diff options
Diffstat (limited to 'epan/dissectors/packet-dcerpc-netlogon.c')
| -rw-r--r-- | epan/dissectors/packet-dcerpc-netlogon.c | 9743 |
1 files changed, 9743 insertions, 0 deletions
diff --git a/epan/dissectors/packet-dcerpc-netlogon.c b/epan/dissectors/packet-dcerpc-netlogon.c new file mode 100644 index 00000000..0e4623fd --- /dev/null +++ b/epan/dissectors/packet-dcerpc-netlogon.c @@ -0,0 +1,9743 @@ +/* packet-dcerpc-netlogon.c + * Routines for SMB \PIPE\NETLOGON packet disassembly + * Copyright 2001,2003 Tim Potter <tpot@samba.org> + * 2002 structure and command dissectors by Ronnie Sahlberg + * + * Wireshark - Network traffic analyzer + * By Gerald Combs <gerald@wireshark.org> + * Copyright 1998 Gerald Combs + * + * SPDX-License-Identifier: GPL-2.0-or-later + */ + +#include "config.h" + + +#include <epan/packet.h> +#include <epan/expert.h> +#include <wsutil/wsgcrypt.h> +#include <wsutil/wslog.h> + +/* for dissect_mscldap_string */ +#include "packet-ldap.h" +#include "packet-dcerpc.h" +#include "packet-dcerpc-nt.h" +#include "packet-dcerpc-netlogon.h" +#include "packet-windows-common.h" +#include "packet-dcerpc-lsa.h" +#include "packet-ntlmssp.h" +#include "packet-dcerpc-misc.h" +/* for keytab format */ +#include <epan/asn1.h> +#include "packet-kerberos.h" +/* for routines to read the keytab file */ +#include "read_keytab_file.h" +/* for decoding */ + +void proto_register_dcerpc_netlogon(void); +void proto_reg_handoff_dcerpc_netlogon(void); + +#ifdef DEBUG_NETLOGON +#include <stdio.h> +#define debugprintf(...) fprintf(stderr,__VA_ARGS__) +static void printnbyte(const guint8* tab,int nb,const char* txt,const char* txt2) +{ + int i=0; + debugprintf("%s ",txt); + for(i=0;i<nb;i++) + { + debugprintf("%02X ",*(tab+i)); + } + debugprintf("%s",txt2); +} +#else +#define debugprintf(...) +static void printnbyte(const guint8* tab _U_,int nb _U_,const char* txt _U_,const char* txt2 _U_) {} +#endif + +#define NETLOGON_FLAG_80000000 0x80000000 +#define NETLOGON_FLAG_40000000 0x40000000 +#define NETLOGON_FLAG_20000000 0x20000000 +#define NETLOGON_FLAG_10000000 0x10000000 +#define NETLOGON_FLAG_8000000 0x8000000 +#define NETLOGON_FLAG_4000000 0x4000000 +#define NETLOGON_FLAG_2000000 0x2000000 +#define NETLOGON_FLAG_AES 0x1000000 +#define NETLOGON_FLAG_800000 0x800000 +#define NETLOGON_FLAG_400000 0x400000 +#define NETLOGON_FLAG_200000 0x200000 +#define NETLOGON_FLAG_100000 0x100000 +#define NETLOGON_FLAG_80000 0x80000 +#define NETLOGON_FLAG_40000 0x40000 +#define NETLOGON_FLAG_20000 0x20000 +#define NETLOGON_FLAG_10000 0x10000 +#define NETLOGON_FLAG_8000 0x8000 +#define NETLOGON_FLAG_STRONGKEY 0x4000 +#define NETLOGON_FLAG_2000 0x2000 +#define NETLOGON_FLAG_1000 0x1000 +#define NETLOGON_FLAG_800 0x800 +#define NETLOGON_FLAG_400 0x400 +#define NETLOGON_FLAG_200 0x200 +#define NETLOGON_FLAG_100 0x100 +#define NETLOGON_FLAG_80 0x80 +#define NETLOGON_FLAG_40 0x40 +#define NETLOGON_FLAG_20 0x20 +#define NETLOGON_FLAG_10 0x10 +#define NETLOGON_FLAG_8 0x8 +#define NETLOGON_FLAG_4 0x4 +#define NETLOGON_FLAG_2 0x2 +#define NETLOGON_FLAG_1 0x1 + +static wmem_map_t *netlogon_auths=NULL; +#if 0 +static wmem_map_t *schannel_auths; +#endif +static gint hf_netlogon_TrustedDomainName_string = -1; +static gint hf_netlogon_UserName_string = -1; +static gint DomainInfo_sid = -1; +static gint DnsDomainInfo_sid = -1; +static gint DnsDomainInfo_domain_guid = -1; +static gint DnsDomainInfo_dns_domain = -1; +static gint DnsDomainInfo_dns_forest = -1; +static gint DnsDomainInfo_name = -1; +static int hf_client_challenge = -1; +static int hf_server_rid = -1; +static int hf_server_challenge = -1; +static int hf_client_credential = -1; +static int hf_server_credential = -1; +static int proto_dcerpc_netlogon = -1; +static int hf_netlogon_logon_dnslogondomainname = -1; +static int hf_netlogon_logon_upn = -1; +static int hf_netlogon_group_attrs_mandatory = -1; +static int hf_netlogon_group_attrs_enabled_by_default = -1; +static int hf_netlogon_group_attrs_enabled = -1; +static int hf_netlogon_opnum = -1; +static int hf_netlogon_data_length = -1; +static int hf_netlogon_extraflags = -1; +static int hf_netlogon_extra_flags_root_forest = -1; +static int hf_netlogon_trust_flags_dc_firsthop = -1; +static int hf_netlogon_trust_flags_rodc_to_dc = -1; +static int hf_netlogon_trust_flags_rodc_ntlm = -1; +static int hf_netlogon_package_name = -1; +static int hf_netlogon_rc = -1; +static int hf_netlogon_dos_rc = -1; +static int hf_netlogon_werr_rc = -1; +static int hf_netlogon_len = -1; +static int hf_netlogon_sensitive_data_flag = -1; +static int hf_netlogon_sensitive_data_len = -1; +static int hf_netlogon_sensitive_data = -1; +static int hf_netlogon_security_information = -1; +static int hf_netlogon_dummy = -1; +static int hf_netlogon_neg_flags = -1; +/* static int hf_netlogon_neg_flags_80000000 = -1; */ +static int hf_netlogon_neg_flags_40000000 = -1; +static int hf_netlogon_neg_flags_20000000 = -1; +/* static int hf_netlogon_neg_flags_10000000 = -1; */ +/* static int hf_netlogon_neg_flags_8000000 = -1; */ +/* static int hf_netlogon_neg_flags_4000000 = -1; */ +/* static int hf_netlogon_neg_flags_2000000 = -1; */ +static int hf_netlogon_neg_flags_1000000 = -1; +/* static int hf_netlogon_neg_flags_800000 = -1; */ +/* static int hf_netlogon_neg_flags_400000 = -1; */ +static int hf_netlogon_neg_flags_200000 = -1; +static int hf_netlogon_neg_flags_100000 = -1; +static int hf_netlogon_neg_flags_80000 = -1; +static int hf_netlogon_neg_flags_40000 = -1; +static int hf_netlogon_neg_flags_20000 = -1; +static int hf_netlogon_neg_flags_10000 = -1; +static int hf_netlogon_neg_flags_8000 = -1; +static int hf_netlogon_neg_flags_4000 = -1; +static int hf_netlogon_neg_flags_2000 = -1; +static int hf_netlogon_neg_flags_1000 = -1; +static int hf_netlogon_neg_flags_800 = -1; +static int hf_netlogon_neg_flags_400 = -1; +static int hf_netlogon_neg_flags_200 = -1; +static int hf_netlogon_neg_flags_100 = -1; +static int hf_netlogon_neg_flags_80 = -1; +static int hf_netlogon_neg_flags_40 = -1; +static int hf_netlogon_neg_flags_20 = -1; +static int hf_netlogon_neg_flags_10 = -1; +static int hf_netlogon_neg_flags_8 = -1; +static int hf_netlogon_neg_flags_4 = -1; +static int hf_netlogon_neg_flags_2 = -1; +static int hf_netlogon_neg_flags_1 = -1; +static int hf_netlogon_minworkingsetsize = -1; +static int hf_netlogon_maxworkingsetsize = -1; +static int hf_netlogon_pagedpoollimit = -1; +static int hf_netlogon_pagefilelimit = -1; +static int hf_netlogon_timelimit = -1; +static int hf_netlogon_nonpagedpoollimit = -1; +/* static int hf_netlogon_pac_size = -1; */ +/* static int hf_netlogon_pac_data = -1; */ +/* static int hf_netlogon_auth_size = -1; */ +/* static int hf_netlogon_auth_data = -1; */ +static int hf_netlogon_cipher_len = -1; +static int hf_netlogon_cipher_maxlen = -1; +static int hf_netlogon_cipher_current_data = -1; +static int hf_netlogon_cipher_current_set_time = -1; +static int hf_netlogon_cipher_old_data = -1; +static int hf_netlogon_cipher_old_set_time = -1; +static int hf_netlogon_priv = -1; +static int hf_netlogon_privilege_entries = -1; +static int hf_netlogon_privilege_control = -1; +static int hf_netlogon_privilege_name = -1; +static int hf_netlogon_systemflags = -1; +static int hf_netlogon_pdc_connection_status = -1; +static int hf_netlogon_tc_connection_status = -1; +static int hf_netlogon_restart_state = -1; +static int hf_netlogon_attrs = -1; +static int hf_netlogon_lsapolicy_len = -1; +/* static int hf_netlogon_lsapolicy_referentid = -1; */ +/* static int hf_netlogon_lsapolicy_pointer = -1; */ +static int hf_netlogon_count = -1; +static int hf_netlogon_entries = -1; +static int hf_netlogon_minpasswdlen = -1; +static int hf_netlogon_passwdhistorylen = -1; +static int hf_netlogon_level16 = -1; +static int hf_netlogon_validation_level = -1; +static int hf_netlogon_reference = -1; +static int hf_netlogon_next_reference = -1; +static int hf_netlogon_timestamp = -1; +static int hf_netlogon_level = -1; +static int hf_netlogon_challenge = -1; +static int hf_netlogon_reserved = -1; +static int hf_netlogon_audit_retention_period = -1; +static int hf_netlogon_auditing_mode = -1; +static int hf_netlogon_max_audit_event_count = -1; +static int hf_netlogon_event_audit_option = -1; +static int hf_netlogon_unknown_string = -1; +static int hf_netlogon_trust_extension = -1; +static int hf_netlogon_trust_max = -1; +static int hf_netlogon_trust_offset = -1; +static int hf_netlogon_trust_len = -1; +static int hf_netlogon_dummy_string = -1; +static int hf_netlogon_dummy_string2 = -1; +static int hf_netlogon_dummy_string3 = -1; +static int hf_netlogon_dummy_string4 = -1; +static int hf_netlogon_dummy_string5 = -1; +static int hf_netlogon_dummy_string6 = -1; +static int hf_netlogon_dummy_string7 = -1; +static int hf_netlogon_dummy_string8 = -1; +static int hf_netlogon_dummy_string9 = -1; +static int hf_netlogon_dummy_string10 = -1; +static int hf_netlogon_unknown_short = -1; +static int hf_netlogon_unknown_long = -1; +static int hf_netlogon_dummy1_long = -1; +static int hf_netlogon_dummy2_long = -1; +static int hf_netlogon_dummy3_long = -1; +static int hf_netlogon_dummy4_long = -1; +static int hf_netlogon_dummy5_long = -1; +static int hf_netlogon_dummy6_long = -1; +static int hf_netlogon_dummy7_long = -1; +static int hf_netlogon_dummy8_long = -1; +static int hf_netlogon_dummy9_long = -1; +static int hf_netlogon_dummy10_long = -1; +static int hf_netlogon_unknown_char = -1; +static int hf_netlogon_logon_time = -1; +static int hf_netlogon_logoff_time = -1; +static int hf_netlogon_last_logoff_time = -1; +static int hf_netlogon_kickoff_time = -1; +static int hf_netlogon_pwd_age = -1; +static int hf_netlogon_pwd_last_set_time = -1; +static int hf_netlogon_pwd_can_change_time = -1; +static int hf_netlogon_pwd_must_change_time = -1; +static int hf_netlogon_nt_chal_resp = -1; +static int hf_netlogon_lm_chal_resp = -1; +static int hf_netlogon_credential = -1; +static int hf_netlogon_acct_name = -1; +static int hf_netlogon_acct_desc = -1; +static int hf_netlogon_group_desc = -1; +static int hf_netlogon_full_name = -1; +static int hf_netlogon_comment = -1; +static int hf_netlogon_parameters = -1; +static int hf_netlogon_logon_script = -1; +static int hf_netlogon_profile_path = -1; +static int hf_netlogon_home_dir = -1; +static int hf_netlogon_dir_drive = -1; +static int hf_netlogon_logon_count = -1; +static int hf_netlogon_logon_count16 = -1; +static int hf_netlogon_bad_pw_count = -1; +static int hf_netlogon_bad_pw_count16 = -1; +static int hf_netlogon_user_rid = -1; +static int hf_netlogon_alias_rid = -1; +static int hf_netlogon_group_rid = -1; +static int hf_netlogon_logon_srv = -1; +/* static int hf_netlogon_principal = -1; */ +static int hf_netlogon_logon_dom = -1; +static int hf_netlogon_resourcegroupcount = -1; +static int hf_netlogon_accountdomaingroupcount = -1; +static int hf_netlogon_domaingroupcount = -1; +static int hf_netlogon_membership_domains_count = -1; +static int hf_netlogon_downlevel_domain_name = -1; +static int hf_netlogon_dns_domain_name = -1; +static int hf_netlogon_ad_client_dns_name = -1; +static int hf_netlogon_domain_name = -1; +static int hf_netlogon_domain_create_time = -1; +static int hf_netlogon_domain_modify_time = -1; +static int hf_netlogon_modify_count = -1; +static int hf_netlogon_db_modify_time = -1; +static int hf_netlogon_db_create_time = -1; +static int hf_netlogon_oem_info = -1; +static int hf_netlogon_serial_number = -1; +static int hf_netlogon_num_rids = -1; +static int hf_netlogon_num_trusts = -1; +static int hf_netlogon_num_controllers = -1; +static int hf_netlogon_num_sid = -1; +static int hf_netlogon_computer_name = -1; +static int hf_netlogon_site_name = -1; +static int hf_netlogon_trusted_dc_name = -1; +static int hf_netlogon_dc_name = -1; +static int hf_netlogon_dc_site_name = -1; +static int hf_netlogon_dns_forest_name = -1; +static int hf_netlogon_dc_address = -1; +static int hf_netlogon_dc_address_type = -1; +static int hf_netlogon_client_site_name = -1; +static int hf_netlogon_workstation = -1; +static int hf_netlogon_workstation_site_name = -1; +static int hf_netlogon_os_version = -1; +static int hf_netlogon_workstation_os = -1; +static int hf_netlogon_workstation_flags = -1; +static int hf_netlogon_supportedenctypes = -1; + +static int hf_netlogon_workstations = -1; +static int hf_netlogon_workstation_fqdn = -1; +static int hf_netlogon_group_name = -1; +static int hf_netlogon_alias_name = -1; +static int hf_netlogon_country = -1; +static int hf_netlogon_codepage = -1; +static int hf_netlogon_flags = -1; +static int hf_netlogon_trust_attribs = -1; +static int hf_netlogon_trust_attribs_non_transitive = -1; +static int hf_netlogon_trust_attribs_uplevel_only = -1; +static int hf_netlogon_trust_attribs_quarantined_domain = -1; +static int hf_netlogon_trust_attribs_forest_transitive = -1; +static int hf_netlogon_trust_attribs_cross_organization = -1; +static int hf_netlogon_trust_attribs_within_forest = -1; +static int hf_netlogon_trust_attribs_treat_as_external = -1; +static int hf_netlogon_trust_type = -1; +static int hf_netlogon_trust_flags = -1; +static int hf_netlogon_trust_flags_inbound = -1; +static int hf_netlogon_trust_flags_outbound = -1; +static int hf_netlogon_trust_flags_in_forest = -1; +static int hf_netlogon_trust_flags_native_mode = -1; +static int hf_netlogon_trust_flags_primary = -1; +static int hf_netlogon_trust_flags_tree_root = -1; +static int hf_netlogon_trust_parent_index = -1; +static int hf_netlogon_user_account_control = -1; +static int hf_netlogon_user_account_control_dont_require_preauth = -1; +static int hf_netlogon_user_account_control_use_des_key_only = -1; +static int hf_netlogon_user_account_control_not_delegated = -1; +static int hf_netlogon_user_account_control_trusted_for_delegation = -1; +static int hf_netlogon_user_account_control_smartcard_required = -1; +static int hf_netlogon_user_account_control_encrypted_text_password_allowed = -1; +static int hf_netlogon_user_account_control_account_auto_locked = -1; +static int hf_netlogon_user_account_control_dont_expire_password = -1; +static int hf_netlogon_user_account_control_server_trust_account = -1; +static int hf_netlogon_user_account_control_workstation_trust_account = -1; +static int hf_netlogon_user_account_control_interdomain_trust_account = -1; +static int hf_netlogon_user_account_control_mns_logon_account = -1; +static int hf_netlogon_user_account_control_normal_account = -1; +static int hf_netlogon_user_account_control_temp_duplicate_account = -1; +static int hf_netlogon_user_account_control_password_not_required = -1; +static int hf_netlogon_user_account_control_home_directory_required = -1; +static int hf_netlogon_user_account_control_account_disabled = -1; +static int hf_netlogon_user_flags = -1; +static int hf_netlogon_user_flags_extra_sids = -1; +static int hf_netlogon_user_flags_resource_groups = -1; +static int hf_netlogon_auth_flags = -1; +static int hf_netlogon_pwd_expired = -1; +static int hf_netlogon_nt_pwd_present = -1; +static int hf_netlogon_lm_pwd_present = -1; +static int hf_netlogon_code = -1; +static int hf_netlogon_database_id = -1; +static int hf_netlogon_sync_context = -1; +static int hf_netlogon_max_size = -1; +static int hf_netlogon_max_log_size = -1; +static int hf_netlogon_dns_host = -1; +static int hf_netlogon_acct_expiry_time = -1; +static int hf_netlogon_encrypted_lm_owf_password = -1; +static int hf_netlogon_lm_owf_password = -1; +static int hf_netlogon_nt_owf_password = -1; +static int hf_netlogon_param_ctrl = -1; +static int hf_netlogon_logon_id = -1; +static int hf_netlogon_num_deltas = -1; +static int hf_netlogon_user_session_key = -1; +static int hf_netlogon_blob_size = -1; +static int hf_netlogon_blob = -1; +static int hf_netlogon_logon_attempts = -1; +static int hf_netlogon_authoritative = -1; +static int hf_netlogon_secure_channel_type = -1; +static int hf_netlogon_logonsrv_handle = -1; +static int hf_netlogon_delta_type = -1; +static int hf_netlogon_get_dcname_request_flags = -1; +static int hf_netlogon_get_dcname_request_flags_force_rediscovery = -1; +static int hf_netlogon_get_dcname_request_flags_directory_service_required = -1; +static int hf_netlogon_get_dcname_request_flags_directory_service_preferred = -1; +static int hf_netlogon_get_dcname_request_flags_gc_server_required = -1; +static int hf_netlogon_get_dcname_request_flags_pdc_required = -1; +static int hf_netlogon_get_dcname_request_flags_background_only = -1; +static int hf_netlogon_get_dcname_request_flags_ip_required = -1; +static int hf_netlogon_get_dcname_request_flags_kdc_required = -1; +static int hf_netlogon_get_dcname_request_flags_timeserv_required = -1; +static int hf_netlogon_get_dcname_request_flags_writable_required = -1; +static int hf_netlogon_get_dcname_request_flags_good_timeserv_preferred = -1; +static int hf_netlogon_get_dcname_request_flags_avoid_self = -1; +static int hf_netlogon_get_dcname_request_flags_only_ldap_needed = -1; +static int hf_netlogon_get_dcname_request_flags_is_flat_name = -1; +static int hf_netlogon_get_dcname_request_flags_is_dns_name = -1; +static int hf_netlogon_get_dcname_request_flags_return_dns_name = -1; +static int hf_netlogon_get_dcname_request_flags_return_flat_name = -1; +static int hf_netlogon_dc_flags = -1; +static int hf_netlogon_dc_flags_pdc_flag = -1; +static int hf_netlogon_dc_flags_gc_flag = -1; +static int hf_netlogon_dc_flags_ldap_flag = -1; +static int hf_netlogon_dc_flags_ds_flag = -1; +static int hf_netlogon_dc_flags_kdc_flag = -1; +static int hf_netlogon_dc_flags_timeserv_flag = -1; +static int hf_netlogon_dc_flags_closest_flag = -1; +static int hf_netlogon_dc_flags_writable_flag = -1; +static int hf_netlogon_dc_flags_good_timeserv_flag = -1; +static int hf_netlogon_dc_flags_ndnc_flag = -1; +static int hf_netlogon_dc_flags_dns_controller_flag = -1; +static int hf_netlogon_dc_flags_dns_domain_flag = -1; +static int hf_netlogon_dc_flags_dns_forest_flag = -1; +/* static int hf_netlogon_dnsdomaininfo = -1; */ +static int hf_netlogon_s4u2proxytarget = -1; +static int hf_netlogon_transitedlistsize = -1; +static int hf_netlogon_transited_service = -1; +static int hf_netlogon_logon_duration = -1; +static int hf_netlogon_time_created = -1; + +static gint ett_nt_counted_longs_as_string = -1; +static gint ett_dcerpc_netlogon = -1; +static gint ett_group_attrs = -1; +static gint ett_user_flags = -1; +static gint ett_user_account_control = -1; +static gint ett_QUOTA_LIMITS = -1; +static gint ett_IDENTITY_INFO = -1; +static gint ett_DELTA_ENUM = -1; +static gint ett_authenticate_flags = -1; +static gint ett_CYPHER_VALUE = -1; +static gint ett_UNICODE_MULTI = -1; +static gint ett_DOMAIN_CONTROLLER_INFO = -1; +static gint ett_UNICODE_STRING_512 = -1; +static gint ett_TYPE_50 = -1; +static gint ett_TYPE_52 = -1; +static gint ett_DELTA_ID_UNION = -1; +static gint ett_TYPE_44 = -1; +static gint ett_DELTA_UNION = -1; +static gint ett_LM_OWF_PASSWORD = -1; +static gint ett_NT_OWF_PASSWORD = -1; +static gint ett_GROUP_MEMBERSHIP = -1; +static gint ett_BLOB = -1; +static gint ett_DS_DOMAIN_TRUSTS = -1; +static gint ett_LSA_POLICY_INFO = -1; +static gint ett_DOMAIN_TRUST_INFO = -1; +static gint ett_trust_flags = -1; +static gint ett_trust_attribs = -1; +static gint ett_get_dcname_request_flags = -1; +static gint ett_dc_flags = -1; +static gint ett_wstr_LOGON_IDENTITY_INFO_string = -1; +static gint ett_domain_group_memberships = -1; +static gint ett_domains_group_memberships = -1; + +static expert_field ei_netlogon_auth_nthash = EI_INIT; +static expert_field ei_netlogon_session_key = EI_INIT; + +typedef struct _netlogon_auth_vars { + guint64 client_challenge; + guint64 server_challenge; + md4_pass nthash; + int auth_fd_num; + guint8 session_key[16]; + guint8 encryption_key[16]; + guint8 sequence[16]; + guint32 flags; + guint64 seq; + guint64 confounder; + guint8 private_type; + gboolean can_decrypt; + char* client_name; + int start; + int next_start; + struct _netlogon_auth_vars *next; +} netlogon_auth_vars; + +typedef struct _seen_packet { + gboolean isseen; + guint32 num; +} seen_packet; + +static seen_packet seen; + +static e_guid_t uuid_dcerpc_netlogon = { + 0x12345678, 0x1234, 0xabcd, + { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0xcf, 0xfb } +}; + +static guint16 ver_dcerpc_netlogon = 1; + +static gint dissect_dcerpc_8bytes (tvbuff_t *tvb, gint offset, packet_info *pinfo _U_, + proto_tree *tree, guint8 *drep, + int hfindex, guint64 *pdata) +{ + guint64 data; + + data = ((drep[0] & DREP_LITTLE_ENDIAN) + ? tvb_get_letoh64 (tvb, offset) + : tvb_get_ntoh64 (tvb, offset)); + + /* These fields are FT_BYTES, hence the byte order doesn't matter */ + if (tree) { + proto_tree_add_item(tree, hfindex, tvb, offset, 8, ENC_NA); + } + if (pdata) + *pdata = data; + return offset+8; +} + +static const true_false_string user_account_control_dont_require_preauth= { + "This account DOESN'T_REQUIRE_PREAUTHENTICATION", + "This account REQUIRES preauthentication", +}; +static const true_false_string user_account_control_use_des_key_only= { + "This account must USE_DES_KEY_ONLY for passwords", + "This account does NOT have to use_des_key_only", +}; +static const true_false_string user_account_control_not_delegated= { + "This account is NOT_DELEGATED", + "This might have been delegated", +}; +static const true_false_string user_account_control_trusted_for_delegation= { + "This account is TRUSTED_FOR_DELEGATION", + "This account is NOT trusted_for_delegation", +}; +static const true_false_string user_account_control_smartcard_required= { + "This account REQUIRES_SMARTCARD to authenticate", + "This account does NOT require_smartcard to authenticate", +}; +static const true_false_string user_account_control_encrypted_text_password_allowed= { + "This account allows ENCRYPTED_TEXT_PASSWORD", + "This account does NOT allow encrypted_text_password", +}; +static const true_false_string user_account_control_account_auto_locked= { + "This account is AUTO_LOCKED", + "This account is NOT auto_locked", +}; +static const true_false_string user_account_control_dont_expire_password= { + "This account DOESN'T_EXPIRE_PASSWORDs", + "This account might expire_passwords", +}; +static const true_false_string user_account_control_server_trust_account= { + "This account is a SERVER_TRUST_ACCOUNT", + "This account is NOT a server_trust_account", +}; +static const true_false_string user_account_control_workstation_trust_account= { + "This account is a WORKSTATION_TRUST_ACCOUNT", + "This account is NOT a workstation_trust_account", +}; +static const true_false_string user_account_control_interdomain_trust_account= { + "This account is an INTERDOMAIN_TRUST_ACCOUNT", + "This account is NOT an interdomain_trust_account", +}; +static const true_false_string user_account_control_mns_logon_account= { + "This account is a MNS_LOGON_ACCOUNT", + "This account is NOT a mns_logon_account", +}; +static const true_false_string user_account_control_normal_account= { + "This account is a NORMAL_ACCOUNT", + "This account is NOT a normal_account", +}; +static const true_false_string user_account_control_temp_duplicate_account= { + "This account is a TEMP_DUPLICATE_ACCOUNT", + "This account is NOT a temp_duplicate_account", +}; +static const true_false_string user_account_control_password_not_required= { + "This account REQUIRES_NO_PASSWORD", + "This account REQUIRES a password", +}; +static const true_false_string user_account_control_home_directory_required= { + "This account REQUIRES_HOME_DIRECTORY", + "This account does NOT require_home_directory", +}; +static const true_false_string user_account_control_account_disabled= { + "This account is DISABLED", + "This account is NOT disabled", +}; + +typedef struct _netlogon_auth_key { + /* + * For now we only match the client and server ip + * addresses, as keys can be used across tcp connections. + * + * Also note that ServerChallenge and ServerAuthenticate + * can be on different tcp connections! + * + * TODO: + * * We could have a challenge table indexed by client, server + * and computer name + * * A good ServerAuthenticate could fill a session key table + * indexed by computer name. + * * A DCERPC bind/alter context could lookup the session key table + * and copy the session key to the DCERPC connection/auth_context. + */ + address client; + address server; +} netlogon_auth_key; + +static gint +netlogon_auth_equal (gconstpointer k1, gconstpointer k2) +{ + const netlogon_auth_key *key1 = (const netlogon_auth_key *)k1; + const netlogon_auth_key *key2 = (const netlogon_auth_key *)k2; + + return (addresses_equal(&key1->client,&key2->client) && addresses_equal(&key1->server,&key2->server)); +} + +static guint +netlogon_auth_hash (gconstpointer k) +{ + const netlogon_auth_key *key1 = (const netlogon_auth_key *)k; + guint hash_val1 = 0; + + hash_val1 = add_address_to_hash(hash_val1, &key1->client); + hash_val1 = add_address_to_hash(hash_val1, &key1->server); + return hash_val1; +} +static int +netlogon_dissect_EXTRA_FLAGS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 mask; + static int * const extraflags[] = { + &hf_netlogon_extra_flags_root_forest, + &hf_netlogon_trust_flags_dc_firsthop, + &hf_netlogon_trust_flags_rodc_to_dc, + &hf_netlogon_trust_flags_rodc_ntlm, + NULL + }; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, + -1, &mask); + + proto_tree_add_bitmask_value_with_flags(parent_tree, tvb, offset-4, hf_netlogon_extraflags, ett_trust_flags, extraflags, mask, BMT_NO_APPEND); + return offset; +} + +struct LOGON_INFO_STATE; + +struct LOGON_INFO_STATE_CB { + struct LOGON_INFO_STATE *state; + ntlmssp_blob *response; + const guint8 **name_ptr; + int name_levels; +}; + +struct LOGON_INFO_STATE { + packet_info *pinfo; + proto_tree *tree; + guint8 server_challenge[8]; + ntlmssp_blob nt_response; + ntlmssp_blob lm_response; + ntlmssp_header_t ntlmssph; + struct LOGON_INFO_STATE_CB domain_cb, acct_cb, host_cb, nt_cb, lm_cb; +}; + +static void dissect_LOGON_INFO_STATE_finish(struct LOGON_INFO_STATE *state) +{ + if (state->ntlmssph.acct_name != NULL && + state->nt_response.length >= 24 && + state->lm_response.length >= 24) + { + if (state->ntlmssph.domain_name == NULL) { + state->ntlmssph.domain_name = ""; + } + if (state->ntlmssph.host_name == NULL) { + state->ntlmssph.host_name = ""; + } + + ntlmssp_create_session_key(state->pinfo, + state->tree, + &state->ntlmssph, + 0, /* NTLMSSP_ flags */ + state->server_challenge, + NULL, /* encryptedsessionkey */ + &state->nt_response, + &state->lm_response); + } +} + +static void dissect_ndr_lm_nt_byte_array(packet_info *pinfo, + proto_tree *tree, + proto_item *item _U_, + dcerpc_info *di, + tvbuff_t *tvb, + int start_offset, + int end_offset, + void *callback_args) +{ + struct LOGON_INFO_STATE_CB *cb_ref = (struct LOGON_INFO_STATE_CB *)callback_args; + struct LOGON_INFO_STATE *state = NULL; + int offset = start_offset; + guint64 tmp; + guint16 len; + + if (cb_ref == NULL) { + return; + } + state = cb_ref->state; + + if (di->conformant_run) { + /* just a run to handle conformant arrays, no scalars to dissect */ + return; + } + + /* NDR array header */ + ALIGN_TO_5_BYTES + if (di->call_data->flags & DCERPC_IS_NDR64) { + offset += 3 * 8; + } else { + offset += 3 * 4; + } + + tmp = end_offset - offset; + if (tmp > NTLMSSP_BLOB_MAX_SIZE) { + tmp = NTLMSSP_BLOB_MAX_SIZE; + } + len = (guint16)tmp; + cb_ref->response->length = len; + cb_ref->response->contents = (guint8 *)tvb_memdup(pinfo->pool, tvb, offset, len); + if (len > 24) { + dissect_ntlmv2_response(tvb, pinfo, tree, offset, len); + } + + dissect_LOGON_INFO_STATE_finish(state); +} + +static int +dissect_ndr_lm_nt_hash_cb(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep, int hf_index, + dcerpc_callback_fnct_t *callback, + void *callback_args) +{ + guint16 len, size; + + /* Structure starts with short, but is aligned for longs */ + + ALIGN_TO_4_BYTES; + + if (di->conformant_run) + return offset; + +#if 0 + struct { + short len; + short size; + [size_is(size/2), length_is(len/2), ptr] unsigned short *string; + } HASH; + +#endif + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_nt_cs_len, &len); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_nt_cs_size, &size); + + offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, di, drep, + dissect_ndr_byte_array, NDR_POINTER_UNIQUE, + "Bytes Array", hf_index, callback, callback_args); + + return offset; +} + +static int +dissect_ndr_lm_nt_hash_helper(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep, int hf_index, + struct LOGON_INFO_STATE_CB *cb_ref) +{ + proto_tree *subtree; + + subtree = proto_tree_add_subtree( + tree, tvb, offset, 0, ett_LM_OWF_PASSWORD, NULL, + proto_registrar_get_name(hf_index)); + + return dissect_ndr_lm_nt_hash_cb( + tvb, offset, pinfo, subtree, di, drep, hf_index, + dissect_ndr_lm_nt_byte_array, cb_ref); +} + +static int +netlogon_dissect_USER_ACCOUNT_CONTROL(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 mask; + static int * const uac[] = { + &hf_netlogon_user_account_control_dont_require_preauth, + &hf_netlogon_user_account_control_use_des_key_only, + &hf_netlogon_user_account_control_not_delegated, + &hf_netlogon_user_account_control_trusted_for_delegation, + &hf_netlogon_user_account_control_smartcard_required, + &hf_netlogon_user_account_control_encrypted_text_password_allowed, + &hf_netlogon_user_account_control_account_auto_locked, + &hf_netlogon_user_account_control_dont_expire_password, + &hf_netlogon_user_account_control_server_trust_account, + &hf_netlogon_user_account_control_workstation_trust_account, + &hf_netlogon_user_account_control_interdomain_trust_account, + &hf_netlogon_user_account_control_mns_logon_account, + &hf_netlogon_user_account_control_normal_account, + &hf_netlogon_user_account_control_temp_duplicate_account, + &hf_netlogon_user_account_control_password_not_required, + &hf_netlogon_user_account_control_home_directory_required, + &hf_netlogon_user_account_control_account_disabled, + NULL + }; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, + -1, &mask); + + proto_tree_add_bitmask_value_with_flags(parent_tree, tvb, offset-4, hf_netlogon_user_account_control, ett_user_account_control, uac, mask, BMT_NO_APPEND); + + return offset; +} + + +static int +netlogon_dissect_LOGONSRV_HANDLE(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Server Handle", + hf_netlogon_logonsrv_handle, 0); + + return offset; +} + +/* + * IDL typedef struct { + * IDL [unique][string] wchar_t *effective_name; + * IDL long priv; + * IDL long auth_flags; + * IDL long logon_count; + * IDL long bad_pw_count; + * IDL long last_logon; + * IDL long last_logoff; + * IDL long logoff_time; + * IDL long kickoff_time; + * IDL long password_age; + * IDL long pw_can_change; + * IDL long pw_must_change; + * IDL [unique][string] wchar_t *computer; + * IDL [unique][string] wchar_t *domain; + * IDL [unique][string] wchar_t *script_path; + * IDL long reserved; + */ +static int +netlogon_dissect_VALIDATION_UAS_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Effective Account", + hf_netlogon_acct_name, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_priv, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_auth_flags, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_count, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_bad_pw_count, NULL); + + + offset = dissect_ndr_time_t(tvb, offset, pinfo, tree, di, drep, hf_netlogon_logon_time, NULL); + + offset = dissect_ndr_time_t(tvb, offset, pinfo, tree, di, drep, hf_netlogon_last_logoff_time, NULL); + + offset = dissect_ndr_time_t(tvb, offset, pinfo, tree, di, drep, hf_netlogon_logoff_time, NULL); + + offset = dissect_ndr_time_t(tvb, offset, pinfo, tree, di, drep, hf_netlogon_kickoff_time, NULL); + + offset = dissect_ndr_time_t(tvb, offset, pinfo, tree, di, drep, hf_netlogon_pwd_age, NULL); + + offset = dissect_ndr_time_t(tvb, offset, pinfo, tree, di, drep, hf_netlogon_pwd_can_change_time, NULL); + + offset = dissect_ndr_time_t(tvb, offset, pinfo, tree, di, drep, hf_netlogon_pwd_must_change_time, NULL); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Computer", hf_netlogon_computer_name, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Script", hf_netlogon_logon_script, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + +/* + * IDL long NetrLogonUasLogon( + * IDL [in][unique][string] wchar_t *ServerName, + * IDL [in][ref][string] wchar_t *UserName, + * IDL [in][ref][string] wchar_t *Workstation, + * IDL [out][unique] VALIDATION_UAS_INFO *info + * IDL ); + */ +static int +netlogon_dissect_netrlogonuaslogon_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Account", hf_netlogon_acct_name, CB_STR_COL_INFO); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Workstation", hf_netlogon_workstation, 0); + + return offset; +} + + +static int +netlogon_dissect_netrlogonuaslogon_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION_UAS_INFO, NDR_POINTER_UNIQUE, + "VALIDATION_UAS_INFO", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + +/* + * IDL typedef struct { + * IDL long duration; + * IDL short logon_count; + * IDL } LOGOFF_UAS_INFO; + */ +static int +netlogon_dissect_LOGOFF_UAS_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 duration; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + duration = tvb_get_guint32(tvb, offset, DREP_ENC_INTEGER(drep)); + proto_tree_add_uint_format_value(tree, hf_netlogon_logon_duration, tvb, offset, 4, duration, "unknown time format"); + offset+= 4; + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_count16, NULL); + + return offset; +} + +/* + * IDL long NetrLogonUasLogoff( + * IDL [in][unique][string] wchar_t *ServerName, + * IDL [in][ref][string] wchar_t *UserName, + * IDL [in][ref][string] wchar_t *Workstation, + * IDL [out][ref] LOGOFF_UAS_INFO *info + * IDL ); + */ +static int +netlogon_dissect_netrlogonuaslogoff_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Account", hf_netlogon_acct_name, CB_STR_COL_INFO); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Workstation", hf_netlogon_workstation, 0); + + return offset; +} + + +static int +netlogon_dissect_netrlogonuaslogoff_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_LOGOFF_UAS_INFO, NDR_POINTER_REF, + "LOGOFF_UAS_INFO", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_BYTE_byte(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_char, NULL); + + return offset; +} + +static int +netlogon_dissect_BYTE_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_byte); + + return offset; +} + + +static void cb_wstr_LOGON_IDENTITY_INFO(packet_info *pinfo, proto_tree *tree, + proto_item *item, dcerpc_info *di, + tvbuff_t *tvb, + int start_offset, int end_offset, + void *callback_args) +{ + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + struct LOGON_INFO_STATE_CB *cb_ref = + (struct LOGON_INFO_STATE_CB *)callback_args; + struct LOGON_INFO_STATE *state = cb_ref->state; + + cb_wstr_postprocess(pinfo, tree, item, di, tvb, start_offset, end_offset, + GINT_TO_POINTER(cb_ref->name_levels)); + + if (*cb_ref->name_ptr == NULL) { + *cb_ref->name_ptr = (const guint8 *)dcv->private_data; + } + + dissect_LOGON_INFO_STATE_finish(state); +} + +static int +dissect_ndr_wstr_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep, + int hf_index, int levels, + struct LOGON_INFO_STATE_CB *cb_ref) +{ + proto_item *item = NULL; + proto_tree *subtree = NULL; + + if (cb_ref == NULL) { + return dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_index, levels); + } + + subtree = proto_tree_add_subtree(tree, tvb, offset, 0, + ett_wstr_LOGON_IDENTITY_INFO_string, &item, + proto_registrar_get_name(hf_index)); + + /* + * Add 2 levels, so that the string gets attached to the + * "Character Array" top-level item and to the top-level item + * added above. + */ + cb_ref->name_levels = 2 + levels; + cb_ref->name_levels |= CB_STR_SAVE; + return dissect_ndr_counted_string_cb(tvb, offset, pinfo, subtree, di, drep, + hf_index, cb_wstr_LOGON_IDENTITY_INFO, cb_ref); +} + +/* + * IDL typedef struct { + * IDL UNICODESTRING LogonDomainName; + * IDL long ParameterControl; + * IDL uint64 LogonID; + * IDL UNICODESTRING UserName; + * IDL UNICODESTRING Workstation; + * IDL } LOGON_IDENTITY_INFO; + */ +static int +netlogon_dissect_LOGON_IDENTITY_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep, + struct LOGON_INFO_STATE *state) +{ + struct LOGON_INFO_STATE_CB *domain_cb = NULL; + struct LOGON_INFO_STATE_CB *acct_cb = NULL; + struct LOGON_INFO_STATE_CB *host_cb = NULL; + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if (state != NULL) { + domain_cb = &state->domain_cb; + acct_cb = &state->acct_cb; + host_cb = &state->host_cb; + } + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_IDENTITY_INFO, &item, "IDENTITY_INFO:"); + } + + /* XXX: It would be nice to get the domain and account name + displayed in COL_INFO. */ + + offset = dissect_ndr_wstr_LOGON_IDENTITY_INFO(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_dom, 0, domain_cb); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_param_ctrl, NULL); + + offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_id, NULL); + + offset = dissect_ndr_wstr_LOGON_IDENTITY_INFO(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_acct_name, 1, acct_cb); + + offset = dissect_ndr_wstr_LOGON_IDENTITY_INFO(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_workstation, 0, host_cb); + +#ifdef REMOVED + /* NetMon does not recognize these bytes. I'll comment them out until someone complains */ + /* XXX 8 extra bytes here */ + /* there were 8 extra bytes, either here or in NETWORK_INFO that does not match + the idl file. Could be a bug in either the NETLOGON implementation or in the + idl file. + */ + offset = netlogon_dissect_8_unknown_bytes(tvb, offset, pinfo, tree, di, drep); +#endif + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + +/* + * IDL typedef struct { + * IDL char password[16]; + * IDL } LM_OWF_PASSWORD; + */ +static int +netlogon_dissect_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep _U_) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect.*/ + return offset; + } + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 16, + ett_LM_OWF_PASSWORD, &item, "LM_OWF_PASSWORD:"); + } + + proto_tree_add_item(tree, hf_netlogon_lm_owf_password, tvb, offset, 16, + ENC_NA); + offset += 16; + + return offset; +} + +/* + * IDL typedef struct { + * IDL char password[16]; + * IDL } NT_OWF_PASSWORD; + */ +static int +netlogon_dissect_NT_OWF_PASSWORD(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep _U_) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect.*/ + return offset; + } + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 16, + ett_NT_OWF_PASSWORD, &item, "NT_OWF_PASSWORD:"); + } + + proto_tree_add_item(tree, hf_netlogon_nt_owf_password, tvb, offset, 16, + ENC_NA); + offset += 16; + + return offset; +} + + +/* + * IDL typedef struct { + * IDL LOGON_IDENTITY_INFO identity_info; + * IDL LM_OWF_PASSWORD lmpassword; + * IDL NT_OWF_PASSWORD ntpassword; + * IDL } INTERACTIVE_INFO; + */ +static int +netlogon_dissect_INTERACTIVE_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset, + pinfo, tree, di, drep, + NULL); + + offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset, + pinfo, tree, di, drep); + + offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + +/* + * IDL typedef struct { + * IDL char chl[8]; + * IDL } CHALLENGE; + */ +static int +netlogon_dissect_CHALLENGE(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + dcerpc_info *di, guint8 *drep _U_) +{ + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect.*/ + return offset; + } + + proto_tree_add_item(tree, hf_netlogon_challenge, tvb, offset, 8, + ENC_NA); + offset += 8; + + return offset; +} + +static int +netlogon_dissect_NETWORK_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + struct LOGON_INFO_STATE *state = + (struct LOGON_INFO_STATE *)di->private_data; + int last_offset; + struct LOGON_INFO_STATE_CB *nt_cb = NULL; + struct LOGON_INFO_STATE_CB *lm_cb = NULL; + + if (state == NULL) { + state = wmem_new0(pinfo->pool, struct LOGON_INFO_STATE); + state->ntlmssph = (ntlmssp_header_t) { .type = NTLMSSP_AUTH, }; + state->domain_cb.state = state; + state->domain_cb.name_ptr = &state->ntlmssph.domain_name; + state->acct_cb.state = state; + state->acct_cb.name_ptr = &state->ntlmssph.acct_name; + state->host_cb.state = state; + state->host_cb.name_ptr = &state->ntlmssph.host_name; + state->nt_cb.state = state; + state->nt_cb.response = &state->nt_response; + state->lm_cb.state = state; + state->lm_cb.response = &state->lm_response; + di->private_data = state; + } + state->pinfo = pinfo; + state->tree = tree; + + offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset, + pinfo, tree, di, drep, + state); + last_offset = offset; + offset = netlogon_dissect_CHALLENGE(tvb, offset, + pinfo, tree, di, drep); + if (offset == (last_offset + 8)) { + tvb_memcpy(tvb, state->server_challenge, last_offset, 8); + nt_cb = &state->nt_cb; + lm_cb = &state->lm_cb; + } + offset = dissect_ndr_lm_nt_hash_helper(tvb,offset,pinfo, tree, di, drep, + hf_netlogon_nt_chal_resp, + nt_cb); + offset = dissect_ndr_lm_nt_hash_helper(tvb,offset,pinfo, tree, di, drep, + hf_netlogon_lm_chal_resp, + lm_cb); + return offset; +} + + +/* + * IDL typedef struct { + * IDL LOGON_IDENTITY_INFO logon_info; + * IDL LM_OWF_PASSWORD lmpassword; + * IDL NT_OWF_PASSWORD ntpassword; + * IDL } SERVICE_INFO; + */ +static int +netlogon_dissect_SERVICE_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset, + pinfo, tree, di, drep, + NULL); + + offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset, + pinfo, tree, di, drep); + + offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + +static int +netlogon_dissect_GENERIC_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGON_IDENTITY_INFO(tvb, offset, + pinfo, tree, di, drep, + NULL); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_package_name, 0|CB_STR_SAVE); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_data_length, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_REF, + "Logon Data", -1); + return offset; +} +/* + * IDL typedef [switch_type(short)] union { + * IDL [case(1)][unique] INTERACTIVE_INFO *iinfo; + * IDL [case(2)][unique] NETWORK_INFO *ninfo; + * IDL [case(3)][unique] SERVICE_INFO *sinfo; + * IDL } LEVEL; + */ +static int +netlogon_dissect_LEVEL(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint16 level = 0; + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level16, &level); + ALIGN_TO_4_BYTES; + switch(level){ + case 1: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_INTERACTIVE_INFO, NDR_POINTER_UNIQUE, + "INTERACTIVE_INFO:", -1); + break; + case 2: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_NETWORK_INFO, NDR_POINTER_UNIQUE, + "NETWORK_INFO:", -1); + break; + case 3: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_SERVICE_INFO, NDR_POINTER_UNIQUE, + "SERVICE_INFO:", -1); + break; + case 4: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_GENERIC_INFO, NDR_POINTER_UNIQUE, + "GENERIC_INFO:", -1); + break; + case 5: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_INTERACTIVE_INFO, NDR_POINTER_UNIQUE, + "INTERACTIVE_TRANSITIVE_INFO:", -1); + break; + case 6: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_NETWORK_INFO, NDR_POINTER_UNIQUE, + "NETWORK_TRANSITIVE_INFO", -1); + break; + case 7: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_SERVICE_INFO, NDR_POINTER_UNIQUE, + "SERVICE_TRANSITIVE_INFO", -1); + break; + } + return offset; +} + +/* + * IDL typedef struct { + * IDL char cred[8]; + * IDL } CREDENTIAL; + */ +static int +netlogon_dissect_CREDENTIAL(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + dcerpc_info *di, guint8 *drep _U_) +{ + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect.*/ + return offset; + } + + proto_tree_add_item(tree, hf_netlogon_credential, tvb, offset, 8, + ENC_NA); + offset += 8; + + return offset; +} + + +/* + * IDL typedef struct { + * IDL CREDENTIAL cred; + * IDL long timestamp; + * IDL } AUTHENTICATOR; + */ +static int +netlogon_dissect_AUTHENTICATOR(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset = netlogon_dissect_CREDENTIAL(tvb, offset, + pinfo, tree, di, drep); + + /* + * XXX - this appears to be a UNIX time_t in some credentials, but + * appears to be random junk in other credentials. + * For example, it looks like a UNIX time_t in "credential" + * AUTHENTICATORs, but like random junk in "return_authenticator" + * AUTHENTICATORs. + */ + ALIGN_TO_4_BYTES; + proto_tree_add_item(tree, hf_netlogon_timestamp, tvb, offset, 4, ENC_TIME_SECS|ENC_LITTLE_ENDIAN); + offset+= 4; + + return offset; +} + + +static const true_false_string group_attrs_mandatory = { + "The MANDATORY bit is SET", + "The mandatory bit is NOT set", +}; +static const true_false_string group_attrs_enabled_by_default = { + "The ENABLED_BY_DEFAULT bit is SET", + "The enabled_by_default bit is NOT set", +}; +static const true_false_string group_attrs_enabled = { + "The enabled bit is SET", + "The enabled bit is NOT set", +}; +static int +netlogon_dissect_GROUP_MEMBERSHIP_ATTRIBUTES(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 mask; + static int * const attr[] = { + &hf_netlogon_group_attrs_enabled, + &hf_netlogon_group_attrs_enabled_by_default, + &hf_netlogon_group_attrs_mandatory, + NULL + }; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, + -1, &mask); + + proto_tree_add_bitmask_value_with_flags(parent_tree, tvb, offset-4, hf_netlogon_attrs, ett_group_attrs, attr, mask, BMT_NO_APPEND); + return offset; +} + +/* + * IDL typedef struct { + * IDL long user_id; + * IDL long attributes; + * IDL } GROUP_MEMBERSHIP; + */ +static int +netlogon_dissect_GROUP_MEMBERSHIP(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_GROUP_MEMBERSHIP, &item, "GROUP_MEMBERSHIP:"); + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_rid, NULL); + + offset = netlogon_dissect_GROUP_MEMBERSHIP_ATTRIBUTES(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + +static int +netlogon_dissect_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_GROUP_MEMBERSHIP); + + return offset; +} + +/* + * IDL typedef struct { + * IDL char user_session_key[16]; + * IDL } USER_SESSION_KEY; + */ +static int +netlogon_dissect_USER_SESSION_KEY(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + dcerpc_info *di, guint8 *drep _U_) +{ + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect.*/ + return offset; + } + + proto_tree_add_item(tree, hf_netlogon_user_session_key, tvb, offset, 16, + ENC_NA); + offset += 16; + + return offset; +} + + + +static const true_false_string user_flags_extra_sids= { + "The EXTRA_SIDS bit is SET", + "The extra_sids is NOT set", +}; +static const true_false_string user_flags_resource_groups= { + "The RESOURCE_GROUPS bit is SET", + "The resource_groups is NOT set", +}; +static int +netlogon_dissect_USER_FLAGS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 mask; + static int * const flags[] = { + &hf_netlogon_user_flags_resource_groups, + &hf_netlogon_user_flags_extra_sids, + NULL + }; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, + -1, &mask); + + proto_tree_add_bitmask_value_with_flags(parent_tree, tvb, offset-4, hf_netlogon_user_flags, ett_user_flags, flags, mask, BMT_NO_APPEND); + return offset; +} + +static int +netlogon_dissect_GROUP_MEMBERSHIPS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep, + int hf_count, const char *array_name) +{ + guint32 rgc; + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_count, &rgc); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE, + array_name, -1); + + return offset; +} + +static int +netlogon_dissect_DOMAIN_GROUP_MEMBERSHIPS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep, + int hf_count, const char *name) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_domain_group_memberships, + &item, name); + } + + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + + offset = netlogon_dissect_GROUP_MEMBERSHIPS(tvb, offset, + pinfo, tree, + di, drep, + hf_count, + "GroupIDs"); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_DOMAIN_GROUP_MEMBERSHIPS_WRAPPER(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + return netlogon_dissect_DOMAIN_GROUP_MEMBERSHIPS(tvb, offset, + pinfo, tree, + di, drep, + hf_netlogon_domaingroupcount, + "DomainGroupIDs"); +} + +static int +netlogon_dissect_DOMAIN_GROUP_MEMBERSHIP_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_GROUP_MEMBERSHIPS_WRAPPER); + + return offset; +} + +static int +netlogon_dissect_DOMAINS_GROUP_MEMBERSHIPS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep, + int hf_count, const char *name) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + guint32 rgc; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_domains_group_memberships, + &item, name); + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_count, &rgc); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_GROUP_MEMBERSHIP_ARRAY, + NDR_POINTER_UNIQUE, + name, -1); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +/* + * IDL typedef struct { + * IDL uint64 LogonTime; + * IDL uint64 LogoffTime; + * IDL uint64 KickOffTime; + * IDL uint64 PasswdLastSet; + * IDL uint64 PasswdCanChange; + * IDL uint64 PasswdMustChange; + * IDL unicodestring effectivename; + * IDL unicodestring fullname; + * IDL unicodestring logonscript; + * IDL unicodestring profilepath; + * IDL unicodestring homedirectory; + * IDL unicodestring homedirectorydrive; + * IDL short LogonCount; + * IDL short BadPasswdCount; + * IDL long userid; + * IDL long primarygroup; + * IDL long groupcount; + * IDL [unique][size_is(groupcount)] GROUP_MEMBERSHIP *groupids; + * IDL long userflags; + * IDL USER_SESSION_KEY key; + * IDL unicodestring logonserver; + * IDL unicodestring domainname; + * IDL [unique] SID logondomainid; + * IDL long expansionroom[2]; + * IDL long useraccountcontrol; + * IDL long expansionroom[7]; + * IDL } VALIDATION_SAM_INFO; + */ +static int +netlogon_dissect_VALIDATION_SAM_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logoff_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_kickoff_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_last_set_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_can_change_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_must_change_time); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_acct_name, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_full_name, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_script, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_profile_path, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_home_dir, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dir_drive, 0); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_count16, NULL); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_bad_pw_count16, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_rid, NULL); + + offset = netlogon_dissect_GROUP_MEMBERSHIPS(tvb, offset, + pinfo, tree, di, drep, + hf_netlogon_num_rids, + "GroupIDs"); + + offset = netlogon_dissect_USER_FLAGS(tvb, offset, + pinfo, tree, di, drep); + + offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_srv, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy1_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy2_long, NULL); + + offset = netlogon_dissect_USER_ACCOUNT_CONTROL(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy4_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy5_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy6_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy7_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy8_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy9_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy10_long, NULL); + + return offset; +} + + + +/* + * IDL typedef struct { + * IDL uint64 LogonTime; + * IDL uint64 LogoffTime; + * IDL uint64 KickOffTime; + * IDL uint64 PasswdLastSet; + * IDL uint64 PasswdCanChange; + * IDL uint64 PasswdMustChange; + * IDL unicodestring effectivename; + * IDL unicodestring fullname; + * IDL unicodestring logonscript; + * IDL unicodestring profilepath; + * IDL unicodestring homedirectory; + * IDL unicodestring homedirectorydrive; + * IDL short LogonCount; + * IDL short BadPasswdCount; + * IDL long userid; + * IDL long primarygroup; + * IDL long groupcount; + * IDL [unique] GROUP_MEMBERSHIP *groupids; + * IDL long userflags; + * IDL USER_SESSION_KEY key; + * IDL unicodestring logonserver; + * IDL unicodestring domainname; + * IDL [unique] SID logondomainid; + * IDL long expansionroom[2]; + * IDL long useraccountcontrol; + * IDL long expansionroom[7]; + * IDL long sidcount; + * IDL [unique] SID_AND_ATTRIBS; + * IDL } VALIDATION_SAM_INFO2; + */ +static int +netlogon_dissect_VALIDATION_SAM_INFO2(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_VALIDATION_SAM_INFO(tvb,offset,pinfo,tree,di,drep); +#if 0 + int i; + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logoff_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_kickoff_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_last_set_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_can_change_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_must_change_time); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_acct_name, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_full_name, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_script, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_profile_path, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_home_dir, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dir_drive, 0); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_count16, NULL); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_bad_pw_count16, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_rid, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_rids, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE, + "GROUP_MEMBERSHIP_ARRAY", -1); + + offset = netlogon_dissect_USER_FLAGS(tvb, offset, + pinfo, tree, di, drep); + + offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_srv, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + + for(i=0;i<2;i++){ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + } + offset = netlogon_dissect_USER_ACCOUNT_CONTROL(tvb, offset, + pinfo, tree, di, drep); + + for(i=0;i<7;i++){ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + } +#endif + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_sid, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE, + "SID_AND_ATTRIBUTES_ARRAY:", -1); + + return offset; +} + + +static int +netlogon_dissect_VALIDATION_SAM_INFO4(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_VALIDATION_SAM_INFO2(tvb,offset,pinfo,tree,di,drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_dnslogondomainname, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_upn, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string2, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string3, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string4, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string5, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string6, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string7, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string8, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string9, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string10, 0); + return offset; +} + +/* + * IDL typedef struct { + * IDL uint64 LogonTime; + * IDL uint64 LogoffTime; + * IDL uint64 KickOffTime; + * IDL uint64 PasswdLastSet; + * IDL uint64 PasswdCanChange; + * IDL uint64 PasswdMustChange; + * IDL unicodestring effectivename; + * IDL unicodestring fullname; + * IDL unicodestring logonscript; + * IDL unicodestring profilepath; + * IDL unicodestring homedirectory; + * IDL unicodestring homedirectorydrive; + * IDL short LogonCount; + * IDL short BadPasswdCount; + * IDL long userid; + * IDL long primarygroup; + * IDL long groupcount; + * IDL [unique] GROUP_MEMBERSHIP *groupids; + * IDL long userflags; + * IDL USER_SESSION_KEY key; + * IDL unicodestring logonserver; + * IDL unicodestring domainname; + * IDL [unique] SID logondomainid; + * IDL long expansionroom[2]; + * IDL long useraccountcontrol; + * IDL long expansionroom[7]; + * IDL long sidcount; + * IDL [unique] SID_AND_ATTRIBS; + * IDL [unique] SID resourcegroupdomainsid; + * IDL long resourcegroupcount; + qqq + * IDL } PAC_LOGON_INFO; + */ +int +netlogon_dissect_PAC_LOGON_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_VALIDATION_SAM_INFO(tvb,offset,pinfo,tree,di, drep); +#if 0 + int i; + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logoff_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_kickoff_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_last_set_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_can_change_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_must_change_time); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_acct_name, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_full_name, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_script, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_profile_path, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_home_dir, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dir_drive, 0); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_count16, NULL); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_bad_pw_count16, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_rid, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_rids, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_GROUP_MEMBERSHIP_ARRAY, NDR_POINTER_UNIQUE, + "GROUP_MEMBERSHIP_ARRAY", -1); + + offset = netlogon_dissect_USER_FLAGS(tvb, offset, + pinfo, tree, di, drep); + + offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_srv, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + + for(i=0;i<2;i++){ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + } + offset = netlogon_dissect_USER_ACCOUNT_CONTROL(tvb, offset, + pinfo, tree, di, drep); + + for(i=0;i<7;i++){ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + } +#endif + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_sid, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE, + "SID_AND_ATTRIBUTES_ARRAY:", -1); + + offset = netlogon_dissect_DOMAIN_GROUP_MEMBERSHIPS(tvb, offset, + pinfo, tree, di, drep, + hf_netlogon_resourcegroupcount, + "ResourceGroupIDs"); + + return offset; +} + +static int +netlogon_dissect_S4U_Transited_Service_name(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_transited_service, 1); + + return offset; +} + +static int +netlogon_dissect_S4U_Transited_Services_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_S4U_Transited_Service_name); + + return offset; +} + +int +netlogon_dissect_PAC_S4U_DELEGATION_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_s4u2proxytarget, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_transitedlistsize, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_S4U_Transited_Services_array, NDR_POINTER_UNIQUE, + "S4UTransitedServices", -1); + + return offset; +} + +/* + * IDL typedef struct { + * IDL long UserId; + * IDL long PrimaryGroupId; + * IDL SID AccountDomainId; + * IDL long AccountGroupCount; + * IDL [size_is(AccountGroupCount)] PGROUP_MEMBERSHIP AccountGroupIds; + * IDL ULONG SidCount; + * IDL [size_is(SidCount)] PKERB_SID_AND_ATTRIBUTES ExtraSids; + * IDL ULONG DomainGroupCount; + * IDL [size_is(DomainGroupCount)] PDOMAIN_GROUP_MEMBERSHIP DomainGroup; + * IDL } PAC_DEVICE_INFO; + */ +int +netlogon_dissect_PAC_DEVICE_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_rid, NULL); + + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + + offset = netlogon_dissect_GROUP_MEMBERSHIPS(tvb, offset, + pinfo, tree, di, drep, + hf_netlogon_accountdomaingroupcount, + "AccountDomainGroupIds"); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_sid, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_ndr_nt_SID_AND_ATTRIBUTES_ARRAY, NDR_POINTER_UNIQUE, + "ExtraSids:SID_AND_ATTRIBUTES_ARRAY:", -1); + + offset = netlogon_dissect_DOMAINS_GROUP_MEMBERSHIPS(tvb, offset, + pinfo, tree, di, drep, + hf_netlogon_membership_domains_count, + "ExtraDomain Membership Array"); + + return offset; +} + +#if 0 +static int +netlogon_dissect_PAC(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep _U_) +{ + guint32 pac_size; + + if(di->conformant_run){ + return offset; + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pac_size, &pac_size); + + proto_tree_add_item(tree, hf_netlogon_pac_data, tvb, offset, pac_size, + ENC_NA); + offset += pac_size; + + return offset; +} + +static int +netlogon_dissect_AUTH(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep _U_) +{ + guint32 auth_size; + + if(di->conformant_run){ + return offset; + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_auth_size, &auth_size); + + proto_tree_add_item(tree, hf_netlogon_auth_data, tvb, offset, auth_size, + ENC_NA); + offset += auth_size; + + return offset; +} +#endif + +static int +netlogon_dissect_VALIDATION_GENERIC_INFO2 (tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_data_length, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_REF, + "Validation Data", -1); + + return offset; +} +/* + * IDL typedef struct { + * IDL long pac_size + * IDL [unique][size_is(pac_size)] char *pac; + * IDL UNICODESTRING logondomain; + * IDL UNICODESTRING logonserver; + * IDL UNICODESTRING principalname; + * IDL long auth_size; + * IDL [unique][size_is(auth_size)] char *auth; + * IDL USER_SESSION_KEY user_session_key; + * IDL long expansionroom[2]; + * IDL long useraccountcontrol; + * IDL long expansionroom[7]; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL } VALIDATION_PAC_INFO; + */ +#if 0 /* Not used (anymore ?) */ +static int +netlogon_dissect_VALIDATION_PAC_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + int i; + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pac_size, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_PAC, NDR_POINTER_UNIQUE, "PAC:", -1); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_srv, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_principal, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_auth_size, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTH, NDR_POINTER_UNIQUE, "AUTH:", -1); + + offset = netlogon_dissect_USER_SESSION_KEY(tvb, offset, + pinfo, tree, di, drep); + + for(i=0;i<2;i++){ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + } + offset = netlogon_dissect_USER_ACCOUNT_CONTROL(tvb, offset, + pinfo, tree, di, drep); + + for(i=0;i<7;i++){ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + } + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + return offset; +} +#endif + +/* + * IDL typedef [switch_type(short)] union { + * IDL [case(1)][unique] VALIDATION_UAS *uas; + * IDL [case(2)][unique] VALIDATION_SAM_INFO *sam; + * IDL [case(3)][unique] VALIDATION_SAM_INFO2 *sam2; + * IDL [case(4)][unique] VALIDATION_GENERIC_INFO *generic; + * IDL [case(5)][unique] VALIDATION_GENERIC_INFO *generic2; + * IDL [case(5)][unique] VALIDATION_GENERIC_INFO *generic2; + * IDL [case(6)][unique] VALIDATION_SAM_INFO4 *sam4; + * IDL } VALIDATION; + */ +static int +netlogon_dissect_VALIDATION(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint16 level = 0; + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_validation_level, &level); + + ALIGN_TO_4_BYTES; + switch(level){ + case 1: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION_UAS_INFO, NDR_POINTER_UNIQUE, + "VALIDATION_UAS_INFO:", -1); + break; + case 2: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION_SAM_INFO, NDR_POINTER_UNIQUE, + "VALIDATION_SAM_INFO:", -1); + break; + case 3: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION_SAM_INFO2, NDR_POINTER_UNIQUE, + "VALIDATION_SAM_INFO2:", -1); + break; + case 4: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION_GENERIC_INFO2, NDR_POINTER_UNIQUE, + "VALIDATION_INFO:", -1); + break; + case 5: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION_GENERIC_INFO2, NDR_POINTER_UNIQUE, + "VALIDATION_INFO2:", -1); + break; + case 6: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION_SAM_INFO4, NDR_POINTER_UNIQUE, + "VALIDATION_SAM_INFO4:", -1); + break; + } + return offset; +} +/* + * IDL long NetrLogonSamLogonWithFlags( + * IDL [in][unique][string] wchar_t *ServerName, + * IDL [in][unique][string] wchar_t *Workstation, + * IDL [in][unique] AUTHENTICATOR *credential, + * IDL [in][out][unique] AUTHENTICATOR *returnauthenticator, + * IDL [in] short LogonLevel, + * IDL [in][ref] LOGON_LEVEL *logonlevel, + * IDL [in] short ValidationLevel, + * IDL [out][ref] VALIDATION *validation, + * IDL [out][ref] boolean Authorative + * IDL [in][out] unsigned long ExtraFlags + * IDL ); + */ +static int +netlogon_dissect_netrlogonsamlogonflags_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Computer Name", + hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level16, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_LEVEL, NDR_POINTER_REF, + "LEVEL: LogonLevel", -1); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_validation_level, NULL); + + offset = netlogon_dissect_EXTRA_FLAGS(tvb, offset, pinfo, tree, di, drep); + + return offset; +} + +static int +netlogon_dissect_netrlogonsamlogonflags_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION, NDR_POINTER_REF, + "VALIDATION:", -1); + + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_authoritative, NULL); + + offset = netlogon_dissect_EXTRA_FLAGS(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + + +/* + * IDL long NetrLogonSamLogon( + * IDL [in][unique][string] wchar_t *ServerName, + * IDL [in][unique][string] wchar_t *Workstation, + * IDL [in][unique] AUTHENTICATOR *credential, + * IDL [in][out][unique] AUTHENTICATOR *returnauthenticator, + * IDL [in] short LogonLevel, + * IDL [in][ref] LOGON_LEVEL *logonlevel, + * IDL [in] short ValidationLevel, + * IDL [out][ref] VALIDATION *validation, + * IDL [out][ref] boolean Authorative + * IDL ); + */ +static int +netlogon_dissect_netrlogonsamlogon_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Computer Name", + hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level16, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_LEVEL, NDR_POINTER_REF, + "LEVEL: LogonLevel", -1); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_validation_level, NULL); + + return offset; +} + +static int +netlogon_dissect_netrlogonsamlogon_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION, NDR_POINTER_REF, + "VALIDATION:", -1); + + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_authoritative, NULL); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +/* + * IDL long NetrLogonSamLogoff( + * IDL [in][unique][string] wchar_t *ServerName, + * IDL [in][unique][string] wchar_t *ComputerName, + * IDL [in][unique] AUTHENTICATOR credential, + * IDL [in][unique] AUTHENTICATOR return_authenticator, + * IDL [in] short logon_level, + * IDL [in][ref] LEVEL logoninformation + * IDL ); + */ +static int +netlogon_dissect_netrlogonsamlogoff_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Computer Name", + hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level16, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_LEVEL, NDR_POINTER_REF, + "LEVEL: logoninformation", -1); + + return offset; +} +static int +netlogon_dissect_netrlogonsamlogoff_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static void generate_hash_key(packet_info *pinfo,unsigned char is_server,netlogon_auth_key *key) +{ + if(is_server) { + copy_address_shallow(&key->server,&pinfo->src); + copy_address_shallow(&key->client,&pinfo->dst); + } + else { + copy_address_shallow(&key->server,&pinfo->dst); + copy_address_shallow(&key->client,&pinfo->src); + } + +} + +/* + * IDL long NetrServerReqChallenge( + * IDL [in][unique][string] wchar_t *ServerName, + * IDL [in][ref][string] wchar_t *ComputerName, + * IDL [in][ref] CREDENTIAL client_credential, + * IDL [out][ref] CREDENTIAL server_credential + * IDL ); + */ +static int +netlogon_dissect_netrserverreqchallenge_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + /*int oldoffset = offset;*/ + netlogon_auth_vars *vars; + netlogon_auth_vars *existing_vars; + netlogon_auth_key key; + guint8 tab[8] = { 0,0,0,0,0,0,0,0}; + dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data; + + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, pinfo, tree, di, drep); + offset = dissect_ndr_pointer_cb( + tvb, offset, pinfo, tree, di, drep, + dissect_ndr_wchar_cvstring, NDR_POINTER_REF, + "Computer Name", hf_netlogon_computer_name, + cb_wstr_postprocess, + GINT_TO_POINTER(CB_STR_COL_INFO |CB_STR_SAVE | 1)); + + debugprintf("1)Len %d offset %d txt %s\n",(int) strlen((char *)dcv->private_data),offset,(char*)dcv->private_data); + vars = wmem_new0(wmem_file_scope(), netlogon_auth_vars); + vars->client_name = wmem_strdup(wmem_file_scope(), (const guint8 *)dcv->private_data); + debugprintf("2)Len %d offset %d txt %s\n",(int) strlen((char *)dcv->private_data),offset,vars->client_name); + + offset = dissect_dcerpc_8bytes(tvb, offset, pinfo, tree, drep, + hf_client_challenge,&vars->client_challenge); + memcpy(tab,&vars->client_challenge,8); + + vars->start = pinfo->num; + vars->next_start = -1; + vars->next = NULL; + + generate_hash_key(pinfo,0,&key); + existing_vars = (netlogon_auth_vars *)wmem_map_lookup(netlogon_auths, &key); + if (!existing_vars) { + netlogon_auth_key *k = (netlogon_auth_key *)wmem_memdup(wmem_file_scope(), &key, sizeof(netlogon_auth_key)); + copy_address_wmem(wmem_file_scope(), &k->client, &key.client); + copy_address_wmem(wmem_file_scope(), &k->server, &key.server); + debugprintf("Adding initial vars with this start packet = %d\n",vars->start); + wmem_map_insert(netlogon_auths, k, vars); + } + else { + while(existing_vars->next != NULL && existing_vars->start < vars->start) { + debugprintf("Looping to find existing vars ...\n"); + existing_vars = existing_vars->next; + } + if(existing_vars->next != NULL || existing_vars->start == vars->start) { + debugprintf("It seems that I already record this vars start packet = %d\n",vars->start); + wmem_free(wmem_file_scope(), vars); + } + else { + debugprintf("Adding a new entry with this start packet = %d\n",vars->start); + existing_vars->next_start = pinfo->num; + existing_vars->next = vars; + } + } + return offset; +} + +static int +netlogon_dissect_netrserverreqchallenge_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + netlogon_auth_vars *vars; + netlogon_auth_key key; + guint64 server_challenge; + + generate_hash_key(pinfo,1,&key); + vars = (netlogon_auth_vars *)wmem_map_lookup(netlogon_auths,(gconstpointer*) &key); + + offset = dissect_dcerpc_8bytes(tvb, offset, pinfo, tree, drep, + hf_server_challenge, &server_challenge); + /*offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CREDENTIAL, NDR_POINTER_REF, + "CREDENTIAL: server credential", -1);*/ + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + if(vars != NULL) { + while(vars !=NULL && vars->next_start != -1 && vars->next_start < (int)pinfo->num ) + { + vars = vars->next; + debugprintf("looping challenge reply... %d %d \n", vars->next_start, pinfo->num); + } + if(vars == NULL) + { + debugprintf("Something strange happened while searching for challenge_reply\n"); + } + else + { + vars->server_challenge = server_challenge; + } + } +/* + else + { + debugprintf("Vars not found in challenge reply\n"); + } +*/ + return offset; +} + + +static int +netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_secure_channel_type, NULL); + + return offset; +} + + +/* + * IDL long NetrServerAuthenticate( + * IDL [in][unique][string] wchar_t *ServerName, + * IDL [in][ref][string] wchar_t *UserName, + * IDL [in] short secure_challenge_type, + * IDL [in][ref][string] wchar_t *ComputerName, + * IDL [in][ref] CREDENTIAL client_challenge, + * IDL [out][ref] CREDENTIAL server_challenge + * IDL ); + */ +static int +netlogon_dissect_netrserverauthenticate_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "User Name", hf_netlogon_acct_name, CB_STR_COL_INFO); + + offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, CB_STR_COL_INFO); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CREDENTIAL, NDR_POINTER_REF, + "CREDENTIAL: client challenge", -1); + + return offset; +} +static int +netlogon_dissect_netrserverauthenticate023_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, + proto_tree *tree, + dcerpc_info *di, + guint8 *drep, + int version); +static int +netlogon_dissect_netrserverauthenticate_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + return netlogon_dissect_netrserverauthenticate023_reply(tvb,offset,pinfo,tree,di,drep,0); +} + + + +/* + * IDL typedef struct { + * IDL char encrypted_password[16]; + * IDL } ENCRYPTED_LM_OWF_PASSWORD; + */ +static int +netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD(tvbuff_t *tvb, int offset, + packet_info *pinfo _U_, proto_tree *tree, + dcerpc_info *di, guint8 *drep _U_) +{ + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect.*/ + return offset; + } + + proto_tree_add_item(tree, hf_netlogon_encrypted_lm_owf_password, tvb, offset, 16, + ENC_NA); + offset += 16; + + return offset; +} + +/* + * IDL long NetrServerPasswordSet( + * IDL [in][unique][string] wchar_t *ServerName, + * IDL [in][ref][string] wchar_t *UserName, + * IDL [in] short secure_challenge_type, + * IDL [in][ref][string] wchar_t *ComputerName, + * IDL [in][ref] AUTHENTICATOR credential, + * IDL [in][ref] LM_OWF_PASSWORD UasNewPassword, + * IDL [out][ref] AUTHENTICATOR return_authenticator + * IDL ); + */ +static int +netlogon_dissect_netrserverpasswordset_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "User Name", hf_netlogon_acct_name, 0); + + offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_ENCRYPTED_LM_OWF_PASSWORD, NDR_POINTER_REF, + "ENCRYPTED_LM_OWF_PASSWORD: hashed_pwd", -1); + + return offset; +} +static int +netlogon_dissect_netrserverpasswordset_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL [unique][string] wchar_t *UserName; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_DELETE_USER; + */ +static int +netlogon_dissect_DELTA_DELETE_USER(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Account Name", hf_netlogon_acct_name, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL bool SensitiveDataFlag; + * IDL long DataLength; + * IDL [unique][size_is(DataLength)] char *SensitiveData; + * IDL } USER_PRIVATE_INFO; + */ +static int +netlogon_dissect_SENSITIVE_DATA(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 data_len; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_sensitive_data_len, &data_len); + + proto_tree_add_item(tree, hf_netlogon_sensitive_data, tvb, offset, + data_len, ENC_NA); + offset += data_len; + + return offset; +} +static int +netlogon_dissect_USER_PRIVATE_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_sensitive_data_flag, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_sensitive_data_len, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_SENSITIVE_DATA, NDR_POINTER_UNIQUE, + "SENSITIVE_DATA", -1); + + return offset; +} + +/* + * IDL typedef struct { + * IDL UNICODESTRING UserName; + * IDL UNICODESTRING FullName; + * IDL long UserID; + * IDL long PrimaryGroupID; + * IDL UNICODESTRING HomeDir; + * IDL UNICODESTRING HomeDirDrive; + * IDL UNICODESTRING LogonScript; + * IDL UNICODESTRING Comment; + * IDL UNICODESTRING Workstations; + * IDL NTTIME LastLogon; + * IDL NTTIME LastLogoff; + * IDL LOGON_HOURS logonhours; + * IDL short BadPwCount; + * IDL short LogonCount; + * IDL NTTIME PwLastSet; + * IDL NTTIME AccountExpires; + * IDL long AccountControl; + * IDL LM_OWF_PASSWORD lmpw; + * IDL NT_OWF_PASSWORD ntpw; + * IDL bool NTPwPresent; + * IDL bool LMPwPresent; + * IDL bool PwExpired; + * IDL UNICODESTRING UserComment; + * IDL UNICODESTRING Parameters; + * IDL short CountryCode; + * IDL short CodePage; + * IDL USER_PRIVATE_INFO user_private_info; + * IDL long SecurityInformation; + * IDL LSA_SECURITY_DESCRIPTOR sec_desc; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_USER; + */ +static int +netlogon_dissect_DELTA_USER(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_acct_name, 3); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_full_name, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_rid, NULL); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_home_dir, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dir_drive, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_script, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_acct_desc, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_workstations, 0); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logoff_time); + + offset = dissect_ndr_nt_LOGON_HOURS(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_bad_pw_count16, NULL); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_count16, NULL); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_last_set_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_acct_expiry_time); + + offset = dissect_ndr_nt_acct_ctrl(tvb, offset, pinfo, tree, di, drep); + + offset = netlogon_dissect_LM_OWF_PASSWORD(tvb, offset, + pinfo, tree, di, drep); + + offset = netlogon_dissect_NT_OWF_PASSWORD(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_nt_pwd_present, NULL); + + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_lm_pwd_present, NULL); + + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_expired, NULL); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_comment, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_parameters, 0); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_country, NULL); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_codepage, NULL); + + offset = netlogon_dissect_USER_PRIVATE_INFO(tvb, offset, pinfo, tree, + di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_security_information, NULL); + + offset = lsarpc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL UNICODESTRING DomainName; + * IDL UNICODESTRING OEMInfo; + * IDL NTTIME forcedlogoff; + * IDL short minpasswdlen; + * IDL short passwdhistorylen; + * IDL NTTIME pwd_must_change_time; + * IDL NTTIME pwd_can_change_time; + * IDL NTTIME domain_modify_time; + * IDL NTTIME domain_create_time; + * IDL long SecurityInformation; + * IDL LSA_SECURITY_DESCRIPTOR sec_desc; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_DOMAIN; + */ +static int +netlogon_dissect_DELTA_DOMAIN(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_domain_name, 3); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_oem_info, 0); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_kickoff_time); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_minpasswdlen, NULL); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_passwdhistorylen, NULL); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_must_change_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pwd_can_change_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_domain_modify_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_domain_create_time); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_security_information, NULL); + + offset = lsarpc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL UNICODESTRING groupname; + * IDL GROUP_MEMBERSHIP group_membership; + * IDL UNICODESTRING comment; + * IDL long SecurityInformation; + * IDL LSA_SECURITY_DESCRIPTOR sec_desc; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_GROUP; + */ +static int +netlogon_dissect_DELTA_GROUP(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_name, 3); + + offset = netlogon_dissect_GROUP_MEMBERSHIP(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_desc, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_security_information, NULL); + + offset = lsarpc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL UNICODESTRING OldName; + * IDL UNICODESTRING NewName; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_RENAME; + */ +static int +netlogon_dissect_DELTA_RENAME(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + di->hf_index, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + di->hf_index, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +static int +netlogon_dissect_RID(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + + return offset; +} + +static int +netlogon_dissect_RID_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_RID); + + return offset; +} + +static int +netlogon_dissect_ATTRIB(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_attrs, NULL); + + return offset; +} + +static int +netlogon_dissect_ATTRIB_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_ATTRIB); + + return offset; +} + +/* + * IDL typedef struct { + * IDL [unique][size_is(num_rids)] long *rids; + * IDL [unique][size_is(num_rids)] long *attribs; + * IDL long num_rids; + * IDL long dummy1; + * IDL long dummy2; + * IDL long dummy3; + * IDL long dummy4; + * IDL } DELTA_GROUP_MEMBER; + */ +static int +netlogon_dissect_DELTA_GROUP_MEMBER(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_RID_array, NDR_POINTER_UNIQUE, + "RIDs:", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_ATTRIB_array, NDR_POINTER_UNIQUE, + "Attribs:", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_rids, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL UNICODESTRING alias_name; + * IDL long rid; + * IDL long SecurityInformation; + * IDL LSA_SECURITY_DESCRIPTOR sec_desc; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_ALIAS; + */ +static int +netlogon_dissect_DELTA_ALIAS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_alias_name, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_alias_rid, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_security_information, NULL); + + offset = lsarpc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL [unique] SID_ARRAY sids; + * IDL long dummy1; + * IDL long dummy2; + * IDL long dummy3; + * IDL long dummy4; + * IDL } DELTA_ALIAS_MEMBER; + */ +static int +netlogon_dissect_DELTA_ALIAS_MEMBER(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_nt_PSID_ARRAY(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +static int +netlogon_dissect_EVENT_AUDIT_OPTION(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_event_audit_option, NULL); + + return offset; +} + +static int +netlogon_dissect_EVENT_AUDIT_OPTIONS_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_EVENT_AUDIT_OPTION); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL long pagedpoollimit; + * IDL long nonpagedpoollimit; + * IDL long minimumworkingsetsize; + * IDL long maximumworkingsetsize; + * IDL long pagefilelimit; + * IDL NTTIME timelimit; + * IDL } QUOTA_LIMITS; + */ +static int +netlogon_dissect_QUOTA_LIMITS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_QUOTA_LIMITS, &item, "QUOTA_LIMTS:"); + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pagedpoollimit, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_nonpagedpoollimit, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_minworkingsetsize, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_maxworkingsetsize, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pagefilelimit, NULL); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_timelimit); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + +/* + * IDL typedef struct { + * IDL long maxlogsize; + * IDL NTTIME auditretentionperiod; + * IDL bool auditingmode; + * IDL long maxauditeventcount; + * IDL [unique][size_is(maxauditeventcount)] long *eventauditoptions; + * IDL UNICODESTRING primarydomainname; + * IDL [unique] SID *sid; + * IDL QUOTA_LIMITS quota_limits; + * IDL NTTIME db_modify_time; + * IDL NTTIME db_create_time; + * IDL long SecurityInformation; + * IDL LSA_SECURITY_DESCRIPTOR sec_desc; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_POLICY; + */ +static int +netlogon_dissect_DELTA_POLICY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_max_log_size, NULL); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_audit_retention_period); + + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_auditing_mode, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_max_audit_event_count, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_EVENT_AUDIT_OPTIONS_ARRAY, NDR_POINTER_UNIQUE, + "Event Audit Options:", -1); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_domain_name, 0); + + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + + offset = netlogon_dissect_QUOTA_LIMITS(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_db_modify_time); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_db_create_time); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_security_information, NULL); + + offset = lsarpc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +static int +netlogon_dissect_CONTROLLER(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dc_name, 0); + + return offset; +} + +static int +netlogon_dissect_CONTROLLER_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CONTROLLER); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL UNICODESTRING DomainName; + * IDL long num_controllers; + * IDL [unique][size_is(num_controllers)] UNICODESTRING *controller_names; + * IDL long SecurityInformation; + * IDL LSA_SECURITY_DESCRIPTOR sec_desc; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_TRUSTED_DOMAINS; + */ +static int +netlogon_dissect_DELTA_TRUSTED_DOMAINS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_domain_name, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_controllers, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CONTROLLER_ARRAY, NDR_POINTER_UNIQUE, + "Domain Controllers:", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_security_information, NULL); + + offset = lsarpc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +static int +netlogon_dissect_PRIV_ATTR(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_attrs, NULL); + + return offset; +} + +static int +netlogon_dissect_PRIV_ATTR_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_PRIV_ATTR); + + return offset; +} + +static int +netlogon_dissect_PRIV_NAME(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_privilege_name, 1); + + return offset; +} + +static int +netlogon_dissect_PRIV_NAME_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_PRIV_NAME); + + return offset; +} + + + +/* + * IDL typedef struct { + * IDL long privilegeentries; + * IDL long provolegecontrol; + * IDL [unique][size_is(privilege_entries)] long *privilege_attrib; + * IDL [unique][size_is(privilege_entries)] UNICODESTRING *privilege_name; + * IDL QUOTALIMITS quotalimits; + * IDL long SecurityInformation; + * IDL LSA_SECURITY_DESCRIPTOR sec_desc; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_ACCOUNTS; + */ +static int +netlogon_dissect_DELTA_ACCOUNTS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_privilege_entries, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_privilege_control, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_PRIV_ATTR_ARRAY, NDR_POINTER_UNIQUE, + "PRIV_ATTR_ARRAY:", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_PRIV_NAME_ARRAY, NDR_POINTER_UNIQUE, + "PRIV_NAME_ARRAY:", -1); + + offset = netlogon_dissect_QUOTA_LIMITS(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_systemflags, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_security_information, NULL); + + offset = lsarpc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + +/* + * IDL typedef struct { + * IDL long len; + * IDL long maxlen; + * IDL [unique][size_is(maxlen)][length_is(len)] char *cipher_data; + * IDL } CIPHER_VALUE; + */ +static int +netlogon_dissect_CIPHER_VALUE_DATA(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 data_len; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep, + hf_netlogon_cipher_maxlen, NULL); + + /* skip offset */ + offset += 4; + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep, + hf_netlogon_cipher_len, &data_len); + + proto_tree_add_item(tree, di->hf_index, tvb, offset, + data_len, ENC_NA); + offset += data_len; + + return offset; +} +static int +netlogon_dissect_CIPHER_VALUE(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep, const char *name, int hf_index) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_CYPHER_VALUE, &item, name); + } + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep, + hf_netlogon_cipher_len, NULL); + + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep, + hf_netlogon_cipher_maxlen, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CIPHER_VALUE_DATA, NDR_POINTER_UNIQUE, + name, hf_index); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +/* + * IDL typedef struct { + * IDL CIPHER_VALUE current_cipher; + * IDL NTTIME current_cipher_set_time; + * IDL CIPHER_VALUE old_cipher; + * IDL NTTIME old_cipher_set_time; + * IDL long SecurityInformation; + * IDL LSA_SECURITY_DESCRIPTOR sec_desc; + * IDL UNICODESTRING dummy1; + * IDL UNICODESTRING dummy2; + * IDL UNICODESTRING dummy3; + * IDL UNICODESTRING dummy4; + * IDL long dummy5; + * IDL long dummy6; + * IDL long dummy7; + * IDL long dummy8; + * IDL } DELTA_SECRET; + */ +static int +netlogon_dissect_DELTA_SECRET(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_CIPHER_VALUE(tvb, offset, + pinfo, tree, di, drep, + "CIPHER_VALUE: current cipher value", + hf_netlogon_cipher_current_data); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_cipher_current_set_time); + + offset = netlogon_dissect_CIPHER_VALUE(tvb, offset, + pinfo, tree, di, drep, + "CIPHER_VALUE: old cipher value", + hf_netlogon_cipher_old_data); + + offset = dissect_ndr_nt_NTTIME(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_cipher_old_set_time); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_security_information, NULL); + + offset = lsarpc_dissect_sec_desc_buf(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + +/* + * IDL typedef struct { + * IDL long low_value; + * IDL long high_value; + * } MODIFIED_COUNT; + */ +static int +netlogon_dissect_MODIFIED_COUNT(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_duint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_modify_count, NULL); + + return offset; +} + + +#define DT_DELTA_DOMAIN 1 +#define DT_DELTA_GROUP 2 +#define DT_DELTA_DELETE_GROUP 3 +#define DT_DELTA_RENAME_GROUP 4 +#define DT_DELTA_USER 5 +#define DT_DELTA_DELETE_USER 6 +#define DT_DELTA_RENAME_USER 7 +#define DT_DELTA_GROUP_MEMBER 8 +#define DT_DELTA_ALIAS 9 +#define DT_DELTA_DELETE_ALIAS 10 +#define DT_DELTA_RENAME_ALIAS 11 +#define DT_DELTA_ALIAS_MEMBER 12 +#define DT_DELTA_POLICY 13 +#define DT_DELTA_TRUSTED_DOMAINS 14 +#define DT_DELTA_DELETE_TRUST 15 +#define DT_DELTA_ACCOUNTS 16 +#define DT_DELTA_DELETE_ACCOUNT 17 +#define DT_DELTA_SECRET 18 +#define DT_DELTA_DELETE_SECRET 19 +#define DT_DELTA_DELETE_GROUP2 20 +#define DT_DELTA_DELETE_USER2 21 +#define DT_MODIFIED_COUNT 22 + +static const value_string delta_type_vals[] = { + { DT_DELTA_DOMAIN, "Domain" }, + { DT_DELTA_GROUP, "Group" }, + { DT_DELTA_DELETE_GROUP, "Delete Group" }, + { DT_DELTA_RENAME_GROUP, "Rename Group" }, + { DT_DELTA_USER, "User" }, + { DT_DELTA_DELETE_USER, "Delete User" }, + { DT_DELTA_RENAME_USER, "Rename User" }, + { DT_DELTA_GROUP_MEMBER, "Group Member" }, + { DT_DELTA_ALIAS, "Alias" }, + { DT_DELTA_DELETE_ALIAS, "Delete Alias" }, + { DT_DELTA_RENAME_ALIAS, "Rename Alias" }, + { DT_DELTA_ALIAS_MEMBER, "Alias Member" }, + { DT_DELTA_POLICY, "Policy" }, + { DT_DELTA_TRUSTED_DOMAINS, "Trusted Domains" }, + { DT_DELTA_DELETE_TRUST, "Delete Trust" }, + { DT_DELTA_ACCOUNTS, "Accounts" }, + { DT_DELTA_DELETE_ACCOUNT, "Delete Account" }, + { DT_DELTA_SECRET, "Secret" }, + { DT_DELTA_DELETE_SECRET, "Delete Secret" }, + { DT_DELTA_DELETE_GROUP2, "Delete Group2" }, + { DT_DELTA_DELETE_USER2, "Delete User2" }, + { DT_MODIFIED_COUNT, "Modified Count" }, + { 0, NULL } +}; +/* + * IDL typedef [switch_type(short)] union { + * IDL [case(1)][unique] DELTA_DOMAIN *domain; + * IDL [case(2)][unique] DELTA_GROUP *group; + * IDL [case(3)][unique] rid only ; + * IDL [case(4)][unique] DELTA_RENAME_GROUP *rename_group; + * IDL [case(5)][unique] DELTA_USER *user; + * IDL [case(6)][unique] rid only ; + * IDL [case(7)][unique] DELTA_RENAME_USER *rename_user; + * IDL [case(8)][unique] DELTA_GROUP_MEMBER *group_member; + * IDL [case(9)][unique] DELTA_ALIAS *alias; + * IDL [case(10)][unique] rid only ; + * IDL [case(11)][unique] DELTA_RENAME_ALIAS *alias; + * IDL [case(12)][unique] DELTA_ALIAS_MEMBER *alias_member; + * IDL [case(13)][unique] DELTA_POLICY *policy; + * IDL [case(14)][unique] DELTA_TRUSTED_DOMAINS *trusted_domains; + * IDL [case(15)][unique] PSID ; + * IDL [case(16)][unique] DELTA_ACCOUNTS *accounts; + * IDL [case(17)][unique] PSID ; + * IDL [case(18)][unique] DELTA_SECRET *secret; + * IDL [case(19)][unique] string; + * IDL [case(20)][unique] DELTA_DELETE_GROUP2 *delete_group; + * IDL [case(21)][unique] DELTA_DELETE_USER2 *delete_user; + * IDL [case(22)][unique] MODIFIED_COUNT *modified_count; + * IDL } DELTA_UNION; + */ +static int +netlogon_dissect_DELTA_UNION(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + guint16 level = 0; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_DELTA_UNION, &item, "DELTA_UNION:"); + } + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_delta_type, &level); + + ALIGN_TO_4_BYTES; + switch(level){ + case 1: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_DOMAIN, NDR_POINTER_UNIQUE, + "DELTA_DOMAIN:", -1); + break; + case 2: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_GROUP, NDR_POINTER_UNIQUE, + "DELTA_GROUP:", -1); + break; + case 4: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE, + "DELTA_RENAME_GROUP:", hf_netlogon_group_name); + break; + case 5: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_USER, NDR_POINTER_UNIQUE, + "DELTA_USER:", -1); + break; + case 7: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE, + "DELTA_RENAME_USER:", hf_netlogon_acct_name); + break; + case 8: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_GROUP_MEMBER, NDR_POINTER_UNIQUE, + "DELTA_GROUP_MEMBER:", -1); + break; + case 9: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ALIAS, NDR_POINTER_UNIQUE, + "DELTA_ALIAS:", -1); + break; + case 11: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_RENAME, NDR_POINTER_UNIQUE, + "DELTA_RENAME_ALIAS:", hf_netlogon_alias_name); + break; + case 12: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ALIAS_MEMBER, NDR_POINTER_UNIQUE, + "DELTA_ALIAS_MEMBER:", -1); + break; + case 13: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_POLICY, NDR_POINTER_UNIQUE, + "DELTA_POLICY:", -1); + break; + case 14: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_TRUSTED_DOMAINS, NDR_POINTER_UNIQUE, + "DELTA_TRUSTED_DOMAINS:", -1); + break; + case 16: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ACCOUNTS, NDR_POINTER_UNIQUE, + "DELTA_ACCOUNTS:", -1); + break; + case 18: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_SECRET, NDR_POINTER_UNIQUE, + "DELTA_SECRET:", -1); + break; + case 20: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE, + "DELTA_DELETE_GROUP:", -1); + break; + case 21: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_DELETE_USER, NDR_POINTER_UNIQUE, + "DELTA_DELETE_USER:", -1); + break; + case 22: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_UNIQUE, + "MODIFIED_COUNT:", -1); + break; + } + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + + +/* IDL XXX must verify this one, especially 13-19 + * IDL typedef [switch_type(short)] union { + * IDL [case(1)] long rid; + * IDL [case(2)] long rid; + * IDL [case(3)] long rid; + * IDL [case(4)] long rid; + * IDL [case(5)] long rid; + * IDL [case(6)] long rid; + * IDL [case(7)] long rid; + * IDL [case(8)] long rid; + * IDL [case(9)] long rid; + * IDL [case(10)] long rid; + * IDL [case(11)] long rid; + * IDL [case(12)] long rid; + * IDL [case(13)] [unique] SID *sid; + * IDL [case(14)] [unique] SID *sid; + * IDL [case(15)] [unique] SID *sid; + * IDL [case(16)] [unique] SID *sid; + * IDL [case(17)] [unique] SID *sid; + * IDL [case(18)] [unique][string] wchar_t *Name ; + * IDL [case(19)] [unique][string] wchar_t *Name ; + * IDL [case(20)] long rid; + * IDL [case(21)] long rid; + * IDL } DELTA_ID_UNION; + */ +static int +netlogon_dissect_DELTA_ID_UNION(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + guint16 level = 0; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_DELTA_ID_UNION, &item, "DELTA_ID_UNION:"); + } + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_delta_type, &level); + + ALIGN_TO_4_BYTES; + switch(level){ + case 1: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_group_rid, NULL); + break; + case 2: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 3: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 4: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 5: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 6: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 7: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 8: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 9: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 10: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 11: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 12: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 13: + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + break; + case 14: + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + break; + case 15: + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + break; + case 16: + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + break; + case 17: + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + break; + case 18: + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, + tree, di, drep, NDR_POINTER_UNIQUE, "unknown", + hf_netlogon_unknown_string, 0); + break; + case 19: + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, + tree, di, drep, NDR_POINTER_UNIQUE, "unknown", + hf_netlogon_unknown_string, 0); + break; + case 20: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + case 21: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_user_rid, NULL); + break; + } + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +/* + * IDL typedef struct { + * IDL short delta_type; + * IDL DELTA_ID_UNION delta_id_union; + * IDL DELTA_UNION delta_union; + * IDL } DELTA_ENUM; + */ +static int +netlogon_dissect_DELTA_ENUM(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + guint16 type; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_DELTA_ENUM, &item, "DELTA_ENUM:"); + } + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_delta_type, &type); + + proto_item_append_text(item, "%s", val_to_str( + type, delta_type_vals, "Unknown")); + + offset = netlogon_dissect_DELTA_ID_UNION(tvb, offset, + pinfo, tree, di, drep); + + offset = netlogon_dissect_DELTA_UNION(tvb, offset, + pinfo, tree, di, drep); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_DELTA_ENUM_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ENUM); + + return offset; +} + +/* + * IDL typedef struct { + * IDL long num_deltas; + * IDL [unique][size_is(num_deltas)] DELTA_ENUM *delta_enum; + * IDL } DELTA_ENUM_ARRAY; + */ +static int +netlogon_dissect_DELTA_ENUM_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_deltas, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ENUM_array, NDR_POINTER_UNIQUE, + "DELTA_ENUM: deltas", -1); + + return offset; +} + + +/* + * IDL long NetrDatabaseDeltas( + * IDL [in][string][ref] wchar_t *logonserver, # REF!!! + * IDL [in][string][ref] wchar_t *computername, + * IDL [in][ref] AUTHENTICATOR credential, + * IDL [in][out][ref] AUTHENTICATOR return_authenticator, + * IDL [in] long database_id, + * IDL [in][out][ref] MODIFIED_COUNT domain_modify_count, + * IDL [in] long preferredmaximumlength, + * IDL [out][unique] DELTA_ENUM_ARRAY *delta_enum_array + * IDL ); + */ +static int +netlogon_dissect_netrdatabasedeltas_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_database_id, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_REF, + "MODIFIED_COUNT: domain modified count", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_max_size, NULL); + + return offset; +} +static int +netlogon_dissect_netrdatabasedeltas_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_MODIFIED_COUNT, NDR_POINTER_REF, + "MODIFIED_COUNT: domain modified count", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE, + "DELTA_ENUM_ARRAY: deltas", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +/* + * IDL long NetrDatabaseSync( + * IDL [in][string][ref] wchar_t *logonserver, # REF!!! + * IDL [in][string][ref] wchar_t *computername, + * IDL [in][ref] AUTHENTICATOR credential, + * IDL [in][out][ref] AUTHENTICATOR return_authenticator, + * IDL [in] long database_id, + * IDL [in][out][ref] long sync_context, + * IDL [in] long preferredmaximumlength, + * IDL [out][unique] DELTA_ENUM_ARRAY *delta_enum_array + * IDL ); + */ +static int +netlogon_dissect_netrdatabasesync_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_database_id, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_sync_context, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_max_size, NULL); + + return offset; +} + + +static int +netlogon_dissect_netrdatabasesync_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_sync_context, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE, + "DELTA_ENUM_ARRAY: deltas", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +/* + * IDL typedef struct { + * IDL char computer_name[16]; + * IDL long timecreated; + * IDL long serial_number; + * IDL } UAS_INFO_0; + */ +static int +netlogon_dissect_UAS_INFO_0(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 time_created; + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + proto_tree_add_item(tree, hf_netlogon_computer_name, tvb, offset, 16, ENC_ASCII); + offset += 16; + + time_created = tvb_get_guint32(tvb, offset, DREP_ENC_INTEGER(drep)); + proto_tree_add_uint_format_value(tree, hf_netlogon_time_created, tvb, offset, 4, time_created, "unknown time format"); + offset+= 4; + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_serial_number, NULL); + + return offset; +} + + +/* + * IDL long NetrAccountDeltas( + * IDL [in][string][unique] wchar_t *logonserver, + * IDL [in][string][ref] wchar_t *computername, + * IDL [in][ref] AUTHENTICATOR credential, + * IDL [in][out][ref] AUTHENTICATOR return_authenticator, + * IDL [out][ref][size_is(count_returned)] char *Buffer, + * IDL [out][ref] long count_returned, + * IDL [out][ref] long total_entries, + * IDL [in][out][ref] UAS_INFO_0 recordid, + * IDL [in][long] count, + * IDL [in][long] level, + * IDL [in][long] buffersize, + * IDL ); + */ +static int +netlogon_dissect_netraccountdeltas_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF, + "UAS_INFO_0: RecordID", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_count, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_max_size, NULL); + + return offset; +} +static int +netlogon_dissect_netraccountdeltas_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_REF, + "BYTE_array: Buffer", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_count, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_entries, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF, + "UAS_INFO_0: RecordID", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +/* + * IDL long NetrAccountSync( + * IDL [in][string][unique] wchar_t *logonserver, + * IDL [in][string][ref] wchar_t *computername, + * IDL [in][ref] AUTHENTICATOR credential, + * IDL [in][out][ref] AUTHENTICATOR return_authenticator, + * IDL [out][ref][size_is(count_returned)] char *Buffer, + * IDL [out][ref] long count_returned, + * IDL [out][ref] long total_entries, + * IDL [out][ref] long next_reference, + * IDL [in][long] reference, + * IDL [in][long] level, + * IDL [in][long] buffersize, + * IDL [in][out][ref] UAS_INFO_0 recordid, + * IDL ); + */ +static int +netlogon_dissect_netraccountsync_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reference, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_max_size, NULL); + + return offset; +} +static int +netlogon_dissect_netraccountsync_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_REF, + "BYTE_array: Buffer", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_count, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_entries, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_next_reference, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_UAS_INFO_0, NDR_POINTER_REF, + "UAS_INFO_0: RecordID", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +/* + * IDL long NetrGetDcName( + * IDL [in][ref][string] wchar_t *logon_server, + * IDL [in][unique][string] wchar_t *domainname, + * IDL [out][unique][string] wchar_t *dcname, + * IDL }; + */ +static int +netlogon_dissect_netrgetdcname_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0); + + return offset; +} +static int +netlogon_dissect_netrgetdcname_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Domain", hf_netlogon_dc_name, 0); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + + +/* + * IDL typedef struct { + * IDL long flags; + * IDL long pdc_connection_status; + * IDL } NETLOGON_INFO_1; + */ +static int +netlogon_dissect_NETLOGON_INFO_1(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_flags, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pdc_connection_status, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL long flags; + * IDL long pdc_connection_status; + * IDL [unique][string] wchar_t trusted_dc_name; + * IDL long tc_connection_status; + * IDL } NETLOGON_INFO_2; + */ +static int +netlogon_dissect_NETLOGON_INFO_2(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_flags, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_pdc_connection_status, NULL); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Trusted DC Name", + hf_netlogon_trusted_dc_name, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_tc_connection_status, NULL); + + return offset; +} + + +/* + * IDL typedef struct { + * IDL long flags; + * IDL long logon_attempts; + * IDL long reserved; + * IDL long reserved; + * IDL long reserved; + * IDL long reserved; + * IDL long reserved; + * IDL } NETLOGON_INFO_3; + */ +static int +netlogon_dissect_NETLOGON_INFO_3(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_flags, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_logon_attempts, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_reserved, NULL); + + return offset; +} + + +/* + * IDL typedef [switch_type(long)] union { + * IDL [case(1)] [unique] NETLOGON_INFO_1 *i1; + * IDL [case(2)] [unique] NETLOGON_INFO_2 *i2; + * IDL [case(3)] [unique] NETLOGON_INFO_3 *i3; + * IDL } CONTROL_QUERY_INFORMATION; + */ +static int +netlogon_dissect_CONTROL_QUERY_INFORMATION(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 level = 0; + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, &level); + + ALIGN_TO_4_BYTES; + switch(level){ + case 1: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_NETLOGON_INFO_1, NDR_POINTER_UNIQUE, + "NETLOGON_INFO_1:", -1); + break; + case 2: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_NETLOGON_INFO_2, NDR_POINTER_UNIQUE, + "NETLOGON_INFO_2:", -1); + break; + case 3: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_NETLOGON_INFO_3, NDR_POINTER_UNIQUE, + "NETLOGON_INFO_3:", -1); + break; + } + + return offset; +} + + +/* + * IDL long NetrLogonControl( + * IDL [in][string][unique] wchar_t *logonserver, + * IDL [in] long function_code, + * IDL [in] long level, + * IDL [out][ref] CONTROL_QUERY_INFORMATION + * IDL ); + */ +static int +netlogon_dissect_netrlogoncontrol_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_code, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, NULL); + + return offset; +} +static int +netlogon_dissect_netrlogoncontrol_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF, + "CONTROL_QUERY_INFORMATION:", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + + +/* + * IDL long NetrGetAnyDCName( + * IDL [in][unique][string] wchar_t *logon_server, + * IDL [in][unique][string] wchar_t *domainname, + * IDL [out][unique][string] wchar_t *dcname, + * IDL }; + */ +static int +netlogon_dissect_netrgetanydcname_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Server Handle", + hf_netlogon_logonsrv_handle, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Domain", hf_netlogon_domain_name, 0); + + return offset; +} +static int +netlogon_dissect_netrgetanydcname_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Domain", hf_netlogon_dc_name, 0); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + + +/* + * IDL typedef [switch_type(long)] union { + * IDL [case(5)] [unique][string] wchar_t *unknown; + * IDL [case(6)] [unique][string] wchar_t *unknown; + * IDL [case(0xfffe)] long unknown; + * IDL [case(7)] [unique][string] wchar_t *unknown; + * IDL } CONTROL_DATA_INFORMATION; + */ +/* XXX + * According to muddle this is what CONTROL_DATA_INFORMATION is supposed + * to look like. However NetMon does not recognize any such informationlevels. + * + * I'll leave it as CONTROL_DATA_INFORMATION with no informationlevels + * until someone has any source of better authority to call upon. + */ +static int +netlogon_dissect_CONTROL_DATA_INFORMATION(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 level = 0; + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, &level); + + ALIGN_TO_4_BYTES; + switch(level){ + case 5: + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, + tree, di, drep, NDR_POINTER_UNIQUE, "Trusted Domain Name", + hf_netlogon_TrustedDomainName_string, 0); + break; + case 6: + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, + tree, di, drep, NDR_POINTER_UNIQUE, "Trusted Domain Name", + hf_netlogon_TrustedDomainName_string, 0); + break; + case 0xfffe: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + break; + case 8: + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, + tree, di, drep, NDR_POINTER_UNIQUE, "UserName", + hf_netlogon_UserName_string, 0); + break; + } + + return offset; +} + + +/* + * IDL long NetrLogonControl2( + * IDL [in][string][unique] wchar_t *logonserver, + * IDL [in] long function_code, + * IDL [in] long level, + * IDL [in][ref] CONTROL_DATA_INFORMATION *data, + * IDL [out][ref] CONTROL_QUERY_INFORMATION *query + * IDL ); + */ +static int +netlogon_dissect_netrlogoncontrol2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_code, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CONTROL_DATA_INFORMATION, NDR_POINTER_REF, + "CONTROL_DATA_INFORMATION: ", -1); + + return offset; +} + +static int +netlogon_dissect_netrlogoncontrol2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + guint32 status; + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF, + "CONTROL_QUERY_INFORMATION:", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_netlogon_werr_rc, &status); + + if (status != 0) + col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown WERR error 0x%08x")); + + + return offset; +} + + + + +/* + * IDL long NetrDatabaseSync2( + * IDL [in][string][ref] wchar_t *logonserver, # REF!!! + * IDL [in][string][ref] wchar_t *computername, + * IDL [in][ref] AUTHENTICATOR credential, + * IDL [in][out][ref] AUTHENTICATOR return_authenticator, + * IDL [in] long database_id, + * IDL [in] short restart_state, + * IDL [in][out][ref] long *sync_context, + * IDL [in] long preferredmaximumlength, + * IDL [out][unique] DELTA_ENUM_ARRAY *delta_enum_array + * IDL ); + */ +static int +netlogon_dissect_netrdatabasesync2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_database_id, NULL); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_restart_state, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_sync_context, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_max_size, NULL); + + return offset; +} + +static int +netlogon_dissect_netrdatabasesync2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_sync_context, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE, + "DELTA_ENUM_ARRAY: deltas", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +/* + * IDL long NetrDatabaseRedo( + * IDL [in][string][ref] wchar_t *logonserver, # REF!!! + * IDL [in][string][ref] wchar_t *computername, + * IDL [in][ref] AUTHENTICATOR credential, + * IDL [in][out][ref] AUTHENTICATOR return_authenticator, + * IDL [in][ref][size_is(change_log_entry_size)] char *change_log_entry, + * IDL [in] long change_log_entry_size, + * IDL [out][unique] DELTA_ENUM_ARRAY *delta_enum_array + * IDL ); + */ +static int +netlogon_dissect_netrdatabaseredo_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Server Handle", hf_netlogon_logonsrv_handle, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_REF, + "Change log entry: ", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_max_log_size, NULL); + + return offset; +} + +static int +netlogon_dissect_netrdatabaseredo_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DELTA_ENUM_ARRAY, NDR_POINTER_UNIQUE, + "DELTA_ENUM_ARRAY: deltas", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +/* + * IDL long NetrLogonControl2Ex( + * IDL [in][string][unique] wchar_t *logonserver, + * IDL [in] long function_code, + * IDL [in] long level, + * IDL [in][ref] CONTROL_DATA_INFORMATION *data, + * IDL [out][ref] CONTROL_QUERY_INFORMATION *query + * IDL ); + */ +static int +netlogon_dissect_netrlogoncontrol2ex_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_code, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CONTROL_DATA_INFORMATION, NDR_POINTER_REF, + "CONTROL_DATA_INFORMATION: ", -1); + + return offset; +} +static int +netlogon_dissect_netrlogoncontrol2ex_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CONTROL_QUERY_INFORMATION, NDR_POINTER_REF, + "CONTROL_QUERY_INFORMATION:", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + + + + +static const value_string trust_type_vals[] = { + { 1, "NT4 Domain" }, + { 2, "AD Domain" }, + { 3, "MIT Kerberos realm" }, + { 4, "DCE realm" }, + { 0, NULL } +}; + +#define DS_INET_ADDRESS 1 +#define DS_NETBIOS_ADDRESS 2 + +static const value_string dc_address_types[] = { + { DS_INET_ADDRESS, "IP/DNS name" }, + { DS_NETBIOS_ADDRESS, "NetBIOS name" }, + { 0, NULL} +}; + + +#define RQ_ROOT_FOREST 0x0001 +#define RQ_DC_XFOREST 0x0002 +#define RQ_RODC_DIF_DOMAIN 0x0004 +#define RQ_NTLM_FROM_RODC 0x0008 + +#define DS_DOMAIN_IN_FOREST 0x0001 +#define DS_DOMAIN_DIRECT_OUTBOUND 0x0002 +#define DS_DOMAIN_TREE_ROOT 0x0004 +#define DS_DOMAIN_PRIMARY 0x0008 +#define DS_DOMAIN_NATIVE_MODE 0x0010 +#define DS_DOMAIN_DIRECT_INBOUND 0x0020 + +static const true_false_string trust_inbound = { + "There is a DIRECT INBOUND trust for the servers domain", + "There is NO direct inbound trust for the servers domain" +}; +static const true_false_string trust_outbound = { + "There is a DIRECT OUTBOUND trust for this domain", + "There is NO direct outbound trust for this domain" +}; +static const true_false_string trust_in_forest = { + "The domain is a member IN the same FOREST as the queried server", + "The domain is NOT a member of the queried servers domain" +}; +static const true_false_string trust_native_mode = { + "The primary domain is a NATIVE MODE w2k domain", + "The primary is NOT a native mode w2k domain" +}; +static const true_false_string trust_primary = { + "The domain is the PRIMARY domain of the queried server", + "The domain is NOT the primary domain of the queried server" +}; +static const true_false_string trust_tree_root = { + "The domain is the ROOT of a domain TREE", + "The domain is NOT a root of a domain tree" +}; + + +static int +netlogon_dissect_DOMAIN_TRUST_FLAGS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 mask; + static int * const flags[] = { + &hf_netlogon_trust_flags_inbound, + &hf_netlogon_trust_flags_native_mode, + &hf_netlogon_trust_flags_primary, + &hf_netlogon_trust_flags_tree_root, + &hf_netlogon_trust_flags_outbound, + &hf_netlogon_trust_flags_in_forest, + NULL + }; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, + -1, &mask); + + proto_tree_add_bitmask_value_with_flags(parent_tree, tvb, offset-4, hf_netlogon_trust_flags, ett_trust_flags, flags, mask, BMT_NO_APPEND); + return offset; +} + + + +static const true_false_string trust_attribs_non_transitive = { + "This is a NON TRANSITIVE trust relation", + "This is a normal trust" +}; +static const true_false_string trust_attribs_uplevel_only = { + "This is an UPLEVEL ONLY trust relation", + "This is a normal trust" +}; +static const true_false_string trust_attribs_quarantined_domain = { + "This is a QUARANTINED DOMAIN (so don't expect lookupsids to work)", + "This is a normal trust" +}; +static const true_false_string trust_attribs_forest_transitive = { + "This is a FOREST TRANSITIVE trust", + "This is a normal trust" +}; +static const true_false_string trust_attribs_cross_organization = { + "This is a CROSS ORGANIZATION trust", + "This is a normal trust" +}; +static const true_false_string trust_attribs_within_forest = { + "This is a WITHIN FOREST trust", + "This is a normal trust" +}; +static const true_false_string trust_attribs_treat_as_external = { + "TREAT this trust AS an EXTERNAL trust", + "This is a normal trust" +}; + +static int +netlogon_dissect_DOMAIN_TRUST_ATTRIBS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 mask; + static int * const attr[] = { + &hf_netlogon_trust_attribs_treat_as_external, + &hf_netlogon_trust_attribs_within_forest, + &hf_netlogon_trust_attribs_cross_organization, + &hf_netlogon_trust_attribs_forest_transitive, + &hf_netlogon_trust_attribs_quarantined_domain, + &hf_netlogon_trust_attribs_uplevel_only, + &hf_netlogon_trust_attribs_non_transitive, + NULL + }; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, + -1, &mask); + + proto_tree_add_bitmask_value_with_flags(parent_tree, tvb, offset-4, hf_netlogon_trust_attribs, ett_trust_attribs, attr, mask, BMT_NO_APPEND); + return offset; +} + + +#define DS_FORCE_REDISCOVERY 0x00000001 +#define DS_DIRECTORY_SERVICE_REQUIRED 0x00000010 +#define DS_DIRECTORY_SERVICE_PREFERRED 0x00000020 +#define DS_GC_SERVER_REQUIRED 0x00000040 +#define DS_PDC_REQUIRED 0x00000080 +#define DS_BACKGROUND_ONLY 0x00000100 +#define DS_IP_REQUIRED 0x00000200 +#define DS_KDC_REQUIRED 0x00000400 +#define DS_TIMESERV_REQUIRED 0x00000800 +#define DS_WRITABLE_REQUIRED 0x00001000 +#define DS_GOOD_TIMESERV_PREFERRED 0x00002000 +#define DS_AVOID_SELF 0x00004000 +#define DS_ONLY_LDAP_NEEDED 0x00008000 +#define DS_IS_FLAT_NAME 0x00010000 +#define DS_IS_DNS_NAME 0x00020000 +#define DS_RETURN_DNS_NAME 0x40000000 +#define DS_RETURN_FLAT_NAME 0x80000000 + +static const true_false_string get_dcname_request_flags_force_rediscovery = { + "FORCE REDISCOVERY of any cached data", + "You may return cached data" +}; +static const true_false_string get_dcname_request_flags_directory_service_required = { + "DIRECTORY SERVICE is REQUIRED on the server", + "We do NOT require directory service servers" +}; +static const true_false_string get_dcname_request_flags_directory_service_preferred = { + "DIRECTORY SERVICE servers are PREFERRED", + "We do NOT have a preference for directory service servers" +}; +static const true_false_string get_dcname_request_flags_gc_server_required = { + "GC SERVER is REQUIRED", + "gc server is NOT required" +}; +static const true_false_string get_dcname_request_flags_pdc_required = { + "PDC SERVER is REQUIRED", + "pdc server is NOT required" +}; +static const true_false_string get_dcname_request_flags_background_only = { + "Only return cached data, even if it has expired", + "Return cached data unless it has expired" +}; +static const true_false_string get_dcname_request_flags_ip_required = { + "IP address is REQUIRED", + "ip address is NOT required" +}; +static const true_false_string get_dcname_request_flags_kdc_required = { + "KDC server is REQUIRED", + "kdc server is NOT required" +}; +static const true_false_string get_dcname_request_flags_timeserv_required = { + "TIMESERV service is REQUIRED", + "timeserv service is NOT required" +}; +static const true_false_string get_dcname_request_flags_writable_required = { + "the returned dc MUST be WRITEABLE", + "a read-only dc may be returned" +}; +static const true_false_string get_dcname_request_flags_good_timeserv_preferred = { + "GOOD TIMESERV servers are PREFERRED", + "we do NOT have a preference for good timeserv servers" +}; +static const true_false_string get_dcname_request_flags_avoid_self = { + "do NOT return self as dc; return someone else", + "you may return yourSELF as the dc" +}; +static const true_false_string get_dcname_request_flags_only_ldap_needed = { + "we ONLY NEED LDAP; you don't have to return a dc", + "we need a normal dc; an ldap only server will not do" +}; +static const true_false_string get_dcname_request_flags_is_flat_name = { + "the name we specify is a NetBIOS name", + "the name we specify is NOT a NetBIOS name" +}; +static const true_false_string get_dcname_request_flags_is_dns_name = { + "the name we specify is a DNS name", + "the name we specify is NOT a dns name" +}; +static const true_false_string get_dcname_request_flags_return_dns_name = { + "return a DNS name", + "you may return a NON-dns name" +}; +static const true_false_string get_dcname_request_flags_return_flat_name = { + "return a NetBIOS name", + "you may return a NON-NetBIOS name" +}; +static int +netlogon_dissect_GET_DCNAME_REQUEST_FLAGS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 mask; + static int * const flags[] = { + &hf_netlogon_get_dcname_request_flags_return_flat_name, + &hf_netlogon_get_dcname_request_flags_return_dns_name, + &hf_netlogon_get_dcname_request_flags_is_flat_name, + &hf_netlogon_get_dcname_request_flags_is_dns_name, + &hf_netlogon_get_dcname_request_flags_only_ldap_needed, + &hf_netlogon_get_dcname_request_flags_avoid_self, + &hf_netlogon_get_dcname_request_flags_good_timeserv_preferred, + &hf_netlogon_get_dcname_request_flags_writable_required, + &hf_netlogon_get_dcname_request_flags_timeserv_required, + &hf_netlogon_get_dcname_request_flags_kdc_required, + &hf_netlogon_get_dcname_request_flags_ip_required, + &hf_netlogon_get_dcname_request_flags_background_only, + &hf_netlogon_get_dcname_request_flags_pdc_required, + &hf_netlogon_get_dcname_request_flags_gc_server_required, + &hf_netlogon_get_dcname_request_flags_directory_service_preferred, + &hf_netlogon_get_dcname_request_flags_directory_service_required, + &hf_netlogon_get_dcname_request_flags_force_rediscovery, + NULL + }; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, -1, &mask); + + proto_tree_add_bitmask_value_with_flags(parent_tree, tvb, offset-4, hf_netlogon_get_dcname_request_flags, ett_get_dcname_request_flags, flags, mask, BMT_NO_APPEND); + return offset; +} + + + +#define DS_PDC_FLAG 0x00000001 +#define DS_GC_FLAG 0x00000004 +#define DS_LDAP_FLAG 0x00000008 +#define DS_DS_FLAG 0x00000010 +#define DS_KDC_FLAG 0x00000020 +#define DS_TIMESERV_FLAG 0x00000040 +#define DS_CLOSEST_FLAG 0x00000080 +#define DS_WRITABLE_FLAG 0x00000100 +#define DS_GOOD_TIMESERV_FLAG 0x00000200 +#define DS_NDNC_FLAG 0x00000400 +#define DS_DNS_CONTROLLER_FLAG 0x20000000 +#define DS_DNS_DOMAIN_FLAG 0x40000000 +#define DS_DNS_FOREST_FLAG 0x80000000 + +static const true_false_string dc_flags_pdc_flag = { + "this is the PDC of the domain", + "this is NOT the pdc of the domain" +}; +static const true_false_string dc_flags_gc_flag = { + "this is the GC of the forest", + "this is NOT the gc of the forest" +}; +static const true_false_string dc_flags_ldap_flag = { + "this is an LDAP server", + "this is NOT an ldap server" +}; +static const true_false_string dc_flags_ds_flag = { + "this is a DS server", + "this is NOT a ds server" +}; +static const true_false_string dc_flags_kdc_flag = { + "this is a KDC server", + "this is NOT a kdc server" +}; +static const true_false_string dc_flags_timeserv_flag = { + "this is a TIMESERV server", + "this is NOT a timeserv server" +}; +static const true_false_string dc_flags_closest_flag = { + "this is the CLOSEST server", + "this is NOT the closest server" +}; +static const true_false_string dc_flags_writable_flag = { + "this server has a WRITABLE ds database", + "this server has a READ-ONLY ds database" +}; +static const true_false_string dc_flags_good_timeserv_flag = { + "this server is a GOOD TIMESERV server", + "this is NOT a good timeserv server" +}; +static const true_false_string dc_flags_ndnc_flag = { + "NDNC is set", + "ndnc is NOT set" +}; +static const true_false_string dc_flags_dns_controller_flag = { + "DomainControllerName is a DNS name", + "DomainControllerName is NOT a dns name" +}; +static const true_false_string dc_flags_dns_domain_flag = { + "DomainName is a DNS name", + "DomainName is NOT a dns name" +}; +static const true_false_string dc_flags_dns_forest_flag = { + "DnsForestName is a DNS name", + "DnsForestName is NOT a dns name" +}; +static int +netlogon_dissect_DC_FLAGS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 mask; + proto_item *item; + static int * const flags[] = { + &hf_netlogon_dc_flags_dns_forest_flag, + &hf_netlogon_dc_flags_dns_domain_flag, + &hf_netlogon_dc_flags_dns_controller_flag, + &hf_netlogon_dc_flags_ndnc_flag, + &hf_netlogon_dc_flags_good_timeserv_flag, + &hf_netlogon_dc_flags_writable_flag, + &hf_netlogon_dc_flags_closest_flag, + &hf_netlogon_dc_flags_timeserv_flag, + &hf_netlogon_dc_flags_kdc_flag, + &hf_netlogon_dc_flags_ds_flag, + &hf_netlogon_dc_flags_ldap_flag, + &hf_netlogon_dc_flags_gc_flag, + &hf_netlogon_dc_flags_pdc_flag, + NULL + }; + + if(di->conformant_run){ + /*just a run to handle conformant arrays, nothing to dissect */ + return offset; + } + + offset=dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, -1, &mask); + + item = proto_tree_add_bitmask_value_with_flags(parent_tree, tvb, offset-4, hf_netlogon_dc_flags, ett_dc_flags, flags, mask, BMT_NO_APPEND); + if (mask==0x0000ffff) + proto_item_append_text(item, " PING (mask==0x0000ffff)"); + + return offset; +} + + + +static int +netlogon_dissect_pointer_long(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32 (tvb, offset, pinfo, tree, di, drep, + di->hf_index, NULL); + return offset; +} + +#if 0 +static int +netlogon_dissect_pointer_char(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + di->hf_index, NULL); + return offset; +} +#endif + +static int +netlogon_dissect_UNICODE_MULTI_byte(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_char, NULL); + + return offset; +} + +static int +netlogon_dissect_UNICODE_MULTI_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_UNICODE_MULTI_byte); + + return offset; +} + +static int +netlogon_dissect_UNICODE_MULTI(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_UNICODE_MULTI, &item, "UNICODE_MULTI:"); + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_len, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_UNICODE_MULTI_array, NDR_POINTER_UNIQUE, + "unknown", hf_netlogon_unknown_string); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_DOMAIN_CONTROLLER_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_DOMAIN_CONTROLLER_INFO, &item, "DOMAIN_CONTROLLER_INFO:"); + } + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "DC Name", hf_netlogon_dc_name, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "DC Address", hf_netlogon_dc_address, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dc_address_type, NULL); + + offset = dissect_nt_GUID(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Logon Domain", hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "DNS Forest", hf_netlogon_dns_forest_name, 0); + + offset = netlogon_dissect_DC_FLAGS(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "DC Site", hf_netlogon_dc_site_name, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Client Site", + hf_netlogon_client_site_name, 0); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + + + +static int +dissect_ndr_trust_extension(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 len,max; + + if(di->conformant_run){ + return offset; + } + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_trust_max, &max); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_trust_offset, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_trust_len, &len); + + if( max * 2 == 16 ) { + offset = netlogon_dissect_DOMAIN_TRUST_FLAGS(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_trust_parent_index, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_trust_type, NULL); + + offset = netlogon_dissect_DOMAIN_TRUST_ATTRIBS(tvb, offset, pinfo, tree, di, drep); + } + /* else do something scream shout .... */ + + return offset; +} + +static int +netlogon_dissect_BLOB_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 len; + + if(di->conformant_run){ + return offset; + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_blob_size, &len); + + proto_tree_add_item(tree, hf_netlogon_blob, tvb, offset, len, + ENC_NA); + offset += len; + + return offset; +} + +static int +dissect_ndr_ulongs_as_counted_string(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep, int hf_index) +{ + guint16 len, size; + gboolean add_subtree = TRUE; /* Manage room for evolution*/ + proto_item *item; + proto_tree *subtree = tree; + + if (add_subtree) { + + subtree = proto_tree_add_subtree( + tree, tvb, offset, 0, ett_nt_counted_longs_as_string, &item, + proto_registrar_get_name(hf_index)); + } + /* Structure starts with short, but is aligned for longs */ + ALIGN_TO_4_BYTES; + + if (di->conformant_run) + return offset; + + /* + struct { + short len; + short size; + [size_is(size/2), length_is(len/2), ptr] unsigned short *string; + } UNICODE_STRING; + + */ + + offset = dissect_ndr_uint16(tvb, offset, pinfo, subtree, di, drep, + hf_nt_cs_len, &len); + offset = dissect_ndr_uint16(tvb, offset, pinfo, subtree, di, drep, + hf_nt_cs_size, &size); + offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, subtree, di, drep, + dissect_ndr_trust_extension, NDR_POINTER_UNIQUE, + "Buffer", hf_index,NULL,NULL); + return offset; +} + +static int +DomainInfo_sid_(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = lsarpc_dissect_struct_dom_sid2(tvb, offset, pinfo, tree, di, drep, DomainInfo_sid, 0); + + return offset; +} +static int +dissect_element_lsa_DnsDomainInfo_sid(tvbuff_t *tvb , int offset , packet_info *pinfo , proto_tree *tree , dcerpc_info *di, guint8 *drep ) +{ + offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, DomainInfo_sid_, NDR_POINTER_UNIQUE, "Pointer to Sid (dom_sid2)",DnsDomainInfo_sid); + + return offset; +} +static int +dissect_element_lsa_DnsDomainInfo_domain_guid(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep ) +{ + offset = dissect_ndr_uuid_t(tvb, offset, pinfo, tree, di, drep, DnsDomainInfo_domain_guid, NULL); + + return offset; +} + + +static int dissect_part_DnsDomainInfo(tvbuff_t *tvb , int offset, packet_info *pinfo, proto_tree *tree , dcerpc_info *di, guint8 *drep, int hf_index _U_, guint32 param _U_) +{ + + offset = lsarpc_dissect_struct_lsa_StringLarge(tvb, offset, pinfo, tree, di, drep, DnsDomainInfo_name, 0); + + offset = lsarpc_dissect_struct_lsa_StringLarge(tvb,offset, pinfo, tree, di, drep, DnsDomainInfo_dns_domain, 0); + + offset = lsarpc_dissect_struct_lsa_StringLarge(tvb,offset, pinfo, tree, di, drep, DnsDomainInfo_dns_forest, 0); + + offset = dissect_element_lsa_DnsDomainInfo_domain_guid(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_element_lsa_DnsDomainInfo_sid(tvb, offset, pinfo, tree, di, drep); + + + return offset; +} + + +static int +netlogon_dissect_ONE_DOMAIN_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_DOMAIN_TRUST_INFO, &item, "ONE_DOMAIN_INFO"); + } +/*hf_netlogon_dnsdomaininfo*/ + offset = dissect_part_DnsDomainInfo(tvb, offset, pinfo, tree, di, drep, 0, 0); + + + /* It is structed as a string but it's not ... it's 4 ulong */ + offset = dissect_ndr_ulongs_as_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_trust_extension); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string2, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string3, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string4, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy1_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy2_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy3_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy4_long, NULL); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_DOMAIN_TRUST_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_ONE_DOMAIN_INFO); + + return offset; +} + + +static int +netlogon_dissect_LSA_POLICY_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep ) +{ + proto_item *item=NULL; + proto_tree *subtree=NULL; + guint32 len; + + if(di->conformant_run){ + return offset; + } + + if(tree){ + subtree = proto_tree_add_subtree(tree, tvb, offset, 0, + ett_LSA_POLICY_INFO, &item, "LSA Policy"); + } + offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep, + hf_netlogon_lsapolicy_len, &len); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, subtree, di, drep, + netlogon_dissect_BLOB_array, NDR_POINTER_UNIQUE, + "Pointer:", -1); + + return offset; +} + + + + +static int +netlogon_dissect_WORKSTATION_INFO(tvbuff_t *tvb , int offset , + packet_info *pinfo , proto_tree *tree , + dcerpc_info *di, guint8 *drep ) +{ + /* This is not the good way to do it ... it stinks ... + * but after half of a day fighting against wireshark and ndr ... + * I decided to keep this hack ... + * At least data are correctly displayed without invented ints ... + */ + offset = netlogon_dissect_LSA_POLICY_INFO(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Workstation FQDN", + hf_netlogon_workstation_fqdn, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Workstation Site", + hf_netlogon_workstation_site_name, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Dummy 1", hf_netlogon_dummy_string, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Dummy 2", hf_netlogon_dummy_string2, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Dummy 3", hf_netlogon_dummy_string3, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Dummy 4", hf_netlogon_dummy_string4, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_os_version, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_workstation_os, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string3, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string4, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_workstation_flags, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy2_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy3_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy4_long, NULL); + return offset; +} + +static int +netlogon_dissect_WORKSTATION_INFORMATION(tvbuff_t *tvb , int offset , + packet_info *pinfo , proto_tree *tree , + dcerpc_info *di, guint8 *drep ) { + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_WORKSTATION_INFO, NDR_POINTER_UNIQUE, + "WORKSTATION INFO", -1); + return offset; +} + +static int +netlogon_dissect_DOMAIN_INFO(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_ONE_DOMAIN_INFO(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_trusts, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_TRUST_INFO, NDR_POINTER_UNIQUE, + "DOMAIN_TRUST_ARRAY: Trusted domains", -1); + + offset = netlogon_dissect_LSA_POLICY_INFO(tvb,offset,pinfo, tree,di,drep); + +/* offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_num_trusts, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_TRUST_INFO, NDR_POINTER_UNIQUE, + "LSA Policy", -1); +*/ + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_ad_client_dns_name, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string2, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string3, 0); + + offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy_string4, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_workstation_flags, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_supportedenctypes, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy3_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dummy4_long, NULL); + + return offset; +} + + +static int +netlogon_dissect_DOMAIN_INFORMATION(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 level = 0; + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, &level); + + ALIGN_TO_4_BYTES; + switch(level){ + case 1: + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_INFO, NDR_POINTER_UNIQUE, + "DOMAIN_INFO", -1); + break; + } + + return offset; +} + +static int +netlogon_dissect_UNICODE_STRING_512(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + int i; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_UNICODE_STRING_512, &item, "UNICODE_STRING_512:"); + } + + for(i=0;i<256;i++){ + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_short, NULL); + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_element_844_byte(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_char, NULL); + + return offset; +} + +static int +netlogon_dissect_element_844_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_element_844_byte); + + return offset; +} + +static int +netlogon_dissect_TYPE_50(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_TYPE_50, &item, "TYPE_50:"); + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_element_844_array, NDR_POINTER_UNIQUE, + "unknown", hf_netlogon_unknown_string); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_TYPE_50_ptr(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_TYPE_50, NDR_POINTER_UNIQUE, + "TYPE_50 pointer: unknown_TYPE_50", -1); + + return offset; +} + +static int +netlogon_dissect_DS_DOMAIN_TRUSTS(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, dcerpc_info *di, guint8 *drep) +{ + guint32 tmp; + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_DS_DOMAIN_TRUSTS, NULL, "DS_DOMAIN_TRUSTS"); + } + + /* name */ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "NetBIOS Name", + hf_netlogon_downlevel_domain_name, 0); + + /* domain */ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "DNS Domain Name", + hf_netlogon_dns_domain_name, 0); + + offset = netlogon_dissect_DOMAIN_TRUST_FLAGS(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_trust_parent_index, &tmp); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_trust_type, &tmp); + + offset = netlogon_dissect_DOMAIN_TRUST_ATTRIBS(tvb, offset, pinfo, tree, di, drep); + + /* SID pointer */ + offset = dissect_ndr_nt_PSID(tvb, offset, pinfo, tree, di, drep); + + /* GUID */ + offset = dissect_nt_GUID(tvb, offset, pinfo, tree, di, drep); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DS_DOMAIN_TRUSTS); + + return offset; +} + +static int +netlogon_dissect_element_865_byte(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_char, NULL); + + return offset; +} + +static int +netlogon_dissect_element_865_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_element_865_byte); + + return offset; +} + +static int +netlogon_dissect_element_866_byte(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_char, NULL); + + return offset; +} + +static int +netlogon_dissect_element_866_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_element_866_byte); + + return offset; +} + +static int +netlogon_dissect_TYPE_52(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_TYPE_52, &item, "TYPE_52:"); + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_element_865_array, NDR_POINTER_UNIQUE, + "unknown", hf_netlogon_unknown_string); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_element_866_array, NDR_POINTER_UNIQUE, + "unknown", hf_netlogon_unknown_string); + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_TYPE_52_ptr(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_TYPE_52, NDR_POINTER_UNIQUE, + "TYPE_52 pointer: unknown_TYPE_52", -1); + return offset; +} + + +static int +netlogon_dissect_TYPE_44(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *parent_tree, + dcerpc_info *di, guint8 *drep) +{ + proto_item *item=NULL; + proto_tree *tree=NULL; + int old_offset=offset; + guint32 level = 0; + + if(parent_tree){ + tree = proto_tree_add_subtree(parent_tree, tvb, offset, 0, + ett_TYPE_44, &item, "TYPE_44:"); + } + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, &level); + + ALIGN_TO_4_BYTES; + switch(level){ + case 1: + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + break; + } + + proto_item_set_len(item, offset-old_offset); + return offset; +} + +static int +netlogon_dissect_WORKSTATION_BUFFER(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, + dcerpc_info *di, guint8 *drep) +{ + guint32 level; + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level, &level); + if (level == 2) { + /* Specs are not very clear (as usual ...) it seems that the + * structure in both case is a NETLOGON_WORKSTATION_INFO + * but in this case only the LSA POLICY INFO will contain + * something + */ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_WORKSTATION_INFORMATION, NDR_POINTER_UNIQUE, + "LSA POLICY INFO", -1); + } + else { + if (level == 1) { + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_WORKSTATION_INFORMATION, NDR_POINTER_UNIQUE, + "WORKSTATION INFORMATION", -1);} + } + return offset; +} + +static int +netlogon_dissect_netrenumeratetrusteddomains_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + + +static int +netlogon_dissect_netrenumeratetrusteddomains_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_UNICODE_MULTI, NDR_POINTER_REF, + "UNICODE_MULTI pointer: trust_dom_name_list", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_dsrgetdcname_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_nt_GUID, NDR_POINTER_UNIQUE, + "GUID pointer: domain_guid", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_nt_GUID, NDR_POINTER_UNIQUE, + "GUID pointer: site_guid", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_flags, NULL); + + return offset; +} + + +static int +netlogon_dissect_dsrgetdcname_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE, + "DOMAIN_CONTROLLER_INFO:", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrlogondummyroutine1_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "unknown string", + hf_netlogon_unknown_string, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + return offset; +} + + +static int +netlogon_dissect_netrlogondummyroutine1_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_TYPE_44, NDR_POINTER_UNIQUE, + "TYPE_44 pointer: unknown_TYPE_44", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrlogonsetservicebits_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + return offset; +} + + +static int +netlogon_dissect_netrlogonsetservicebits_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +static int +netlogon_dissect_netrlogongettrustrid_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "unknown string", + hf_netlogon_unknown_string, 0); + + return offset; +} + + +static int +netlogon_dissect_netrlogongettrustrid_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE, + "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +static int +netlogon_dissect_netrlogoncomputeserverdigest_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE, + "BYTE pointer: unknown_BYTE", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + return offset; +} + +static int +netlogon_dissect_BYTE_16_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + int i; + + for(i=0;i<16;i++){ + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_char, NULL); + } + + return offset; +} + +static int +netlogon_dissect_netrlogoncomputeserverdigest_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_16_array, NDR_POINTER_UNIQUE, + "BYTE pointer: unknown_BYTE", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrlogoncomputeclientdigest_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "unknown string", + hf_netlogon_unknown_string, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE, + "BYTE pointer: unknown_BYTE", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + return offset; +} + + +static int +netlogon_dissect_netrlogoncomputeclientdigest_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_16_array, NDR_POINTER_UNIQUE, + "BYTE pointer: unknown_BYTE", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} +static int netlogon_dissect_neg_options(tvbuff_t *tvb,proto_tree *tree,guint32 flags,int offset) +{ + static int * const hf_flags[] = { +#if 0 + &hf_netlogon_neg_flags_80000000, +#endif + &hf_netlogon_neg_flags_40000000, + &hf_netlogon_neg_flags_20000000, +#if 0 + &hf_netlogon_neg_flags_10000000, + &hf_netlogon_neg_flags_8000000, + &hf_netlogon_neg_flags_4000000, + &hf_netlogon_neg_flags_2000000, + &hf_netlogon_neg_flags_800000, + &hf_netlogon_neg_flags_400000, +#endif + &hf_netlogon_neg_flags_1000000, + &hf_netlogon_neg_flags_200000, + &hf_netlogon_neg_flags_100000, + &hf_netlogon_neg_flags_80000, + &hf_netlogon_neg_flags_40000, + &hf_netlogon_neg_flags_20000, + &hf_netlogon_neg_flags_10000, + &hf_netlogon_neg_flags_8000, + &hf_netlogon_neg_flags_4000, + &hf_netlogon_neg_flags_2000, + &hf_netlogon_neg_flags_1000, + &hf_netlogon_neg_flags_800, + &hf_netlogon_neg_flags_400, + &hf_netlogon_neg_flags_200, + &hf_netlogon_neg_flags_100, + &hf_netlogon_neg_flags_80, + &hf_netlogon_neg_flags_40, + &hf_netlogon_neg_flags_20, + &hf_netlogon_neg_flags_10, + &hf_netlogon_neg_flags_8, + &hf_netlogon_neg_flags_4, + &hf_netlogon_neg_flags_2, + &hf_netlogon_neg_flags_1, + NULL + }; + + proto_tree_add_bitmask_value_with_flags(tree, tvb, offset, hf_netlogon_neg_flags, ett_authenticate_flags, hf_flags, flags, BMT_NO_APPEND); + + return 0; +} + +static int +netlogon_dissect_netrserverauthenticate3_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + guint32 flags; + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + ALIGN_TO_5_BYTES + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Acct Name", hf_netlogon_acct_name, 0); + + if (di->call_data->flags & DCERPC_IS_NDR64) { + ALIGN_TO_4_BYTES + } else { + ALIGN_TO_2_BYTES + } + + offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset, + pinfo, tree, di, drep); + + ALIGN_TO_5_BYTES + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", hf_netlogon_computer_name, 0); + + offset = dissect_dcerpc_8bytes(tvb, offset, pinfo, tree, drep, + hf_client_credential, NULL); +#if 0 + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_CREDENTIAL, NDR_POINTER_REF, + "Client Challenge", -1); +#endif + +#if 0 + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_neg_flags, NULL); +#endif + ALIGN_TO_4_BYTES; + + flags = tvb_get_letohl (tvb, offset); + netlogon_dissect_neg_options(tvb,tree,flags,offset); + seen.isseen = FALSE; + seen.num = 0; + offset +=4; + return offset; +} + +/* + * IDL long NetrServerAuthenticate2( + * IDL [in][string][unique] wchar_t *logonserver, + * IDL [in][ref][string] wchar_t *username, + * IDL [in] short secure_channel_type, + * IDL [in][ref][string] wchar_t *computername, + * IDL [in][ref] CREDENTIAL *client_chal, + * IDL [out][ref] CREDENTIAL *server_chal, + * IDL [in][out][ref] long *negotiate_flags, + * IDL ); + */ +static int +netlogon_dissect_netrserverauthenticate2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + return netlogon_dissect_netrserverauthenticate3_rqst(tvb,offset,pinfo,tree,di,drep); +} + +static int +netlogon_dissect_netrserverauthenticate023_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, + proto_tree *tree, + dcerpc_info *di, + guint8 *drep, + int version) +{ + guint32 flags = 0; + netlogon_auth_vars *vars; + netlogon_auth_key key; + guint64 server_cred; + + offset = dissect_dcerpc_8bytes(tvb, offset, pinfo, tree, drep, + hf_server_credential, &server_cred); + + if (version >= 2) { + flags = tvb_get_letohl (tvb, offset); + netlogon_dissect_neg_options(tvb,tree,flags,offset); + offset +=4; + } + ALIGN_TO_4_BYTES; + if (version >= 3) { + offset = dissect_dcerpc_uint32(tvb, offset, pinfo, tree, drep, + hf_server_rid, NULL); + } + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + generate_hash_key(pinfo, 1 , &key); + + vars = (netlogon_auth_vars *)wmem_map_lookup(netlogon_auths, &key); + if(vars != NULL) { + debugprintf("Found some vars (ie. server/client challenges), let's see if I can get a session key\n"); + while(vars != NULL && vars->next_start != -1 && vars->next_start < (int) pinfo->num ) { + debugprintf("looping auth reply...\n"); + vars = vars->next; + } + if(vars == NULL ) { + debugprintf("Something strange happened while searching for authenticate_reply\n"); + } + else { + md4_pass *pass_list=NULL; + const md4_pass *used_md4 = NULL; + const char *used_method = NULL; + guint32 list_size = 0; + unsigned int i = 0; + md4_pass password; + guint8 session_key[16]; + int found = 0; + + vars->flags = flags; + vars->can_decrypt = FALSE; + list_size = get_md4pass_list(pinfo->pool, &pass_list); + debugprintf("Found %d passwords \n",list_size); + if( flags & NETLOGON_FLAG_AES ) + { + guint8 salt_buf[16] = { 0 }; + guint8 sha256[HASH_SHA2_256_LENGTH]; + guint64 calculated_cred; + + memcpy(&salt_buf[0], (guint8*)&vars->client_challenge, 8); + memcpy(&salt_buf[8], (guint8*)&vars->server_challenge, 8); + + used_method = "AES"; + printnbyte((guint8*)&vars->client_challenge,8,"Client challenge:","\n"); + printnbyte((guint8*)&vars->server_challenge,8,"Server challenge:","\n"); + printnbyte((guint8*)&server_cred,8,"Server creds:","\n"); + for(i=0;i<list_size;i++) + { + used_md4 = &pass_list[i]; + password = pass_list[i]; + printnbyte((guint8*)&password, 16,"NTHASH:","\n"); + if (!ws_hmac_buffer(GCRY_MD_SHA256, sha256, salt_buf, sizeof(salt_buf), (guint8*) &password, 16)) { + gcry_error_t err; + gcry_cipher_hd_t cipher_hd = NULL; + guint8 iv[16] = { 0 }; + + /* truncate the session key to 16 bytes */ + memcpy(session_key, sha256, 16); + printnbyte((guint8*)session_key, 16,"Session Key","\n"); + + /* Open the cipher */ + err = gcry_cipher_open(&cipher_hd, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CFB8, 0); + if (err != 0) { + ws_warning("GCRY: cipher open %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + break; + } + + /* Set the initial value */ + err = gcry_cipher_setiv(cipher_hd, iv, sizeof(iv)); + if (err != 0) { + ws_warning("GCRY: setiv %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + break; + } + + /* Set the key */ + err = gcry_cipher_setkey(cipher_hd, session_key, 16); + if (err != 0) { + ws_warning("GCRY: setkey %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + break; + } + + calculated_cred = 0x1234567812345678; + err = gcry_cipher_encrypt(cipher_hd, + (guint8 *)&calculated_cred, 8, + (const guint8 *)&vars->server_challenge, 8); + if (err != 0) { + ws_warning("GCRY: encrypt %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + break; + } + + /* Done with the cipher */ + gcry_cipher_close(cipher_hd); + + printnbyte((guint8*)&calculated_cred,8,"Calculated creds:","\n"); + + if(calculated_cred==server_cred) { + found = 1; + break; + } + } + } + } else if ( flags & NETLOGON_FLAG_STRONGKEY ) { + guint8 zeros[4] = { 0 }; + guint8 md5[HASH_MD5_LENGTH]; + gcry_md_hd_t md5_handle; + guint8 buf[8] = { 0 }; + guint64 calculated_cred; + + used_method = "MD5"; + if (!gcry_md_open(&md5_handle, GCRY_MD_MD5, 0)) { + gcry_md_write(md5_handle, zeros, 4); + gcry_md_write(md5_handle, (guint8*)&vars->client_challenge, 8); + gcry_md_write(md5_handle, (guint8*)&vars->server_challenge, 8); + memcpy(md5, gcry_md_read(md5_handle, 0), 16); + gcry_md_close(md5_handle); + } + printnbyte(md5,8,"MD5:","\n"); + printnbyte((guint8*)&vars->client_challenge,8,"Client challenge:","\n"); + printnbyte((guint8*)&vars->server_challenge,8,"Server challenge:","\n"); + printnbyte((guint8*)&server_cred,8,"Server creds:","\n"); + for(i=0;i<list_size;i++) + { + used_md4 = &pass_list[i]; + password = pass_list[i]; + if (!ws_hmac_buffer(GCRY_MD_MD5, session_key, md5, HASH_MD5_LENGTH, (guint8*) &password, 16)) { + crypt_des_ecb(buf,(unsigned char*)&vars->server_challenge,session_key); + crypt_des_ecb((unsigned char*)&calculated_cred,buf,session_key+7); + printnbyte((guint8*)&calculated_cred,8,"Calculated creds:","\n"); + if(calculated_cred==server_cred) { + found = 1; + break; + } + } + } + } + else + { + /*Not implemented*/ + debugprintf("Else case not implemented\n"); + memset(session_key,0,16); + } + if(found) { + vars->nthash = *used_md4; + vars->auth_fd_num = pinfo->num; + memcpy(&vars->session_key,session_key,16); + debugprintf("Found the good session key !\n"); + expert_add_info_format(pinfo, proto_tree_get_parent(tree), + &ei_netlogon_auth_nthash, + "%s authenticated using %s (%02x%02x%02x%02x...)", + used_method, used_md4->key_origin, + used_md4->md4[0] & 0xFF, used_md4->md4[1] & 0xFF, + used_md4->md4[2] & 0xFF, used_md4->md4[3] & 0xFF); + expert_add_info_format(pinfo, proto_tree_get_parent(tree), + &ei_netlogon_session_key, + "session key (" + "%02x%02x%02x%02x" + "%02x%02x%02x%02x" + "%02x%02x%02x%02x" + "%02x%02x%02x%02x" + ")", + session_key[0] & 0xFF, session_key[1] & 0xFF, + session_key[2] & 0xFF, session_key[3] & 0xFF, + session_key[4] & 0xFF, session_key[5] & 0xFF, + session_key[6] & 0xFF, session_key[7] & 0xFF, + session_key[8] & 0xFF, session_key[9] & 0xFF, + session_key[10] & 0xFF, session_key[11] & 0xFF, + session_key[12] & 0xFF, session_key[13] & 0xFF, + session_key[14] & 0xFF, session_key[15] & 0xFF); + } + else { + debugprintf("Session key not found !\n"); + memset(&vars->session_key,0,16); + } + } + } + + return offset; +} + +static int +netlogon_dissect_netrserverauthenticate3_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + return netlogon_dissect_netrserverauthenticate023_reply(tvb,offset,pinfo,tree,di,drep,3); +} + +static int +netlogon_dissect_netrserverauthenticate2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + return netlogon_dissect_netrserverauthenticate023_reply(tvb,offset,pinfo,tree,di,drep,2); +} + + +static int +netlogon_dissect_dsrgetdcnameex_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_nt_GUID, NDR_POINTER_UNIQUE, + "GUID pointer: domain_guid", -1); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Site Name", hf_netlogon_site_name, 0); + + offset = netlogon_dissect_GET_DCNAME_REQUEST_FLAGS(tvb, offset, pinfo, tree, di, drep); + + return offset; +} + + +static int +netlogon_dissect_dsrgetdcnameex_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE, + "DOMAIN_CONTROLLER_INFO:", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_dsrgetsitename_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + + +static int +netlogon_dissect_dsrgetsitename_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + + /* XXX hmmm this does not really look like a UNIQUE pointer but + will do for now. I think it is really a 32bit integer followed by + a REF pointer to a unicode string */ + offset = dissect_ndr_pointer_cb(tvb, offset, pinfo, tree, di, drep, + dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE, "Site Name", + hf_netlogon_site_name, cb_wstr_postprocess, + GINT_TO_POINTER(CB_STR_COL_INFO | 1)); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrlogongetdomaininfo_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + /* Unlike the other NETLOGON RPCs, this is not a unique pointer. */ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Server Handle", hf_netlogon_computer_name, 0); + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Computer Name", + hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: client", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_WORKSTATION_BUFFER, NDR_POINTER_REF, + "WORKSTATION_BUFFER", -1); + return offset; +} + + +static int +netlogon_dissect_netrlogongetdomaininfo_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_INFORMATION, NDR_POINTER_REF, + "DOMAIN_INFORMATION", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrserverpasswordset2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Acct Name", + hf_netlogon_acct_name, 0); + + offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "Computer Name", + hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = netlogon_dissect_UNICODE_STRING_512(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + + +static int +netlogon_dissect_netrserverpasswordset2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrserverpasswordget_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Acct Name", hf_netlogon_acct_name, 0); + + offset = netlogon_dissect_NETLOGON_SECURE_CHANNEL_TYPE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Computer Name", + hf_netlogon_computer_name, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + return offset; +} + + +static int +netlogon_dissect_netrserverpasswordget_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_LM_OWF_PASSWORD, NDR_POINTER_REF, + "LM_OWF_PASSWORD pointer: server_pwd", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrlogonsendtosam_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "unknown string", + hf_netlogon_unknown_string, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_REF, + "AUTHENTICATOR: credential", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE, + "BYTE pointer: unknown_BYTE", -1); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + return offset; +} + + +static int +netlogon_dissect_netrlogonsendtosam_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_AUTHENTICATOR, NDR_POINTER_UNIQUE, + "AUTHENTICATOR: return_authenticator", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_dsraddresstositenamesw_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE, + "BYTE pointer: unknown_BYTE", -1); + + return offset; +} + + +static int +netlogon_dissect_dsraddresstositenamesw_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_TYPE_50_ptr, NDR_POINTER_UNIQUE, + "TYPE_50** pointer: unknown_TYPE_50", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_dsrgetdcnameex2_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Client Account", + hf_netlogon_acct_name, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Client Account", + hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_nt_GUID, NDR_POINTER_UNIQUE, + "Domain GUID:", -1); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Client Site", + hf_netlogon_site_name, 0); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + return offset; +} + + +static int +netlogon_dissect_dsrgetdcnameex2_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DOMAIN_CONTROLLER_INFO, NDR_POINTER_UNIQUE, + "DOMAIN_CONTROLLER_INFO:", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrlogongettimeserviceparentdomain_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + + +static int +netlogon_dissect_netrlogongettimeserviceparentdomain_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "unknown string", + hf_netlogon_unknown_string, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE, + "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrenumeratetrusteddomainsex_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + +static int +netlogon_dissect_netrenumeratetrusteddomainsex_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_entries, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY, NDR_POINTER_UNIQUE, + "DS_DOMAIN_TRUSTS_ARRAY:", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_dsraddresstositenamesexw_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_long, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_BYTE_array, NDR_POINTER_UNIQUE, + "BYTE pointer: unknown_BYTE", -1); + + return offset; +} + + +static int +netlogon_dissect_dsraddresstositenamesexw_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_TYPE_52_ptr, NDR_POINTER_UNIQUE, + "TYPE_52 pointer: unknown_TYPE_52", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + + +static int +netlogon_dissect_site_name_item(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_counted_string_cb( + tvb, offset, pinfo, tree, di, drep, hf_netlogon_site_name, + cb_wstr_postprocess, + GINT_TO_POINTER(CB_STR_COL_INFO | 1)); + + return offset; +} +static int +netlogon_dissect_site_name_array(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_site_name_item); + + return offset; +} + +static int +netlogon_dissect_site_names(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_count, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_site_name_array, NDR_POINTER_UNIQUE, + "Site name array", -1); + + return offset; +} + +static int +netlogon_dissect_dsrgetdcsitecoveragew_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + return offset; +} + + +static int +netlogon_dissect_dsrgetdcsitecoveragew_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_site_names, NDR_POINTER_UNIQUE, + "Site names", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_netrlogonsamlogonex_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "LogonServer", + hf_netlogon_computer_name, 0); + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Computer Name", + hf_netlogon_computer_name, 0); + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_level16, NULL); + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_LEVEL, NDR_POINTER_REF, + "LEVEL: LogonLevel", -1); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_validation_level, NULL); + + offset = netlogon_dissect_EXTRA_FLAGS(tvb, offset, pinfo, tree, di, drep); + +#if 0 + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "unknown string", + hf_netlogon_unknown_string, 0); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "unknown string", + hf_netlogon_unknown_string, 0); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_short, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_LEVEL, NDR_POINTER_UNIQUE, + "LEVEL pointer: unknown_NETLOGON_LEVEL", -1); + + offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_unknown_short, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE, + "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long); +#endif + return offset; +} + + +static int +netlogon_dissect_netrlogonsamlogonex_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION, NDR_POINTER_REF, + "VALIDATION:", -1); + + offset = dissect_ndr_uint8(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_authoritative, NULL); + + offset = netlogon_dissect_EXTRA_FLAGS(tvb, offset, pinfo, tree, di, drep); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); +#if 0 + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_VALIDATION, NDR_POINTER_UNIQUE, + "VALIDATION: unknown_NETLOGON_VALIDATION", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_pointer_char, NDR_POINTER_UNIQUE, + "BOOLEAN pointer: unknown_BOOLEAN", hf_netlogon_unknown_char); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_pointer_long, NDR_POINTER_UNIQUE, + "ULONG pointer: unknown_ULONG", hf_netlogon_unknown_long); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); +#endif + return offset; +} + + +static int +netlogon_dissect_dsrenumeratedomaintrusts_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = netlogon_dissect_DOMAIN_TRUST_FLAGS(tvb, offset, pinfo, tree, di, drep); + + return offset; +} + + +static int +netlogon_dissect_dsrenumeratedomaintrusts_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_entries, NULL); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + netlogon_dissect_DS_DOMAIN_TRUSTS_ARRAY, NDR_POINTER_UNIQUE, + "DS_DOMAIN_TRUSTS_ARRAY:", -1); + + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_dos_rc, NULL); + + return offset; +} + +static int +netlogon_dissect_dsrderegisterdnshostrecords_rqst(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = netlogon_dissect_LOGONSRV_HANDLE(tvb, offset, + pinfo, tree, di, drep); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_UNIQUE, "Domain", hf_netlogon_logon_dom, 0); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_nt_GUID, NDR_POINTER_UNIQUE, + "GUID pointer: domain_guid", -1); + + offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, di, drep, + dissect_nt_GUID, NDR_POINTER_UNIQUE, + "GUID pointer: dsa_guid", -1); + + offset = dissect_ndr_str_pointer_item(tvb, offset, pinfo, tree, di, drep, + NDR_POINTER_REF, "dns_host", hf_netlogon_dns_host, 0); + + return offset; +} + + +static int +netlogon_dissect_dsrderegisterdnshostrecords_reply(tvbuff_t *tvb, int offset, + packet_info *pinfo, proto_tree *tree, dcerpc_info *di, guint8 *drep) +{ + offset = dissect_ntstatus(tvb, offset, pinfo, tree, di, drep, + hf_netlogon_rc, NULL); + + return offset; +} + +/* Dissect secure channel stuff */ + +static int hf_netlogon_secchan_nl_message_type = -1; +static int hf_netlogon_secchan_nl_message_flags = -1; +static int hf_netlogon_secchan_nl_message_flags_nb_domain = -1; +static int hf_netlogon_secchan_nl_message_flags_nb_host = -1; +static int hf_netlogon_secchan_nl_message_flags_dns_domain = -1; +static int hf_netlogon_secchan_nl_message_flags_dns_host = -1; +static int hf_netlogon_secchan_nl_message_flags_nb_host_utf8 = -1; +static int hf_netlogon_secchan_nl_nb_domain = -1; +static int hf_netlogon_secchan_nl_nb_host = -1; +static int hf_netlogon_secchan_nl_dns_domain = -1; +static int hf_netlogon_secchan_nl_dns_host = -1; +static int hf_netlogon_secchan_nl_nb_host_utf8 = -1; + +static gint ett_secchan_verf = -1; +static gint ett_secchan_nl_auth_message = -1; +static gint ett_secchan_nl_auth_message_flags = -1; + +static const value_string nl_auth_types[] = { + { 0x00000000, "Request"}, + { 0x00000001, "Response"}, + { 0, NULL } +}; + + +/* MS-NRPC : 2.2.1.3.1 NL_AUTH_MESSAGE */ +static int dissect_secchan_nl_auth_message(tvbuff_t *tvb, int offset, + packet_info *pinfo, + proto_tree *tree, dcerpc_info *di _U_, guint8 *drep) +{ + proto_item *item = NULL; + proto_tree *subtree = NULL; + guint32 messagetype; + guint64 messageflags; + static int * const flag_fields[] = { + &hf_netlogon_secchan_nl_message_flags_nb_domain, + &hf_netlogon_secchan_nl_message_flags_nb_host, + &hf_netlogon_secchan_nl_message_flags_dns_domain, + &hf_netlogon_secchan_nl_message_flags_dns_host, + &hf_netlogon_secchan_nl_message_flags_nb_host_utf8, + NULL + }; + int len; + + if (tree) { + subtree = proto_tree_add_subtree( + tree, tvb, offset, -1, ett_secchan_nl_auth_message, &item, + "Secure Channel NL_AUTH_MESSAGE"); + } + + /* We can't use the NDR routines as the DCERPC call data hasn't + been initialised since we haven't made a DCERPC call yet, just + a bind request. */ + + /* Type */ + offset = dissect_dcerpc_uint32( + tvb, offset, pinfo, subtree, drep, + hf_netlogon_secchan_nl_message_type, &messagetype); + + /* Flags */ + proto_tree_add_bitmask_ret_uint64(subtree, tvb, offset, + hf_netlogon_secchan_nl_message_flags, + ett_secchan_nl_auth_message_flags, + flag_fields, + (drep[0] & DREP_LITTLE_ENDIAN) ? + ENC_LITTLE_ENDIAN : + ENC_BIG_ENDIAN, + &messageflags); + offset += 4; + + + /* Buffer */ + /* netbios domain name */ + if (messageflags&0x00000001) { + len = tvb_strsize(tvb, offset); + proto_tree_add_item(subtree, hf_netlogon_secchan_nl_nb_domain, tvb, offset, len, ENC_ASCII); + offset += len; + } + + /* netbios host name */ + if (messageflags&0x00000002) { + len = tvb_strsize(tvb, offset); + proto_tree_add_item(subtree, hf_netlogon_secchan_nl_nb_host, tvb, offset, len, ENC_ASCII); + offset += len; + } + + /* DNS domain name */ + if (messageflags&0x00000004) { + int old_offset=offset; + char *str; + + offset=dissect_mscldap_string(tvb, offset, 255, &str); + proto_tree_add_string(subtree, hf_netlogon_secchan_nl_dns_domain, tvb, old_offset, offset-old_offset, str); + } + + /* DNS host name */ + if (messageflags&0x00000008) { + int old_offset=offset; + char *str; + + offset=dissect_mscldap_string(tvb, offset, 255, &str); + proto_tree_add_string(subtree, hf_netlogon_secchan_nl_dns_host, tvb, old_offset, offset-old_offset, str); + } + + /* NetBios host name (UTF8) */ + if (messageflags&0x00000010) { + int old_offset=offset; + char *str; + + offset=dissect_mscldap_string(tvb, offset, 255, &str); + proto_tree_add_string(subtree, hf_netlogon_secchan_nl_nb_host_utf8, tvb, old_offset, offset-old_offset, str); + } + + + return offset; +} + +/* Subdissectors */ + +static dcerpc_sub_dissector dcerpc_netlogon_dissectors[] = { + { NETLOGON_NETRLOGONUASLOGON, "NetrLogonUasLogon", + netlogon_dissect_netrlogonuaslogon_rqst, + netlogon_dissect_netrlogonuaslogon_reply }, + { NETLOGON_NETRLOGONUASLOGOFF, "NetrLogonUasLogoff", + netlogon_dissect_netrlogonuaslogoff_rqst, + netlogon_dissect_netrlogonuaslogoff_reply }, + { NETLOGON_NETRLOGONSAMLOGON, "NetrLogonSamLogon", + netlogon_dissect_netrlogonsamlogon_rqst, + netlogon_dissect_netrlogonsamlogon_reply }, + { NETLOGON_NETRLOGONSAMLOGOFF, "NetrLogonSamLogoff", + netlogon_dissect_netrlogonsamlogoff_rqst, + netlogon_dissect_netrlogonsamlogoff_reply }, + { NETLOGON_NETRSERVERREQCHALLENGE, "NetrServerReqChallenge", + netlogon_dissect_netrserverreqchallenge_rqst, + netlogon_dissect_netrserverreqchallenge_reply }, + { NETLOGON_NETRSERVERAUTHENTICATE, "NetrServerAuthenticate", + netlogon_dissect_netrserverauthenticate_rqst, + netlogon_dissect_netrserverauthenticate_reply }, + { NETLOGON_NETRSERVERPASSWORDSET, "NetrServerPasswordSet", + netlogon_dissect_netrserverpasswordset_rqst, + netlogon_dissect_netrserverpasswordset_reply }, + { NETLOGON_NETRDATABASEDELTAS, "NetrDatabaseDeltas", + netlogon_dissect_netrdatabasedeltas_rqst, + netlogon_dissect_netrdatabasedeltas_reply }, + { NETLOGON_NETRDATABASESYNC, "NetrDatabaseSync", + netlogon_dissect_netrdatabasesync_rqst, + netlogon_dissect_netrdatabasesync_reply }, + { NETLOGON_NETRACCOUNTDELTAS, "NetrAccountDeltas", + netlogon_dissect_netraccountdeltas_rqst, + netlogon_dissect_netraccountdeltas_reply }, + { NETLOGON_NETRACCOUNTSYNC, "NetrAccountSync", + netlogon_dissect_netraccountsync_rqst, + netlogon_dissect_netraccountsync_reply }, + { NETLOGON_NETRGETDCNAME, "NetrGetDCName", + netlogon_dissect_netrgetdcname_rqst, + netlogon_dissect_netrgetdcname_reply }, + { NETLOGON_NETRLOGONCONTROL, "NetrLogonControl", + netlogon_dissect_netrlogoncontrol_rqst, + netlogon_dissect_netrlogoncontrol_reply }, + { NETLOGON_NETRGETANYDCNAME, "NetrGetAnyDCName", + netlogon_dissect_netrgetanydcname_rqst, + netlogon_dissect_netrgetanydcname_reply }, + { NETLOGON_NETRLOGONCONTROL2, "NetrLogonControl2", + netlogon_dissect_netrlogoncontrol2_rqst, + netlogon_dissect_netrlogoncontrol2_reply }, + { NETLOGON_NETRSERVERAUTHENTICATE2, "NetrServerAuthenticate2", + netlogon_dissect_netrserverauthenticate2_rqst, + netlogon_dissect_netrserverauthenticate2_reply }, + { NETLOGON_NETRDATABASESYNC2, "NetrDatabaseSync2", + netlogon_dissect_netrdatabasesync2_rqst, + netlogon_dissect_netrdatabasesync2_reply }, + { NETLOGON_NETRDATABASEREDO, "NetrDatabaseRedo", + netlogon_dissect_netrdatabaseredo_rqst, + netlogon_dissect_netrdatabaseredo_reply }, + { NETLOGON_NETRLOGONCONTROL2EX, "NetrLogonControl2Ex", + netlogon_dissect_netrlogoncontrol2ex_rqst, + netlogon_dissect_netrlogoncontrol2ex_reply }, + { NETLOGON_NETRENUMERATETRUSTEDDOMAINS, "NetrEnumerateTrustedDomains", + netlogon_dissect_netrenumeratetrusteddomains_rqst, + netlogon_dissect_netrenumeratetrusteddomains_reply }, + { NETLOGON_DSRGETDCNAME, "DsrGetDcName", + netlogon_dissect_dsrgetdcname_rqst, + netlogon_dissect_dsrgetdcname_reply }, + { NETLOGON_NETRLOGONDUMMYROUTINE1, "NetrLogonDummyRoutine1", + netlogon_dissect_netrlogondummyroutine1_rqst, + netlogon_dissect_netrlogondummyroutine1_reply }, + { NETLOGON_NETRLOGONSETSERVICEBITS, "NetrLogonSetServiceBits", + netlogon_dissect_netrlogonsetservicebits_rqst, + netlogon_dissect_netrlogonsetservicebits_reply }, + { NETLOGON_NETRLOGONGETTRUSTRID, "NetrLogonGetTrustRid", + netlogon_dissect_netrlogongettrustrid_rqst, + netlogon_dissect_netrlogongettrustrid_reply }, + { NETLOGON_NETRLOGONCOMPUTESERVERDIGEST, "NetrLogonComputeServerDigest", + netlogon_dissect_netrlogoncomputeserverdigest_rqst, + netlogon_dissect_netrlogoncomputeserverdigest_reply }, + { NETLOGON_NETRLOGONCOMPUTECLIENTDIGEST, "NetrLogonComputeClientDigest", + netlogon_dissect_netrlogoncomputeclientdigest_rqst, + netlogon_dissect_netrlogoncomputeclientdigest_reply }, + { NETLOGON_NETRSERVERAUTHENTICATE3, "NetrServerAuthenticate3", + netlogon_dissect_netrserverauthenticate3_rqst, + netlogon_dissect_netrserverauthenticate3_reply }, + { NETLOGON_DSRGETDCNAMEX, "DsrGetDcNameEx", + netlogon_dissect_dsrgetdcnameex_rqst, + netlogon_dissect_dsrgetdcnameex_reply }, + { NETLOGON_DSRGETSITENAME, "DsrGetSiteName", + netlogon_dissect_dsrgetsitename_rqst, + netlogon_dissect_dsrgetsitename_reply }, + { NETLOGON_NETRLOGONGETDOMAININFO, "NetrLogonGetDomainInfo", + netlogon_dissect_netrlogongetdomaininfo_rqst, + netlogon_dissect_netrlogongetdomaininfo_reply }, + { NETLOGON_NETRSERVERPASSWORDSET2, "NetrServerPasswordSet2", + netlogon_dissect_netrserverpasswordset2_rqst, + netlogon_dissect_netrserverpasswordset2_reply }, + { NETLOGON_NETRSERVERPASSWORDGET, "NetrServerPasswordGet", + netlogon_dissect_netrserverpasswordget_rqst, + netlogon_dissect_netrserverpasswordget_reply }, + { NETLOGON_NETRLOGONSENDTOSAM, "NetrLogonSendToSam", + netlogon_dissect_netrlogonsendtosam_rqst, + netlogon_dissect_netrlogonsendtosam_reply }, + { NETLOGON_DSRADDRESSTOSITENAMESW, "DsrAddressToSiteNamesW", + netlogon_dissect_dsraddresstositenamesw_rqst, + netlogon_dissect_dsraddresstositenamesw_reply }, + { NETLOGON_DSRGETDCNAMEEX2, "DsrGetDcNameEx2", + netlogon_dissect_dsrgetdcnameex2_rqst, + netlogon_dissect_dsrgetdcnameex2_reply }, + { NETLOGON_NETRLOGONGETTIMESERVICEPARENTDOMAIN, + "NetrLogonGetTimeServiceParentDomain", + netlogon_dissect_netrlogongettimeserviceparentdomain_rqst, + netlogon_dissect_netrlogongettimeserviceparentdomain_reply }, + { NETLOGON_NETRENUMERATETRUSTEDDOMAINSEX, "NetrEnumerateTrustedDomainsEx", + netlogon_dissect_netrenumeratetrusteddomainsex_rqst, + netlogon_dissect_netrenumeratetrusteddomainsex_reply }, + { NETLOGON_DSRADDRESSTOSITENAMESEXW, "DsrAddressToSiteNamesExW", + netlogon_dissect_dsraddresstositenamesexw_rqst, + netlogon_dissect_dsraddresstositenamesexw_reply }, + { NETLOGON_DSRGETDCSITECOVERAGEW, "DsrGetDcSiteCoverageW", + netlogon_dissect_dsrgetdcsitecoveragew_rqst, + netlogon_dissect_dsrgetdcsitecoveragew_reply }, + { NETLOGON_NETRLOGONSAMLOGONEX, "NetrLogonSamLogonEx", + netlogon_dissect_netrlogonsamlogonex_rqst, + netlogon_dissect_netrlogonsamlogonex_reply }, + { NETLOGON_DSRENUMERATEDOMAINTRUSTS, "DsrEnumerateDomainTrusts", + netlogon_dissect_dsrenumeratedomaintrusts_rqst, + netlogon_dissect_dsrenumeratedomaintrusts_reply }, + { NETLOGON_DSRDEREGISTERDNSHOSTRECORDS, "DsrDeregisterDnsHostRecords", + netlogon_dissect_dsrderegisterdnshostrecords_rqst, + netlogon_dissect_dsrderegisterdnshostrecords_reply }, + { NETLOGON_NETRSERVERTRUSTPASSWORDSGET, "NetrServerTrustPasswordsGet", + NULL, NULL }, + { NETLOGON_DSRGETFORESTTRUSTINFORMATION, "DsrGetForestTrustInformation", + NULL, NULL }, + { NETLOGON_NETRGETFORESTTRUSTINFORMATION, "NetrGetForestTrustInformation", + NULL, NULL }, + { NETLOGON_NETRLOGONSAMLOGONWITHFLAGS, "NetrLogonSamLogonWithFlags", + netlogon_dissect_netrlogonsamlogonflags_rqst, + netlogon_dissect_netrlogonsamlogonflags_reply }, + { NETLOGON_NETRSERVERGETTRUSTINFO, "NetrServerGetTrustInfo", + NULL, NULL }, + {0, NULL, NULL, NULL } +}; + +static int hf_netlogon_secchan_verf = -1; +static int hf_netlogon_secchan_verf_signalg = -1; +static int hf_netlogon_secchan_verf_sealalg = -1; +static int hf_netlogon_secchan_verf_flag = -1; +static int hf_netlogon_secchan_verf_digest = -1; +static int hf_netlogon_secchan_verf_seq = -1; +static int hf_netlogon_secchan_verf_nonce = -1; + +static const value_string sign_algs[] = { + { 0x0077, "HMAC-MD5"}, + { 0x0013, "HMAC-SHA256"}, + { 0, NULL} +}; + +static const value_string seal_algs[] = { + { 0xFFFF, "Not Encrypted"}, + { 0x007A, "RC4"}, + { 0x001A, "AES-128"}, + { 0, NULL} +}; + +static int get_seal_key(const guint8 *session_key,int key_len,guint8* seal_key) +{ + guint8 zero_sk[16] = { 0 }; + int i = 0; + + memset(seal_key,0,16); + if(memcmp(session_key,zero_sk,16)) { + for(i=0;i<key_len;i++) { + seal_key[i] = session_key[i] ^ 0xF0; + } + return 1; + } else { + return 0; + } + +} + +static guint64 uncrypt_sequence_aes(guint8* session_key,guint64 checksum,guint64 enc_seq,unsigned char is_server _U_) +{ + gcry_error_t err; + gcry_cipher_hd_t cipher_hd = NULL; + guint8 iv[16] = { 0 }; + + memcpy(&iv[0], (guint8*)&checksum, 8); + memcpy(&iv[8], (guint8*)&checksum, 8); + + /* Open the cipher */ + err = gcry_cipher_open(&cipher_hd, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CFB8, 0); + if (err != 0) { + ws_warning("GCRY: cipher open %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + return 0; + } + + /* Set the initial value */ + err = gcry_cipher_setiv(cipher_hd, iv, sizeof(iv)); + if (err != 0) { + ws_warning("GCRY: setiv %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + return 0; + } + + /* Set the key */ + err = gcry_cipher_setkey(cipher_hd, session_key, 16); + if (err != 0) { + ws_warning("GCRY: setkey %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + return 0; + } + + err = gcry_cipher_decrypt(cipher_hd, (guint8*) &enc_seq, 8, NULL, 0); + if (err != 0) { + ws_warning("GCRY: encrypt %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + return 0; + } + /* Done with the cipher */ + gcry_cipher_close(cipher_hd); + return enc_seq; +} + +static guint64 uncrypt_sequence_strong(guint8* session_key,guint64 checksum,guint64 enc_seq,unsigned char is_server _U_) +{ + guint8 zeros[4] = { 0 }; + guint8 buf[HASH_MD5_LENGTH]; + guint8 key[HASH_MD5_LENGTH]; + gcry_cipher_hd_t rc4_handle; + guint8 *p_seq = (guint8*) &enc_seq; + /*guint32 temp;*/ + + if (ws_hmac_buffer(GCRY_MD_MD5, buf, zeros, 4, session_key, 16)) { + return 0; + } + + if (ws_hmac_buffer(GCRY_MD_MD5, key, (guint8*)&checksum, 8, buf, HASH_MD5_LENGTH)) { + return 0; + } + + if (!gcry_cipher_open (&rc4_handle, GCRY_CIPHER_ARCFOUR, GCRY_CIPHER_MODE_STREAM, 0)) { + if (!gcry_cipher_setkey(rc4_handle, key, HASH_MD5_LENGTH)) { + gcry_cipher_decrypt(rc4_handle, p_seq, 8, NULL, 0); + } + gcry_cipher_close(rc4_handle); + } + /*temp = *((guint32*)p_seq); + *((guint32*)p_seq) = *((guint32*)p_seq+1); + *((guint32*)p_seq+1) = temp; + + if(!is_server) { + *p_seq = *p_seq & 0x7F; + } + */ + return enc_seq; +} + +static guint64 uncrypt_sequence(guint32 flags, guint8* session_key,guint64 checksum,guint64 enc_seq,unsigned char is_server _U_) +{ + if (flags & NETLOGON_FLAG_AES) { + return uncrypt_sequence_aes(session_key, checksum, enc_seq, is_server); + } + + if (flags & NETLOGON_FLAG_STRONGKEY) { + return uncrypt_sequence_strong(session_key, checksum, enc_seq, is_server); + } + + return 0; +} + +static gcry_error_t prepare_decryption_cipher_aes(netlogon_auth_vars *vars, + gcry_cipher_hd_t *_cipher_hd) +{ + gcry_error_t err; + gcry_cipher_hd_t cipher_hd = NULL; + guint64 sequence = vars->seq; + + guint8 iv[16] = { 0 }; + + memcpy(&iv[0], (guint8*)&sequence, 8); + memcpy(&iv[8], (guint8*)&sequence, 8); + + /* Open the cipher */ + err = gcry_cipher_open(&cipher_hd, GCRY_CIPHER_AES128, GCRY_CIPHER_MODE_CFB8, 0); + if (err != 0) { + ws_warning("GCRY: cipher open %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + return 0; + } + + /* Set the initial value */ + err = gcry_cipher_setiv(cipher_hd, iv, sizeof(iv)); + if (err != 0) { + ws_warning("GCRY: setiv %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + return 0; + } + + /* Set the key */ + err = gcry_cipher_setkey(cipher_hd, vars->encryption_key, 16); + if (err != 0) { + ws_warning("GCRY: setkey %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + return 0; + } + + *_cipher_hd = cipher_hd; + return 0; +} + +static gcry_error_t prepare_decryption_cipher_strong(netlogon_auth_vars *vars, + gcry_cipher_hd_t *_cipher_hd) +{ + gcry_error_t err; + gcry_cipher_hd_t cipher_hd = NULL; + guint8 zeros[4] = { 0 }; + guint64 sequence = vars->seq; + guint8 tmp[HASH_MD5_LENGTH] = { 0 }; + guint8 seal_key[16] = { 0 }; + + err = ws_hmac_buffer(GCRY_MD_MD5, tmp, zeros, 4, vars->encryption_key, 16); + if (err != 0) { + ws_warning("GCRY: GCRY_MD_MD5 %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + return err; + } + err = ws_hmac_buffer(GCRY_MD_MD5, seal_key, (guint8*)&sequence, 8, tmp, HASH_MD5_LENGTH); + if (err != 0) { + ws_warning("GCRY: GCRY_MD_MD5 %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + return err; + } + + /* Open the cipher */ + err = gcry_cipher_open(&cipher_hd, GCRY_CIPHER_ARCFOUR, GCRY_CIPHER_MODE_STREAM, 0); + if (err != 0) { + ws_warning("GCRY: cipher open %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + return err; + } + + /* Set the key */ + err = gcry_cipher_setkey(cipher_hd, seal_key, 16); + if (err != 0) { + ws_warning("GCRY: setkey %s/%s\n", gcry_strsource(err), gcry_strerror(err)); + gcry_cipher_close(cipher_hd); + return err; + } + + *_cipher_hd = cipher_hd; + return 0; +} + +static gcry_error_t prepare_decryption_cipher(netlogon_auth_vars *vars, + gcry_cipher_hd_t *_cipher_hd) +{ + *_cipher_hd = NULL; + + if (vars->flags & NETLOGON_FLAG_AES) { + return prepare_decryption_cipher_aes(vars, _cipher_hd); + } + + if (vars->flags & NETLOGON_FLAG_STRONGKEY) { + return prepare_decryption_cipher_strong(vars, _cipher_hd); + } + + return GPG_ERR_UNSUPPORTED_ALGORITHM; +} + +static tvbuff_t * +dissect_packet_data(tvbuff_t *tvb ,tvbuff_t *auth_tvb _U_, + int offset , packet_info *pinfo ,dcerpc_auth_info *auth_info _U_,unsigned char is_server) +{ + + tvbuff_t *buf = NULL; + guint8* decrypted; + netlogon_auth_vars *vars; + netlogon_auth_key key; + /*debugprintf("Dissection of request data offset %d len=%d on packet %d\n",offset,tvb_length_remaining(tvb,offset),pinfo->num);*/ + + generate_hash_key(pinfo,is_server,&key); + vars = (netlogon_auth_vars *)wmem_map_lookup(netlogon_auths, &key); + + if(vars != NULL ) { + while(vars != NULL && vars->next_start != -1 && vars->next_start < (int) pinfo->num ) { + vars = vars->next; + } + if(vars == NULL ) { + debugprintf("Vars not found %d (packet_data)\n",wmem_map_size(netlogon_auths)); + return(buf); + } + else { + if(vars->can_decrypt == TRUE) { + gcry_error_t err; + gcry_cipher_hd_t cipher_hd = NULL; + int data_len; + guint64 copyconfounder = vars->confounder; + + data_len = tvb_captured_length_remaining(tvb,offset); + if (data_len < 0) { + return NULL; + } + err = prepare_decryption_cipher(vars, &cipher_hd); + if (err != 0) { + ws_warning("GCRY: prepare_decryption_cipher %s/%s\n", + gcry_strsource(err), gcry_strerror(err)); + return NULL; + } + gcry_cipher_decrypt(cipher_hd, (guint8*)©confounder, 8, NULL, 0); + decrypted = (guint8*)tvb_memdup(pinfo->pool, tvb, offset,data_len); + if (!(vars->flags & NETLOGON_FLAG_AES)) { + gcry_cipher_reset(cipher_hd); + } + gcry_cipher_decrypt(cipher_hd, decrypted, data_len, NULL, 0); + gcry_cipher_close(cipher_hd); + buf = tvb_new_child_real_data(tvb, decrypted, data_len, data_len); + /* Note: caller does add_new_data_source(...) */ + } + else { + debugprintf("Session key not found can't decrypt ...\n"); + } + } + } else { + debugprintf("Vars not found %d (packet_data)\n",wmem_map_size(netlogon_auths)); + return(buf); + } + + return(buf); +} + +static tvbuff_t* dissect_request_data(tvbuff_t *header_tvb _U_, + tvbuff_t *payload_tvb, + tvbuff_t *trailer_tvb _U_, + tvbuff_t *auth_tvb, + packet_info *pinfo, + dcerpc_auth_info *auth_info) +{ + return dissect_packet_data(payload_tvb,auth_tvb,0,pinfo,auth_info,0); +} + +static tvbuff_t* dissect_response_data(tvbuff_t *header_tvb _U_, + tvbuff_t *payload_tvb, + tvbuff_t *trailer_tvb _U_, + tvbuff_t *auth_tvb, + packet_info *pinfo, + dcerpc_auth_info *auth_info) +{ + return dissect_packet_data(payload_tvb,auth_tvb,0,pinfo,auth_info,1); +} + +/* MS-NRPC 2.2.1.3.2 */ +static int +dissect_secchan_verf(tvbuff_t *tvb, int offset, packet_info *pinfo, + proto_tree *tree, guint8 *drep, unsigned char is_server) +{ + netlogon_auth_vars *vars; + netlogon_auth_key key; + proto_item *vf = NULL; + proto_tree *subtree = NULL; + guint64 encrypted_seq; + guint64 digest = 0; + guint64 confounder = 0; + int update_vars = 0; + + generate_hash_key(pinfo,is_server,&key); + vars = (netlogon_auth_vars *)wmem_map_lookup(netlogon_auths,(gconstpointer*) &key); + if( ! (seen.isseen && seen.num == pinfo->num) ) { + /* + * Create a new tree, and split into x components ... + */ + vf = proto_tree_add_item(tree, hf_netlogon_secchan_verf, tvb, + offset, -1, ENC_NA); + subtree = proto_item_add_subtree(vf, ett_secchan_verf); + + proto_tree_add_item(subtree, hf_netlogon_secchan_verf_signalg, tvb, + offset, 2, ENC_LITTLE_ENDIAN); + proto_tree_add_item(subtree, hf_netlogon_secchan_verf_sealalg, tvb, + offset+2, 2, ENC_LITTLE_ENDIAN); + /* 2 pad bytes */ + proto_tree_add_item(subtree, hf_netlogon_secchan_verf_flag, tvb, + offset+6, 2, ENC_NA); + offset += 8; + + offset = dissect_dcerpc_8bytes(tvb, offset, pinfo, subtree, drep, + hf_netlogon_secchan_verf_seq, &encrypted_seq); + + offset = dissect_dcerpc_8bytes(tvb, offset, pinfo, subtree, drep, + hf_netlogon_secchan_verf_digest, &digest); + + /* In some cases the nonce if the data/signture are encrypted ("integrity/seal in MS language")*/ + + if (tvb_bytes_exist(tvb, offset, 8)) { + offset = dissect_dcerpc_8bytes(tvb, offset, pinfo, subtree, drep, + hf_netlogon_secchan_verf_nonce, &confounder); + } + update_vars = 1; + } + if( vars != NULL ) { + while(vars != NULL && vars->next_start != -1 && vars->next_start < (int)pinfo->num ) { + vars = vars->next; + } + if(vars == NULL ) { + debugprintf("Vars not found %d (packet_data)\n",wmem_map_size(netlogon_auths)); + return(offset); + } + else { + if(update_vars) { + vars->confounder = confounder; + vars->seq = uncrypt_sequence(vars->flags,vars->session_key,digest,encrypted_seq,is_server); + } + + if(get_seal_key(vars->session_key,16,vars->encryption_key)) + { + vars->can_decrypt = TRUE; + } + else + { + debugprintf("get seal key returned 0\n"); + } + + if (vars->can_decrypt) { + expert_add_info_format(pinfo, proto_tree_get_parent(subtree), + &ei_netlogon_session_key, + "Using session key learned in frame %d (" + "%02x%02x%02x%02x" + ") from %s", + vars->auth_fd_num, + vars->session_key[0] & 0xFF, vars->session_key[1] & 0xFF, + vars->session_key[2] & 0xFF, vars->session_key[3] & 0xFF, + vars->nthash.key_origin); + } + } + } + else + { + debugprintf("Vars not found (is null %d) %d (dissect_verf)\n",vars==NULL,wmem_map_size(netlogon_auths)); + } + /*debugprintf("Setting isseen to true, old packet %d new %d\n",seen.num,pinfo->num);*/ + seen.isseen = TRUE; + seen.num = pinfo->num; + + return offset; +} +static int +dissect_request_secchan_verf(tvbuff_t *tvb, int offset, packet_info *pinfo , + proto_tree *tree, dcerpc_info *di _U_, guint8 *drep ) +{ + return dissect_secchan_verf(tvb,offset,pinfo,tree,drep,0); +} +static int +dissect_response_secchan_verf(tvbuff_t *tvb, int offset, packet_info *pinfo , + proto_tree *tree, dcerpc_info *di _U_, guint8 *drep ) +{ + return dissect_secchan_verf(tvb,offset,pinfo,tree,drep,1); +} + +void +proto_register_dcerpc_netlogon(void) +{ + + static hf_register_info hf[] = { + { &hf_netlogon_opnum, + { "Operation", "netlogon.opnum", FT_UINT16, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_rc, { + "Return code", "netlogon.rc", FT_UINT32, BASE_HEX | BASE_EXT_STRING, + &NT_errors_ext, 0x0, "Netlogon return code", HFILL }}, + + { &hf_netlogon_dos_rc, + { "DOS error code", "netlogon.dos.rc", FT_UINT32, + BASE_HEX | BASE_EXT_STRING, &DOS_errors_ext, 0x0, NULL, HFILL}}, + + { &hf_netlogon_werr_rc, + { "WERR error code", "netlogon.werr.rc", FT_UINT32, + BASE_HEX | BASE_EXT_STRING, &WERR_errors_ext, 0x0, NULL, HFILL}}, + + { &hf_netlogon_param_ctrl, { + "Param Ctrl", "netlogon.param_ctrl", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_logon_id, { + "Logon ID", "netlogon.logon_id", FT_UINT64, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_modify_count, { + "Modify Count", "netlogon.modify_count", FT_UINT64, BASE_DEC, + NULL, 0x0, "How many times the object has been modified", HFILL }}, + + { &hf_netlogon_security_information, { + "Security Information", "netlogon.security_information", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_count, { + "Count", "netlogon.count", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_entries, { + "Entries", "netlogon.entries", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_credential, { + "Credential", "netlogon.credential", FT_BYTES, BASE_NONE, + NULL, 0x0, "Netlogon Credential", HFILL }}, + + { &hf_netlogon_challenge, { + "Challenge", "netlogon.challenge", FT_BYTES, BASE_NONE, + NULL, 0x0, "Netlogon challenge", HFILL }}, + + { &hf_netlogon_lm_owf_password, { + "LM Pwd", "netlogon.lm_owf_pwd", FT_BYTES, BASE_NONE, + NULL, 0x0, "LanManager OWF Password", HFILL }}, + + { &hf_netlogon_user_session_key, { + "User Session Key", "netlogon.user_session_key", FT_BYTES, BASE_NONE, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_encrypted_lm_owf_password, { + "Encrypted LM Pwd", "netlogon.lm_owf_pwd.encrypted", FT_BYTES, BASE_NONE, + NULL, 0x0, "Encrypted LanManager OWF Password", HFILL }}, + + { &hf_netlogon_nt_owf_password, { + "NT Pwd", "netlogon.nt_owf_pwd", FT_BYTES, BASE_NONE, + NULL, 0x0, "NT OWF Password", HFILL }}, + + { &hf_netlogon_blob, { + "BLOB", "netlogon.blob", FT_BYTES, BASE_NONE, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_len, { + "Len", "netlogon.len", FT_UINT32, BASE_DEC, + NULL, 0, "Length", HFILL }}, + + { &hf_netlogon_priv, { + "Priv", "netlogon.priv", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_privilege_entries, { + "Privilege Entries", "netlogon.privilege_entries", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_privilege_control, { + "Privilege Control", "netlogon.privilege_control", FT_UINT32, BASE_HEX, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_privilege_name, { + "Privilege Name", "netlogon.privilege_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_pdc_connection_status, { + "PDC Connection Status", "netlogon.pdc_connection_status", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_tc_connection_status, { + "TC Connection Status", "netlogon.tc_connection_status", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_attrs, { + "Attributes", "netlogon.attrs", FT_UINT32, BASE_HEX, + NULL, 0, NULL, HFILL }}, + +#if 0 + { &hf_netlogon_lsapolicy_referentid, + { "Referent ID", "netlogon.lsapolicy.referentID", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, +#endif + + { &hf_netlogon_lsapolicy_len, + { "Length", "netlogon.lsapolicy.length", FT_UINT32, BASE_DEC, + NULL, 0x0, "Length of the policy buffer", HFILL }}, + +#if 0 + { &hf_netlogon_lsapolicy_pointer, + { "Pointer", "netlogon.lsapolicy.pointer", FT_BYTES, BASE_NONE, + NULL, 0x0, "Pointer to LSA POLICY", HFILL }}, +#endif + + { &hf_netlogon_unknown_string, + { "Unknown string", "netlogon.unknown_string", FT_STRING, BASE_NONE, + NULL, 0, "Unknown string. If you know what this is, contact wireshark developers.", HFILL }}, + + { &hf_netlogon_TrustedDomainName_string, + { "TrustedDomainName", "netlogon.TrustedDomainName", FT_STRING, BASE_NONE, + NULL, 0, "TrustedDomainName string.", HFILL }}, + + { &hf_netlogon_UserName_string, + { "UserName", "netlogon.UserName", FT_STRING, BASE_NONE, + NULL, 0, "UserName string.", HFILL }}, + + { &hf_netlogon_dummy_string, + { "Dummy String", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_trust_extension, + { "Trust extension", "netlogon.trust.extension", FT_STRING, BASE_NONE, + NULL, 0, "Trusts extension.", HFILL }}, + + { &hf_netlogon_trust_offset, + { "Offset", "netlogon.trust.extension_offset", FT_UINT32, BASE_DEC, + NULL, 0, "Trusts extension.", HFILL }}, + + { &hf_netlogon_trust_len, + { "Length", "netlogon.trust.extension_length", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_trust_max, + { "Max Count", "netlogon.trust.extension.maxcount", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_dummy_string2, + { "Dummy String2", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 2. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy_string3, + { "Dummy String3", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 3. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy_string4, + { "Dummy String4", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 4. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy_string5, + { "Dummy String5", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 5. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy_string6, + { "Dummy String6", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 6. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy_string7, + { "Dummy String7", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 7. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy_string8, + { "Dummy String8", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 8. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy_string9, + { "Dummy String9", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 9. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy_string10, + { "Dummy String10", "netlogon.dummy_string", FT_STRING, BASE_NONE, + NULL, 0, "Dummy String 10. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_unknown_long, + { "Unknown long", "netlogon.unknown.long", FT_UINT32, BASE_HEX, + NULL, 0x0, "Unknown long. If you know what this is, contact wireshark developers.", HFILL }}, + + { &hf_netlogon_dummy1_long, + { "Dummy1 Long", "netlogon.dummy.long1", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 1. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy2_long, + { "Dummy2 Long", "netlogon.dummy.long2", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 2. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy3_long, + { "Dummy3 Long", "netlogon.dummy.long3", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 3. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy4_long, + { "Dummy4 Long", "netlogon.dummy.long4", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 4. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy5_long, + { "Dummy5 Long", "netlogon.dummy.long5", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 5. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy6_long, + { "Dummy6 Long", "netlogon.dummy.long6", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 6. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy7_long, + { "Dummy7 Long", "netlogon.dummy.long7", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 7. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy8_long, + { "Dummy8 Long", "netlogon.dummy.long8", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 8. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy9_long, + { "Dummy9 Long", "netlogon.dummy.long9", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 9. Used is reserved for next evolutions.", HFILL }}, + + { &hf_netlogon_dummy10_long, + { "Dummy10 Long", "netlogon.dummy.long10", FT_UINT32, BASE_HEX, + NULL, 0x0, "Dummy long 10. Used is reserved for next evolutions.", HFILL }}, + + + { &hf_netlogon_supportedenctypes, + { "Supported Encryption Types", "netlogon.encryption.types", FT_UINT32, BASE_HEX, + NULL, 0x0, "Encryption types", HFILL }}, + + { &hf_netlogon_workstation_flags, + { "Workstation Flags", "netlogon.workstation.flags", FT_UINT32, BASE_HEX, + NULL, 0x0, "Flags", HFILL }}, + + { &hf_netlogon_reserved, + { "Reserved", "netlogon.reserved", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + { &hf_netlogon_unknown_short, + { "Unknown short", "netlogon.unknown.short", FT_UINT16, BASE_HEX, + NULL, 0x0, "Unknown short. If you know what this is, contact wireshark developers.", HFILL }}, + + { &hf_netlogon_unknown_char, + { "Unknown char", "netlogon.unknown.char", FT_UINT8, BASE_HEX, + NULL, 0x0, "Unknown char. If you know what this is, contact wireshark developers.", HFILL }}, + + { &hf_netlogon_acct_expiry_time, + { "Acct Expiry Time", "netlogon.acct.expiry_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0x0, "When this account will expire", HFILL }}, + + { &hf_netlogon_nt_pwd_present, + { "NT PWD Present", "netlogon.nt_pwd_present", FT_UINT8, BASE_HEX, + NULL, 0x0, "Is NT password present for this account?", HFILL }}, + + { &hf_netlogon_lm_pwd_present, + { "LM PWD Present", "netlogon.lm_pwd_present", FT_UINT8, BASE_HEX, + NULL, 0x0, "Is LanManager password present for this account?", HFILL }}, + + { &hf_netlogon_pwd_expired, + { "PWD Expired", "netlogon.pwd_expired", FT_UINT8, BASE_HEX, + NULL, 0x0, "Whether this password has expired or not", HFILL }}, + + { &hf_netlogon_authoritative, + { "Authoritative", "netlogon.authoritative", FT_UINT8, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_sensitive_data_flag, + { "Sensitive Data", "netlogon.sensitive_data_flag", FT_UINT8, BASE_DEC, + NULL, 0x0, "Sensitive data flag", HFILL }}, + + { &hf_netlogon_auditing_mode, + { "Auditing Mode", "netlogon.auditing_mode", FT_UINT8, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_max_audit_event_count, + { "Max Audit Event Count", "netlogon.max_audit_event_count", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_event_audit_option, + { "Event Audit Option", "netlogon.event_audit_option", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_sensitive_data_len, + { "Length", "netlogon.sensitive_data_len", FT_UINT32, BASE_DEC, + NULL, 0x0, "Length of sensitive data", HFILL }}, + + { &hf_netlogon_nt_chal_resp, + { "NT Chal resp", "netlogon.nt_chal_resp", FT_BYTES, BASE_NONE, + NULL, 0, "Challenge response for NT authentication", HFILL }}, + + { &hf_netlogon_lm_chal_resp, + { "LM Chal resp", "netlogon.lm_chal_resp", FT_BYTES, BASE_NONE, + NULL, 0, "Challenge response for LM authentication", HFILL }}, + + { &hf_netlogon_cipher_len, + { "Cipher Len", "netlogon.cipher_len", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_cipher_maxlen, + { "Cipher Max Len", "netlogon.cipher_maxlen", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + +#if 0 + { &hf_netlogon_pac_data, + { "Pac Data", "netlogon.pac.data", FT_BYTES, BASE_NONE, + NULL, 0, NULL, HFILL }}, +#endif + + { &hf_netlogon_sensitive_data, + { "Data", "netlogon.sensitive_data", FT_BYTES, BASE_NONE, + NULL, 0, "Sensitive Data", HFILL }}, + +#if 0 + { &hf_netlogon_auth_data, + { "Auth Data", "netlogon.auth.data", FT_BYTES, BASE_NONE, + NULL, 0, NULL, HFILL }}, +#endif + + { &hf_netlogon_cipher_current_data, + { "Cipher Current Data", "netlogon.cipher_current_data", FT_BYTES, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_cipher_old_data, + { "Cipher Old Data", "netlogon.cipher_old_data", FT_BYTES, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_acct_name, + { "Acct Name", "netlogon.acct_name", FT_STRING, BASE_NONE, + NULL, 0, "Account Name", HFILL }}, + + { &hf_netlogon_acct_desc, + { "Acct Desc", "netlogon.acct_desc", FT_STRING, BASE_NONE, + NULL, 0, "Account Description", HFILL }}, + + { &hf_netlogon_group_desc, + { "Group Desc", "netlogon.group_desc", FT_STRING, BASE_NONE, + NULL, 0, "Group Description", HFILL }}, + + { &hf_netlogon_full_name, + { "Full Name", "netlogon.full_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_comment, + { "Comment", "netlogon.comment", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_parameters, + { "Parameters", "netlogon.parameters", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_logon_script, + { "Logon Script", "netlogon.logon_script", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_profile_path, + { "Profile Path", "netlogon.profile_path", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_home_dir, + { "Home Dir", "netlogon.home_dir", FT_STRING, BASE_NONE, + NULL, 0, "Home Directory", HFILL }}, + + { &hf_netlogon_dir_drive, + { "Dir Drive", "netlogon.dir_drive", FT_STRING, BASE_NONE, + NULL, 0, "Drive letter for home directory", HFILL }}, + + { &hf_netlogon_logon_srv, + { "Server", "netlogon.server", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + +#if 0 + { &hf_netlogon_principal, + { "Principal", "netlogon.principal", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, +#endif + + { &hf_netlogon_logon_dom, + { "Domain", "netlogon.domain", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_resourcegroupcount, + { "ResourceGroup count", "netlogon.resourcegroupcount", FT_UINT32, BASE_DEC, + NULL, 0, "Number of Resource Groups", HFILL }}, + + { &hf_netlogon_accountdomaingroupcount, + { "AccountDomainGroup count", "netlogon.accountdomaingroupcount", FT_UINT32, BASE_DEC, + NULL, 0, "Number of Account Domain Groups", HFILL }}, + + { &hf_netlogon_domaingroupcount, + { "DomainGroup count", "netlogon.domaingroupcount", FT_UINT32, BASE_DEC, + NULL, 0, "Number of Domain Groups", HFILL }}, + + { &hf_netlogon_membership_domains_count, + { "Membership Domains count", "netlogon.membershipsdomainscount", FT_UINT32, BASE_DEC, + NULL, 0, "Number of ExtraDomain Membership Arrays", HFILL }}, + + { &hf_netlogon_computer_name, + { "Computer Name", "netlogon.computer_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_site_name, + { "Site Name", "netlogon.site_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_dc_name, + { "DC Name", "netlogon.dc.name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_dc_site_name, + { "DC Site Name", "netlogon.dc.site_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_dns_forest_name, + { "DNS Forest Name", "netlogon.dns.forest_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_dc_address, + { "DC Address", "netlogon.dc.address", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_dc_address_type, + { "DC Address Type", "netlogon.dc.address_type", FT_UINT32, BASE_DEC, + VALS(dc_address_types), 0, NULL, HFILL }}, + + { &hf_netlogon_client_site_name, + { "Client Site Name", "netlogon.client.site_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_workstation_site_name, + { "Wkst Site Name", "netlogon.wkst.site_name", FT_STRING, BASE_NONE, + NULL, 0, "Workstation Site Name", HFILL }}, + + { &hf_netlogon_workstation, + { "Wkst Name", "netlogon.wkst.name", FT_STRING, BASE_NONE, + NULL, 0, "Workstation Name", HFILL }}, + + { &hf_netlogon_os_version, + { "OS version", "netlogon.os.version", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_workstation_os, + { "Wkst OS", "netlogon.wkst.os", FT_STRING, BASE_NONE, + NULL, 0, "Workstation OS", HFILL }}, + + { &hf_netlogon_workstations, + { "Workstations", "netlogon.wksts", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_workstation_fqdn, + { "Wkst FQDN", "netlogon.wkst.fqdn", FT_STRING, BASE_NONE, + NULL, 0, "Workstation FQDN", HFILL }}, + + { &hf_netlogon_group_name, + { "Group Name", "netlogon.group_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_alias_name, + { "Alias Name", "netlogon.alias_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_dns_host, + { "DNS Host", "netlogon.dns_host", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_downlevel_domain_name, + { "Downlevel Domain", "netlogon.downlevel_domain", FT_STRING, BASE_NONE, + NULL, 0, "Downlevel Domain Name", HFILL }}, + + { &hf_netlogon_dns_domain_name, + { "DNS Domain", "netlogon.dns_domain", FT_STRING, BASE_NONE, + NULL, 0, "DNS Domain Name", HFILL }}, + + { &hf_netlogon_ad_client_dns_name, + { "Client DNS Name", "netlogon.client_dns_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_domain_name, + { "Domain", "netlogon.domain", FT_STRING, BASE_NONE, + NULL, 0, "Domain Name", HFILL }}, + + { &hf_netlogon_oem_info, + { "OEM Info", "netlogon.oem_info", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_trusted_dc_name, + { "Trusted DC", "netlogon.trusted_dc", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_logon_dnslogondomainname, + { "DNS Logon Domain name", "netlogon.logon.dnslogondomainname", FT_STRING, BASE_NONE, + NULL, 0, "DNS Name of the logon domain", HFILL }}, + + { &hf_netlogon_logon_upn, + { "UPN", "netlogon.logon.upn", FT_STRING, BASE_NONE, + NULL, 0, "User Principal Name", HFILL }}, + + { &hf_netlogon_logonsrv_handle, + { "Handle", "netlogon.handle", FT_STRING, BASE_NONE, + NULL, 0, "Logon Srv Handle", HFILL }}, + + { &hf_netlogon_dummy, + { "Dummy", "netlogon.dummy", FT_STRING, BASE_NONE, + NULL, 0, "Dummy string", HFILL }}, + + { &hf_netlogon_logon_count16, + { "Logon Count", "netlogon.logon_count16", FT_UINT16, BASE_DEC, + NULL, 0x0, "Number of successful logins", HFILL }}, + + { &hf_netlogon_logon_count, + { "Logon Count", "netlogon.logon_count", FT_UINT32, BASE_DEC, + NULL, 0x0, "Number of successful logins", HFILL }}, + + { &hf_netlogon_bad_pw_count16, + { "Bad PW Count", "netlogon.bad_pw_count16", FT_UINT16, BASE_DEC, + NULL, 0x0, "Number of failed logins", HFILL }}, + + { &hf_netlogon_bad_pw_count, + { "Bad PW Count", "netlogon.bad_pw_count", FT_UINT32, BASE_DEC, + NULL, 0x0, "Number of failed logins", HFILL }}, + + { &hf_netlogon_country, + { "Country", "netlogon.country", FT_UINT16, BASE_DEC | BASE_EXT_STRING, + &ms_country_codes_ext, 0x0, "Country setting for this account", HFILL }}, + + { &hf_netlogon_codepage, + { "Codepage", "netlogon.codepage", FT_UINT16, BASE_DEC, + NULL, 0x0, "Codepage setting for this account", HFILL }}, + + { &hf_netlogon_level16, + { "Level", "netlogon.level16", FT_UINT16, BASE_DEC, + NULL, 0x0, "Which option of the union is represented here", HFILL }}, + + { &hf_netlogon_validation_level, + { "Validation Level", "netlogon.validation_level", FT_UINT16, BASE_DEC, + NULL, 0x0, "Requested level of validation", HFILL }}, + + { &hf_netlogon_minpasswdlen, + { "Min Password Len", "netlogon.min_passwd_len", FT_UINT16, BASE_DEC, + NULL, 0x0, "Minimum length of password", HFILL }}, + + { &hf_netlogon_passwdhistorylen, + { "Passwd History Len", "netlogon.passwd_history_len", FT_UINT16, BASE_DEC, + NULL, 0x0, "Length of password history", HFILL }}, + + { &hf_netlogon_secure_channel_type, + { "Sec Chan Type", "netlogon.sec_chan_type", FT_UINT16, BASE_DEC, + VALS(misc_netr_SchannelType_vals), 0x0, "Secure Channel Type", HFILL }}, + + { &hf_netlogon_restart_state, + { "Restart State", "netlogon.restart_state", FT_UINT16, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_delta_type, + { "Delta Type", "netlogon.delta_type", FT_UINT16, BASE_DEC, + VALS(delta_type_vals), 0x0, NULL, HFILL }}, + + { &hf_netlogon_blob_size, + { "Size", "netlogon.blob.size", FT_UINT32, BASE_DEC, + NULL, 0x0, "Size in bytes of BLOB", HFILL }}, + + { &hf_netlogon_code, + { "Code", "netlogon.code", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_level, + { "Level", "netlogon.level", FT_UINT32, BASE_DEC, + NULL, 0x0, "Which option of the union is represented here", HFILL }}, + + { &hf_netlogon_reference, + { "Reference", "netlogon.reference", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_next_reference, + { "Next Reference", "netlogon.next_reference", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_timestamp, + { "Timestamp", "netlogon.timestamp", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_user_rid, + { "User RID", "netlogon.rid", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_alias_rid, + { "Alias RID", "netlogon.alias_rid", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_group_rid, + { "Group RID", "netlogon.group_rid", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_num_rids, + { "Num RIDs", "netlogon.num_rids", FT_UINT32, BASE_DEC, + NULL, 0x0, "Number of RIDs", HFILL }}, + + { &hf_netlogon_num_controllers, + { "Num DCs", "netlogon.num_dc", FT_UINT32, BASE_DEC, + NULL, 0x0, "Number of domain controllers", HFILL }}, + + { &hf_netlogon_num_sid, + { "Num Extra SID", "netlogon.num_sid", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_flags, + { "Flags", "netlogon.flags", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_user_account_control, + { "User Account Control", "netlogon.user_account_control", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_user_flags, + { "User Flags", "netlogon.user_flags", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_auth_flags, + { "Auth Flags", "netlogon.auth_flags", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_systemflags, + { "System Flags", "netlogon.system_flags", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_database_id, + { "Database Id", "netlogon.database_id", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_sync_context, + { "Sync Context", "netlogon.sync_context", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_max_size, + { "Max Size", "netlogon.max_size", FT_UINT32, BASE_DEC, + NULL, 0x0, "Max Size of database", HFILL }}, + + { &hf_netlogon_max_log_size, + { "Max Log Size", "netlogon.max_log_size", FT_UINT32, BASE_DEC, + NULL, 0x0, "Max Size of log", HFILL }}, + +#if 0 + { &hf_netlogon_pac_size, + { "Pac Size", "netlogon.pac.size", FT_UINT32, BASE_DEC, + NULL, 0x0, "Size of PacData in bytes", HFILL }}, +#endif + +#if 0 + { &hf_netlogon_auth_size, + { "Auth Size", "netlogon.auth.size", FT_UINT32, BASE_DEC, + NULL, 0x0, "Size of AuthData in bytes", HFILL }}, +#endif + + { &hf_netlogon_num_deltas, + { "Num Deltas", "netlogon.num_deltas", FT_UINT32, BASE_DEC, + NULL, 0x0, "Number of SAM Deltas in array", HFILL }}, + + { &hf_netlogon_num_trusts, + { "Num Trusts", "netlogon.num_trusts", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_logon_attempts, + { "Logon Attempts", "netlogon.logon_attempts", FT_UINT32, BASE_DEC, + NULL, 0x0, "Number of logon attempts", HFILL }}, + + { &hf_netlogon_pagefilelimit, + { "Page File Limit", "netlogon.page_file_limit", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_pagedpoollimit, + { "Paged Pool Limit", "netlogon.paged_pool_limit", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_nonpagedpoollimit, + { "Non-Paged Pool Limit", "netlogon.nonpaged_pool_limit", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_minworkingsetsize, + { "Min Working Set Size", "netlogon.min_working_set_size", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_maxworkingsetsize, + { "Max Working Set Size", "netlogon.max_working_set_size", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_serial_number, + { "Serial Number", "netlogon.serial_number", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_neg_flags, + { "Negotiation options", "netlogon.neg_flags", FT_UINT32, BASE_HEX, + NULL, 0x0, "Negotiation Flags", HFILL }}, + +#if 0 + { &hf_netlogon_neg_flags_80000000, + { "Not used 80000000", "ntlmssp.neg_flags.na8000000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_80000000, "Not used", HFILL }}, +#endif + + { &hf_netlogon_neg_flags_40000000, + { "Authenticated RPC supported", "ntlmssp.neg_flags.na4000000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_40000000, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_20000000, + { "Authenticated RPC via lsass supported", "ntlmssp.neg_flags.na2000000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_20000000, "rpc via lsass", HFILL }}, + +#if 0 + { &hf_netlogon_neg_flags_10000000, + { "Not used 10000000", "ntlmssp.neg_flags.na1000000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_10000000, "Not used", HFILL }}, +#endif + +#if 0 + { &hf_netlogon_neg_flags_8000000, + { "Not used 8000000", "ntlmssp.neg_flags.na800000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_8000000, "Not used", HFILL }}, +#endif + +#if 0 + { &hf_netlogon_neg_flags_4000000, + { "Not used 4000000", "ntlmssp.neg_flags.na400000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_4000000, "Not used", HFILL }}, +#endif + +#if 0 + { &hf_netlogon_neg_flags_2000000, + { "Not used 2000000", "ntlmssp.neg_flags.na200000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_2000000, "Not used", HFILL }}, +#endif + + { &hf_netlogon_neg_flags_1000000, + { "AES supported", "ntlmssp.neg_flags.na100000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_AES, "AES", HFILL }}, + +#if 0 + { &hf_netlogon_neg_flags_800000, + { "Not used 800000", "ntlmssp.neg_flags.na800000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_800000, "Not used", HFILL }}, +#endif + +#if 0 + { &hf_netlogon_neg_flags_400000, + { "Not used 400000", "ntlmssp.neg_flags.na400000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_400000, "AES&SHA2", HFILL }}, +#endif + + { &hf_netlogon_neg_flags_200000, + { "RODC pass-through", "ntlmssp.neg_flags.na200000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_200000, "rodc pt", HFILL }}, + + { &hf_netlogon_neg_flags_100000, + { "NO NT4 emulation", "ntlmssp.neg_flags.na100000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_100000, "No NT4 emu", HFILL }}, + + { &hf_netlogon_neg_flags_80000, + { "Cross forest trust", "ntlmssp.neg_flags.na80000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_80000, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_40000, + { "GetDomainInfo supported", "ntlmssp.neg_flags.na40000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_40000, "GetDomainInfo", HFILL }}, + + { &hf_netlogon_neg_flags_20000, + { "ServerPasswordSet2 supported", "ntlmssp.neg_flags.na20000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_20000, "PasswordSet2", HFILL }}, + + { &hf_netlogon_neg_flags_10000, + { "DNS trusts supported", "ntlmssp.neg_flags.na10000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_10000, "DNS Trusts", HFILL }}, + + { &hf_netlogon_neg_flags_8000, + { "Transitive trusts", "ntlmssp.neg_flags.na8000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_8000, "Transitive trust", HFILL }}, + + { &hf_netlogon_neg_flags_4000, + { "Strong key", "ntlmssp.neg_flags.na4000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_STRONGKEY, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_2000, + { "Avoid replication Auth database", "ntlmssp.neg_flags.na2000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_2000, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_1000, + { "Avoid replication account database", "ntlmssp.neg_flags.na1000", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_1000, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_800, + { "Concurrent RPC", "ntlmssp.neg_flags.na800", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_800, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_400, + { "Generic pass-through", "ntlmssp.neg_flags.na400", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_400, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_200, + { "SendToSam", "ntlmssp.neg_flags.na200", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_200, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_100, + { "Refusal of password change", "ntlmssp.neg_flags.na100", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_100, "PWD change refusal", HFILL }}, + + { &hf_netlogon_neg_flags_80, + { "DatabaseRedo call", "ntlmssp.neg_flags.na80", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_80, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_40, + { "Handle multiple SIDs", "ntlmssp.neg_flags.na40", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_40, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_20, + { "Restarting full DC sync", "ntlmssp.neg_flags.na20", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_20, NULL, HFILL }}, + + { &hf_netlogon_neg_flags_10, + { "BDC handling Changelogs", "ntlmssp.neg_flags.na10", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_10, "BDC Changelog", HFILL }}, + + { &hf_netlogon_neg_flags_8, + { "Promotion count(deprecated)", "ntlmssp.neg_flags.na8", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_8, "Promotion count", HFILL }}, + + { &hf_netlogon_neg_flags_4, + { "RC4 encryption", "ntlmssp.neg_flags.na4", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_4, "RC4", HFILL }}, + + { &hf_netlogon_neg_flags_2, + { "NT3.5 BDC continuous update", "ntlmssp.neg_flags.na2", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_2, "NT3.5", HFILL }}, + + { &hf_netlogon_neg_flags_1, + { "Account lockout", "ntlmssp.neg_flags.na1", FT_BOOLEAN, 32, TFS(&tfs_set_notset), NETLOGON_FLAG_1, NULL, HFILL }}, + + { &hf_netlogon_dc_flags, + { "Domain Controller Flags", "netlogon.dc.flags", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_dc_flags_pdc_flag, + { "PDC", "netlogon.dc.flags.pdc", + FT_BOOLEAN, 32, TFS(&dc_flags_pdc_flag), DS_PDC_FLAG, + "If this server is a PDC", HFILL }}, + + { &hf_netlogon_dc_flags_gc_flag, + { "GC", "netlogon.dc.flags.gc", + FT_BOOLEAN, 32, TFS(&dc_flags_gc_flag), DS_GC_FLAG, + "If this server is a GC", HFILL }}, + + { &hf_netlogon_dc_flags_ldap_flag, + { "LDAP", "netlogon.dc.flags.ldap", + FT_BOOLEAN, 32, TFS(&dc_flags_ldap_flag), DS_LDAP_FLAG, + "If this is an LDAP server", HFILL }}, + + { &hf_netlogon_dc_flags_ds_flag, + { "DS", "netlogon.dc.flags.ds", + FT_BOOLEAN, 32, TFS(&dc_flags_ds_flag), DS_DS_FLAG, + "If this server is a DS", HFILL }}, + + { &hf_netlogon_dc_flags_kdc_flag, + { "KDC", "netlogon.dc.flags.kdc", + FT_BOOLEAN, 32, TFS(&dc_flags_kdc_flag), DS_KDC_FLAG, + "If this is a KDC", HFILL }}, + + { &hf_netlogon_dc_flags_timeserv_flag, + { "Timeserv", "netlogon.dc.flags.timeserv", + FT_BOOLEAN, 32, TFS(&dc_flags_timeserv_flag), DS_TIMESERV_FLAG, + "If this server is a TimeServer", HFILL }}, + + { &hf_netlogon_dc_flags_closest_flag, + { "Closest", "netlogon.dc.flags.closest", + FT_BOOLEAN, 32, TFS(&dc_flags_closest_flag), DS_CLOSEST_FLAG, + "If this is the closest server", HFILL }}, + + { &hf_netlogon_dc_flags_writable_flag, + { "Writable", "netlogon.dc.flags.writable", + FT_BOOLEAN, 32, TFS(&dc_flags_writable_flag), DS_WRITABLE_FLAG, + "If this server can do updates to the database", HFILL }}, + + { &hf_netlogon_dc_flags_good_timeserv_flag, + { "Good Timeserv", "netlogon.dc.flags.good_timeserv", + FT_BOOLEAN, 32, TFS(&dc_flags_good_timeserv_flag), DS_GOOD_TIMESERV_FLAG, + "If this is a Good TimeServer", HFILL }}, + + { &hf_netlogon_dc_flags_ndnc_flag, + { "NDNC", "netlogon.dc.flags.ndnc", + FT_BOOLEAN, 32, TFS(&dc_flags_ndnc_flag), DS_NDNC_FLAG, + "If this is an NDNC server", HFILL }}, + + { &hf_netlogon_dc_flags_dns_controller_flag, + { "DNS Controller", "netlogon.dc.flags.dns_controller", + FT_BOOLEAN, 32, TFS(&dc_flags_dns_controller_flag), DS_DNS_CONTROLLER_FLAG, + "If this server is a DNS Controller", HFILL }}, + + { &hf_netlogon_dc_flags_dns_domain_flag, + { "DNS Domain", "netlogon.dc.flags.dns_domain", + FT_BOOLEAN, 32, TFS(&dc_flags_dns_domain_flag), DS_DNS_DOMAIN_FLAG, + NULL, HFILL }}, + + { &hf_netlogon_dc_flags_dns_forest_flag, + { "DNS Forest", "netlogon.dc.flags.dns_forest", + FT_BOOLEAN, 32, TFS(&dc_flags_dns_forest_flag), DS_DNS_FOREST_FLAG, + NULL, HFILL }}, + + { &hf_netlogon_get_dcname_request_flags, + { "Flags", "netlogon.get_dcname.request.flags", FT_UINT32, BASE_HEX, + NULL, 0x0, "Flags for DSGetDCName request", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_force_rediscovery, + { "Force Rediscovery", "netlogon.get_dcname.request.flags.force_rediscovery", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_force_rediscovery), DS_FORCE_REDISCOVERY, + "Whether to allow the server to returned cached information or not", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_directory_service_required, + { "DS Required", "netlogon.get_dcname.request.flags.ds_required", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_required), DS_DIRECTORY_SERVICE_REQUIRED, + "Whether we require that the returned DC supports w2k or not", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_directory_service_preferred, + { "DS Preferred", "netlogon.get_dcname.request.flags.ds_preferred", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_directory_service_preferred), DS_DIRECTORY_SERVICE_PREFERRED, + "Whether we prefer the call to return a w2k server (if available)", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_gc_server_required, + { "GC Required", "netlogon.get_dcname.request.flags.gc_server_required", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_gc_server_required), DS_GC_SERVER_REQUIRED, + "Whether we require that the returned DC is a Global Catalog server", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_pdc_required, + { "PDC Required", "netlogon.get_dcname.request.flags.pdc_required", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_pdc_required), DS_PDC_REQUIRED, + "Whether we require the returned DC to be the PDC", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_background_only, + { "Background Only", "netlogon.get_dcname.request.flags.background_only", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_background_only), DS_BACKGROUND_ONLY, + "If we want cached data, even if it may have expired", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_ip_required, + { "IP Required", "netlogon.get_dcname.request.flags.ip_required", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_ip_required), DS_IP_REQUIRED, + "If we require the IP of the DC in the reply", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_kdc_required, + { "KDC Required", "netlogon.get_dcname.request.flags.kdc_required", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_kdc_required), DS_KDC_REQUIRED, + "If we require that the returned server is a KDC", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_timeserv_required, + { "Timeserv Required", "netlogon.get_dcname.request.flags.timeserv_required", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_timeserv_required), DS_TIMESERV_REQUIRED, + "If we require the returned server to be a WindowsTimeServ server", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_writable_required, + { "Writable Required", "netlogon.get_dcname.request.flags.writable_required", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_writable_required), DS_WRITABLE_REQUIRED, + "If we require that the returned server is writable", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_good_timeserv_preferred, + { "Timeserv Preferred", "netlogon.get_dcname.request.flags.good_timeserv_preferred", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_good_timeserv_preferred), DS_GOOD_TIMESERV_PREFERRED, + "If we prefer Windows Time Servers", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_avoid_self, + { "Avoid Self", "netlogon.get_dcname.request.flags.avoid_self", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_avoid_self), DS_AVOID_SELF, + "Return another DC than the one we ask", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_only_ldap_needed, + { "Only LDAP Needed", "netlogon.get_dcname.request.flags.only_ldap_needed", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_only_ldap_needed), DS_ONLY_LDAP_NEEDED, + "We just want an LDAP server, it does not have to be a DC", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_is_flat_name, + { "Is Flat Name", "netlogon.get_dcname.request.flags.is_flat_name", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_flat_name), DS_IS_FLAT_NAME, + "If the specified domain name is a NetBIOS name", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_is_dns_name, + { "Is DNS Name", "netlogon.get_dcname.request.flags.is_dns_name", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_is_dns_name), DS_IS_DNS_NAME, + "If the specified domain name is a DNS name", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_return_dns_name, + { "Return DNS Name", "netlogon.get_dcname.request.flags.return_dns_name", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_dns_name), DS_RETURN_DNS_NAME, + "Only return a DNS name (or an error)", HFILL }}, + + { &hf_netlogon_get_dcname_request_flags_return_flat_name, + { "Return Flat Name", "netlogon.get_dcname.request.flags.return_flat_name", + FT_BOOLEAN, 32, TFS(&get_dcname_request_flags_return_flat_name), DS_RETURN_FLAT_NAME, + "Only return a NetBIOS name (or an error)", HFILL }}, + + { &hf_netlogon_trust_attribs, + { "Trust Attributes", "netlogon.trust_attribs", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_trust_attribs_non_transitive, + { "Non Transitive", "netlogon.trust.attribs.non_transitive", FT_BOOLEAN, 32, + TFS(&trust_attribs_non_transitive), 0x00000001, NULL, HFILL }}, + + { &hf_netlogon_trust_attribs_uplevel_only, + { "Uplevel Only", "netlogon.trust.attribs.uplevel_only", FT_BOOLEAN, 32, + TFS(&trust_attribs_uplevel_only), 0x00000002, NULL, HFILL }}, + + { &hf_netlogon_trust_attribs_quarantined_domain, + { "Quarantined Domain", "netlogon.trust.attribs.quarantined_domain", FT_BOOLEAN, 32, + TFS(&trust_attribs_quarantined_domain), 0x00000004, NULL, HFILL }}, + + { &hf_netlogon_trust_attribs_forest_transitive, + { "Forest Transitive", "netlogon.trust.attribs.forest_transitive", FT_BOOLEAN, 32, + TFS(&trust_attribs_forest_transitive), 0x00000008, NULL, HFILL }}, + + { &hf_netlogon_trust_attribs_cross_organization, + { "Cross Organization", "netlogon.trust.attribs.cross_organization", FT_BOOLEAN, 32, + TFS(&trust_attribs_cross_organization), 0x00000010, NULL, HFILL }}, + + { &hf_netlogon_trust_attribs_within_forest, + { "Within Forest", "netlogon.trust.attribs.within_forest", FT_BOOLEAN, 32, + TFS(&trust_attribs_within_forest), 0x00000020, NULL, HFILL }}, + + { &hf_netlogon_trust_attribs_treat_as_external, + { "Treat As External", "netlogon.trust.attribs.treat_as_external", FT_BOOLEAN, 32, + TFS(&trust_attribs_treat_as_external), 0x00000040, NULL, HFILL }}, + + { &hf_netlogon_trust_type, + { "Trust Type", "netlogon.trust_type", FT_UINT32, BASE_DEC, + VALS(trust_type_vals), 0x0, NULL, HFILL }}, + + { &hf_netlogon_extraflags, + { "Extra Flags", "netlogon.extra_flags", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_extra_flags_root_forest, + { "Request passed to DC of root forest", "netlogon.extra.flags.rootdc", + FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_ROOT_FOREST, + NULL, HFILL }}, + + { &hf_netlogon_trust_flags_dc_firsthop, + { "DC at the end of the first hop of cross forest", "netlogon.extra.flags.dc_firsthop", + FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_DC_XFOREST, + NULL, HFILL }}, + + { &hf_netlogon_trust_flags_rodc_to_dc, + { "Request from a RODC to a DC from another domain", "netlogon.extra.flags.rodc_to_dc", + FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_RODC_DIF_DOMAIN, + NULL, HFILL }}, + + { &hf_netlogon_trust_flags_rodc_ntlm, + { "Request is a NTLM auth passed by a RODC", "netlogon.extra.flags.rodc_ntlm", + FT_BOOLEAN, 32, TFS(&tfs_set_notset), RQ_NTLM_FROM_RODC, + NULL, HFILL }}, + + { &hf_netlogon_trust_flags, + { "Trust Flags", "netlogon.trust_flags", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_trust_flags_inbound, + { "Inbound Trust", "netlogon.trust.flags.inbound", + FT_BOOLEAN, 32, TFS(&trust_inbound), DS_DOMAIN_DIRECT_INBOUND, + "Inbound trust. Whether the domain directly trusts the queried servers domain", HFILL }}, + + { &hf_netlogon_trust_flags_outbound, + { "Outbound Trust", "netlogon.trust.flags.outbound", + FT_BOOLEAN, 32, TFS(&trust_outbound), DS_DOMAIN_DIRECT_OUTBOUND, + "Outbound Trust. Whether the domain is directly trusted by the servers domain", HFILL }}, + + { &hf_netlogon_trust_flags_in_forest, + { "In Forest", "netlogon.trust.flags.in_forest", + FT_BOOLEAN, 32, TFS(&trust_in_forest), DS_DOMAIN_IN_FOREST, + "Whether this domain is a member of the same forest as the servers domain", HFILL }}, + + { &hf_netlogon_trust_flags_native_mode, + { "Native Mode", "netlogon.trust.flags.native_mode", + FT_BOOLEAN, 32, TFS(&trust_native_mode), DS_DOMAIN_NATIVE_MODE, + "Whether the domain is a w2k native mode domain or not", HFILL }}, + + { &hf_netlogon_trust_flags_primary, + { "Primary", "netlogon.trust.flags.primary", + FT_BOOLEAN, 32, TFS(&trust_primary), DS_DOMAIN_PRIMARY, + "Whether the domain is the primary domain for the queried server or not", HFILL }}, + + { &hf_netlogon_trust_flags_tree_root, + { "Tree Root", "netlogon.trust.flags.tree_root", + FT_BOOLEAN, 32, TFS(&trust_tree_root), DS_DOMAIN_TREE_ROOT, + "Whether the domain is the root of the tree for the queried server", HFILL }}, + + { &hf_netlogon_trust_parent_index, + { "Parent Index", "netlogon.parent_index", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_logon_time, + { "Logon Time", "netlogon.logon_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time for last time this user logged on", HFILL }}, + + { &hf_netlogon_kickoff_time, + { "Kickoff Time", "netlogon.kickoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time when this user will be kicked off", HFILL }}, + + { &hf_netlogon_logoff_time, + { "Logoff Time", "netlogon.logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time for last time this user logged off", HFILL }}, + + { &hf_netlogon_last_logoff_time, + { "Last Logoff Time", "netlogon.last_logoff_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time for last time this user logged off", HFILL }}, + + { &hf_netlogon_pwd_last_set_time, + { "PWD Last Set", "netlogon.pwd_last_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Last time this users password was changed", HFILL }}, + + { &hf_netlogon_pwd_age, + { "PWD Age", "netlogon.pwd_age", FT_RELATIVE_TIME, BASE_NONE, + NULL, 0, "Time since this users password was changed", HFILL }}, + + { &hf_netlogon_pwd_can_change_time, + { "PWD Can Change", "netlogon.pwd_can_change_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "When this users password may be changed", HFILL }}, + + { &hf_netlogon_pwd_must_change_time, + { "PWD Must Change", "netlogon.pwd_must_change_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "When this users password must be changed", HFILL }}, + + { &hf_netlogon_domain_create_time, + { "Domain Create Time", "netlogon.domain_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time when this domain was created", HFILL }}, + + { &hf_netlogon_domain_modify_time, + { "Domain Modify Time", "netlogon.domain_modify_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time when this domain was last modified", HFILL }}, + + { &hf_netlogon_db_modify_time, + { "DB Modify Time", "netlogon.db_modify_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time when last modified", HFILL }}, + + { &hf_netlogon_db_create_time, + { "DB Create Time", "netlogon.db_create_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time when created", HFILL }}, + + { &hf_netlogon_cipher_current_set_time, + { "Cipher Current Set Time", "netlogon.cipher_current_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time when current cipher was initiated", HFILL }}, + + { &hf_netlogon_cipher_old_set_time, + { "Cipher Old Set Time", "netlogon.cipher_old_set_time", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, + NULL, 0, "Time when previous cipher was initiated", HFILL }}, + + { &hf_netlogon_audit_retention_period, + { "Audit Retention Period", "netlogon.audit_retention_period", FT_RELATIVE_TIME, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_timelimit, + { "Time Limit", "netlogon.time_limit", FT_RELATIVE_TIME, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + + { &hf_client_credential, + { "Client Credential", "netlogon.clientcred", FT_BYTES, BASE_NONE, + NULL, 0x0, NULL, HFILL }}, + + { &hf_server_credential, + { "Server Credential", "netlogon.servercred", FT_BYTES, BASE_NONE, + NULL, 0x0, NULL, HFILL }}, + + { &hf_server_rid, + { "Account RID", "netlogon.serverrid", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + + { &hf_client_challenge, + { "Client Challenge", "netlogon.clientchallenge", FT_BYTES, BASE_NONE, + NULL, 0x0, NULL, HFILL }}, + + { &hf_server_challenge, + { "Server Challenge", "netlogon.serverchallenge", FT_BYTES, BASE_NONE, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_message_type, + { "Message Type", "netlogon.secchan.nl_auth_message.message_type", FT_UINT32, BASE_HEX, + VALS(nl_auth_types), 0x0, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_message_flags, + { "Message Flags", "netlogon.secchan.nl_auth_message.message_flags", FT_UINT32, BASE_HEX, + NULL, 0x0, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_message_flags_nb_domain, + { "NetBios Domain", "netlogon.secchan.nl_auth_message.message_flags.nb_domain", FT_BOOLEAN, 32, + NULL, 0x00000001, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_message_flags_nb_host, + { "NetBios Host", "netlogon.secchan.nl_auth_message.message_flags.nb_host", FT_BOOLEAN, 32, + NULL, 0x00000002, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_message_flags_dns_domain, + { "DNS Domain", "netlogon.secchan.nl_auth_message.message_flags.dns_domain", FT_BOOLEAN, 32, + NULL, 0x00000004, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_message_flags_dns_host, + { "DNS Host", "netlogon.secchan.nl_auth_message.message_flags.dns_host", FT_BOOLEAN, 32, + NULL, 0x00000008, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_message_flags_nb_host_utf8, + { "NetBios Host(UTF8)", "netlogon.secchan.nl_auth_message.message_flags.nb_host_utf8", FT_BOOLEAN, 32, + NULL, 0x00000010, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_nb_domain, + { "NetBios Domain", "netlogon.secchan.nl_auth_message.nb_domain", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_nb_host, + { "NetBios Host", "netlogon.secchan.nl_auth_message.nb_host", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_nb_host_utf8, + { "NetBios Host(UTF8)", "netlogon.secchan.nl_auth_message.nb_host_utf8", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_dns_domain, + { "DNS Domain", "netlogon.secchan.nl_auth_message.dns_domain", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_secchan_nl_dns_host, + { "DNS Host", "netlogon.secchan.nl_auth_message.dns_host", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_data_length, + { "Length of Data", "netlogon.data.length", FT_UINT32, BASE_DEC, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_package_name, + { "SSP Package Name", "netlogon.data.package_name", FT_STRING, BASE_NONE, + NULL, 0, NULL, HFILL }}, + + { &hf_netlogon_secchan_verf, + { "Secure Channel Verifier", "netlogon.secchan.verifier", FT_NONE, BASE_NONE, + NULL, 0x0, "Verifier", HFILL }}, + + { &hf_netlogon_secchan_verf_signalg, + { "Sign algorithm", "netlogon.secchan.signalg", FT_UINT16, BASE_HEX, + VALS(sign_algs), 0, NULL, HFILL }}, + + { &hf_netlogon_secchan_verf_sealalg, + { "Seal algorithm", "netlogon.secchan.sealalg", FT_UINT16, BASE_HEX, + VALS(seal_algs), 0, NULL, HFILL }}, + + { &hf_netlogon_secchan_verf_flag, + { "Flags", "netlogon.secchan.flags", FT_BYTES, BASE_NONE, NULL, + 0x0, NULL, HFILL }}, + + { &hf_netlogon_secchan_verf_digest, + { "Packet Digest", "netlogon.secchan.digest", FT_BYTES, BASE_NONE, NULL, + 0x0, NULL, HFILL }}, + + { &hf_netlogon_secchan_verf_seq, + { "Sequence No", "netlogon.secchan.seq", FT_BYTES, BASE_NONE, NULL, + 0x0, NULL, HFILL }}, + + { &hf_netlogon_secchan_verf_nonce, + { "Nonce", "netlogon.secchan.nonce", FT_BYTES, BASE_NONE, NULL, + 0x0, NULL, HFILL }}, + + { &hf_netlogon_group_attrs_mandatory, + { "Mandatory", "netlogon.groups.attrs.mandatory", + FT_BOOLEAN, 32, TFS(&group_attrs_mandatory), 0x00000001, + "The group attributes MANDATORY flag", HFILL }}, + + { &hf_netlogon_group_attrs_enabled_by_default, + { "Enabled By Default", "netlogon.groups.attrs.enabled_by_default", + FT_BOOLEAN, 32, TFS(&group_attrs_enabled_by_default), 0x00000002, + "The group attributes ENABLED_BY_DEFAULT flag", HFILL }}, + + { &hf_netlogon_group_attrs_enabled, + { "Enabled", "netlogon.groups.attrs.enabled", + FT_BOOLEAN, 32, TFS(&group_attrs_enabled), 0x00000004, + "The group attributes ENABLED flag", HFILL }}, + + { &hf_netlogon_user_flags_extra_sids, + { "Extra SIDs", "netlogon.user.flags.extra_sids", + FT_BOOLEAN, 32, TFS(&user_flags_extra_sids), 0x00000020, + "The user flags EXTRA_SIDS", HFILL }}, + + { &hf_netlogon_user_flags_resource_groups, + { "Resource Groups", "netlogon.user.flags.resource_groups", + FT_BOOLEAN, 32, TFS(&user_flags_resource_groups), 0x00000200, + "The user flags RESOURCE_GROUPS", HFILL }}, + + { &hf_netlogon_user_account_control_dont_require_preauth, + { "Don't Require PreAuth", "netlogon.user.account_control.dont_require_preauth", + FT_BOOLEAN, 32, TFS(&user_account_control_dont_require_preauth), 0x00010000, + "The user account control DONT_REQUIRE_PREAUTH flag", HFILL }}, + + { &hf_netlogon_user_account_control_use_des_key_only, + { "Use DES Key Only", "netlogon.user.account_control.use_des_key_only", + FT_BOOLEAN, 32, TFS(&user_account_control_use_des_key_only), 0x00008000, + "The user account control use_des_key_only flag", HFILL }}, + + { &hf_netlogon_user_account_control_not_delegated, + { "Not Delegated", "netlogon.user.account_control.not_delegated", + FT_BOOLEAN, 32, TFS(&user_account_control_not_delegated), 0x00004000, + "The user account control not_delegated flag", HFILL }}, + + { &hf_netlogon_user_account_control_trusted_for_delegation, + { "Trusted For Delegation", "netlogon.user.account_control.trusted_for_delegation", + FT_BOOLEAN, 32, TFS(&user_account_control_trusted_for_delegation), 0x00002000, + "The user account control trusted_for_delegation flag", HFILL }}, + + { &hf_netlogon_user_account_control_smartcard_required, + { "SmartCard Required", "netlogon.user.account_control.smartcard_required", + FT_BOOLEAN, 32, TFS(&user_account_control_smartcard_required), 0x00001000, + "The user account control smartcard_required flag", HFILL }}, + + { &hf_netlogon_user_account_control_encrypted_text_password_allowed, + { "Encrypted Text Password Allowed", "netlogon.user.account_control.encrypted_text_password_allowed", + FT_BOOLEAN, 32, TFS(&user_account_control_encrypted_text_password_allowed), 0x00000800, + "The user account control encrypted_text_password_allowed flag", HFILL }}, + + { &hf_netlogon_user_account_control_account_auto_locked, + { "Account Auto Locked", "netlogon.user.account_control.account_auto_locked", + FT_BOOLEAN, 32, TFS(&user_account_control_account_auto_locked), 0x00000400, + "The user account control account_auto_locked flag", HFILL }}, + + { &hf_netlogon_user_account_control_dont_expire_password, + { "Don't Expire Password", "netlogon.user.account_control.dont_expire_password", + FT_BOOLEAN, 32, TFS(&user_account_control_dont_expire_password), 0x00000200, + "The user account control dont_expire_password flag", HFILL }}, + + { &hf_netlogon_user_account_control_server_trust_account, + { "Server Trust Account", "netlogon.user.account_control.server_trust_account", + FT_BOOLEAN, 32, TFS(&user_account_control_server_trust_account), 0x00000100, + "The user account control server_trust_account flag", HFILL }}, + + { &hf_netlogon_user_account_control_workstation_trust_account, + { "Workstation Trust Account", "netlogon.user.account_control.workstation_trust_account", + FT_BOOLEAN, 32, TFS(&user_account_control_workstation_trust_account), 0x00000080, + "The user account control workstation_trust_account flag", HFILL }}, + + { &hf_netlogon_user_account_control_interdomain_trust_account, + { "Interdomain trust Account", "netlogon.user.account_control.interdomain_trust_account", + FT_BOOLEAN, 32, TFS(&user_account_control_interdomain_trust_account), 0x00000040, + "The user account control interdomain_trust_account flag", HFILL }}, + + { &hf_netlogon_user_account_control_mns_logon_account, + { "MNS Logon Account", "netlogon.user.account_control.mns_logon_account", + FT_BOOLEAN, 32, TFS(&user_account_control_mns_logon_account), 0x00000020, + "The user account control mns_logon_account flag", HFILL }}, + + { &hf_netlogon_user_account_control_normal_account, + { "Normal Account", "netlogon.user.account_control.normal_account", + FT_BOOLEAN, 32, TFS(&user_account_control_normal_account), 0x00000010, + "The user account control normal_account flag", HFILL }}, + + { &hf_netlogon_user_account_control_temp_duplicate_account, + { "Temp Duplicate Account", "netlogon.user.account_control.temp_duplicate_account", + FT_BOOLEAN, 32, TFS(&user_account_control_temp_duplicate_account), 0x00000008, + "The user account control temp_duplicate_account flag", HFILL }}, + + { &hf_netlogon_user_account_control_password_not_required, + { "Password Not Required", "netlogon.user.account_control.password_not_required", + FT_BOOLEAN, 32, TFS(&user_account_control_password_not_required), 0x00000004, + "The user account control password_not_required flag", HFILL }}, + + { &hf_netlogon_user_account_control_home_directory_required, + { "Home Directory Required", "netlogon.user.account_control.home_directory_required", + FT_BOOLEAN, 32, TFS(&user_account_control_home_directory_required), 0x00000002, + "The user account control home_directory_required flag", HFILL }}, + + { &hf_netlogon_user_account_control_account_disabled, + { "Account Disabled", "netlogon.user.account_control.account_disabled", + FT_BOOLEAN, 32, TFS(&user_account_control_account_disabled), 0x00000001, + "The user account control account_disabled flag", HFILL }}, + +#if 0 + { &hf_netlogon_dnsdomaininfo, + { "DnsDomainInfo", "netlogon.dnsdomaininfo", FT_NONE, BASE_NONE, + NULL, 0x0, NULL, HFILL }}, +#endif + + { &DnsDomainInfo_sid, + { "Sid", "lsarpc.lsa_DnsDomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &DomainInfo_sid, + { "Sid", "lsarpc.lsa_DomainInfo.sid", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &DnsDomainInfo_domain_guid, + { "Domain Guid", "lsarpc.lsa_DnsDomainInfo.domain_guid", FT_GUID, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &DnsDomainInfo_dns_forest, + { "Dns Forest", "lsarpc.lsa_DnsDomainInfo.dns_forest", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &DnsDomainInfo_dns_domain, + { "Dns Domain", "lsarpc.lsa_DnsDomainInfo.dns_domain", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &DnsDomainInfo_name, + { "Name", "lsarpc.lsa_DnsDomainInfo.name", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }}, + { &hf_netlogon_s4u2proxytarget, + { "S4U2proxyTarget", "netlogon.s4u2proxytarget", FT_STRING, BASE_NONE, + NULL, 0, "Target for constrained delegation using s4u2proxy", HFILL }}, + { &hf_netlogon_transitedlistsize, + { "TransitedListSize", "netlogon.transited_list_size", FT_UINT32, BASE_HEX, + NULL, 0x0, "Number of elements in the TransitedServices array.", HFILL }}, + { &hf_netlogon_transited_service, + { "Transited Service", "netlogon.transited_service", FT_STRING, BASE_NONE, + NULL, 0, "S4U2 Transited Service name", HFILL }}, + { &hf_netlogon_logon_duration, + { "Duration", "netlogon.logon_duration", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + { &hf_netlogon_time_created, + { "Time Created", "netlogon.time_created", FT_UINT32, BASE_DEC, + NULL, 0x0, NULL, HFILL }}, + }; + + static gint *ett[] = { + &ett_dcerpc_netlogon, + &ett_authenticate_flags, + &ett_CYPHER_VALUE, + &ett_QUOTA_LIMITS, + &ett_IDENTITY_INFO, + &ett_DELTA_ENUM, + &ett_UNICODE_MULTI, + &ett_DOMAIN_CONTROLLER_INFO, + &ett_UNICODE_STRING_512, + &ett_TYPE_50, + &ett_TYPE_52, + &ett_DELTA_ID_UNION, + &ett_TYPE_44, + &ett_DELTA_UNION, + &ett_LM_OWF_PASSWORD, + &ett_NT_OWF_PASSWORD, + &ett_GROUP_MEMBERSHIP, + &ett_DS_DOMAIN_TRUSTS, + &ett_BLOB, + &ett_DOMAIN_TRUST_INFO, + &ett_LSA_POLICY_INFO, + &ett_trust_flags, + &ett_trust_attribs, + &ett_get_dcname_request_flags, + &ett_dc_flags, + &ett_secchan_nl_auth_message, + &ett_secchan_nl_auth_message_flags, + &ett_secchan_verf, + &ett_group_attrs, + &ett_user_flags, + &ett_nt_counted_longs_as_string, + &ett_user_account_control, + &ett_wstr_LOGON_IDENTITY_INFO_string, + &ett_domain_group_memberships, + &ett_domains_group_memberships, + }; + static ei_register_info ei[] = { + { &ei_netlogon_auth_nthash, { + "netlogon.authenticated", PI_SECURITY, PI_CHAT, + "Authenticated NTHASH", EXPFILL + }}, + { &ei_netlogon_session_key, { + "netlogon.sessionkey", PI_SECURITY, PI_CHAT, + "SessionKey", EXPFILL + }}, + }; + expert_module_t* expert_netlogon; + + proto_dcerpc_netlogon = proto_register_protocol("Microsoft Network Logon", "RPC_NETLOGON", "rpc_netlogon"); + + proto_register_field_array(proto_dcerpc_netlogon, hf, array_length(hf)); + proto_register_subtree_array(ett, array_length(ett)); + expert_netlogon = expert_register_protocol(proto_dcerpc_netlogon); + expert_register_field_array(expert_netlogon, ei, array_length(ei)); + + netlogon_auths = wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), netlogon_auth_hash, netlogon_auth_equal); +#if 0 + schannel_auths = wmem_map_new_autoreset(wmem_epan_scope(), wmem_file_scope(), netlogon_auth_hash, netlogon_auth_equal); +#endif +} + +static dcerpc_auth_subdissector_fns secchan_auth_fns = { + dissect_secchan_nl_auth_message, /* Bind */ + dissect_secchan_nl_auth_message, /* Bind ACK */ + NULL, /* AUTH3 */ + dissect_request_secchan_verf, /* Request verifier */ + dissect_response_secchan_verf, /* Response verifier */ + dissect_request_data, /* Request data */ + dissect_response_data /* Response data */ +}; + +void +proto_reg_handoff_dcerpc_netlogon(void) +{ + /* Register protocol as dcerpc */ + seen.isseen = FALSE; + seen.num = 0; + dcerpc_init_uuid(proto_dcerpc_netlogon, ett_dcerpc_netlogon, + &uuid_dcerpc_netlogon, ver_dcerpc_netlogon, + dcerpc_netlogon_dissectors, hf_netlogon_opnum); + + + register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT_INTEGRITY, + DCE_C_RPC_AUTHN_PROTOCOL_SEC_CHAN, + &secchan_auth_fns); + register_dcerpc_auth_subdissector(DCE_C_AUTHN_LEVEL_PKT_PRIVACY, + DCE_C_RPC_AUTHN_PROTOCOL_SEC_CHAN, + &secchan_auth_fns); +} + +/* + * Editor modelines - https://www.wireshark.org/tools/modelines.html + * + * Local variables: + * c-basic-offset: 4 + * tab-width: 8 + * indent-tabs-mode: nil + * End: + * + * vi: set shiftwidth=4 tabstop=8 expandtab: + * :indentSize=4:tabSize=8:noTabs=true: + */ |