tree_root,
+ { "Tree Root", "netlogon.trust.flags.tree_root",
+ FT_BOOLEAN, 32, TFS(&trust_tree_root), DS_DOMAIN_TREE_ROOT,
+ "Whether the domain is the root of the tree for the queried server", HFILL }},
+
+ { &hf_netlogon_trust_parent_index,
+ { "Parent Index", "netlogon.parent_index", FT_UINT32, BASE_HEX,
+ NULL, 0x0, NULL, HFILL }},
+
+ { &hf_netlogon_logon_time,
+ { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time for last time this user logged on", HFILL }},
+
+ { &hf_netlogon_kickoff_time,
+ { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time when this user will be kicked off", HFILL }},
+
+ { &hf_netlogon_logoff_time,
+ { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time for last time this user logged off", HFILL }},
+
+ { &hf_netlogon_last_logoff_time,
+ { "Last Logoff Time", "netlogon.last_logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time for last time this user logged off", HFILL }},
+
+ { &hf_netlogon_pwd_last_set_time,
+ { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Last time this users password was changed", HFILL }},
+
+ { &hf_netlogon_pwd_age,
+ { "PWD Age", "netlogon.pwd_age", FT_RELATIVE_TIME, BASE_NONE,
+ NULL, 0, "Time since this users password was changed", HFILL }},
+
+ { &hf_netlogon_pwd_can_change_time,
+ { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "When this users password may be changed", HFILL }},
+
+ { &hf_netlogon_pwd_must_change_time,
+ { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "When this users password must be changed", HFILL }},
+
+ { &hf_netlogon_domain_create_time,
+ { "Domain Create Time", "netlogon.domain_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time when this domain was created", HFILL }},
+
+ { &hf_netlogon_domain_modify_time,
+ { "Domain Modify Time", "netlogon.domain_modify_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time when this domain was last modified", HFILL }},
+
+ { &hf_netlogon_db_modify_time,
+ { "DB Modify Time", "netlogon.db_modify_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time when last modified", HFILL }},
+
+ { &hf_netlogon_db_create_time,
+ { "DB Create Time", "netlogon.db_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time when created", HFILL }},
+
+ { &hf_netlogon_cipher_current_set_time,
+ { "Cipher Current Set Time", "netlogon.cipher_current_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time when current cipher was initiated", HFILL }},
+
+ { &hf_netlogon_cipher_old_set_time,
+ { "Cipher Old Set Time", "netlogon.cipher_old_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
+ NULL, 0, "Time when previous cipher was initiated", HFILL }},
+
+ { &hf_netlogon_audit_retention_period,
+ { "Audit Retention Period", "netlogon.audit_retention_period", FT_RELATIVE_TIME, BASE_NONE,
+ NULL, 0, "Audit retention period", HFILL }},
+
+ { &hf_netlogon_timelimit,
+ { "Time Limit", "netlogon.time_limit", FT_RELATIVE_TIME, BASE_NONE,
+ NULL, 0, NULL, HFILL }},
- { &hf_netlogon_secchan_verf_nonce,
- { "Nonce", "netlogon.secchan.nonce", FT_BYTES, BASE_NONE, NULL,
- 0x0, NULL, HFILL }},
-
- { &hf_netlogon_group_attrs_mandatory,
- { "Mandatory", "netlogon.groups.attrs.mandatory",
- FT_BOOLEAN, 32, TFS(&group_attrs_mandatory), 0x00000001,
- "The group attributes MANDATORY flag", HFILL }},
-
- { &hf_netlogon_group_attrs_enabled_by_default,
- { "Enabled By Default", "netlogon.groups.attrs.enabled_by_default",
- FT_BOOLEAN, 32, TFS(&group_attrs_enabled_by_default), 0x00000002,
- "The group attributes ENABLED_BY_DEFAULT flag", HFILL }},
-
- { &hf_netlogon_group_attrs_enabled,
- { "Enabled", "netlogon.groups.attrs.enabled",
- FT_BOOLEAN, 32, TFS(&group_attrs_enabled), 0x00000004,
- "The group attributes ENABLED flag", HFILL }},
-
- { &hf_netlogon_user_flags_extra_sids,
- { "Extra SIDs", "netlogon.user.flags.extra_sids",
- FT_BOOLEAN, 32, TFS(&user_flags_extra_sids), 0x00000020,
- "The user flags EXTRA_SIDS", HFILL }},
-
- { &hf_netlogon_user_flags_resource_groups,
- { "Resource Groups", "netlogon.user.flags.resource_groups",
- FT_BOOLEAN, 32, TFS(&user_flags_resource_groups), 0x00000200,
- "The user flags RESOURCE_GROUPS", HFILL }},
-
- { &hf_netlogon_user_account_control_dont_require_preauth,
- { "Don't Require PreAuth", "netlogon.user.account_control.dont_require_preauth",
- FT_BOOLEAN, 32, TFS(&user_account_control_dont_require_preauth), 0x00010000,
- "The user account control DONT_REQUIRE_PREAUTH flag", HFILL }},
-
- { &hf_netlogon_user_account_control_use_des_key_only,
- { "Use DES Key Only", "netlogon.user.account_control.use_des_key_only",
- FT_BOOLEAN, 32, TFS(&user_account_control_use_des_key_only), 0x00008000,
- "The user account control use_des_key_only flag", HFILL }},
-
- { &hf_netlogon_user_account_control_not_delegated,
- { "Not Delegated", "netlogon.user.account_control.not_delegated",
- FT_BOOLEAN, 32, TFS(&user_account_control_not_delegated), 0x00004000,
- "The user account control not_delegated flag", HFILL }},
-
- { &hf_netlogon_user_account_control_trusted_for_delegation,
- { "Trusted For Delegation", "netlogon.user.account_control.trusted_for_delegation",
- FT_BOOLEAN, 32, TFS(&user_account_control_trusted_for_delegation), 0x00002000,
- "The user account control trusted_for_delegation flag", HFILL }},
-
- { &hf_netlogon_user_account_control_smartcard_required,
- { "SmartCard Required", "netlogon.user.account_control.smartcard_required",
- FT_BOOLEAN, 32, TFS(&user_account_control_smartcard_required), 0x00001000,
- "The user account control smartcard_required flag", HFILL }},
-
- { &hf_netlogon_user_account_control_encrypted_text_password_allowed,
- { "Encrypted Text Password Allowed", "netlogon.user.account_control.encrypted_text_password_allowed",
- FT_BOOLEAN, 32, TFS(&user_account_control_encrypted_text_password_allowed), 0x00000800,
- "The user account control encrypted_text_password_allowed flag", HFILL }},
-
- { &hf_netlogon_user_account_control_account_auto_locked,
- { "Account Auto Locked", "netlogon.user.account_control.account_auto_locked",
- FT_BOOLEAN, 32, TFS(&user_account_control_account_auto_locked), 0x00000400,
- "The user account control account_auto_locked flag", HFILL }},
-
- { &hf_netlogon_user_account_control_dont_expire_password,
- { "Don't Expire Password", "netlogon.user.account_control.dont_expire_password",
- FT_BOOLEAN, 32, TFS(&user_account_control_dont_expire_password), 0x00000200,
- "The user account control dont_expire_password flag", HFILL }},
-
- { &hf_netlogon_user_account_control_server_trust_account,
- { "Server Trust Account", "netlogon.user.account_control.server_trust_account",
- FT_BOOLEAN, 32, TFS(&user_account_control_server_trust_account), 0x00000100,
- "The user account control server_trust_account flag", HFILL }},
-
- { &hf_netlogon_user_account_control_workstation_trust_account,
- { "Workstation Trust Account", "netlogon.user.account_control.workstation_trust_account",
- FT_BOOLEAN, 32, TFS(&user_account_control_workstation_trust_account), 0x00000080,
- "The user account control workstation_trust_account flag", HFILL }},
-
- { &hf_netlogon_user_account_control_interdomain_trust_account,
- { "Interdomain trust Account", "netlogon.user.account_control.interdomain_trust_account",
- FT_BOOLEAN, 32, TFS(&user_account_control_interdomain_trust_account), 0x00000040,
- "The user account control interdomain_trust_account flag", HFILL }},
-
- { &hf_netlogon_user_account_control_mns_logon_account,
- { "MNS Logon Account", "netlogon.user.account_control.mns_logon_account",
- FT_BOOLEAN, 32, TFS(&user_account_control_mns_logon_account), 0x00000020,
- "The user account control mns_logon_account flag", HFILL }},
-
- { &hf_netlogon_user_account_control_normal_account,
- { "Normal Account", "netlogon.user.account_control.normal_account",
- FT_BOOLEAN, 32, TFS(&user_account_control_normal_account), 0x00000010,
- "The user account control normal_account flag", HFILL }},
-
- { &hf_netlogon_user_account_control_temp_duplicate_account,
- { "Temp Duplicate Account", "netlogon.user.account_control.temp_duplicate_account",
- FT_BOOLEAN, 32, TFS(&user_account_control_temp_duplicate_account), 0x00000008,
- "The user account control temp_duplicate_account flag", HFILL }},
-
- { &hf_netlogon_user_account_control_password_not_required,
- { "Password Not Required", "netlogon.user.account_control.password_not_required",
- FT_BOOLEAN, 32, TFS(&user_account_control_password_not_required), 0x00000004,
- "The user account control password_not_required flag", HFILL }},
-
- { &hf_netlogon_user_account_control_home_directory_required,
- { "Home Directory Required", "netlogon.user.account_control.home_directory_required",
- FT_BOOLEAN, 32, TFS(&user_account_control_home_directory_required), 0x00000002,
- "The user account control home_directory_required flag", HFILL }},
-
- { &hf_netlogon_user_account_control_account_disabled,
- { "Account Disabled", "netlogon.user.account_control.account_disabled",
- FT_BOOLEAN, 32, TFS(&user_account_control_account_disabled), 0x00000001,
- "The user account control account_disabled flag", HFILL }},
+ { &hf_netlogon_group_attrs_mandatory,
+ { "Mandatory", "netlogon.groups.attrs.mandatory",
+ FT_BOOLEAN, 32, TFS(&group_attrs_mandatory), 0x00000001,
+ "The group attributes MANDATORY flag", HFILL }},
+
+ { &hf_netlogon_group_attrs_enabled_by_default,
+ { "Enabled By Default", "netlogon.groups.attrs.enabled_by_default",
+ FT_BOOLEAN, 32, TFS(&group_attrs_enabled_by_default), 0x00000002,
+ "The group attributes ENABLED_BY_DEFAULT flag", HFILL }},
+
+ { &hf_netlogon_group_attrs_enabled,
+ { "Enabled", "netlogon.groups.attrs.enabled",
+ FT_BOOLEAN, 32, TFS(&group_attrs_enabled), 0x00000004,
+ "The group attributes ENABLED flag", HFILL }},
+
+ { &hf_netlogon_user_flags_extra_sids,
+ { "Extra SIDs", "netlogon.user.flags.extra_sids",
+ FT_BOOLEAN, 32, TFS(&user_flags_extra_sids), 0x00000020,
+ "The user flags EXTRA_SIDS", HFILL }},
+
+ { &hf_netlogon_user_flags_resource_groups,
+ { "Resource Groups", "netlogon.user.flags.resource_groups",
+ FT_BOOLEAN, 32, TFS(&user_flags_resource_groups), 0x00000200,
+ "The user flags RESOURCE_GROUPS", HFILL }},
+
+ { &hf_netlogon_user_account_control_dont_require_preauth,
+ { "Don't Require PreAuth", "netlogon.user.account_control.dont_require_preauth",
+ FT_BOOLEAN, 32, TFS(&user_account_control_dont_require_preauth), 0x00010000,
+ "The user account control DONT_REQUIRE_PREAUTH flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_use_des_key_only,
+ { "Use DES Key Only", "netlogon.user.account_control.use_des_key_only",
+ FT_BOOLEAN, 32, TFS(&user_account_control_use_des_key_only), 0x00008000,
+ "The user account control use_des_key_only flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_not_delegated,
+ { "Not Delegated", "netlogon.user.account_control.not_delegated",
+ FT_BOOLEAN, 32, TFS(&user_account_control_not_delegated), 0x00004000,
+ "The user account control not_delegated flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_trusted_for_delegation,
+ { "Trusted For Delegation", "netlogon.user.account_control.trusted_for_delegation",
+ FT_BOOLEAN, 32, TFS(&user_account_control_trusted_for_delegation), 0x00002000,
+ "The user account control trusted_for_delegation flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_smartcard_required,
+ { "SmartCard Required", "netlogon.user.account_control.smartcard_required",
+ FT_BOOLEAN, 32, TFS(&user_account_control_smartcard_required), 0x00001000,
+ "The user account control smartcard_required flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_encrypted_text_password_allowed,
+ { "Encrypted Text Password Allowed", "netlogon.user.account_control.encrypted_text_password_allowed",
+ FT_BOOLEAN, 32, TFS(&user_account_control_encrypted_text_password_allowed), 0x00000800,
+ "The user account control encrypted_text_password_allowed flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_account_auto_locked,
+ { "Account Auto Locked", "netlogon.user.account_control.account_auto_locked",
+ FT_BOOLEAN, 32, TFS(&user_account_control_account_auto_locked), 0x00000400,
+ "The user account control account_auto_locked flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_dont_expire_password,
+ { "Don't Expire Password", "netlogon.user.account_control.dont_expire_password",
+ FT_BOOLEAN, 32, TFS(&user_account_control_dont_expire_password), 0x00000200,
+ "The user account control dont_expire_password flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_server_trust_account,
+ { "Server Trust Account", "netlogon.user.account_control.server_trust_account",
+ FT_BOOLEAN, 32, TFS(&user_account_control_server_trust_account), 0x00000100,
+ "The user account control server_trust_account flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_workstation_trust_account,
+ { "Workstation Trust Account", "netlogon.user.account_control.workstation_trust_account",
+ FT_BOOLEAN, 32, TFS(&user_account_control_workstation_trust_account), 0x00000080,
+ "The user account control workstation_trust_account flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_interdomain_trust_account,
+ { "Interdomain trust Account", "netlogon.user.account_control.interdomain_trust_account",
+ FT_BOOLEAN, 32, TFS(&user_account_control_interdomain_trust_account), 0x00000040,
+ "The user account control interdomain_trust_account flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_mns_logon_account,
+ { "MNS Logon Account", "netlogon.user.account_control.mns_logon_account",
+ FT_BOOLEAN, 32, TFS(&user_account_control_mns_logon_account), 0x00000020,
+ "The user account control mns_logon_account flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_normal_account,
+ { "Normal Account", "netlogon.user.account_control.normal_account",
+ FT_BOOLEAN, 32, TFS(&user_account_control_normal_account), 0x00000010,
+ "The user account control normal_account flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_temp_duplicate_account,
+ { "Temp Duplicate Account", "netlogon.user.account_control.temp_duplicate_account",
+ FT_BOOLEAN, 32, TFS(&user_account_control_temp_duplicate_account), 0x00000008,
+ "The user account control temp_duplicate_account flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_password_not_required,
+ { "Password Not Required", "netlogon.user.account_control.password_not_required",
+ FT_BOOLEAN, 32, TFS(&user_account_control_password_not_required), 0x00000004,
+ "The user account control password_not_required flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_home_directory_required,
+ { "Home Directory Required", "netlogon.user.account_control.home_directory_required",
+ FT_BOOLEAN, 32, TFS(&user_account_control_home_directory_required), 0x00000002,
+ "The user account control home_directory_required flag", HFILL }},
+
+ { &hf_netlogon_user_account_control_account_disabled,
+ { "Account Disabled", "netlogon.user.account_control.account_disabled",
+ FT_BOOLEAN, 32, TFS(&user_account_control_account_disabled), 0x00000001,
+ "The user account control account_disabled flag", HFILL }},