epan/dissectors/packet-dcerpc-witness.c

   1 /* DO NOT EDIT
   2         This file was automatically generated by Pidl
   3         from witness.idl and witness.cnf.
   4
   5         Pidl is a perl based IDL compiler for DCE/RPC idl files.
   6         It is maintained by the Samba team, not the Wireshark team.
   7         Instructions on how to download and install Pidl can be
   8         found at https://wiki.wireshark.org/Pidl
   9 */
  10
  11
  12 #include "config.h"
  13 #include <string.h>
  14 #include <wsutil/array.h>
  15 #include <epan/packet.h>
  16 #include <epan/tfs.h>
  17
  18 #include "packet-dcerpc.h"
  19 #include "packet-dcerpc-nt.h"
  20 #include "packet-windows-common.h"
  21 #include "packet-dcerpc-witness.h"
  22 void proto_register_dcerpc_witness(void);
  23 void proto_reg_handoff_dcerpc_witness(void);
  24
  25 /* Ett declarations */
  26 static int ett_dcerpc_witness;
  27 static int ett_witness_witness_interfaceInfo_flags;
  28 static int ett_witness_witness_interfaceInfo;
  29 static int ett_witness_witness_interfaceList;
  30 static int ett_witness_witness_ResourceChange;
  31 static int ett_witness_witness_IPaddrInfo_flags;
  32 static int ett_witness_witness_IPaddrInfo;
  33 static int ett_witness_witness_IPaddrInfoList;
  34 static int ett_witness_witness_notifyResponse_message;
  35 static int ett_witness_witness_notifyResponse;
  36 static int ett_witness_witness_RegisterEx_flags;
  37
  38
  39 /* Header field declarations */
  40 static int hf_witness_opnum;
  41 static int hf_witness_werror;
  42 static int hf_witness_witness_AsyncNotify_context_handle;
  43 static int hf_witness_witness_AsyncNotify_response;
  44 static int hf_witness_witness_GetInterfaceList_interface_list;
  45 static int hf_witness_witness_IPaddrInfoList_addr;
  46 static int hf_witness_witness_IPaddrInfoList_length;
  47 static int hf_witness_witness_IPaddrInfoList_num;
  48 static int hf_witness_witness_IPaddrInfoList_reserved;
  49 static int hf_witness_witness_IPaddrInfo_flags;
  50 static int hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE;
  51 static int hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE;
  52 static int hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V4;
  53 static int hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V6;
  54 static int hf_witness_witness_IPaddrInfo_ipv4;
  55 static int hf_witness_witness_IPaddrInfo_ipv6;
  56 static int hf_witness_witness_RegisterEx_client_computer_name;
  57 static int hf_witness_witness_RegisterEx_context_handle;
  58 static int hf_witness_witness_RegisterEx_flags;
  59 static int hf_witness_witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION;
  60 static int hf_witness_witness_RegisterEx_ip_address;
  61 static int hf_witness_witness_RegisterEx_net_name;
  62 static int hf_witness_witness_RegisterEx_share_name;
  63 static int hf_witness_witness_RegisterEx_timeout;
  64 static int hf_witness_witness_RegisterEx_version;
  65 static int hf_witness_witness_Register_client_computer_name;
  66 static int hf_witness_witness_Register_context_handle;
  67 static int hf_witness_witness_Register_ip_address;
  68 static int hf_witness_witness_Register_net_name;
  69 static int hf_witness_witness_Register_version;
  70 static int hf_witness_witness_ResourceChange_length;
  71 static int hf_witness_witness_ResourceChange_name;
  72 static int hf_witness_witness_ResourceChange_type;
  73 static int hf_witness_witness_UnRegister_context_handle;
  74 static int hf_witness_witness_interfaceInfo_flags;
  75 static int hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID;
  76 static int hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID;
  77 static int hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF;
  78 static int hf_witness_witness_interfaceInfo_group_name;
  79 static int hf_witness_witness_interfaceInfo_ipv4;
  80 static int hf_witness_witness_interfaceInfo_ipv6;
  81 static int hf_witness_witness_interfaceInfo_state;
  82 static int hf_witness_witness_interfaceInfo_version;
  83 static int hf_witness_witness_interfaceList_interfaces;
  84 static int hf_witness_witness_interfaceList_num_interfaces;
  85 static int hf_witness_witness_notifyResponse_length;
  86 static int hf_witness_witness_notifyResponse_message_client_move;
  87 static int hf_witness_witness_notifyResponse_message_data;
  88 static int hf_witness_witness_notifyResponse_message_ip_change;
  89 static int hf_witness_witness_notifyResponse_message_resource_change;
  90 static int hf_witness_witness_notifyResponse_message_share_move;
  91 static int hf_witness_witness_notifyResponse_messages;
  92 static int hf_witness_witness_notifyResponse_messages_;
  93 static int hf_witness_witness_notifyResponse_num;
  94 static int hf_witness_witness_notifyResponse_type;
  95
  96 static int proto_dcerpc_witness;
  97 /* Version information */
  98
  99
 100 static e_guid_t uuid_dcerpc_witness = {
 101         0xccd8c074, 0xd0e5, 0x4a40,
 102         { 0x92, 0xb4, 0xd0, 0x74, 0xfa, 0xa6, 0xba, 0x28 }
 103 };
 104 static uint16_t ver_dcerpc_witness = 1;
 105
 106 const value_string witness_witness_version_vals[] = {
 107         { WITNESS_V1, "WITNESS_V1" },
 108         { WITNESS_V2, "WITNESS_V2" },
 109         { WITNESS_UNSPECIFIED_VERSION, "WITNESS_UNSPECIFIED_VERSION" },
 110 { 0, NULL }
 111 };
 112 const value_string witness_witness_interfaceInfo_state_vals[] = {
 113         { WITNESS_STATE_UNKNOWN, "WITNESS_STATE_UNKNOWN" },
 114         { WITNESS_STATE_AVAILABLE, "WITNESS_STATE_AVAILABLE" },
 115         { WITNESS_STATE_UNAVAILABLE, "WITNESS_STATE_UNAVAILABLE" },
 116 { 0, NULL }
 117 };
 118 static const true_false_string witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID_tfs = {
 119    "WITNESS_INFO_IPv4_VALID is SET",
 120    "WITNESS_INFO_IPv4_VALID is NOT SET",
 121 };
 122 static const true_false_string witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID_tfs = {
 123    "WITNESS_INFO_IPv6_VALID is SET",
 124    "WITNESS_INFO_IPv6_VALID is NOT SET",
 125 };
 126 static const true_false_string witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF_tfs = {
 127    "WITNESS_INFO_WITNESS_IF is SET",
 128    "WITNESS_INFO_WITNESS_IF is NOT SET",
 129 };
 130 static int witness_dissect_element_interfaceInfo_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 131 static int witness_dissect_element_interfaceInfo_state(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 132 static int witness_dissect_element_interfaceInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 133 static int witness_dissect_element_interfaceInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 134 static int witness_dissect_element_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 135 static int witness_dissect_element_interfaceList_num_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 136 static int witness_dissect_element_interfaceList_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 137 static int witness_dissect_element_interfaceList_interfaces_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 138 static int witness_dissect_element_interfaceList_interfaces__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 139 const value_string witness_witness_notifyResponse_type_vals[] = {
 140         { WITNESS_NOTIFY_RESOURCE_CHANGE, "WITNESS_NOTIFY_RESOURCE_CHANGE" },
 141         { WITNESS_NOTIFY_CLIENT_MOVE, "WITNESS_NOTIFY_CLIENT_MOVE" },
 142         { WITNESS_NOTIFY_SHARE_MOVE, "WITNESS_NOTIFY_SHARE_MOVE" },
 143         { WITNESS_NOTIFY_IP_CHANGE, "WITNESS_NOTIFY_IP_CHANGE" },
 144 { 0, NULL }
 145 };
 146 const value_string witness_witness_ResourceChange_type_vals[] = {
 147         { WITNESS_RESOURCE_STATE_UNKNOWN, "WITNESS_RESOURCE_STATE_UNKNOWN" },
 148         { WITNESS_RESOURCE_STATE_AVAILABLE, "WITNESS_RESOURCE_STATE_AVAILABLE" },
 149         { WITNESS_RESOURCE_STATE_UNAVAILABLE, "WITNESS_RESOURCE_STATE_UNAVAILABLE" },
 150 { 0, NULL }
 151 };
 152 static int witness_dissect_element_ResourceChange_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 153 static int witness_dissect_element_ResourceChange_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 154 static int witness_dissect_element_ResourceChange_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 155 static const true_false_string witness_IPaddrInfo_flags_WITNESS_IPADDR_V4_tfs = {
 156    "WITNESS_IPADDR_V4 is SET",
 157    "WITNESS_IPADDR_V4 is NOT SET",
 158 };
 159 static const true_false_string witness_IPaddrInfo_flags_WITNESS_IPADDR_V6_tfs = {
 160    "WITNESS_IPADDR_V6 is SET",
 161    "WITNESS_IPADDR_V6 is NOT SET",
 162 };
 163 static const true_false_string witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE_tfs = {
 164    "WITNESS_IPADDR_ONLINE is SET",
 165    "WITNESS_IPADDR_ONLINE is NOT SET",
 166 };
 167 static const true_false_string witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE_tfs = {
 168    "WITNESS_IPADDR_OFFLINE is SET",
 169    "WITNESS_IPADDR_OFFLINE is NOT SET",
 170 };
 171 static int witness_dissect_element_IPaddrInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 172 static int witness_dissect_element_IPaddrInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 173 static int witness_dissect_element_IPaddrInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 174 static int witness_dissect_element_IPaddrInfoList_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 175 static int witness_dissect_element_IPaddrInfoList_reserved(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 176 static int witness_dissect_element_IPaddrInfoList_num(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 177 static int witness_dissect_element_notifyResponse_message_resource_change(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 178 static int witness_dissect_element_notifyResponse_message_client_move(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 179 static int witness_dissect_element_notifyResponse_message_share_move(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 180 static int witness_dissect_element_notifyResponse_message_ip_change(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 181 static int witness_dissect_element_notifyResponse_message_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 182 static int witness_dissect_element_notifyResponse_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, uint32_t *type);
 183 static int witness_dissect_element_notifyResponse_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 184 static int witness_dissect_element_notifyResponse_num(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 185 static const true_false_string witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION_tfs = {
 186    "WITNESS_REGISTER_IP_NOTIFICATION is SET",
 187    "WITNESS_REGISTER_IP_NOTIFICATION is NOT SET",
 188 };
 189 static int witness_dissect_element_GetInterfaceList_interface_list(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 190 static int witness_dissect_element_GetInterfaceList_interface_list_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 191 static int witness_dissect_element_GetInterfaceList_interface_list__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 192 static int witness_dissect_element_Register_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 193 static int witness_dissect_element_Register_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 194 static int witness_dissect_element_Register_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 195 static int witness_dissect_element_Register_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 196 static int witness_dissect_element_Register_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 197 static int witness_dissect_element_Register_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 198 static int witness_dissect_element_Register_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 199 static int witness_dissect_element_Register_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 200 static int witness_dissect_element_Register_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 201 static int witness_dissect_element_UnRegister_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 202 static int witness_dissect_element_AsyncNotify_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 203 static int witness_dissect_element_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 204 static int witness_dissect_element_AsyncNotify_response_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 205 static int witness_dissect_element_AsyncNotify_response__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 206 static int witness_dissect_element_RegisterEx_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 207 static int witness_dissect_element_RegisterEx_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 208 static int witness_dissect_element_RegisterEx_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 209 static int witness_dissect_element_RegisterEx_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 210 static int witness_dissect_element_RegisterEx_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 211 static int witness_dissect_element_RegisterEx_share_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 212 static int witness_dissect_element_RegisterEx_share_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 213 static int witness_dissect_element_RegisterEx_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 214 static int witness_dissect_element_RegisterEx_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 215 static int witness_dissect_element_RegisterEx_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 216 static int witness_dissect_element_RegisterEx_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 217 static int witness_dissect_element_RegisterEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 218 static int witness_dissect_element_RegisterEx_timeout(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_);
 219  #include "to_str.h"
 220 static int
 221 witness_dissect_notifyResponse_message(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_);
 222 static int
 223 witness_dissect_notifyResponse_message_(tvbuff_t *tvb, int offset, int length _U_, packet_info *pinfo,
 224                                         proto_tree *tree, dcerpc_info *di, uint8_t *drep _U_)
 225 {
 226         uint32_t *type = (uint32_t *)di->private_data;
 227         uint8_t le_drep[4] = { DREP_LITTLE_ENDIAN, };
 228         return witness_dissect_notifyResponse_message(tvb, offset, pinfo, tree, di, le_drep,
 229                                                       hf_witness_witness_notifyResponse_messages_, *type);
 230 }
 231 static int
 232 witness_dissect_element_notifyResponse_messages(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info *di _U_, uint8_t *drep _U_)
 233 {
 234         offset = dissect_ndr_ucarray_block(tvb, offset, pinfo, tree, di, drep,
 235                                            witness_dissect_notifyResponse_message_);
 236         return offset;
 237 }
 238 int
 239 witness_dissect_struct_notifyResponse(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 240 {
 241         uint32_t *type = NULL;
 242         proto_item *item = NULL;
 243         proto_tree *tree = NULL;
 244         int old_offset;
 245         ALIGN_TO_4_BYTES;
 246         ALIGN_TO_4_BYTES;
 247         old_offset = offset;
 248         if (parent_tree) {
 249                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 250                 tree = proto_item_add_subtree(item, ett_witness_witness_notifyResponse);
 251         }
 252         type = wmem_new0(pinfo->pool, uint32_t);
 253         offset = witness_dissect_element_notifyResponse_type(tvb, offset, pinfo, tree, di, drep, type);
 254         offset = witness_dissect_element_notifyResponse_length(tvb, offset, pinfo, tree, di, drep);
 255         offset = witness_dissect_element_notifyResponse_num(tvb, offset, pinfo, tree, di, drep);
 256         di->private_data = type;
 257         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep,
 258                                               witness_dissect_element_notifyResponse_messages,
 259                                               NDR_POINTER_UNIQUE, "Pointer to Message Buffer (uint8)",
 260                                               hf_witness_witness_notifyResponse_messages);
 261         proto_item_set_len(item, offset-old_offset);
 262         if (di->call_data->flags & DCERPC_IS_NDR64) {
 263                 ALIGN_TO_4_BYTES;
 264         }
 265         return offset;
 266 }
 267 static int
 268 witness_dissect_element_IPaddrInfoList_addr(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 269 {
 270         offset = witness_dissect_struct_IPaddrInfo(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_IPaddrInfoList_addr,0);
 271         return offset;
 272 }
 273 int
 274 witness_dissect_struct_IPaddrInfoList(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 275 {
 276         proto_item *item = NULL;
 277         proto_tree *tree = NULL;
 278         bool oldalign = di->no_align;
 279         int old_offset;
 280         uint32_t i, num;
 281         di->no_align = true;
 282         old_offset = offset;
 283         if (parent_tree) {
 284                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 285                 tree = proto_item_add_subtree(item, ett_witness_witness_IPaddrInfoList);
 286         }
 287         offset = witness_dissect_element_IPaddrInfoList_length(tvb, offset, pinfo, tree, di, drep);
 288         offset = witness_dissect_element_IPaddrInfoList_reserved(tvb, offset, pinfo, tree, di, drep);
 289         num = tvb_get_letohl(tvb, offset);
 290         offset = witness_dissect_element_IPaddrInfoList_num(tvb, offset, pinfo, tree, di, drep);
 291         for (i = 0; i < num; i++) {
 292                 offset = witness_dissect_element_IPaddrInfoList_addr(tvb, offset, pinfo, tree, di, drep);
 293         }
 294         proto_item_set_len(item, offset-old_offset);
 295         di->no_align = oldalign;
 296         return offset;
 297 }
 298 static int
 299 witness_dissect_element_interfaceInfo_group_name(tvbuff_t *tvb, int offset, packet_info *pinfo _U_, proto_tree *parent_tree, dcerpc_info *di _U_, uint8_t *drep _U_)
 300 {
 301         int totlen, stringlen;
 302         char *str;
 303         proto_item *pi;
 304         /*
 305          * XXX - this is described as
 306          *
 307          *    [charset(UTF16),to_null] uint16 group_name[260];
 308          *
 309          * I haven't found any documentation for what "to_null" means
 310          * in PIDL; is this a null-padded 260*2-byte array, so that
 311          * strings can be up to 260 16-bit units in length, or is
 312          * it a null-*terminated* string, so that it can be up to 259
 313          * 16-bit units in length?
 314          *
 315          * We assume it's null-padded, for now, and scan for a 2-byte
 316          * null terminator within the 260 2-byte units, and use
 317          * that as the length, with the length being 2*260 if there
 318          * isn't one.
 319          *
 320          * This will result in totlen being the total length, in
 321          * bytes, of the string, including the null terminator, if
 322          * present, and stringlen being the total length, in bytes.
 323          * not counting any null terminator.
 324          */
 325         totlen = 0;
 326         stringlen = 0;
 327         while (totlen < 2*260) {
 328                 /*
 329                  * These 2 bytes are either part of the string
 330                  * or part of the null terminator, so count
 331                  * them.
 332                  */
 333                 totlen += 2;
 334                 if (tvb_get_letohs(tvb, offset + stringlen) == 0)
 335                         break;
 336                 /*
 337                  * Those 2 bytes are part of the string, so
 338                  * count them.
 339                  */
 340                 stringlen += 2;
 341         }
 342         pi = proto_tree_add_item_ret_display_string(parent_tree,
 343             hf_witness_witness_interfaceInfo_group_name, tvb, offset, stringlen,
 344             ENC_UTF_16|ENC_LITTLE_ENDIAN,
 345             pinfo->pool, &str);
 346         proto_item_append_text(pi, " [%d]", totlen);
 347         proto_item_append_text(parent_tree, ": %s", str);
 348         /*
 349          * All 260 16-bit units are part of the field, as they're always
 350          * there even if they don't need to be.
 351          */
 352         return offset + 2*260;
 353 }
 354 static int
 355 PIDL_dissect_ipv4address(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep _U_, int hfindex, uint32_t param)
 356 {
 357         if (di->conformant_run) {
 358                 /* just a run to handle conformant arrays, no scalars to dissect */
 359                 return offset;
 360         }
 361         if (!di->no_align && (offset % 4)) {
 362                 offset += 4 - (offset % 4);
 363         }
 364         proto_tree_add_item(tree, hfindex, tvb, offset, 4, ENC_BIG_ENDIAN);
 365         if (param & PIDL_SET_COL_INFO) {
 366                 const char *ip = tvb_ip_to_str(pinfo->pool, tvb, offset);
 367                 header_field_info *hf_info = proto_registrar_get_nth(hfindex);
 368                 proto_item_append_text(proto_tree_get_parent(tree), " %s:%s", hf_info->name, ip);
 369                 col_append_fstr(pinfo->cinfo, COL_INFO," %s:%s", hf_info->name, ip);
 370         }
 371         return offset + 4;
 372 }
 373 static int
 374 PIDL_dissect_ipv6address(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, dcerpc_info *di, uint8_t *drep _U_, int hfindex, uint32_t param)
 375 {
 376         if (di->conformant_run) {
 377                 /* just a run to handle conformant arrays, no scalars to dissect */
 378                 return offset;
 379         }
 380         if (!di->no_align && (offset % 2)) {
 381                 offset += 2 - (offset % 2);
 382         }
 383         proto_tree_add_item(tree, hfindex, tvb, offset, 16, ENC_BIG_ENDIAN);
 384         if (param & PIDL_SET_COL_INFO) {
 385                 const char *ip = tvb_ip6_to_str(pinfo->pool, tvb, offset);
 386                 header_field_info *hf_info = proto_registrar_get_nth(hfindex);
 387                 proto_item_append_text(proto_tree_get_parent(tree), " %s:%s", hf_info->name, ip);
 388                 col_append_fstr(pinfo->cinfo, COL_INFO," %s:%s", hf_info->name, ip);
 389         }
 390         return offset + 16;
 391 }
 392
 393
 394 /* IDL: enum { */
 395 /* IDL:         WITNESS_V1=0x00010001, */
 396 /* IDL:         WITNESS_V2=0x00020000, */
 397 /* IDL:         WITNESS_UNSPECIFIED_VERSION=0xFFFFFFFF, */
 398 /* IDL: } */
 399
 400 int
 401 witness_dissect_enum_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t *param _U_)
 402 {
 403         uint32_t parameter=0;
 404         if (param) {
 405                 parameter = *param;
 406         }
 407         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 408         if (param) {
 409                 *param = parameter;
 410         }
 411         return offset;
 412 }
 413
 414
 415 /* IDL: enum { */
 416 /* IDL:         WITNESS_STATE_UNKNOWN=0x0000, */
 417 /* IDL:         WITNESS_STATE_AVAILABLE=0x0001, */
 418 /* IDL:         WITNESS_STATE_UNAVAILABLE=0x00ff, */
 419 /* IDL: } */
 420
 421 int
 422 witness_dissect_enum_interfaceInfo_state(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint16_t *param _U_)
 423 {
 424         uint16_t parameter=0;
 425         if (param) {
 426                 parameter = *param;
 427         }
 428         offset = dissect_ndr_uint16(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 429         if (param) {
 430                 *param = parameter;
 431         }
 432         return offset;
 433 }
 434
 435
 436 /* IDL: bitmap { */
 437 /* IDL:         WITNESS_INFO_IPv4_VALID =  0x00000001 , */
 438 /* IDL:         WITNESS_INFO_IPv6_VALID =  0x00000002 , */
 439 /* IDL:         WITNESS_INFO_WITNESS_IF =  0x00000004 , */
 440 /* IDL: } */
 441
 442 int
 443 witness_dissect_bitmap_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 444 {
 445         proto_item *item;
 446         static int * const witness_witness_interfaceInfo_flags_fields[] = {
 447                 &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID,
 448                 &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID,
 449                 &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF,
 450                 NULL
 451         };
 452         uint32_t flags;
 453         ALIGN_TO_4_BYTES;
 454
 455         item = proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_index,
 456                                 ett_witness_witness_interfaceInfo_flags, witness_witness_interfaceInfo_flags_fields, DREP_ENC_INTEGER(drep), BMT_NO_FALSE);
 457
 458         offset = dissect_ndr_uint32(tvb, offset, pinfo, parent_tree, di, drep, -1, &flags);
 459
 460         if (!flags)
 461                 proto_item_append_text(item, ": (No values set)");
 462
 463         if (flags & (~0x00000007)) {
 464                 flags &= (~0x00000007);
 465                 proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);
 466         }
 467
 468         return offset;
 469 }
 470
 471
 472 /* IDL: struct { */
 473 /* IDL:         [charset(UTF16)] [to_null(1)] uint16 group_name[260]; */
 474 /* IDL:         witness_version version; */
 475 /* IDL:         witness_interfaceInfo_state state; */
 476 /* IDL:         [flag(LIBNDR_FLAG_BIGENDIAN)] ipv4address ipv4; */
 477 /* IDL:         [flag(LIBNDR_FLAG_BIGENDIAN)] ipv6address ipv6; */
 478 /* IDL:         witness_interfaceInfo_flags flags; */
 479 /* IDL: } */
 480
 481 static int
 482 witness_dissect_element_interfaceInfo_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 483 {
 484         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_version, 0);
 485
 486         return offset;
 487 }
 488
 489 static int
 490 witness_dissect_element_interfaceInfo_state(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 491 {
 492         offset = witness_dissect_enum_interfaceInfo_state(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_state, 0);
 493
 494         return offset;
 495 }
 496
 497 static int
 498 witness_dissect_element_interfaceInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 499 {
 500         offset=PIDL_dissect_ipv4address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_ipv4, PIDL_SET_COL_INFO);
 501
 502         return offset;
 503 }
 504
 505 static int
 506 witness_dissect_element_interfaceInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 507 {
 508         offset=PIDL_dissect_ipv6address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_ipv6, PIDL_SET_COL_INFO);
 509
 510         return offset;
 511 }
 512
 513 static int
 514 witness_dissect_element_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 515 {
 516         offset = witness_dissect_bitmap_interfaceInfo_flags(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_flags, 0);
 517
 518         return offset;
 519 }
 520
 521 int
 522 witness_dissect_struct_interfaceInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 523 {
 524         proto_item *item = NULL;
 525         proto_tree *tree = NULL;
 526         int old_offset;
 527
 528         ALIGN_TO_4_BYTES;
 529
 530         old_offset = offset;
 531
 532         if (parent_tree) {
 533                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 534                 tree = proto_item_add_subtree(item, ett_witness_witness_interfaceInfo);
 535         }
 536
 537         offset = witness_dissect_element_interfaceInfo_group_name(tvb, offset, pinfo, tree, di, drep);
 538
 539         offset = witness_dissect_element_interfaceInfo_version(tvb, offset, pinfo, tree, di, drep);
 540
 541         offset = witness_dissect_element_interfaceInfo_state(tvb, offset, pinfo, tree, di, drep);
 542
 543         offset = witness_dissect_element_interfaceInfo_ipv4(tvb, offset, pinfo, tree, di, drep);
 544
 545         offset = witness_dissect_element_interfaceInfo_ipv6(tvb, offset, pinfo, tree, di, drep);
 546
 547         offset = witness_dissect_element_interfaceInfo_flags(tvb, offset, pinfo, tree, di, drep);
 548
 549
 550         proto_item_set_len(item, offset-old_offset);
 551
 552
 553         if (di->call_data->flags & DCERPC_IS_NDR64) {
 554                 ALIGN_TO_4_BYTES;
 555         }
 556
 557         return offset;
 558 }
 559
 560
 561 /* IDL: struct { */
 562 /* IDL:         uint32 num_interfaces; */
 563 /* IDL:         [size_is(num_interfaces)] [unique(1)] witness_interfaceInfo *interfaces; */
 564 /* IDL: } */
 565
 566 static int
 567 witness_dissect_element_interfaceList_num_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 568 {
 569         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceList_num_interfaces, 0);
 570
 571         return offset;
 572 }
 573
 574 static int
 575 witness_dissect_element_interfaceList_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 576 {
 577         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_interfaceList_interfaces_, NDR_POINTER_UNIQUE, "Pointer to Interfaces (witness_interfaceInfo)",hf_witness_witness_interfaceList_interfaces);
 578
 579         return offset;
 580 }
 581
 582 static int
 583 witness_dissect_element_interfaceList_interfaces_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 584 {
 585         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_interfaceList_interfaces__);
 586
 587         return offset;
 588 }
 589
 590 static int
 591 witness_dissect_element_interfaceList_interfaces__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 592 {
 593         offset = witness_dissect_struct_interfaceInfo(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_interfaceList_interfaces,0);
 594
 595         return offset;
 596 }
 597
 598 int
 599 witness_dissect_struct_interfaceList(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 600 {
 601         proto_item *item = NULL;
 602         proto_tree *tree = NULL;
 603         int old_offset;
 604
 605         ALIGN_TO_5_BYTES;
 606
 607         old_offset = offset;
 608
 609         if (parent_tree) {
 610                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 611                 tree = proto_item_add_subtree(item, ett_witness_witness_interfaceList);
 612         }
 613
 614         offset = witness_dissect_element_interfaceList_num_interfaces(tvb, offset, pinfo, tree, di, drep);
 615
 616         offset = witness_dissect_element_interfaceList_interfaces(tvb, offset, pinfo, tree, di, drep);
 617
 618
 619         proto_item_set_len(item, offset-old_offset);
 620
 621
 622         if (di->call_data->flags & DCERPC_IS_NDR64) {
 623                 ALIGN_TO_5_BYTES;
 624         }
 625
 626         return offset;
 627 }
 628
 629
 630 /* IDL: enum { */
 631 /* IDL:         WITNESS_NOTIFY_RESOURCE_CHANGE=1, */
 632 /* IDL:         WITNESS_NOTIFY_CLIENT_MOVE=2, */
 633 /* IDL:         WITNESS_NOTIFY_SHARE_MOVE=3, */
 634 /* IDL:         WITNESS_NOTIFY_IP_CHANGE=4, */
 635 /* IDL: } */
 636
 637 int
 638 witness_dissect_enum_notifyResponse_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t *param _U_)
 639 {
 640         uint32_t parameter=0;
 641         if (param) {
 642                 parameter = *param;
 643         }
 644         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 645         if (param) {
 646                 *param = parameter;
 647         }
 648         return offset;
 649 }
 650
 651
 652 /* IDL: enum { */
 653 /* IDL:         WITNESS_RESOURCE_STATE_UNKNOWN=0x00, */
 654 /* IDL:         WITNESS_RESOURCE_STATE_AVAILABLE=0x01, */
 655 /* IDL:         WITNESS_RESOURCE_STATE_UNAVAILABLE=0xff, */
 656 /* IDL: } */
 657
 658 int
 659 witness_dissect_enum_ResourceChange_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t *param _U_)
 660 {
 661         uint32_t parameter=0;
 662         if (param) {
 663                 parameter = *param;
 664         }
 665         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 666         if (param) {
 667                 *param = parameter;
 668         }
 669         return offset;
 670 }
 671
 672
 673 /* IDL: struct { */
 674 /* IDL:         [value(ndr_size_witness_ResourceChange(r,ndr->flags))] uint32 length; */
 675 /* IDL:         witness_ResourceChange_type type; */
 676 /* IDL:         [flag(LIBNDR_FLAG_STR_NULLTERM)] string name; */
 677 /* IDL: } */
 678
 679 static int
 680 witness_dissect_element_ResourceChange_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 681 {
 682         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_ResourceChange_length, 0);
 683
 684         return offset;
 685 }
 686
 687 static int
 688 witness_dissect_element_ResourceChange_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 689 {
 690         offset = witness_dissect_enum_ResourceChange_type(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_ResourceChange_type, 0);
 691
 692         return offset;
 693 }
 694
 695 static int
 696 witness_dissect_element_ResourceChange_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 697 {
 698         offset = dissect_null_term_wstring(tvb, offset, pinfo, tree, drep, hf_witness_witness_ResourceChange_name , 0);
 699
 700         return offset;
 701 }
 702
 703 int
 704 witness_dissect_struct_ResourceChange(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 705 {
 706         proto_item *item = NULL;
 707         proto_tree *tree = NULL;
 708         bool oldalign = di->no_align;
 709         int old_offset;
 710
 711         di->no_align = true;
 712
 713         old_offset = offset;
 714
 715         if (parent_tree) {
 716                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 717                 tree = proto_item_add_subtree(item, ett_witness_witness_ResourceChange);
 718         }
 719
 720         offset = witness_dissect_element_ResourceChange_length(tvb, offset, pinfo, tree, di, drep);
 721
 722         offset = witness_dissect_element_ResourceChange_type(tvb, offset, pinfo, tree, di, drep);
 723
 724         offset = witness_dissect_element_ResourceChange_name(tvb, offset, pinfo, tree, di, drep);
 725
 726
 727         proto_item_set_len(item, offset-old_offset);
 728
 729
 730         di->no_align = oldalign;
 731
 732         return offset;
 733 }
 734
 735
 736 /* IDL: bitmap { */
 737 /* IDL:         WITNESS_IPADDR_V4 =  0x00000001 , */
 738 /* IDL:         WITNESS_IPADDR_V6 =  0x00000002 , */
 739 /* IDL:         WITNESS_IPADDR_ONLINE =  0x00000008 , */
 740 /* IDL:         WITNESS_IPADDR_OFFLINE =  0x00000010 , */
 741 /* IDL: } */
 742
 743 int
 744 witness_dissect_bitmap_IPaddrInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 745 {
 746         proto_item *item;
 747         static int * const witness_witness_IPaddrInfo_flags_fields[] = {
 748                 &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V4,
 749                 &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V6,
 750                 &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE,
 751                 &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE,
 752                 NULL
 753         };
 754         uint32_t flags;
 755         ALIGN_TO_4_BYTES;
 756
 757         item = proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_index,
 758                                 ett_witness_witness_IPaddrInfo_flags, witness_witness_IPaddrInfo_flags_fields, DREP_ENC_INTEGER(drep), BMT_NO_FALSE);
 759
 760         offset = dissect_ndr_uint32(tvb, offset, pinfo, parent_tree, di, drep, -1, &flags);
 761
 762         if (!flags)
 763                 proto_item_append_text(item, ": (No values set)");
 764
 765         if (flags & (~0x0000001b)) {
 766                 flags &= (~0x0000001b);
 767                 proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);
 768         }
 769
 770         return offset;
 771 }
 772
 773
 774 /* IDL: struct { */
 775 /* IDL:         witness_IPaddrInfo_flags flags; */
 776 /* IDL:         ipv4address ipv4; */
 777 /* IDL:         ipv6address ipv6; */
 778 /* IDL: } */
 779
 780 static int
 781 witness_dissect_element_IPaddrInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 782 {
 783         offset = witness_dissect_bitmap_IPaddrInfo_flags(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfo_flags, 0);
 784
 785         return offset;
 786 }
 787
 788 static int
 789 witness_dissect_element_IPaddrInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 790 {
 791         offset=PIDL_dissect_ipv4address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfo_ipv4, PIDL_SET_COL_INFO);
 792
 793         return offset;
 794 }
 795
 796 static int
 797 witness_dissect_element_IPaddrInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 798 {
 799         offset=PIDL_dissect_ipv6address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfo_ipv6, PIDL_SET_COL_INFO);
 800
 801         return offset;
 802 }
 803
 804 int
 805 witness_dissect_struct_IPaddrInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 806 {
 807         proto_item *item = NULL;
 808         proto_tree *tree = NULL;
 809         bool oldalign = di->no_align;
 810         int old_offset;
 811
 812         di->no_align = true;
 813
 814         old_offset = offset;
 815
 816         if (parent_tree) {
 817                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 818                 tree = proto_item_add_subtree(item, ett_witness_witness_IPaddrInfo);
 819         }
 820
 821         offset = witness_dissect_element_IPaddrInfo_flags(tvb, offset, pinfo, tree, di, drep);
 822
 823         offset = witness_dissect_element_IPaddrInfo_ipv4(tvb, offset, pinfo, tree, di, drep);
 824
 825         offset = witness_dissect_element_IPaddrInfo_ipv6(tvb, offset, pinfo, tree, di, drep);
 826
 827
 828         proto_item_set_len(item, offset-old_offset);
 829
 830
 831         di->no_align = oldalign;
 832
 833         return offset;
 834 }
 835
 836
 837 /* IDL: struct { */
 838 /* IDL:         [value(r->num*ndr_size_witness_IPaddrInfo(r->addr,ndr->flags))] uint32 length; */
 839 /* IDL:         [value(0)] uint32 reserved; */
 840 /* IDL:         uint32 num; */
 841 /* IDL:         witness_IPaddrInfo addr[num]; */
 842 /* IDL: } */
 843
 844 static int
 845 witness_dissect_element_IPaddrInfoList_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 846 {
 847         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfoList_length, 0);
 848
 849         return offset;
 850 }
 851
 852 static int
 853 witness_dissect_element_IPaddrInfoList_reserved(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 854 {
 855         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfoList_reserved, 0);
 856
 857         return offset;
 858 }
 859
 860 static int
 861 witness_dissect_element_IPaddrInfoList_num(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 862 {
 863         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_IPaddrInfoList_num, 0);
 864
 865         return offset;
 866 }
 867
 868
 869 /* IDL: [flag(LIBNDR_FLAG_NOALIGN|LIBNDR_FLAG_LITTLE_ENDIAN)] [nodiscriminant(1)] [public(1)] [switch_type(witness_notifyResponse_type)] union { */
 870 /* IDL: [case(WITNESS_NOTIFY_RESOURCE_CHANGE)] [case(WITNESS_NOTIFY_RESOURCE_CHANGE)] witness_ResourceChange resource_change; */
 871 /* IDL: [case(WITNESS_NOTIFY_CLIENT_MOVE)] [case(WITNESS_NOTIFY_CLIENT_MOVE)] witness_IPaddrInfoList client_move; */
 872 /* IDL: [case(WITNESS_NOTIFY_SHARE_MOVE)] [case(WITNESS_NOTIFY_SHARE_MOVE)] witness_IPaddrInfoList share_move; */
 873 /* IDL: [case(WITNESS_NOTIFY_IP_CHANGE)] [case(WITNESS_NOTIFY_IP_CHANGE)] witness_IPaddrInfoList ip_change; */
 874 /* IDL: [default] ; */
 875 /* IDL: } */
 876
 877 static int
 878 witness_dissect_element_notifyResponse_message_resource_change(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 879 {
 880         offset = witness_dissect_struct_ResourceChange(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_notifyResponse_message_resource_change,0);
 881
 882         return offset;
 883 }
 884
 885 static int
 886 witness_dissect_element_notifyResponse_message_client_move(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 887 {
 888         offset = witness_dissect_struct_IPaddrInfoList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_notifyResponse_message_client_move,0);
 889
 890         return offset;
 891 }
 892
 893 static int
 894 witness_dissect_element_notifyResponse_message_share_move(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 895 {
 896         offset = witness_dissect_struct_IPaddrInfoList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_notifyResponse_message_share_move,0);
 897
 898         return offset;
 899 }
 900
 901 static int
 902 witness_dissect_element_notifyResponse_message_ip_change(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 903 {
 904         offset = witness_dissect_struct_IPaddrInfoList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_notifyResponse_message_ip_change,0);
 905
 906         return offset;
 907 }
 908
 909 static int
 910 witness_dissect_element_notifyResponse_message_data(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 911 {
 912         offset = dissect_ndr_datablob(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_message_data, 1);
 913
 914         return offset;
 915 }
 916
 917 static int
 918 witness_dissect_notifyResponse_message(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 919 {
 920         proto_item *item = NULL;
 921         proto_tree *tree = NULL;
 922         int old_offset;
 923         uint32_t level = param;
 924
 925         old_offset = offset;
 926         if (parent_tree) {
 927                 tree = proto_tree_add_subtree(parent_tree, tvb, offset, -1, ett_witness_witness_notifyResponse_message, &item, "witness_notifyResponse_message");
 928         }
 929
 930         switch(level) {
 931                 case WITNESS_NOTIFY_RESOURCE_CHANGE:
 932                         offset = witness_dissect_element_notifyResponse_message_resource_change(tvb, offset, pinfo, tree, di, drep);
 933                 break;
 934
 935                 case WITNESS_NOTIFY_CLIENT_MOVE:
 936                         offset = witness_dissect_element_notifyResponse_message_client_move(tvb, offset, pinfo, tree, di, drep);
 937                 break;
 938
 939                 case WITNESS_NOTIFY_SHARE_MOVE:
 940                         offset = witness_dissect_element_notifyResponse_message_share_move(tvb, offset, pinfo, tree, di, drep);
 941                 break;
 942
 943                 case WITNESS_NOTIFY_IP_CHANGE:
 944                         offset = witness_dissect_element_notifyResponse_message_ip_change(tvb, offset, pinfo, tree, di, drep);
 945                 break;
 946
 947                 default:
 948                         offset = witness_dissect_element_notifyResponse_message_data(tvb, offset, pinfo, tree, di, drep);
 949                 break;
 950         }
 951         proto_item_set_len(item, offset-old_offset);
 952
 953
 954         return offset;
 955 }
 956
 957 /* IDL: struct { */
 958 /* IDL:         witness_notifyResponse_type type; */
 959 /* IDL:         [value(ndr_size_witness_notifyResponse(r,ndr->flags)-20)] uint32 length; */
 960 /* IDL:         uint32 num; */
 961 /* IDL:         [flag(LIBNDR_FLAG_REMAINING)] [subcontext(4)] [subcontext_size(length)] [switch_is(type)] witness_notifyResponse_message messages[num]; */
 962 /* IDL: } */
 963
 964 static int
 965 witness_dissect_element_notifyResponse_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, uint32_t *type)
 966 {
 967         offset = witness_dissect_enum_notifyResponse_type(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_type, type);
 968
 969         return offset;
 970 }
 971
 972 static int
 973 witness_dissect_element_notifyResponse_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 974 {
 975         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_length, 0);
 976
 977         return offset;
 978 }
 979
 980 static int
 981 witness_dissect_element_notifyResponse_num(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
 982 {
 983         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_num, 0);
 984
 985         return offset;
 986 }
 987
 988
 989 /* IDL: bitmap { */
 990 /* IDL:         WITNESS_REGISTER_NONE =  0x00000000 , */
 991 /* IDL:         WITNESS_REGISTER_IP_NOTIFICATION =  0x00000001 , */
 992 /* IDL: } */
 993
 994 int
 995 witness_dissect_bitmap_RegisterEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_, int hf_index _U_, uint32_t param _U_)
 996 {
 997         proto_item *item;
 998         static int * const witness_witness_RegisterEx_flags_fields[] = {
 999                 &hf_witness_witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION,
1000                 NULL
1001         };
1002         uint32_t flags;
1003         ALIGN_TO_4_BYTES;
1004
1005         item = proto_tree_add_bitmask_with_flags(parent_tree, tvb, offset, hf_index,
1006                                 ett_witness_witness_RegisterEx_flags, witness_witness_RegisterEx_flags_fields, DREP_ENC_INTEGER(drep), BMT_NO_FALSE);
1007
1008         offset = dissect_ndr_uint32(tvb, offset, pinfo, parent_tree, di, drep, -1, &flags);
1009
1010         if (!flags)
1011                 proto_item_append_text(item, ": (No values set)");
1012
1013         if (flags & (~0x00000001)) {
1014                 flags &= (~0x00000001);
1015                 proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);
1016         }
1017
1018         return offset;
1019 }
1020
1021 static int
1022 witness_dissect_element_GetInterfaceList_interface_list(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1023 {
1024         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_GetInterfaceList_interface_list_, NDR_POINTER_REF, "Pointer to Interface List (witness_interfaceList)",hf_witness_witness_GetInterfaceList_interface_list);
1025
1026         return offset;
1027 }
1028
1029 static int
1030 witness_dissect_element_GetInterfaceList_interface_list_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1031 {
1032         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_GetInterfaceList_interface_list__, NDR_POINTER_UNIQUE, "Pointer to Interface List (witness_interfaceList)",hf_witness_witness_GetInterfaceList_interface_list);
1033
1034         return offset;
1035 }
1036
1037 static int
1038 witness_dissect_element_GetInterfaceList_interface_list__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1039 {
1040         offset = witness_dissect_struct_interfaceList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_GetInterfaceList_interface_list,0);
1041
1042         return offset;
1043 }
1044
1045 /* IDL: WERROR witness_GetInterfaceList( */
1046 /* IDL: [out] [ref] witness_interfaceList **interface_list */
1047 /* IDL: ); */
1048
1049 static int
1050 witness_dissect_GetInterfaceList_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1051 {
1052         uint32_t status;
1053
1054         di->dcerpc_procedure_name="GetInterfaceList";
1055         offset = witness_dissect_element_GetInterfaceList_interface_list(tvb, offset, pinfo, tree, di, drep);
1056         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1057
1058         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1059
1060         if (status != 0)
1061                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1062
1063         return offset;
1064 }
1065
1066 static int
1067 witness_dissect_GetInterfaceList_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1068 {
1069         di->dcerpc_procedure_name="GetInterfaceList";
1070         return offset;
1071 }
1072
1073 static int
1074 witness_dissect_element_Register_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1075 {
1076         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_context_handle_, NDR_POINTER_REF, "Pointer to Context Handle (policy_handle)",hf_witness_witness_Register_context_handle);
1077
1078         return offset;
1079 }
1080
1081 static int
1082 witness_dissect_element_Register_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1083 {
1084         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_Register_context_handle, 0);
1085
1086         return offset;
1087 }
1088
1089 static int
1090 witness_dissect_element_Register_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1091 {
1092         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_Register_version, 0);
1093
1094         return offset;
1095 }
1096
1097 static int
1098 witness_dissect_element_Register_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1099 {
1100         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_net_name_, NDR_POINTER_UNIQUE, "Pointer to Net Name (uint16)",hf_witness_witness_Register_net_name);
1101
1102         return offset;
1103 }
1104
1105 static int
1106 witness_dissect_element_Register_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1107 {
1108         char *data;
1109
1110         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_Register_net_name, false, &data);
1111         proto_item_append_text(tree, ": %s", data);
1112
1113         return offset;
1114 }
1115
1116 static int
1117 witness_dissect_element_Register_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1118 {
1119         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_ip_address_, NDR_POINTER_UNIQUE, "Pointer to Ip Address (uint16)",hf_witness_witness_Register_ip_address);
1120
1121         return offset;
1122 }
1123
1124 static int
1125 witness_dissect_element_Register_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1126 {
1127         char *data;
1128
1129         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_Register_ip_address, false, &data);
1130         proto_item_append_text(tree, ": %s", data);
1131
1132         return offset;
1133 }
1134
1135 static int
1136 witness_dissect_element_Register_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1137 {
1138         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_client_computer_name_, NDR_POINTER_UNIQUE, "Pointer to Client Computer Name (uint16)",hf_witness_witness_Register_client_computer_name);
1139
1140         return offset;
1141 }
1142
1143 static int
1144 witness_dissect_element_Register_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1145 {
1146         char *data;
1147
1148         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_Register_client_computer_name, false, &data);
1149         proto_item_append_text(tree, ": %s", data);
1150
1151         return offset;
1152 }
1153
1154 /* IDL: WERROR witness_Register( */
1155 /* IDL: [out] [ref] policy_handle *context_handle, */
1156 /* IDL: [in] witness_version version, */
1157 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *net_name, */
1158 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *ip_address, */
1159 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *client_computer_name */
1160 /* IDL: ); */
1161
1162 static int
1163 witness_dissect_Register_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1164 {
1165         uint32_t status;
1166
1167         di->dcerpc_procedure_name="Register";
1168         offset = witness_dissect_element_Register_context_handle(tvb, offset, pinfo, tree, di, drep);
1169         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1170
1171         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1172
1173         if (status != 0)
1174                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1175
1176         return offset;
1177 }
1178
1179 static int
1180 witness_dissect_Register_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1181 {
1182         di->dcerpc_procedure_name="Register";
1183         offset = witness_dissect_element_Register_version(tvb, offset, pinfo, tree, di, drep);
1184         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1185         offset = witness_dissect_element_Register_net_name(tvb, offset, pinfo, tree, di, drep);
1186         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1187         offset = witness_dissect_element_Register_ip_address(tvb, offset, pinfo, tree, di, drep);
1188         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1189         offset = witness_dissect_element_Register_client_computer_name(tvb, offset, pinfo, tree, di, drep);
1190         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1191         return offset;
1192 }
1193
1194 static int
1195 witness_dissect_element_UnRegister_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1196 {
1197         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_UnRegister_context_handle, 0);
1198
1199         return offset;
1200 }
1201
1202 /* IDL: WERROR witness_UnRegister( */
1203 /* IDL: [in] policy_handle context_handle */
1204 /* IDL: ); */
1205
1206 static int
1207 witness_dissect_UnRegister_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1208 {
1209         uint32_t status;
1210
1211         di->dcerpc_procedure_name="UnRegister";
1212         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1213
1214         if (status != 0)
1215                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1216
1217         return offset;
1218 }
1219
1220 static int
1221 witness_dissect_UnRegister_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1222 {
1223         di->dcerpc_procedure_name="UnRegister";
1224         offset = witness_dissect_element_UnRegister_context_handle(tvb, offset, pinfo, tree, di, drep);
1225         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1226         return offset;
1227 }
1228
1229 static int
1230 witness_dissect_element_AsyncNotify_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1231 {
1232         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_AsyncNotify_context_handle, 0);
1233
1234         return offset;
1235 }
1236
1237 static int
1238 witness_dissect_element_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1239 {
1240         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_AsyncNotify_response_, NDR_POINTER_REF, "Pointer to Response (witness_notifyResponse)",hf_witness_witness_AsyncNotify_response);
1241
1242         return offset;
1243 }
1244
1245 static int
1246 witness_dissect_element_AsyncNotify_response_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1247 {
1248         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_AsyncNotify_response__, NDR_POINTER_UNIQUE, "Pointer to Response (witness_notifyResponse)",hf_witness_witness_AsyncNotify_response);
1249
1250         return offset;
1251 }
1252
1253 static int
1254 witness_dissect_element_AsyncNotify_response__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1255 {
1256         offset = witness_dissect_struct_notifyResponse(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_AsyncNotify_response,0);
1257
1258         return offset;
1259 }
1260
1261 /* IDL: WERROR witness_AsyncNotify( */
1262 /* IDL: [in] policy_handle context_handle, */
1263 /* IDL: [out] [ref] witness_notifyResponse **response */
1264 /* IDL: ); */
1265
1266 static int
1267 witness_dissect_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1268 {
1269         uint32_t status;
1270
1271         di->dcerpc_procedure_name="AsyncNotify";
1272         offset = witness_dissect_element_AsyncNotify_response(tvb, offset, pinfo, tree, di, drep);
1273         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1274
1275         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1276
1277         if (status != 0)
1278                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1279
1280         return offset;
1281 }
1282
1283 static int
1284 witness_dissect_AsyncNotify_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1285 {
1286         di->dcerpc_procedure_name="AsyncNotify";
1287         offset = witness_dissect_element_AsyncNotify_context_handle(tvb, offset, pinfo, tree, di, drep);
1288         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1289         return offset;
1290 }
1291
1292 static int
1293 witness_dissect_element_RegisterEx_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1294 {
1295         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_context_handle_, NDR_POINTER_REF, "Pointer to Context Handle (policy_handle)",hf_witness_witness_RegisterEx_context_handle);
1296
1297         return offset;
1298 }
1299
1300 static int
1301 witness_dissect_element_RegisterEx_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1302 {
1303         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_context_handle, 0);
1304
1305         return offset;
1306 }
1307
1308 static int
1309 witness_dissect_element_RegisterEx_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1310 {
1311         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_version, 0);
1312
1313         return offset;
1314 }
1315
1316 static int
1317 witness_dissect_element_RegisterEx_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1318 {
1319         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_net_name_, NDR_POINTER_UNIQUE, "Pointer to Net Name (uint16)",hf_witness_witness_RegisterEx_net_name);
1320
1321         return offset;
1322 }
1323
1324 static int
1325 witness_dissect_element_RegisterEx_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1326 {
1327         char *data;
1328
1329         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_RegisterEx_net_name, false, &data);
1330         proto_item_append_text(tree, ": %s", data);
1331
1332         return offset;
1333 }
1334
1335 static int
1336 witness_dissect_element_RegisterEx_share_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1337 {
1338         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_share_name_, NDR_POINTER_UNIQUE, "Pointer to Share Name (uint16)",hf_witness_witness_RegisterEx_share_name);
1339
1340         return offset;
1341 }
1342
1343 static int
1344 witness_dissect_element_RegisterEx_share_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1345 {
1346         char *data;
1347
1348         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_RegisterEx_share_name, false, &data);
1349         proto_item_append_text(tree, ": %s", data);
1350
1351         return offset;
1352 }
1353
1354 static int
1355 witness_dissect_element_RegisterEx_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1356 {
1357         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_ip_address_, NDR_POINTER_UNIQUE, "Pointer to Ip Address (uint16)",hf_witness_witness_RegisterEx_ip_address);
1358
1359         return offset;
1360 }
1361
1362 static int
1363 witness_dissect_element_RegisterEx_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1364 {
1365         char *data;
1366
1367         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_RegisterEx_ip_address, false, &data);
1368         proto_item_append_text(tree, ": %s", data);
1369
1370         return offset;
1371 }
1372
1373 static int
1374 witness_dissect_element_RegisterEx_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1375 {
1376         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_client_computer_name_, NDR_POINTER_UNIQUE, "Pointer to Client Computer Name (uint16)",hf_witness_witness_RegisterEx_client_computer_name);
1377
1378         return offset;
1379 }
1380
1381 static int
1382 witness_dissect_element_RegisterEx_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1383 {
1384         char *data;
1385
1386         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(uint16_t), hf_witness_witness_RegisterEx_client_computer_name, false, &data);
1387         proto_item_append_text(tree, ": %s", data);
1388
1389         return offset;
1390 }
1391
1392 static int
1393 witness_dissect_element_RegisterEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1394 {
1395         offset = witness_dissect_bitmap_RegisterEx_flags(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_flags, 0);
1396
1397         return offset;
1398 }
1399
1400 static int
1401 witness_dissect_element_RegisterEx_timeout(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1402 {
1403         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_timeout, 0);
1404
1405         return offset;
1406 }
1407
1408 /* IDL: WERROR witness_RegisterEx( */
1409 /* IDL: [out] [ref] policy_handle *context_handle, */
1410 /* IDL: [in] witness_version version, */
1411 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *net_name, */
1412 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *share_name, */
1413 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *ip_address, */
1414 /* IDL: [charset(UTF16)] [in] [unique(1)] uint16 *client_computer_name, */
1415 /* IDL: [in] witness_RegisterEx_flags flags, */
1416 /* IDL: [in] uint32 timeout */
1417 /* IDL: ); */
1418
1419 static int
1420 witness_dissect_RegisterEx_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1421 {
1422         uint32_t status;
1423
1424         di->dcerpc_procedure_name="RegisterEx";
1425         offset = witness_dissect_element_RegisterEx_context_handle(tvb, offset, pinfo, tree, di, drep);
1426         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1427
1428         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
1429
1430         if (status != 0)
1431                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str_ext(status, &WERR_errors_ext, "Unknown DOS error 0x%08x"));
1432
1433         return offset;
1434 }
1435
1436 static int
1437 witness_dissect_RegisterEx_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, uint8_t *drep _U_)
1438 {
1439         di->dcerpc_procedure_name="RegisterEx";
1440         offset = witness_dissect_element_RegisterEx_version(tvb, offset, pinfo, tree, di, drep);
1441         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1442         offset = witness_dissect_element_RegisterEx_net_name(tvb, offset, pinfo, tree, di, drep);
1443         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1444         offset = witness_dissect_element_RegisterEx_share_name(tvb, offset, pinfo, tree, di, drep);
1445         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1446         offset = witness_dissect_element_RegisterEx_ip_address(tvb, offset, pinfo, tree, di, drep);
1447         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1448         offset = witness_dissect_element_RegisterEx_client_computer_name(tvb, offset, pinfo, tree, di, drep);
1449         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1450         offset = witness_dissect_element_RegisterEx_flags(tvb, offset, pinfo, tree, di, drep);
1451         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1452         offset = witness_dissect_element_RegisterEx_timeout(tvb, offset, pinfo, tree, di, drep);
1453         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
1454         return offset;
1455 }
1456
1457
1458 static const dcerpc_sub_dissector witness_dissectors[] = {
1459         { 0, "GetInterfaceList",
1460            witness_dissect_GetInterfaceList_request, witness_dissect_GetInterfaceList_response},
1461         { 1, "Register",
1462            witness_dissect_Register_request, witness_dissect_Register_response},
1463         { 2, "UnRegister",
1464            witness_dissect_UnRegister_request, witness_dissect_UnRegister_response},
1465         { 3, "AsyncNotify",
1466            witness_dissect_AsyncNotify_request, witness_dissect_AsyncNotify_response},
1467         { 4, "RegisterEx",
1468            witness_dissect_RegisterEx_request, witness_dissect_RegisterEx_response},
1469         { 0, NULL, NULL, NULL }
1470 };
1471
1472 void proto_register_dcerpc_witness(void)
1473 {
1474         static hf_register_info hf[] = {
1475         { &hf_witness_opnum,
1476           { "Operation", "witness.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
1477         { &hf_witness_werror,
1478           { "Windows Error", "witness.werror", FT_UINT32, BASE_HEX|BASE_EXT_STRING, &WERR_errors_ext, 0, NULL, HFILL }},
1479         { &hf_witness_witness_AsyncNotify_context_handle,
1480           { "Context Handle", "witness.witness_AsyncNotify.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
1481         { &hf_witness_witness_AsyncNotify_response,
1482           { "Response", "witness.witness_AsyncNotify.response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1483         { &hf_witness_witness_GetInterfaceList_interface_list,
1484           { "Interface List", "witness.witness_GetInterfaceList.interface_list", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1485         { &hf_witness_witness_IPaddrInfoList_addr,
1486           { "Addr", "witness.witness_IPaddrInfoList.addr", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1487         { &hf_witness_witness_IPaddrInfoList_length,
1488           { "Length", "witness.witness_IPaddrInfoList.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1489         { &hf_witness_witness_IPaddrInfoList_num,
1490           { "Num", "witness.witness_IPaddrInfoList.num", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1491         { &hf_witness_witness_IPaddrInfoList_reserved,
1492           { "Reserved", "witness.witness_IPaddrInfoList.reserved", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1493         { &hf_witness_witness_IPaddrInfo_flags,
1494           { "Flags", "witness.witness_IPaddrInfo.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
1495         { &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE,
1496           { "WITNESS IPADDR OFFLINE", "witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_OFFLINE", FT_BOOLEAN, 32, TFS(&witness_IPaddrInfo_flags_WITNESS_IPADDR_OFFLINE_tfs), ( 0x00000010 ), NULL, HFILL }},
1497         { &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE,
1498           { "WITNESS IPADDR ONLINE", "witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_ONLINE", FT_BOOLEAN, 32, TFS(&witness_IPaddrInfo_flags_WITNESS_IPADDR_ONLINE_tfs), ( 0x00000008 ), NULL, HFILL }},
1499         { &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V4,
1500           { "WITNESS IPADDR V4", "witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V4", FT_BOOLEAN, 32, TFS(&witness_IPaddrInfo_flags_WITNESS_IPADDR_V4_tfs), ( 0x00000001 ), NULL, HFILL }},
1501         { &hf_witness_witness_IPaddrInfo_flags_WITNESS_IPADDR_V6,
1502           { "WITNESS IPADDR V6", "witness.witness_IPaddrInfo_flags.WITNESS_IPADDR_V6", FT_BOOLEAN, 32, TFS(&witness_IPaddrInfo_flags_WITNESS_IPADDR_V6_tfs), ( 0x00000002 ), NULL, HFILL }},
1503         { &hf_witness_witness_IPaddrInfo_ipv4,
1504           { "Ipv4", "witness.witness_IPaddrInfo.ipv4", FT_IPv4, BASE_NONE, NULL, 0, NULL, HFILL }},
1505         { &hf_witness_witness_IPaddrInfo_ipv6,
1506           { "Ipv6", "witness.witness_IPaddrInfo.ipv6", FT_IPv6, BASE_NONE, NULL, 0, NULL, HFILL }},
1507         { &hf_witness_witness_RegisterEx_client_computer_name,
1508           { "Client Computer Name", "witness.witness_RegisterEx.client_computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1509         { &hf_witness_witness_RegisterEx_context_handle,
1510           { "Context Handle", "witness.witness_RegisterEx.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
1511         { &hf_witness_witness_RegisterEx_flags,
1512           { "Flags", "witness.witness_RegisterEx.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
1513         { &hf_witness_witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION,
1514           { "WITNESS REGISTER IP NOTIFICATION", "witness.witness_RegisterEx_flags.WITNESS_REGISTER_IP_NOTIFICATION", FT_BOOLEAN, 32, TFS(&witness_RegisterEx_flags_WITNESS_REGISTER_IP_NOTIFICATION_tfs), ( 0x00000001 ), NULL, HFILL }},
1515         { &hf_witness_witness_RegisterEx_ip_address,
1516           { "Ip Address", "witness.witness_RegisterEx.ip_address", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1517         { &hf_witness_witness_RegisterEx_net_name,
1518           { "Net Name", "witness.witness_RegisterEx.net_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1519         { &hf_witness_witness_RegisterEx_share_name,
1520           { "Share Name", "witness.witness_RegisterEx.share_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1521         { &hf_witness_witness_RegisterEx_timeout,
1522           { "Timeout", "witness.witness_RegisterEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1523         { &hf_witness_witness_RegisterEx_version,
1524           { "Version", "witness.witness_RegisterEx.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
1525         { &hf_witness_witness_Register_client_computer_name,
1526           { "Client Computer Name", "witness.witness_Register.client_computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1527         { &hf_witness_witness_Register_context_handle,
1528           { "Context Handle", "witness.witness_Register.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
1529         { &hf_witness_witness_Register_ip_address,
1530           { "Ip Address", "witness.witness_Register.ip_address", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1531         { &hf_witness_witness_Register_net_name,
1532           { "Net Name", "witness.witness_Register.net_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1533         { &hf_witness_witness_Register_version,
1534           { "Version", "witness.witness_Register.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
1535         { &hf_witness_witness_ResourceChange_length,
1536           { "Length", "witness.witness_ResourceChange.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1537         { &hf_witness_witness_ResourceChange_name,
1538           { "Name", "witness.witness_ResourceChange.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1539         { &hf_witness_witness_ResourceChange_type,
1540           { "Type", "witness.witness_ResourceChange.type", FT_UINT32, BASE_DEC, VALS(witness_witness_ResourceChange_type_vals), 0, NULL, HFILL }},
1541         { &hf_witness_witness_UnRegister_context_handle,
1542           { "Context Handle", "witness.witness_UnRegister.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
1543         { &hf_witness_witness_interfaceInfo_flags,
1544           { "Flags", "witness.witness_interfaceInfo.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
1545         { &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID,
1546           { "WITNESS INFO IPv4 VALID", "witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv4_VALID", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_WITNESS_INFO_IPv4_VALID_tfs), ( 0x00000001 ), NULL, HFILL }},
1547         { &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID,
1548           { "WITNESS INFO IPv6 VALID", "witness.witness_interfaceInfo_flags.WITNESS_INFO_IPv6_VALID", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_WITNESS_INFO_IPv6_VALID_tfs), ( 0x00000002 ), NULL, HFILL }},
1549         { &hf_witness_witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF,
1550           { "WITNESS INFO WITNESS IF", "witness.witness_interfaceInfo_flags.WITNESS_INFO_WITNESS_IF", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_WITNESS_INFO_WITNESS_IF_tfs), ( 0x00000004 ), NULL, HFILL }},
1551         { &hf_witness_witness_interfaceInfo_group_name,
1552           { "Group Name", "witness.witness_interfaceInfo.group_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1553         { &hf_witness_witness_interfaceInfo_ipv4,
1554           { "Ipv4", "witness.witness_interfaceInfo.ipv4", FT_IPv4, BASE_NONE, NULL, 0, NULL, HFILL }},
1555         { &hf_witness_witness_interfaceInfo_ipv6,
1556           { "Ipv6", "witness.witness_interfaceInfo.ipv6", FT_IPv6, BASE_NONE, NULL, 0, NULL, HFILL }},
1557         { &hf_witness_witness_interfaceInfo_state,
1558           { "State", "witness.witness_interfaceInfo.state", FT_UINT16, BASE_DEC, VALS(witness_witness_interfaceInfo_state_vals), 0, NULL, HFILL }},
1559         { &hf_witness_witness_interfaceInfo_version,
1560           { "Version", "witness.witness_interfaceInfo.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
1561         { &hf_witness_witness_interfaceList_interfaces,
1562           { "Interfaces", "witness.witness_interfaceList.interfaces", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1563         { &hf_witness_witness_interfaceList_num_interfaces,
1564           { "Num Interfaces", "witness.witness_interfaceList.num_interfaces", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1565         { &hf_witness_witness_notifyResponse_length,
1566           { "Length", "witness.witness_notifyResponse.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1567         { &hf_witness_witness_notifyResponse_message_client_move,
1568           { "Client Move", "witness.witness_notifyResponse_message.client_move", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1569         { &hf_witness_witness_notifyResponse_message_data,
1570           { "Data", "witness.witness_notifyResponse_message.data", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1571         { &hf_witness_witness_notifyResponse_message_ip_change,
1572           { "Ip Change", "witness.witness_notifyResponse_message.ip_change", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1573         { &hf_witness_witness_notifyResponse_message_resource_change,
1574           { "Resource Change", "witness.witness_notifyResponse_message.resource_change", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1575         { &hf_witness_witness_notifyResponse_message_share_move,
1576           { "Share Move", "witness.witness_notifyResponse_message.share_move", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1577         { &hf_witness_witness_notifyResponse_messages,
1578           { "Messages", "witness.witness_notifyResponse.messages", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1579         { &hf_witness_witness_notifyResponse_messages_,
1580           { "Messages", "witness.witness_notifyResponse.messages_", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1581         { &hf_witness_witness_notifyResponse_num,
1582           { "Num", "witness.witness_notifyResponse.num", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1583         { &hf_witness_witness_notifyResponse_type,
1584           { "Type", "witness.witness_notifyResponse.type", FT_UINT32, BASE_DEC, VALS(witness_witness_notifyResponse_type_vals), 0, NULL, HFILL }},
1585         };
1586
1587
1588         static int *ett[] = {
1589                 &ett_dcerpc_witness,
1590                 &ett_witness_witness_interfaceInfo_flags,
1591                 &ett_witness_witness_interfaceInfo,
1592                 &ett_witness_witness_interfaceList,
1593                 &ett_witness_witness_ResourceChange,
1594                 &ett_witness_witness_IPaddrInfo_flags,
1595                 &ett_witness_witness_IPaddrInfo,
1596                 &ett_witness_witness_IPaddrInfoList,
1597                 &ett_witness_witness_notifyResponse_message,
1598                 &ett_witness_witness_notifyResponse,
1599                 &ett_witness_witness_RegisterEx_flags,
1600         };
1601
1602         proto_dcerpc_witness = proto_register_protocol("SMB Witness Service", "WITNESS", "witness");
1603         proto_register_field_array(proto_dcerpc_witness, hf, array_length (hf));
1604         proto_register_subtree_array(ett, array_length(ett));
1605 }
1606
1607 void proto_reg_handoff_dcerpc_witness(void)
1608 {
1609         dcerpc_init_uuid(proto_dcerpc_witness, ett_dcerpc_witness,
1610                 &uuid_dcerpc_witness, ver_dcerpc_witness,
1611                 witness_dissectors, hf_witness_opnum);
1612 }