epan/dissectors/packet-dcerpc-witness.c

   1 /* DO NOT EDIT
   2         This file was automatically generated by Pidl
   3         from witness.idl and witness.cnf.
   4
   5         Pidl is a perl based IDL compiler for DCE/RPC idl files.
   6         It is maintained by the Samba team, not the Wireshark team.
   7         Instructions on how to download and install Pidl can be
   8         found at https://wiki.wireshark.org/Pidl
   9 */
  10
  11
  12 #include "config.h"
  13 #include <string.h>
  14 #include <wsutil/array.h>
  15 #include <epan/packet.h>
  16 #include <epan/tfs.h>
  17
  18 #include "packet-dcerpc.h"
  19 #include "packet-dcerpc-nt.h"
  20 #include "packet-windows-common.h"
  21 #include "packet-dcerpc-witness.h"
  22 void proto_register_dcerpc_witness(void);
  23 void proto_reg_handoff_dcerpc_witness(void);
  24
  25 /* Ett declarations */
  26 static int ett_dcerpc_witness;
  27 static int ett_witness_witness_interfaceInfo_flags;
  28 static int ett_witness_witness_interfaceInfo;
  29 static int ett_witness_witness_interfaceList;
  30 static int ett_witness_witness_ResourceChange;
  31 static int ett_witness_witness_IPaddrInfo_flags;
  32 static int ett_witness_witness_IPaddrInfo;
  33 static int ett_witness_witness_IPaddrInfoList;
  34 static int ett_witness_witness_notifyResponse_message;
  35 static int ett_witness_witness_notifyResponse;
  36 static int ett_witness_witness_RegisterEx_flags;
  37
  38
  39 /* Header field declarations */
  40 static int hf_witness_opnum;
  41 static int hf_witness_werror;
  42 static int hf_witness_witness_AsyncNotify_context_handle;
  43 static int hf_witness_witness_AsyncNotify_response;
  44 static int hf_witness_witness_GetInterfaceList_interface_list;
  45 static int hf_witness_witness_IPaddrInfoList_addr;
  46 static int hf_witness_witness_IPaddrInfoList_length;
  47 static int hf_witness_witness_IPaddrInfoList_num;
  48 static int hf_witness_witness_IPaddrInfoList_reserved;
  49 static int hf_witness_witness_IPaddrInfo_flags;
  50 static int hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE;
  51 static int hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE;
  52 static int hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V4;
  53 static int hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V6;
  54 static int hf_witness_witness_IPaddrInfo_ipv4;
  55 static int hf_witness_witness_IPaddrInfo_ipv6;
  56 static int hf_witness_witness_RegisterEx_client_computer_name;
  57 static int hf_witness_witness_RegisterEx_context_handle;
  58 static int hf_witness_witness_RegisterEx_flags;
  59 static int hf_witness_witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION;
  60 static int hf_witness_witness_RegisterEx_ip_address;
  61 static int hf_witness_witness_RegisterEx_net_name;
  62 static int hf_witness_witness_RegisterEx_share_name;
  63 static int hf_witness_witness_RegisterEx_timeout;
  64 static int hf_witness_witness_RegisterEx_version;
  65 static int hf_witness_witness_Register_client_computer_name;
  66 static int hf_witness_witness_Register_context_handle;
  67 static int hf_witness_witness_Register_ip_address;
  68 static int hf_witness_witness_Register_net_name;
  69 static int hf_witness_witness_Register_version;
  70 static int hf_witness_witness_ResourceChange_length;
  71 static int hf_witness_witness_ResourceChange_name;
  72 static int hf_witness_witness_ResourceChange_type;
  73 static int hf_witness_witness_UnRegister_context_handle;
  74 static int hf_witness_witness_interfaceInfo_flags;
  75 static int hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID;
  76 static int hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID;
  77 static int hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF;
  78 static int hf_witness_witness_interfaceInfo_group_name;
  79 static int hf_witness_witness_interfaceInfo_ipv4;
  80 static int hf_witness_witness_interfaceInfo_ipv6;
  81 static int hf_witness_witness_interfaceInfo_state;
  82 static int hf_witness_witness_interfaceInfo_version;
  83 static int hf_witness_witness_interfaceList_interfaces;
  84 static int hf_witness_witness_interfaceList_num_interfaces;
  85 static int hf_witness_witness_notifyResponse_length;
  86 static int hf_witness_witness_notifyResponse_message_client_move;
  87 static int hf_witness_witness_notifyResponse_message_data;
  88 static int hf_witness_witness_notifyResponse_message_ip_change;
  89 static int hf_witness_witness_notifyResponse_message_resource_change;
  90 static int hf_witness_witness_notifyResponse_message_share_move;
  91 static int hf_witness_witness_notifyResponse_messages;
  92 static int hf_witness_witness_notifyResponse_messages_;
  93 static int hf_witness_witness_notifyResponse_num;
  94 static int hf_witness_witness_notifyResponse_type;
  95
  96 static int proto_dcerpc_witness;
  97 /* Version information */
  98
  99
 100 static e_guid_t uuid_dcerpc_witness = {
 101         0xccd8c074, 0xd0e5, 0x4a40,
 102         { 0x92, 0xb4, 0xd0, 0x74, 0xfa, 0xa6, 0xba, 0x28 }
 103 };
 104 static uint16_t ver_dcerpc_witness = 1;
 105
 106 const value_string witness_witness_version_vals[] = {
 107         { WITNESS_V1, "WITNESS_V1" },
 108         { WITNESS_V2, "WITNESS_V2" },
 109         { WITNESS_UNSPECIFIED_VERSION, "WITNESS_UNSPECIFIED_VERSION" },
 110 { 0, NULL }
 111 };
 112 const value_string witness_witness_interfaceInfo_state_vals[] = {
 113         { WITNESS_STATE_UNKNOWN, "WITNESS_STATE_UNKNOWN" },
 114         { WITNESS_STATE_AVAILABLE, "WITNESS_STATE_AVAILABLE" },
 115         { WITNESS_STATE_UNAVAILABLE, "WITNESS_STATE_UNAVAILABLE" },
 116 { 0, NULL }
 117 };
 118 static const true_false_string witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID_tfs = {
 119    "WITNESS_INFO_IPv4_VALID is SET",
 120    "WITNESS_INFO_IPv4_VALID is NOT SET",
 121 };
 122 static const true_false_string witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID_tfs = {
 123    "WITNESS_INFO_IPv6_VALID is SET",
 124    "WITNESS_INFO_IPv6_VALID is NOT SET",
 125 };
 126 static const true_false_string witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF_tfs = {
 127    "WITNESS_INFO_WITNESS_IF is SET",
 128    "WITNESS_INFO_WITNESS_IF is NOT SET",
 129 };
 130 static int witness_dissect_element_interfaceInfo_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 131 static int witness_dissect_element_interfaceInfo_state(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 132 static int witness_dissect_element_interfaceInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 133 static int witness_dissect_element_interfaceInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 134 static int witness_dissect_element_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 135 static int witness_dissect_element_interfaceList_num_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 136 static int witness_dissect_element_interfaceList_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 137 static int witness_dissect_element_interfaceList_interfaces_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 138 static int witness_dissect_element_interfaceList_interfaces__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 139 const value_string witness_witness_notifyResponse_type_vals[] = {
 140         { WITNESS_NOTIFY_RESOURCE_CHANGE, "WITNESS_NOTIFY_RESOURCE_CHANGE" },
 141         { WITNESS_NOTIFY_CLIENT_MOVE, "WITNESS_NOTIFY_CLIENT_MOVE" },
 142         { WITNESS_NOTIFY_SHARE_MOVE, "WITNESS_NOTIFY_SHARE_MOVE" },
 143         { WITNESS_NOTIFY_IP_CHANGE, "WITNESS_NOTIFY_IP_CHANGE" },
 144 { 0, NULL }
 145 };
 146 const value_string witness_witness_ResourceChange_type_vals[] = {
 147         { WITNESS_RESOURCE_STATE_UNKNOWN, "WITNESS_RESOURCE_STATE_UNKNOWN" },
 148         { WITNESS_RESOURCE_STATE_AVAILABLE, "WITNESS_RESOURCE_STATE_AVAILABLE" },
 149         { WITNESS_RESOURCE_STATE_UNAVAILABLE, "WITNESS_RESOURCE_STATE_UNAVAILABLE" },
 150 { 0, NULL }
 151 };
 152 static int witness_dissect_element_ResourceChange_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 153 static int witness_dissect_element_ResourceChange_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 154 static int witness_dissect_element_ResourceChange_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 155 static const true_false_string witness_IPaddrInfo_flags_WITNESS_IPADDR_V4_tfs = {
 156    "WITNESS_IPADDR_V4 is SET",
 157    "WITNESS_IPADDR_V4 is NOT SET",
 158 };
 159 static const true_false_string witness_IPaddrInfo_flags_WITNESS_IPADDR_V6_tfs = {
 160    "WITNESS_IPADDR_V6 is SET",
 161    "WITNESS_IPADDR_V6 is NOT SET",
 162 };
 163 static const true_false_string witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE_tfs = {
 164    "WITNESS_IPADDR_ONLINE is SET",
 165    "WITNESS_IPADDR_ONLINE is NOT SET",
 166 };
 167 static const true_false_string witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE_tfs = {
 168    "WITNESS_IPADDR_OFFLINE is SET",
 169    "WITNESS_IPADDR_OFFLINE is NOT SET",
 170 };
 171 static int witness_dissect_element_IPaddrInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 172 static int witness_dissect_element_IPaddrInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 173 static int witness_dissect_element_IPaddrInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 174 static int witness_dissect_element_IPaddrInfoList_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 175 static int witness_dissect_element_IPaddrInfoList_reserved(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 176 static int witness_dissect_element_notifyResponse_message_resource_change(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 177 static int witness_dissect_element_notifyResponse_message_client_move(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 178 static int witness_dissect_element_notifyResponse_message_share_move(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 179 static int witness_dissect_element_notifyResponse_message_ip_change(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 180 static int witness_dissect_element_notifyResponse_message_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 181 static int witness_dissect_element_notifyResponse_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 182 static const true_false_string witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION_tfs = {
 183    "WITNESS_REGISTER_IP_NOTIFICATION is SET",
 184    "WITNESS_REGISTER_IP_NOTIFICATION is NOT SET",
 185 };
 186 static int witness_dissect_element_GetInterfaceList_interface_list(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 187 static int witness_dissect_element_GetInterfaceList_interface_list_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 188 static int witness_dissect_element_GetInterfaceList_interface_list__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 189 static int witness_dissect_element_Register_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 190 static int witness_dissect_element_Register_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 191 static int witness_dissect_element_Register_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 192 static int witness_dissect_element_Register_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 193 static int witness_dissect_element_Register_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 194 static int witness_dissect_element_Register_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 195 static int witness_dissect_element_Register_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 196 static int witness_dissect_element_Register_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 197 static int witness_dissect_element_Register_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 198 static int witness_dissect_element_UnRegister_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 199 static int witness_dissect_element_AsyncNotify_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 200 static int witness_dissect_element_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 201 static int witness_dissect_element_AsyncNotify_response_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 202 static int witness_dissect_element_AsyncNotify_response__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 203 static int witness_dissect_element_RegisterEx_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 204 static int witness_dissect_element_RegisterEx_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 205 static int witness_dissect_element_RegisterEx_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 206 static int witness_dissect_element_RegisterEx_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 207 static int witness_dissect_element_RegisterEx_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 208 static int witness_dissect_element_RegisterEx_share_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 209 static int witness_dissect_element_RegisterEx_share_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 210 static int witness_dissect_element_RegisterEx_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 211 static int witness_dissect_element_RegisterEx_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 212 static int witness_dissect_element_RegisterEx_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 213 static int witness_dissect_element_RegisterEx_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 214 static int witness_dissect_element_RegisterEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 215 static int witness_dissect_element_RegisterEx_timeout(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 216  #include "to_str.h"
 217  #include "wsutil/str_util.h"
 218 static int
 219 witness_dissect_element_ResourceChange_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 220 {
 221         proto_item *item = NULL;
 222         const char *s = NULL;
 223         int levels = 2;
 224         uint32_t type = 0;
 225         static const value_string type_vals[] = {
 226                 { WITNESS_RESOURCE_STATE_UNKNOWN, "RESOURCE_STATE_UNKNOWN" },
 227                 { WITNESS_RESOURCE_STATE_AVAILABLE, "RESOURCE_AVAILABLE" },
 228                 { WITNESS_RESOURCE_STATE_UNAVAILABLE, "RESOURCE_UNAVAILABLE" },
 229                 { 0, NULL }
 230         };
 231         offset = witness_dissect_enum_ResourceChange_type(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_ResourceChange_type, &type);
 232         s = val_to_str_wmem(pinfo->pool, type, VALS(type_vals), "unknown type: 0x%x");
 233         if (di->conformant_run == 0) {
 234                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", s);
 235         }
 236         if (tree != NULL) {
 237                 item = tree->last_child;
 238         }
 239         item = proto_item_get_parent(item);
 240         while (item && levels > 0) {
 241                 proto_item_append_text(item, " %s", s);
 242                 item = proto_item_get_parent(item);
 243                 levels--;
 244         }
 245         return offset;
 246 }
 247 static int
 248 witness_dissect_element_ResourceChange_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 249 {
 250         int options = CB_STR_COL_INFO | CB_STR_ITEM_LEVELS(2);
 251         offset = dissect_null_term_wstring(tvb, offset, pinfo, tree, drep, hf_witness_witness_ResourceChange_name, options);
 252         return offset;
 253 }
 254 static int
 255 witness_dissect_notifyResponse_message(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_);
 256 struct witness_dissect_notifyResponse_message_state {
 257         uint64_t magic1;
 258         uint32_t type;
 259         uint32_t num;
 260         uint64_t magic2;
 261 };
 262 static int
 263 witness_dissect_notifyResponse_message_(tvbuff_t *tvb, int offset, int length _U_, packet_info *pinfo,
 264                                         proto_tree *tree, dcerpc_info *p_di, uint8_t *p_drep _U_)
 265 {
 266         const struct witness_dissect_notifyResponse_message_state *state =
 267                 (const struct witness_dissect_notifyResponse_message_state *)p_di->private_data;
 268         uint8_t le_drep[4] = { DREP_LITTLE_ENDIAN, };
 269         static dcerpc_info di = {0, };      /* fake dcerpc_info struct */
 270         static dcerpc_call_value call_data = { 0, };
 271         tvbuff_t *subtvb = tvb_new_subset_length(tvb, offset, length);
 272         int suboffset = 0;
 273         uint32_t i;
 274         ws_assert(state->magic1 == 0x0123456789ABCDEF);
 275         ws_assert(state->magic2 == 0xFEDCBA9876543210);
 276         /* fake whatever state the dcerpc runtime support needs */
 277         di.conformant_run=0;
 278         /* we need di->call_data->flags.NDR64 == 0 */
 279         di.call_data=&call_data;
 280         init_ndr_pointer_list(&di);
 281         for (i=0; i < state->num; i++) {
 282                 suboffset = witness_dissect_notifyResponse_message(subtvb, suboffset, pinfo, tree, &di, le_drep,
 283                                                       hf_witness_witness_notifyResponse_messages_, state->type);
 284         }
 285         free_ndr_pointer_list(&di);
 286         return offset + suboffset;
 287 }
 288 static int
 289 witness_dissect_element_notifyResponse_messages(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info *di _U_, uint8_t *drep _U_)
 290 {
 291         offset = dissect_ndr_ucarray_block(tvb, offset, pinfo, tree, di, drep,
 292                                            witness_dissect_notifyResponse_message_);
 293         return offset;
 294 }
 295 static int
 296 witness_dissect_element_notifyResponse_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, uint32_t *type)
 297 {
 298         offset = witness_dissect_enum_notifyResponse_type(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_type, type);
 299         return offset;
 300 }
 301 static int
 302 witness_dissect_element_notifyResponse_num(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, uint32_t *num)
 303 {
 304         offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_num, 0, num);
 305         return offset;
 306 }
 307 int
 308 witness_dissect_struct_notifyResponse(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 309 {
 310         proto_item *item = NULL;
 311         proto_tree *tree = NULL;
 312         int old_offset;
 313         struct witness_dissect_notifyResponse_message_state *state = NULL;
 314         const char *type_name = "UNKNOWN";
 315         ALIGN_TO_4_BYTES;
 316         old_offset = offset;
 317         if (parent_tree) {
 318                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 319                 tree = proto_item_add_subtree(item, ett_witness_witness_notifyResponse);
 320         }
 321         state = wmem_new0(pinfo->pool, struct witness_dissect_notifyResponse_message_state);
 322         state->magic1 = 0x0123456789ABCDEF;
 323         state->magic2 = 0xFEDCBA9876543210;
 324         offset = witness_dissect_element_notifyResponse_type(tvb, offset, pinfo, tree, di, drep, &state->type);
 325         offset = witness_dissect_element_notifyResponse_length(tvb, offset, pinfo, tree, di, drep);
 326         offset = witness_dissect_element_notifyResponse_num(tvb, offset, pinfo, tree, di, drep, &state->num);
 327         switch(state->type) {
 328         case WITNESS_NOTIFY_RESOURCE_CHANGE:
 329                 type_name = "RESOURCE_CHANGE";
 330                 break;
 331         case WITNESS_NOTIFY_CLIENT_MOVE:
 332                 type_name = "CLIENT_MOVE";
 333                 break;
 334         case WITNESS_NOTIFY_SHARE_MOVE:
 335                 type_name = "SHARE_MOVE";
 336                 break;
 337         case WITNESS_NOTIFY_IP_CHANGE:
 338                 type_name = "IP_CHANGE";
 339                 break;
 340         }
 341         if (item) {
 342                 proto_item_append_text(item,
 343                                        " %s (%u message%s)",
 344                                        type_name,
 345                                        state->num,
 346                                        plurality(state->num, "", "s"));
 347                 proto_item_append_text(proto_item_get_parent_nth(item, 1),
 348                                        " %s (%u message%s)",
 349                                        type_name,
 350                                        state->num,
 351                                        plurality(state->num, "", "s"));
 352                 proto_item_append_text(proto_item_get_parent_nth(item, 2),
 353                                        " %s (%u message%s)",
 354                                        type_name,
 355                                        state->num,
 356                                        plurality(state->num, "", "s"));
 357                 proto_item_append_text(proto_item_get_parent_nth(item, 3),
 358                                        " %s (%u message%s)",
 359                                        type_name,
 360                                        state->num,
 361                                        plurality(state->num, "", "s"));
 362         }
 363         if (di->conformant_run == 0) {
 364                 col_append_fstr(pinfo->cinfo, COL_INFO,
 365                                 " %s (%u message%s)",
 366                                 type_name,
 367                                 state->num,
 368                                 plurality(state->num, "", "s"));
 369         }
 370         di->private_data = state;
 371         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep,
 372                                               witness_dissect_element_notifyResponse_messages,
 373                                               NDR_POINTER_UNIQUE, "Pointer to Message Buffer (uint8)",
 374                                               hf_witness_witness_notifyResponse_messages);
 375         proto_item_set_len(item, offset-old_offset);
 376         if (di->call_data->flags & DCERPC_IS_NDR64) {
 377                 ALIGN_TO_4_BYTES;
 378         }
 379         return offset;
 380 }
 381 static int
 382 witness_dissect_element_IPaddrInfoList_num(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, uint32_t *num)
 383 {
 384         offset = PIDL_dissect_uint32_val(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfoList_num, 0, num);
 385         return offset;
 386 }
 387 static int
 388 witness_dissect_element_IPaddrInfoList_addr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 389 {
 390         offset = witness_dissect_struct_IPaddrInfo(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_IPaddrInfoList_addr,0);
 391         return offset;
 392 }
 393 int
 394 witness_dissect_struct_IPaddrInfoList(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 395 {
 396         proto_item *item = NULL;
 397         proto_tree *tree = NULL;
 398         bool oldalign = di->no_align;
 399         int old_offset;
 400         uint32_t i, num;
 401         di->no_align = true;
 402         old_offset = offset;
 403         if (parent_tree) {
 404                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 405                 tree = proto_item_add_subtree(item, ett_witness_witness_IPaddrInfoList);
 406         }
 407         offset = witness_dissect_element_IPaddrInfoList_length(tvb, offset, pinfo, tree, di, drep);
 408         offset = witness_dissect_element_IPaddrInfoList_reserved(tvb, offset, pinfo, tree, di, drep);
 409         offset = witness_dissect_element_IPaddrInfoList_num(tvb, offset, pinfo, tree, di, drep, &num);
 410         for (i = 0; i < num; i++) {
 411                 offset = witness_dissect_element_IPaddrInfoList_addr(tvb, offset, pinfo, tree, di, drep);
 412         }
 413         proto_item_set_len(item, offset-old_offset);
 414         di->no_align = oldalign;
 415         return offset;
 416 }
 417 static int
 418 witness_dissect_element_interfaceInfo_group_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *parent_tree, dcerpc_info *di _U_, uint8_t *drep _U_)
 419 {
 420         int totlen, stringlen;
 421         char *str;
 422         proto_item *pi;
 423         /*
 424          * XXX - this is described as
 425          *
 426          *    [charset(UTF16),to_null] uint16 group_name[260];
 427          *
 428          * I haven't found any documentation for what "to_null" means
 429          * in PIDL; is this a null-padded 260*2-byte array, so that
 430          * strings can be up to 260 16-bit units in length, or is
 431          * it a null-*terminated* string, so that it can be up to 259
 432          * 16-bit units in length?
 433          *
 434          * We assume it's null-padded, for now, and scan for a 2-byte
 435          * null terminator within the 260 2-byte units, and use
 436          * that as the length, with the length being 2*260 if there
 437          * isn't one.
 438          *
 439          * This will result in totlen being the total length, in
 440          * bytes, of the string, including the null terminator, if
 441          * present, and stringlen being the total length, in bytes.
 442          * not counting any null terminator.
 443          */
 444         totlen = 0;
 445         stringlen = 0;
 446         while (totlen < 2*260) {
 447                 /*
 448                  * These 2 bytes are either part of the string
 449                  * or part of the null terminator, so count
 450                  * them.
 451                  */
 452                 totlen += 2;
 453                 if (tvb_get_letohs(tvb, offset + stringlen) == 0)
 454                         break;
 455                 /*
 456                  * Those 2 bytes are part of the string, so
 457                  * count them.
 458                  */
 459                 stringlen += 2;
 460         }
 461         pi = proto_tree_add_item_ret_display_string(parent_tree,
 462             hf_witness_witness_interfaceInfo_group_name, tvb, offset, stringlen,
 463             ENC_UTF_16|ENC_LITTLE_ENDIAN,
 464             pinfo->pool, &str);
 465         proto_item_append_text(pi, " [%d]", totlen);
 466         proto_item_append_text(parent_tree, ": %s", str);
 467         /*
 468          * All 260 16-bit units are part of the field, as they're always
 469          * there even if they don't need to be.
 470          */
 471         return offset + 2*260;
 472 }
 473 static int
 474 PIDL_dissect_ipv4address(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep _U_, int hfindex, uint32_t param)
 475 {
 476         if (di->conformant_run) {
 477                 /* just a run to handle conformant arrays, no scalars to dissect */
 478                 return offset;
 479         }
 480         if (!di->no_align && (offset % 4)) {
 481                 offset += 4 - (offset % 4);
 482         }
 483         proto_tree_add_item(tree, hfindex, tvb, offset, 4, ENC_BIG_ENDIAN);
 484         if (param & PIDL_SET_COL_INFO) {
 485                 const char *ip = tvb_ip_to_str(pinfo->pool, tvb, offset);
 486                 header_field_info *hf_info = proto_registrar_get_nth(hfindex);
 487                 if (strcmp(ip, "0.0.0.0") != 0) {
 488                         proto_item_append_text(proto_tree_get_parent(tree), " %s:%s", hf_info->name, ip);
 489                         col_append_fstr(pinfo->cinfo, COL_INFO," %s:%s", hf_info->name, ip);
 490                 }
 491         }
 492         return offset + 4;
 493 }
 494 static int
 495 PIDL_dissect_ipv6address(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep _U_, int hfindex, uint32_t param)
 496 {
 497         if (di->conformant_run) {
 498                 /* just a run to handle conformant arrays, no scalars to dissect */
 499                 return offset;
 500         }
 501         if (!di->no_align && (offset % 2)) {
 502                 offset += 2 - (offset % 2);
 503         }
 504         proto_tree_add_item(tree, hfindex, tvb, offset, 16, ENC_BIG_ENDIAN);
 505         if (param & PIDL_SET_COL_INFO) {
 506                 const char *ip = tvb_ip6_to_str(pinfo->pool, tvb, offset);
 507                 header_field_info *hf_info = proto_registrar_get_nth(hfindex);
 508                 if (strcmp(ip, "::") != 0) {
 509                         proto_item_append_text(proto_tree_get_parent(tree), " %s:%s", hf_info->name, ip);
 510                         col_append_fstr(pinfo->cinfo, COL_INFO," %s:%s", hf_info->name, ip);
 511                 }
 512         }
 513         return offset + 16;
 514 }
 515 /* IDL: enum { */
 516 /* IDL:         WITNESS_STATE_UNKNOWN=0x00, */
 517 /* IDL:         WITNESS_STATE_AVAILABLE=0x01, */
 518 /* IDL:         WITNESS_STATE_UNAVAILABLE=0xff, */
 519 /* IDL: } */
 520 int
 521 witness_dissect_enum_interfaceInfo_state(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint16_t *param _U_)
 522 {
 523         static const value_string state_vals[] = {
 524                 { WITNESS_STATE_UNKNOWN, "STATE_UNKNOWN" },
 525                 { WITNESS_STATE_AVAILABLE, "AVAILABLE" },
 526                 { WITNESS_STATE_UNAVAILABLE, "UNAVAILABLE" },
 527                 { 0, NULL }
 528         };
 529         const char *s = NULL;
 530         uint16_t parameter=0;
 531         if (param) {
 532                 parameter = *param;
 533         }
 534         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 535         if (param) {
 536                 *param = parameter;
 537         }
 538         s = val_to_str_wmem(pinfo->pool, parameter, VALS(state_vals), "unknown state: 0x%x");
 539         proto_item_append_text(proto_tree_get_parent(tree), " %s:", s);
 540         if (di->conformant_run == 0) {
 541                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", s);
 542         }
 543         return offset;
 544 }
 545 /* IDL: bitmap { */
 546 /* IDL:         WITNESS_INFO_IPv4_VALID =  0x01 , */
 547 /* IDL:         WITNESS_INFO_IPv6_VALID =  0x02 , */
 548 /* IDL:         WITNESS_INFO_WITNESS_IF =  0x04 , */
 549 /* IDL: } */
 550 int
 551 witness_dissect_bitmap_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 552 {
 553         proto_item *item;
 554         static int * const witness_witness_interfaceInfo_flags_fields[] = {
 555                 &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID,
 556                 &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID,
 557                 &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF,
 558                 NULL
 559         };
 560         uint32_t flags;
 561         ALIGN_TO_4_BYTES;
 562         item = proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_index,
 563                                 ett_witness_witness_interfaceInfo_flags, witness_witness_interfaceInfo_flags_fields, DREP_ENC_INTEGER(drep), BMT_NO_FALSE);
 564         offset = dissect_ndr_uint32(tvb, offset, pinfo, parent_tree, di, drep, -1, &flags);
 565         if (!flags)
 566                 proto_item_append_text(item, ": (No values set)");
 567         if (flags & (~0x00000007)) {
 568                 flags &= (~0x00000007);
 569                 proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);
 570         }
 571         if (flags & 0x4) {
 572                 proto_item_append_text(proto_tree_get_parent(parent_tree), " WITNESS_IF");
 573                 col_append_fstr(pinfo->cinfo, COL_INFO," WITNESS_IF");
 574         }
 575         return offset;
 576 }
 577 static int
 578 witness_dissect_element_Register_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 579 {
 580         char *data = NULL;
 581         struct ndr_generic_array nga = { .is_conformant = FALSE, };
 582         offset = dissect_ndr_conformant_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 583         offset = dissect_ndr_varying_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 584         offset = dissect_ndr_generic_array_string(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_Register_net_name, FALSE, &nga, &data);
 585         proto_item_append_text(tree, ": %s", data);
 586         if (di->conformant_run == 0) {
 587                 col_append_fstr(pinfo->cinfo, COL_INFO, " NetName[%s]", data);
 588         }
 589         return offset;
 590 }
 591 static int
 592 witness_dissect_element_Register_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 593 {
 594         char *data = NULL;
 595         struct ndr_generic_array nga = { .is_conformant = FALSE, };
 596         offset = dissect_ndr_conformant_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 597         offset = dissect_ndr_varying_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 598         offset = dissect_ndr_generic_array_string(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_Register_ip_address, FALSE, &nga, &data);
 599         proto_item_append_text(tree, ": %s", data);
 600         if (di->conformant_run == 0) {
 601                 col_append_fstr(pinfo->cinfo, COL_INFO, " IpAddress[%s]", data);
 602         }
 603         return offset;
 604 }
 605 static int
 606 witness_dissect_element_RegisterEx_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 607 {
 608         char *data = NULL;
 609         struct ndr_generic_array nga = { .is_conformant = FALSE, };
 610         offset = dissect_ndr_conformant_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 611         offset = dissect_ndr_varying_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 612         offset = dissect_ndr_generic_array_string(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_RegisterEx_net_name, FALSE, &nga, &data);
 613         proto_item_append_text(tree, ": %s", data);
 614         if (di->conformant_run == 0) {
 615                 col_append_fstr(pinfo->cinfo, COL_INFO, " NetName[%s]", data);
 616         }
 617         return offset;
 618 }
 619 static int
 620 witness_dissect_element_RegisterEx_share_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 621 {
 622         char *data = NULL;
 623         struct ndr_generic_array nga = { .is_conformant = FALSE, };
 624         offset = dissect_ndr_conformant_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 625         offset = dissect_ndr_varying_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 626         offset = dissect_ndr_generic_array_string(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_RegisterEx_share_name, FALSE, &nga, &data);
 627         proto_item_append_text(tree, ": %s", data);
 628         if (di->conformant_run == 0) {
 629                 col_append_fstr(pinfo->cinfo, COL_INFO, " ShareName[%s]", data);
 630         }
 631         return offset;
 632 }
 633 static int
 634 witness_dissect_element_RegisterEx_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 635 {
 636         char *data = NULL;
 637         struct ndr_generic_array nga = { .is_conformant = FALSE, };
 638         offset = dissect_ndr_conformant_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 639         offset = dissect_ndr_varying_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 640         offset = dissect_ndr_generic_array_string(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_RegisterEx_ip_address, FALSE, &nga, &data);
 641         proto_item_append_text(tree, ": %s", data);
 642         if (di->conformant_run == 0) {
 643                 col_append_fstr(pinfo->cinfo, COL_INFO, " IpAddress[%s]", data);
 644         }
 645         return offset;
 646 }
 647
 648
 649 /* IDL: enum { */
 650 /* IDL:         WITNESS_V1=0x00010001, */
 651 /* IDL:         WITNESS_V2=0x00020000, */
 652 /* IDL:         WITNESS_UNSPECIFIED_VERSION=0xFFFFFFFF, */
 653 /* IDL: } */
 654
 655 int
 656 witness_dissect_enum_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t *param _U_)
 657 {
 658         uint32_t parameter=0;
 659         if (param) {
 660                 parameter = *param;
 661         }
 662         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 663         if (param) {
 664                 *param = parameter;
 665         }
 666         return offset;
 667 }
 668
 669
 670 /* IDL: enum { */
 671 /* IDL:         WITNESS_STATE_UNKNOWN=0x0000, */
 672 /* IDL:         WITNESS_STATE_AVAILABLE=0x0001, */
 673 /* IDL:         WITNESS_STATE_UNAVAILABLE=0x00ff, */
 674 /* IDL: } */
 675
 676
 677 /* IDL: bitmap { */
 678 /* IDL:         WITNESS_INFO_IPv4_VALID =  0x00000001 , */
 679 /* IDL:         WITNESS_INFO_IPv6_VALID =  0x00000002 , */
 680 /* IDL:         WITNESS_INFO_WITNESS_IF =  0x00000004 , */
 681 /* IDL: } */
 682
 683
 684 /* IDL: struct { */
 685 /* IDL:         [charset(UTF16)] [to_null(1)] uint16 group_name[260]; */
 686 /* IDL:         witness_version version; */
 687 /* IDL:         witness_interfaceInfo_state state; */
 688 /* IDL:         [flag(LIBNDR_FLAG_BIGENDIAN)] ipv4address ipv4; */
 689 /* IDL:         [flag(LIBNDR_FLAG_BIGENDIAN)] ipv6address ipv6; */
 690 /* IDL:         witness_interfaceInfo_flags flags; */
 691 /* IDL: } */
 692
 693 static int
 694 witness_dissect_element_interfaceInfo_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 695 {
 696         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_version, 0);
 697
 698         return offset;
 699 }
 700
 701 static int
 702 witness_dissect_element_interfaceInfo_state(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 703 {
 704         offset = witness_dissect_enum_interfaceInfo_state(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_state, 0);
 705
 706         return offset;
 707 }
 708
 709 static int
 710 witness_dissect_element_interfaceInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 711 {
 712         offset=PIDL_dissect_ipv4address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_ipv4, PIDL_SET_COL_INFO);
 713
 714         return offset;
 715 }
 716
 717 static int
 718 witness_dissect_element_interfaceInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 719 {
 720         offset=PIDL_dissect_ipv6address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_ipv6, PIDL_SET_COL_INFO);
 721
 722         return offset;
 723 }
 724
 725 static int
 726 witness_dissect_element_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 727 {
 728         offset = witness_dissect_bitmap_interfaceInfo_flags(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_flags, 0);
 729
 730         return offset;
 731 }
 732
 733 int
 734 witness_dissect_struct_interfaceInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 735 {
 736         proto_item *item = NULL;
 737         proto_tree *tree = NULL;
 738         int old_offset;
 739
 740         ALIGN_TO_4_BYTES;
 741
 742         old_offset = offset;
 743
 744         if (parent_tree) {
 745                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 746                 tree = proto_item_add_subtree(item, ett_witness_witness_interfaceInfo);
 747         }
 748
 749         offset = witness_dissect_element_interfaceInfo_group_name(tvb, offset, pinfo, tree, di, drep);
 750
 751         offset = witness_dissect_element_interfaceInfo_version(tvb, offset, pinfo, tree, di, drep);
 752
 753         offset = witness_dissect_element_interfaceInfo_state(tvb, offset, pinfo, tree, di, drep);
 754
 755         offset = witness_dissect_element_interfaceInfo_ipv4(tvb, offset, pinfo, tree, di, drep);
 756
 757         offset = witness_dissect_element_interfaceInfo_ipv6(tvb, offset, pinfo, tree, di, drep);
 758
 759         offset = witness_dissect_element_interfaceInfo_flags(tvb, offset, pinfo, tree, di, drep);
 760
 761
 762         proto_item_set_len(item, offset-old_offset);
 763
 764
 765         if (di->call_data->flags & DCERPC_IS_NDR64) {
 766                 ALIGN_TO_4_BYTES;
 767         }
 768
 769         return offset;
 770 }
 771
 772
 773 /* IDL: struct { */
 774 /* IDL:         uint32 num_interfaces; */
 775 /* IDL:         [size_is(num_interfaces)] [unique(1)] witness_interfaceInfo *interfaces; */
 776 /* IDL: } */
 777
 778 static int
 779 witness_dissect_element_interfaceList_num_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 780 {
 781         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceList_num_interfaces, 0);
 782
 783         return offset;
 784 }
 785
 786 static int
 787 witness_dissect_element_interfaceList_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 788 {
 789         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_interfaceList_interfaces_, NDR_POINTER_UNIQUE, "Pointer to Interfaces (witness_interfaceInfo)",hf_witness_witness_interfaceList_interfaces);
 790
 791         return offset;
 792 }
 793
 794 static int
 795 witness_dissect_element_interfaceList_interfaces_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 796 {
 797         struct ndr_generic_array nga = { .is_conformant = false, };
 798
 799         offset = dissect_ndr_conformant_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
 800
 801         offset = dissect_ndr_generic_array_bytes(tvb, offset, pinfo, tree, di, drep, &nga, witness_dissect_element_interfaceList_interfaces__);
 802
 803         return offset;
 804 }
 805
 806 static int
 807 witness_dissect_element_interfaceList_interfaces__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 808 {
 809         offset = witness_dissect_struct_interfaceInfo(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_interfaceList_interfaces,0);
 810
 811         return offset;
 812 }
 813
 814 int
 815 witness_dissect_struct_interfaceList(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 816 {
 817         proto_item *item = NULL;
 818         proto_tree *tree = NULL;
 819         int old_offset;
 820
 821         ALIGN_TO_5_BYTES;
 822
 823         old_offset = offset;
 824
 825         if (parent_tree) {
 826                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 827                 tree = proto_item_add_subtree(item, ett_witness_witness_interfaceList);
 828         }
 829
 830         offset = witness_dissect_element_interfaceList_num_interfaces(tvb, offset, pinfo, tree, di, drep);
 831
 832         offset = witness_dissect_element_interfaceList_interfaces(tvb, offset, pinfo, tree, di, drep);
 833
 834
 835         proto_item_set_len(item, offset-old_offset);
 836
 837
 838         if (di->call_data->flags & DCERPC_IS_NDR64) {
 839                 ALIGN_TO_5_BYTES;
 840         }
 841
 842         return offset;
 843 }
 844
 845
 846 /* IDL: enum { */
 847 /* IDL:         WITNESS_NOTIFY_RESOURCE_CHANGE=1, */
 848 /* IDL:         WITNESS_NOTIFY_CLIENT_MOVE=2, */
 849 /* IDL:         WITNESS_NOTIFY_SHARE_MOVE=3, */
 850 /* IDL:         WITNESS_NOTIFY_IP_CHANGE=4, */
 851 /* IDL: } */
 852
 853 int
 854 witness_dissect_enum_notifyResponse_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t *param _U_)
 855 {
 856         uint32_t parameter=0;
 857         if (param) {
 858                 parameter = *param;
 859         }
 860         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 861         if (param) {
 862                 *param = parameter;
 863         }
 864         return offset;
 865 }
 866
 867
 868 /* IDL: enum { */
 869 /* IDL:         WITNESS_RESOURCE_STATE_UNKNOWN=0x00, */
 870 /* IDL:         WITNESS_RESOURCE_STATE_AVAILABLE=0x01, */
 871 /* IDL:         WITNESS_RESOURCE_STATE_UNAVAILABLE=0xff, */
 872 /* IDL: } */
 873
 874 int
 875 witness_dissect_enum_ResourceChange_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t *param _U_)
 876 {
 877         uint32_t parameter=0;
 878         if (param) {
 879                 parameter = *param;
 880         }
 881         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 882         if (param) {
 883                 *param = parameter;
 884         }
 885         return offset;
 886 }
 887
 888
 889 /* IDL: struct { */
 890 /* IDL:         [value(ndr_size_witness_ResourceChange(r,ndr->flags))] uint32 length; */
 891 /* IDL:         witness_ResourceChange_type type; */
 892 /* IDL:         [flag(LIBNDR_FLAG_STR_NULLTERM)] string name; */
 893 /* IDL: } */
 894
 895 static int
 896 witness_dissect_element_ResourceChange_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 897 {
 898         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_ResourceChange_length, 0);
 899
 900         return offset;
 901 }
 902
 903 int
 904 witness_dissect_struct_ResourceChange(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 905 {
 906         proto_item *item = NULL;
 907         proto_tree *tree = NULL;
 908         bool oldalign = di->no_align;
 909         int old_offset;
 910
 911         di->no_align = true;
 912
 913         old_offset = offset;
 914
 915         if (parent_tree) {
 916                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 917                 tree = proto_item_add_subtree(item, ett_witness_witness_ResourceChange);
 918         }
 919
 920         offset = witness_dissect_element_ResourceChange_length(tvb, offset, pinfo, tree, di, drep);
 921
 922         offset = witness_dissect_element_ResourceChange_type(tvb, offset, pinfo, tree, di, drep);
 923
 924         offset = witness_dissect_element_ResourceChange_name(tvb, offset, pinfo, tree, di, drep);
 925
 926
 927         proto_item_set_len(item, offset-old_offset);
 928
 929
 930         di->no_align = oldalign;
 931
 932         return offset;
 933 }
 934
 935
 936 /* IDL: bitmap { */
 937 /* IDL:         WITNESS_IPADDR_V4 =  0x00000001 , */
 938 /* IDL:         WITNESS_IPADDR_V6 =  0x00000002 , */
 939 /* IDL:         WITNESS_IPADDR_ONLINE =  0x00000008 , */
 940 /* IDL:         WITNESS_IPADDR_OFFLINE =  0x00000010 , */
 941 /* IDL: } */
 942
 943 int
 944 witness_dissect_bitmap_IPaddrInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 945 {
 946         proto_item *item;
 947         static int * const witness_witness_IPaddrInfo_flags_fields[] = {
 948                 &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V4,
 949                 &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V6,
 950                 &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE,
 951                 &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE,
 952                 NULL
 953         };
 954         uint32_t flags;
 955         ALIGN_TO_4_BYTES;
 956
 957         item = proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_index,
 958                                 ett_witness_witness_IPaddrInfo_flags, witness_witness_IPaddrInfo_flags_fields, DREP_ENC_INTEGER(drep), BMT_NO_FALSE);
 959
 960         offset = dissect_ndr_uint32(tvb, offset, pinfo, parent_tree, di, drep, -1, &flags);
 961
 962         if (!flags)
 963                 proto_item_append_text(item, ": (No values set)");
 964
 965         if (flags & (~0x0000001b)) {
 966                 flags &= (~0x0000001b);
 967                 proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);
 968         }
 969
 970         return offset;
 971 }
 972
 973
 974 /* IDL: struct { */
 975 /* IDL:         witness_IPaddrInfo_flags flags; */
 976 /* IDL:         ipv4address ipv4; */
 977 /* IDL:         ipv6address ipv6; */
 978 /* IDL: } */
 979
 980 static int
 981 witness_dissect_element_IPaddrInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 982 {
 983         offset = witness_dissect_bitmap_IPaddrInfo_flags(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfo_flags, 0);
 984
 985         return offset;
 986 }
 987
 988 static int
 989 witness_dissect_element_IPaddrInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 990 {
 991         offset=PIDL_dissect_ipv4address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfo_ipv4, PIDL_SET_COL_INFO);
 992
 993         return offset;
 994 }
 995
 996 static int
 997 witness_dissect_element_IPaddrInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 998 {
 999         offset=PIDL_dissect_ipv6address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfo_ipv6, PIDL_SET_COL_INFO);
1000
1001         return offset;
1002 }
1003
1004 int
1005 witness_dissect_struct_IPaddrInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
1006 {
1007         proto_item *item = NULL;
1008         proto_tree *tree = NULL;
1009         bool oldalign = di->no_align;
1010         int old_offset;
1011
1012         di->no_align = true;
1013
1014         old_offset = offset;
1015
1016         if (parent_tree) {
1017                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
1018                 tree = proto_item_add_subtree(item, ett_witness_witness_IPaddrInfo);
1019         }
1020
1021         offset = witness_dissect_element_IPaddrInfo_flags(tvb, offset, pinfo, tree, di, drep);
1022
1023         offset = witness_dissect_element_IPaddrInfo_ipv4(tvb, offset, pinfo, tree, di, drep);
1024
1025         offset = witness_dissect_element_IPaddrInfo_ipv6(tvb, offset, pinfo, tree, di, drep);
1026
1027
1028         proto_item_set_len(item, offset-old_offset);
1029
1030
1031         di->no_align = oldalign;
1032
1033         return offset;
1034 }
1035
1036
1037 /* IDL: struct { */
1038 /* IDL:         [value(r->num*ndr_size_witness_IPaddrInfo(r->addr,ndr->flags))] uint32 length; */
1039 /* IDL:         [value(0)] uint32 reserved; */
1040 /* IDL:         uint32 num; */
1041 /* IDL:         witness_IPaddrInfo addr[num]; */
1042 /* IDL: } */
1043
1044 static int
1045 witness_dissect_element_IPaddrInfoList_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1046 {
1047         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfoList_length, 0);
1048
1049         return offset;
1050 }
1051
1052 static int
1053 witness_dissect_element_IPaddrInfoList_reserved(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1054 {
1055         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfoList_reserved, 0);
1056
1057         return offset;
1058 }
1059
1060
1061 /* IDL: [flag(LIBNDR_FLAG_NOALIGN|LIBNDR_FLAG_LITTLE_ENDIAN)] [nodiscriminant(1)] [public(1)] [switch_type(witness_notifyResponse_type)] union { */
1062 /* IDL: [case(WITNESS_NOTIFY_RESOURCE_CHANGE)] [case(WITNESS_NOTIFY_RESOURCE_CHANGE)] witness_ResourceChange resource_change; */
1063 /* IDL: [case(WITNESS_NOTIFY_CLIENT_MOVE)] [case(WITNESS_NOTIFY_CLIENT_MOVE)] witness_IPaddrInfoList client_move; */
1064 /* IDL: [case(WITNESS_NOTIFY_SHARE_MOVE)] [case(WITNESS_NOTIFY_SHARE_MOVE)] witness_IPaddrInfoList share_move; */
1065 /* IDL: [case(WITNESS_NOTIFY_IP_CHANGE)] [case(WITNESS_NOTIFY_IP_CHANGE)] witness_IPaddrInfoList ip_change; */
1066 /* IDL: [default] ; */
1067 /* IDL: } */
1068
1069 static int
1070 witness_dissect_element_notifyResponse_message_resource_change(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1071 {
1072         offset = witness_dissect_struct_ResourceChange(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_notifyResponse_message_resource_change,0);
1073
1074         return offset;
1075 }
1076
1077 static int
1078 witness_dissect_element_notifyResponse_message_client_move(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1079 {
1080         offset = witness_dissect_struct_IPaddrInfoList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_notifyResponse_message_client_move,0);
1081
1082         return offset;
1083 }
1084
1085 static int
1086 witness_dissect_element_notifyResponse_message_share_move(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1087 {
1088         offset = witness_dissect_struct_IPaddrInfoList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_notifyResponse_message_share_move,0);
1089
1090         return offset;
1091 }
1092
1093 static int
1094 witness_dissect_element_notifyResponse_message_ip_change(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1095 {
1096         offset = witness_dissect_struct_IPaddrInfoList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_notifyResponse_message_ip_change,0);
1097
1098         return offset;
1099 }
1100
1101 static int
1102 witness_dissect_element_notifyResponse_message_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1103 {
1104         offset = dissect_ndr_datablob(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_message_data, 1);
1105
1106         return offset;
1107 }
1108
1109 static int
1110 witness_dissect_notifyResponse_message(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
1111 {
1112         proto_item *item = NULL;
1113         proto_tree *tree = NULL;
1114         int old_offset;
1115         uint32_t level = param;
1116
1117         old_offset = offset;
1118         if (parent_tree) {
1119                 tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_witness_witness_notifyResponse_message, &item, "witness_notifyResponse_message");
1120         }
1121
1122         UNION_ALIGN_TO_4_BYTES;
1123
1124         switch(level) {
1125                 case WITNESS_NOTIFY_RESOURCE_CHANGE:
1126                         offset = witness_dissect_element_notifyResponse_message_resource_change(tvb, offset, pinfo, tree, di, drep);
1127                 break;
1128
1129                 case WITNESS_NOTIFY_CLIENT_MOVE:
1130                         offset = witness_dissect_element_notifyResponse_message_client_move(tvb, offset, pinfo, tree, di, drep);
1131                 break;
1132
1133                 case WITNESS_NOTIFY_SHARE_MOVE:
1134                         offset = witness_dissect_element_notifyResponse_message_share_move(tvb, offset, pinfo, tree, di, drep);
1135                 break;
1136
1137                 case WITNESS_NOTIFY_IP_CHANGE:
1138                         offset = witness_dissect_element_notifyResponse_message_ip_change(tvb, offset, pinfo, tree, di, drep);
1139                 break;
1140
1141                 default:
1142                         offset = witness_dissect_element_notifyResponse_message_data(tvb, offset, pinfo, tree, di, drep);
1143                 break;
1144         }
1145         proto_item_set_len(item, offset-old_offset);
1146
1147
1148         return offset;
1149 }
1150
1151 /* IDL: struct { */
1152 /* IDL:         witness_notifyResponse_type type; */
1153 /* IDL:         [value(ndr_size_witness_notifyResponse(r,ndr->flags)-20)] uint32 length; */
1154 /* IDL:         uint32 num; */
1155 /* IDL:         [flag(LIBNDR_FLAG_REMAINING)] [subcontext(4)] [subcontext_size(length)] [switch_is(type)] witness_notifyResponse_message messages[num]; */
1156 /* IDL: } */
1157
1158 static int
1159 witness_dissect_element_notifyResponse_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1160 {
1161         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_length, 0);
1162
1163         return offset;
1164 }
1165
1166
1167 /* IDL: bitmap { */
1168 /* IDL:         WITNESS_REGISTER_NONE =  0x00000000 , */
1169 /* IDL:         WITNESS_REGISTER_IP_NOTIFICATION =  0x00000001 , */
1170 /* IDL: } */
1171
1172 int
1173 witness_dissect_bitmap_RegisterEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
1174 {
1175         proto_item *item;
1176         static int * const witness_witness_RegisterEx_flags_fields[] = {
1177                 &hf_witness_witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION,
1178                 NULL
1179         };
1180         uint32_t flags;
1181         ALIGN_TO_4_BYTES;
1182
1183         item = proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_index,
1184                                 ett_witness_witness_RegisterEx_flags, witness_witness_RegisterEx_flags_fields, DREP_ENC_INTEGER(drep), BMT_NO_FALSE);
1185
1186         offset = dissect_ndr_uint32(tvb, offset, pinfo, parent_tree, di, drep, -1, &flags);
1187
1188         if (!flags)
1189                 proto_item_append_text(item, ": (No values set)");
1190
1191         if (flags & (~0x00000001)) {
1192                 flags &= (~0x00000001);
1193                 proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);
1194         }
1195
1196         return offset;
1197 }
1198
1199 static int
1200 witness_dissect_element_GetInterfaceList_interface_list(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1201 {
1202         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_GetInterfaceList_interface_list_, NDR_POINTER_REF, "Pointer to Interface List (witness_interfaceList)",hf_witness_witness_GetInterfaceList_interface_list);
1203
1204         return offset;
1205 }
1206
1207 static int
1208 witness_dissect_element_GetInterfaceList_interface_list_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1209 {
1210         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_GetInterfaceList_interface_list__, NDR_POINTER_UNIQUE, "Pointer to Interface List (witness_interfaceList)",hf_witness_witness_GetInterfaceList_interface_list);
1211
1212         return offset;
1213 }
1214
1215 static int
1216 witness_dissect_element_GetInterfaceList_interface_list__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1217 {
1218         offset = witness_dissect_struct_interfaceList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_GetInterfaceList_interface_list,0);
1219
1220         return offset;
1221 }
1222
1223 /* IDL: WERROR witness_GetInterfaceList( */
1224 /* IDL: [out] [ref] witness_interfaceList **interface_list */
1225 /* IDL: ); */
1226
1227 static int
1228 witness_dissect_GetInterfaceList_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1229 {
1230         uint32_t status;
1231
1232         di->dcerpc_procedure_name="GetInterfaceList";
1233         offset = witness_dissect_element_GetInterfaceList_interface_list(tvb, offset, pinfo, tree, di, drep);
1234         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1235
1236         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1237
1238         if (status != 0)
1239                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1240
1241         return offset;
1242 }
1243
1244 static int
1245 witness_dissect_GetInterfaceList_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1246 {
1247         di->dcerpc_procedure_name="GetInterfaceList";
1248         return offset;
1249 }
1250
1251 static int
1252 witness_dissect_element_Register_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1253 {
1254         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_context_handle_, NDR_POINTER_REF, "Pointer to Context Handle (policy_handle)",hf_witness_witness_Register_context_handle);
1255
1256         return offset;
1257 }
1258
1259 static int
1260 witness_dissect_element_Register_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1261 {
1262         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_Register_context_handle, 0);
1263
1264         return offset;
1265 }
1266
1267 static int
1268 witness_dissect_element_Register_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1269 {
1270         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_Register_version, 0);
1271
1272         return offset;
1273 }
1274
1275 static int
1276 witness_dissect_element_Register_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1277 {
1278         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_net_name_, NDR_POINTER_UNIQUE, "Pointer to Net Name (uint16)",hf_witness_witness_Register_net_name);
1279
1280         return offset;
1281 }
1282
1283 static int
1284 witness_dissect_element_Register_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1285 {
1286         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_ip_address_, NDR_POINTER_UNIQUE, "Pointer to Ip Address (uint16)",hf_witness_witness_Register_ip_address);
1287
1288         return offset;
1289 }
1290
1291 static int
1292 witness_dissect_element_Register_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1293 {
1294         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_client_computer_name_, NDR_POINTER_UNIQUE, "Pointer to Client Computer Name (uint16)",hf_witness_witness_Register_client_computer_name);
1295
1296         return offset;
1297 }
1298
1299 static int
1300 witness_dissect_element_Register_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1301 {
1302         char *data = NULL;
1303         struct ndr_generic_array nga = { .is_conformant = false, };
1304
1305         offset = dissect_ndr_conformant_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
1306
1307         offset = dissect_ndr_varying_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
1308         offset = dissect_ndr_generic_array_string(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_Register_client_computer_name, false, &nga, &data);
1309         proto_item_append_text(tree, ": %s", data);
1310
1311         return offset;
1312 }
1313
1314 /* IDL: WERROR witness_Register( */
1315 /* IDL: [out] [ref] policy_handle *context_handle, */
1316 /* IDL: [in] witness_version version, */
1317 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *net_name, */
1318 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *ip_address, */
1319 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *client_computer_name */
1320 /* IDL: ); */
1321
1322 static int
1323 witness_dissect_Register_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1324 {
1325         uint32_t status;
1326
1327         di->dcerpc_procedure_name="Register";
1328         offset = witness_dissect_element_Register_context_handle(tvb, offset, pinfo, tree, di, drep);
1329         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1330
1331         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1332
1333         if (status != 0)
1334                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1335
1336         return offset;
1337 }
1338
1339 static int
1340 witness_dissect_Register_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1341 {
1342         di->dcerpc_procedure_name="Register";
1343         offset = witness_dissect_element_Register_version(tvb, offset, pinfo, tree, di, drep);
1344         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1345         offset = witness_dissect_element_Register_net_name(tvb, offset, pinfo, tree, di, drep);
1346         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1347         offset = witness_dissect_element_Register_ip_address(tvb, offset, pinfo, tree, di, drep);
1348         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1349         offset = witness_dissect_element_Register_client_computer_name(tvb, offset, pinfo, tree, di, drep);
1350         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1351         return offset;
1352 }
1353
1354 static int
1355 witness_dissect_element_UnRegister_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1356 {
1357         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_UnRegister_context_handle, 0);
1358
1359         return offset;
1360 }
1361
1362 /* IDL: WERROR witness_UnRegister( */
1363 /* IDL: [in] policy_handle context_handle */
1364 /* IDL: ); */
1365
1366 static int
1367 witness_dissect_UnRegister_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1368 {
1369         uint32_t status;
1370
1371         di->dcerpc_procedure_name="UnRegister";
1372         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1373
1374         if (status != 0)
1375                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1376
1377         return offset;
1378 }
1379
1380 static int
1381 witness_dissect_UnRegister_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1382 {
1383         di->dcerpc_procedure_name="UnRegister";
1384         offset = witness_dissect_element_UnRegister_context_handle(tvb, offset, pinfo, tree, di, drep);
1385         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1386         return offset;
1387 }
1388
1389 static int
1390 witness_dissect_element_AsyncNotify_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1391 {
1392         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_AsyncNotify_context_handle, 0);
1393
1394         return offset;
1395 }
1396
1397 static int
1398 witness_dissect_element_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1399 {
1400         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_AsyncNotify_response_, NDR_POINTER_REF, "Pointer to Response (witness_notifyResponse)",hf_witness_witness_AsyncNotify_response);
1401
1402         return offset;
1403 }
1404
1405 static int
1406 witness_dissect_element_AsyncNotify_response_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1407 {
1408         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_AsyncNotify_response__, NDR_POINTER_UNIQUE, "Pointer to Response (witness_notifyResponse)",hf_witness_witness_AsyncNotify_response);
1409
1410         return offset;
1411 }
1412
1413 static int
1414 witness_dissect_element_AsyncNotify_response__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1415 {
1416         offset = witness_dissect_struct_notifyResponse(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_AsyncNotify_response,0);
1417
1418         return offset;
1419 }
1420
1421 /* IDL: WERROR witness_AsyncNotify( */
1422 /* IDL: [in] policy_handle context_handle, */
1423 /* IDL: [out] [ref] witness_notifyResponse **response */
1424 /* IDL: ); */
1425
1426 static int
1427 witness_dissect_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1428 {
1429         uint32_t status;
1430
1431         di->dcerpc_procedure_name="AsyncNotify";
1432         offset = witness_dissect_element_AsyncNotify_response(tvb, offset, pinfo, tree, di, drep);
1433         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1434
1435         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1436
1437         if (status != 0)
1438                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1439
1440         return offset;
1441 }
1442
1443 static int
1444 witness_dissect_AsyncNotify_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1445 {
1446         di->dcerpc_procedure_name="AsyncNotify";
1447         offset = witness_dissect_element_AsyncNotify_context_handle(tvb, offset, pinfo, tree, di, drep);
1448         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1449         return offset;
1450 }
1451
1452 static int
1453 witness_dissect_element_RegisterEx_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1454 {
1455         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_context_handle_, NDR_POINTER_REF, "Pointer to Context Handle (policy_handle)",hf_witness_witness_RegisterEx_context_handle);
1456
1457         return offset;
1458 }
1459
1460 static int
1461 witness_dissect_element_RegisterEx_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1462 {
1463         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_context_handle, 0);
1464
1465         return offset;
1466 }
1467
1468 static int
1469 witness_dissect_element_RegisterEx_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1470 {
1471         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_version, 0);
1472
1473         return offset;
1474 }
1475
1476 static int
1477 witness_dissect_element_RegisterEx_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1478 {
1479         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_net_name_, NDR_POINTER_UNIQUE, "Pointer to Net Name (uint16)",hf_witness_witness_RegisterEx_net_name);
1480
1481         return offset;
1482 }
1483
1484 static int
1485 witness_dissect_element_RegisterEx_share_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1486 {
1487         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_share_name_, NDR_POINTER_UNIQUE, "Pointer to Share Name (uint16)",hf_witness_witness_RegisterEx_share_name);
1488
1489         return offset;
1490 }
1491
1492 static int
1493 witness_dissect_element_RegisterEx_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1494 {
1495         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_ip_address_, NDR_POINTER_UNIQUE, "Pointer to Ip Address (uint16)",hf_witness_witness_RegisterEx_ip_address);
1496
1497         return offset;
1498 }
1499
1500 static int
1501 witness_dissect_element_RegisterEx_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1502 {
1503         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_client_computer_name_, NDR_POINTER_UNIQUE, "Pointer to Client Computer Name (uint16)",hf_witness_witness_RegisterEx_client_computer_name);
1504
1505         return offset;
1506 }
1507
1508 static int
1509 witness_dissect_element_RegisterEx_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1510 {
1511         char *data = NULL;
1512         struct ndr_generic_array nga = { .is_conformant = false, };
1513
1514         offset = dissect_ndr_conformant_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
1515
1516         offset = dissect_ndr_varying_array_hdr(tvb, offset, pinfo, tree, di, drep, &nga);
1517         offset = dissect_ndr_generic_array_string(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_RegisterEx_client_computer_name, false, &nga, &data);
1518         proto_item_append_text(tree, ": %s", data);
1519
1520         return offset;
1521 }
1522
1523 static int
1524 witness_dissect_element_RegisterEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1525 {
1526         offset = witness_dissect_bitmap_RegisterEx_flags(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_flags, 0);
1527
1528         return offset;
1529 }
1530
1531 static int
1532 witness_dissect_element_RegisterEx_timeout(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1533 {
1534         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_timeout, 0);
1535
1536         return offset;
1537 }
1538
1539 /* IDL: WERROR witness_RegisterEx( */
1540 /* IDL: [out] [ref] policy_handle *context_handle, */
1541 /* IDL: [in] witness_version version, */
1542 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *net_name, */
1543 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *share_name, */
1544 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *ip_address, */
1545 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *client_computer_name, */
1546 /* IDL: [in] witness_RegisterEx_flags flags, */
1547 /* IDL: [in] uint32 timeout */
1548 /* IDL: ); */
1549
1550 static int
1551 witness_dissect_RegisterEx_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1552 {
1553         uint32_t status;
1554
1555         di->dcerpc_procedure_name="RegisterEx";
1556         offset = witness_dissect_element_RegisterEx_context_handle(tvb, offset, pinfo, tree, di, drep);
1557         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1558
1559         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1560
1561         if (status != 0)
1562                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1563
1564         return offset;
1565 }
1566
1567 static int
1568 witness_dissect_RegisterEx_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1569 {
1570         di->dcerpc_procedure_name="RegisterEx";
1571         offset = witness_dissect_element_RegisterEx_version(tvb, offset, pinfo, tree, di, drep);
1572         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1573         offset = witness_dissect_element_RegisterEx_net_name(tvb, offset, pinfo, tree, di, drep);
1574         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1575         offset = witness_dissect_element_RegisterEx_share_name(tvb, offset, pinfo, tree, di, drep);
1576         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1577         offset = witness_dissect_element_RegisterEx_ip_address(tvb, offset, pinfo, tree, di, drep);
1578         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1579         offset = witness_dissect_element_RegisterEx_client_computer_name(tvb, offset, pinfo, tree, di, drep);
1580         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1581         offset = witness_dissect_element_RegisterEx_flags(tvb, offset, pinfo, tree, di, drep);
1582         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1583         offset = witness_dissect_element_RegisterEx_timeout(tvb, offset, pinfo, tree, di, drep);
1584         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1585         return offset;
1586 }
1587
1588
1589 static const dcerpc_sub_dissector witness_dissectors[] = {
1590         { 0, "GetInterfaceList",
1591            witness_dissect_GetInterfaceList_request, witness_dissect_GetInterfaceList_response},
1592         { 1, "Register",
1593            witness_dissect_Register_request, witness_dissect_Register_response},
1594         { 2, "UnRegister",
1595            witness_dissect_UnRegister_request, witness_dissect_UnRegister_response},
1596         { 3, "AsyncNotify",
1597            witness_dissect_AsyncNotify_request, witness_dissect_AsyncNotify_response},
1598         { 4, "RegisterEx",
1599            witness_dissect_RegisterEx_request, witness_dissect_RegisterEx_response},
1600         { 0, NULL, NULL, NULL }
1601 };
1602
1603 void proto_register_dcerpc_witness(void)
1604 {
1605         static hf_register_info hf[] = {
1606         { &hf_witness_opnum,
1607           { "Operation", "witness.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
1608         { &hf_witness_werror,
1609           { "Windows Error", "witness.werror", FT_UINT32, BASE_HEX|BASE_EXT_STRING, &WERR_errors_ext, 0, NULL, HFILL }},
1610         { &hf_witness_witness_AsyncNotify_context_handle,
1611           { "Context Handle", "witness.witness_AsyncNotify.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
1612         { &hf_witness_witness_AsyncNotify_response,
1613           { "Response", "witness.witness_AsyncNotify.response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1614         { &hf_witness_witness_GetInterfaceList_interface_list,
1615           { "Interface List", "witness.witness_GetInterfaceList.interface_list", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1616         { &hf_witness_witness_IPaddrInfoList_addr,
1617           { "Addr", "witness.witness_IPaddrInfoList.addr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1618         { &hf_witness_witness_IPaddrInfoList_length,
1619           { "Length", "witness.witness_IPaddrInfoList.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1620         { &hf_witness_witness_IPaddrInfoList_num,
1621           { "Num", "witness.witness_IPaddrInfoList.num", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1622         { &hf_witness_witness_IPaddrInfoList_reserved,
1623           { "Reserved", "witness.witness_IPaddrInfoList.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1624         { &hf_witness_witness_IPaddrInfo_flags,
1625           { "Flags", "witness.witness_IPaddrInfo.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
1626         { &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE,
1627           { "WITNESS IPADDR OFFLINE", "witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_OFFLINE", FT_BOOLEAN, 32, TFS(&witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE_tfs), ( 0x00000010 ), NULL, HFILL }},
1628         { &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE,
1629           { "WITNESS IPADDR ONLINE", "witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_ONLINE", FT_BOOLEAN, 32, TFS(&witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE_tfs), ( 0x00000008 ), NULL, HFILL }},
1630         { &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V4,
1631           { "WITNESS IPADDR V4", "witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V4", FT_BOOLEAN, 32, TFS(&witness_IPaddrInfo_flags_WITNESS_IPADDR_V4_tfs), ( 0x00000001 ), NULL, HFILL }},
1632         { &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V6,
1633           { "WITNESS IPADDR V6", "witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V6", FT_BOOLEAN, 32, TFS(&witness_IPaddrInfo_flags_WITNESS_IPADDR_V6_tfs), ( 0x00000002 ), NULL, HFILL }},
1634         { &hf_witness_witness_IPaddrInfo_ipv4,
1635           { "Ipv4", "witness.witness_IPaddrInfo.ipv4", FT_IPv4, BASE_NONE, NULL, 0, NULL, HFILL }},
1636         { &hf_witness_witness_IPaddrInfo_ipv6,
1637           { "Ipv6", "witness.witness_IPaddrInfo.ipv6", FT_IPv6, BASE_NONE, NULL, 0, NULL, HFILL }},
1638         { &hf_witness_witness_RegisterEx_client_computer_name,
1639           { "Client Computer Name", "witness.witness_RegisterEx.client_computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1640         { &hf_witness_witness_RegisterEx_context_handle,
1641           { "Context Handle", "witness.witness_RegisterEx.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
1642         { &hf_witness_witness_RegisterEx_flags,
1643           { "Flags", "witness.witness_RegisterEx.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
1644         { &hf_witness_witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION,
1645           { "WITNESS REGISTER IP NOTIFICATION", "witness.witness_RegisterEx_flags.WITNESS_REGISTER_IP_NOTIFICATION", FT_BOOLEAN, 32, TFS(&witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION_tfs), ( 0x00000001 ), NULL, HFILL }},
1646         { &hf_witness_witness_RegisterEx_ip_address,
1647           { "Ip Address", "witness.witness_RegisterEx.ip_address", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1648         { &hf_witness_witness_RegisterEx_net_name,
1649           { "Net Name", "witness.witness_RegisterEx.net_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1650         { &hf_witness_witness_RegisterEx_share_name,
1651           { "Share Name", "witness.witness_RegisterEx.share_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1652         { &hf_witness_witness_RegisterEx_timeout,
1653           { "Timeout", "witness.witness_RegisterEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1654         { &hf_witness_witness_RegisterEx_version,
1655           { "Version", "witness.witness_RegisterEx.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
1656         { &hf_witness_witness_Register_client_computer_name,
1657           { "Client Computer Name", "witness.witness_Register.client_computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1658         { &hf_witness_witness_Register_context_handle,
1659           { "Context Handle", "witness.witness_Register.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
1660         { &hf_witness_witness_Register_ip_address,
1661           { "Ip Address", "witness.witness_Register.ip_address", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1662         { &hf_witness_witness_Register_net_name,
1663           { "Net Name", "witness.witness_Register.net_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1664         { &hf_witness_witness_Register_version,
1665           { "Version", "witness.witness_Register.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
1666         { &hf_witness_witness_ResourceChange_length,
1667           { "Length", "witness.witness_ResourceChange.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1668         { &hf_witness_witness_ResourceChange_name,
1669           { "Name", "witness.witness_ResourceChange.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1670         { &hf_witness_witness_ResourceChange_type,
1671           { "Type", "witness.witness_ResourceChange.type", FT_UINT32, BASE_DEC, VALS(witness_witness_ResourceChange_type_vals), 0, NULL, HFILL }},
1672         { &hf_witness_witness_UnRegister_context_handle,
1673           { "Context Handle", "witness.witness_UnRegister.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
1674         { &hf_witness_witness_interfaceInfo_flags,
1675           { "Flags", "witness.witness_interfaceInfo.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
1676         { &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID,
1677           { "WITNESS INFO IPv4 VALID", "witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv4_VALID", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID_tfs), ( 0x00000001 ), NULL, HFILL }},
1678         { &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID,
1679           { "WITNESS INFO IPv6 VALID", "witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv6_VALID", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID_tfs), ( 0x00000002 ), NULL, HFILL }},
1680         { &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF,
1681           { "WITNESS INFO WITNESS IF", "witness.witness_interfaceInfo_flags.WITNESS_INFO_WITNESS_IF", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF_tfs), ( 0x00000004 ), NULL, HFILL }},
1682         { &hf_witness_witness_interfaceInfo_group_name,
1683           { "Group Name", "witness.witness_interfaceInfo.group_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1684         { &hf_witness_witness_interfaceInfo_ipv4,
1685           { "Ipv4", "witness.witness_interfaceInfo.ipv4", FT_IPv4, BASE_NONE, NULL, 0, NULL, HFILL }},
1686         { &hf_witness_witness_interfaceInfo_ipv6,
1687           { "Ipv6", "witness.witness_interfaceInfo.ipv6", FT_IPv6, BASE_NONE, NULL, 0, NULL, HFILL }},
1688         { &hf_witness_witness_interfaceInfo_state,
1689           { "State", "witness.witness_interfaceInfo.state", FT_UINT16, BASE_DEC, VALS(witness_witness_interfaceInfo_state_vals), 0, NULL, HFILL }},
1690         { &hf_witness_witness_interfaceInfo_version,
1691           { "Version", "witness.witness_interfaceInfo.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
1692         { &hf_witness_witness_interfaceList_interfaces,
1693           { "Interfaces", "witness.witness_interfaceList.interfaces", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1694         { &hf_witness_witness_interfaceList_num_interfaces,
1695           { "Num Interfaces", "witness.witness_interfaceList.num_interfaces", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1696         { &hf_witness_witness_notifyResponse_length,
1697           { "Length", "witness.witness_notifyResponse.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1698         { &hf_witness_witness_notifyResponse_message_client_move,
1699           { "Client Move", "witness.witness_notifyResponse_message.client_move", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1700         { &hf_witness_witness_notifyResponse_message_data,
1701           { "Data", "witness.witness_notifyResponse_message.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1702         { &hf_witness_witness_notifyResponse_message_ip_change,
1703           { "Ip Change", "witness.witness_notifyResponse_message.ip_change", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1704         { &hf_witness_witness_notifyResponse_message_resource_change,
1705           { "Resource Change", "witness.witness_notifyResponse_message.resource_change", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1706         { &hf_witness_witness_notifyResponse_message_share_move,
1707           { "Share Move", "witness.witness_notifyResponse_message.share_move", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1708         { &hf_witness_witness_notifyResponse_messages,
1709           { "Messages", "witness.witness_notifyResponse.messages", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1710         { &hf_witness_witness_notifyResponse_messages_,
1711           { "Messages", "witness.witness_notifyResponse.messages_", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1712         { &hf_witness_witness_notifyResponse_num,
1713           { "Num", "witness.witness_notifyResponse.num", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1714         { &hf_witness_witness_notifyResponse_type,
1715           { "Type", "witness.witness_notifyResponse.type", FT_UINT32, BASE_DEC, VALS(witness_witness_notifyResponse_type_vals), 0, NULL, HFILL }},
1716         };
1717
1718
1719         static int *ett[] = {
1720                 &ett_dcerpc_witness,
1721                 &ett_witness_witness_interfaceInfo_flags,
1722                 &ett_witness_witness_interfaceInfo,
1723                 &ett_witness_witness_interfaceList,
1724                 &ett_witness_witness_ResourceChange,
1725                 &ett_witness_witness_IPaddrInfo_flags,
1726                 &ett_witness_witness_IPaddrInfo,
1727                 &ett_witness_witness_IPaddrInfoList,
1728                 &ett_witness_witness_notifyResponse_message,
1729                 &ett_witness_witness_notifyResponse,
1730                 &ett_witness_witness_RegisterEx_flags,
1731         };
1732
1733         proto_dcerpc_witness = proto_register_protocol("SMB Witness Service", "WITNESS", "witness");
1734         proto_register_field_array(proto_dcerpc_witness, hf, array_length (hf));
1735         proto_register_subtree_array(ett, array_length(ett));
1736 }
1737
1738 void proto_reg_handoff_dcerpc_witness(void)
1739 {
1740         dcerpc_init_uuid(proto_dcerpc_witness, ett_dcerpc_witness,
1741                 &uuid_dcerpc_witness, ver_dcerpc_witness,
1742                 witness_dissectors, hf_witness_opnum);
1743 }