epan/dissectors/packet-dcerpc-witness.c

   1 /* DO NOT EDIT
   2         This filter was automatically generated
   3         from pidl/witness.idl and pidl/witness.cnf.
   4
   5         Pidl is a perl based IDL compiler for DCE/RPC idl files.
   6         It is maintained by the Samba team, not the Wireshark team.
   7         Instructions on how to download and install Pidl can be
   8         found at http://wiki.wireshark.org/Pidl
   9
  10         $Id$
  11 */
  12
  13
  14 #include "config.h"
  15 #ifdef _MSC_VER
  16 #pragma warning(disable:4005)
  17 #pragma warning(disable:4013)
  18 #pragma warning(disable:4018)
  19 #pragma warning(disable:4101)
  20 #endif
  21
  22 #include <glib.h>
  23 #include <string.h>
  24 #include <epan/packet.h>
  25
  26 #include "packet-dcerpc.h"
  27 #include "packet-dcerpc-nt.h"
  28 #include "packet-windows-common.h"
  29 #include "packet-dcerpc-witness.h"
  30
  31 /* Ett declarations */
  32 static gint ett_witness_move_ipaddr_list_flags = -1;
  33 static gint ett_witness_move_ipaddr = -1;
  34 static gint ett_message_buffer = -1;
  35 static gint ett_dcerpc_witness = -1;
  36 static gint ett_witness_witness_interfaceInfo_flags = -1;
  37 static gint ett_witness_witness_interfaceInfo = -1;
  38 static gint ett_witness_witness_interfaceList = -1;
  39 static gint ett_witness_witness_notifyResponse = -1;
  40
  41
  42 /* Header field declarations */
  43 static gint hf_witness_move_ipaddr_list_flags = -1;
  44 static gint hf_witness_witness_RegisterEx_context_handle = -1;
  45 static gint hf_witness_witness_notifyResponse_num_messages = -1;
  46 static gint hf_witness_witness_notifyResponse_message_type = -1;
  47 static gint hf_witness_witness_RegisterEx_flags = -1;
  48 static gint hf_witness_werror = -1;
  49 static gint hf_witness_witness_Register_version = -1;
  50 static gint hf_witness_witness_Register_client_computer_name = -1;
  51 static gint hf_witness_witness_interfaceList_num_interfaces = -1;
  52 static gint hf_witness_context_handle = -1;
  53 static gint hf_witness_witness_interfaceList_interfaces = -1;
  54 static gint hf_witness_move_ipaddr_list_ipv6 = -1;
  55 static gint hf_witness_witness_AsyncNotify_response = -1;
  56 static gint hf_witness_witness_RegisterEx_ip_address = -1;
  57 static gint hf_witness_opnum = -1;
  58 static gint hf_witness_witness_interfaceInfo_version = -1;
  59 static gint hf_witness_change_type = -1;
  60 static gint hf_witness_move_ipaddr_list_flags_ipv4 = -1;
  61 static gint hf_dcerpc_array_max_count = -1;
  62 static gint hf_witness_witness_interfaceInfo_flags_WITNESS_IF = -1;
  63 static gint hf_witness_witness_RegisterEx_version = -1;
  64 static gint hf_witness_witness_interfaceInfo_group_name = -1;
  65 static gint hf_witness_witness_RegisterEx_timeout = -1;
  66 static gint hf_witness_witness_interfaceInfo_flags_IPv6_VALID = -1;
  67 static gint hf_witness_move_ipaddr_list_flags_ipv6 = -1;
  68 static gint hf_witness_witness_interfaceInfo_flags_IPv4_VALID = -1;
  69 static gint hf_witness_witness_interfaceInfo_flags = -1;
  70 static gint hf_witness_witness_interfaceInfo_ipv6 = -1;
  71 static gint hf_witness_witness_interfaceInfo_ipv4 = -1;
  72 static gint hf_witness_change_name = -1;
  73 static gint hf_witness_witness_RegisterEx_client_computer_name = -1;
  74 static gint hf_witness_witness_RegisterEx_share_name = -1;
  75 static gint hf_witness_witness_RegisterEx_net_name = -1;
  76 static gint hf_witness_witness_interfaceInfo_state = -1;
  77 static gint hf_witness_witness_notifyResponse_length = -1;
  78 static gint hf_witness_move_ipaddr_list_ipv4 = -1;
  79 static gint hf_witness_witness_notifyResponse_message_buffer = -1;
  80 static gint hf_witness_witness_GetInterfaceList_interface_list = -1;
  81 static gint hf_witness_witness_Register_net_name = -1;
  82 static gint hf_witness_witness_Register_ip_address = -1;
  83
  84 static gint proto_dcerpc_witness = -1;
  85 /* Version information */
  86
  87
  88 static e_uuid_t uuid_dcerpc_witness = {
  89         0xccd8c074, 0xd0e5, 0x4a40,
  90         { 0x92, 0xb4, 0xd0, 0x74, 0xfa, 0xa6, 0xba, 0x28 }
  91 };
  92 static guint16 ver_dcerpc_witness = 1;
  93
  94 const value_string witness_witness_version_vals[] = {
  95         { WITNESS_V1, "WITNESS_V1" },
  96         { WITNESS_V2, "WITNESS_V2" },
  97 { 0, NULL }
  98 };
  99 const value_string witness_witness_interfaceInfo_state_vals[] = {
 100         { UNKNOWN, "UNKNOWN" },
 101         { AVAILABLE, "AVAILABLE" },
 102         { UNAVAILABLE, "UNAVAILABLE" },
 103 { 0, NULL }
 104 };
 105 static const true_false_string witness_interfaceInfo_flags_IPv4_VALID_tfs = {
 106    "IPv4_VALID is SET",
 107    "IPv4_VALID is NOT SET",
 108 };
 109 static const true_false_string witness_interfaceInfo_flags_IPv6_VALID_tfs = {
 110    "IPv6_VALID is SET",
 111    "IPv6_VALID is NOT SET",
 112 };
 113 static const true_false_string witness_interfaceInfo_flags_WITNESS_IF_tfs = {
 114    "WITNESS_IF is SET",
 115    "WITNESS_IF is NOT SET",
 116 };
 117 static int witness_dissect_element_interfaceInfo_group_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 118 static int witness_dissect_element_interfaceInfo_group_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 119 static int witness_dissect_element_interfaceInfo_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 120 static int witness_dissect_element_interfaceInfo_state(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 121 static int witness_dissect_element_interfaceInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 122 static int witness_dissect_element_interfaceInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 123 static int witness_dissect_element_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 124 static int witness_dissect_element_interfaceList_num_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 125 static int witness_dissect_element_interfaceList_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 126 static int witness_dissect_element_interfaceList_interfaces_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 127 static int witness_dissect_element_interfaceList_interfaces__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 128 const value_string witness_witness_notifyResponse_type_vals[] = {
 129         { RESOURCE_CHANGE, "RESOURCE_CHANGE" },
 130         { CLIENT_MOVE, "CLIENT_MOVE" },
 131         { SHARE_MOVE, "SHARE_MOVE" },
 132         { IP_CHANGE, "IP_CHANGE" },
 133 { 0, NULL }
 134 };
 135 static int witness_dissect_element_notifyResponse_message_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 136 static int witness_dissect_element_notifyResponse_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 137 static int witness_dissect_element_notifyResponse_num_messages(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 138 static int witness_dissect_element_notifyResponse_message_buffer(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 139 static int witness_dissect_element_notifyResponse_message_buffer_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 140 static int witness_dissect_element_notifyResponse_message_buffer__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 141 static int witness_dissect_element_GetInterfaceList_interface_list(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 142 static int witness_dissect_element_GetInterfaceList_interface_list_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 143 static int witness_dissect_element_GetInterfaceList_interface_list__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 144 static int witness_dissect_element_Register_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 145 static int witness_dissect_element_Register_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 146 static int witness_dissect_element_Register_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 147 static int witness_dissect_element_Register_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 148 static int witness_dissect_element_Register_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 149 static int witness_dissect_element_Register_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 150 static int witness_dissect_element_Register_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 151 static int witness_dissect_element_Register_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 152 static int witness_dissect_element_Register_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 153 static int witness_dissect_element_UnRegister_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 154 static int witness_dissect_element_AsyncNotify_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 155 static int witness_dissect_element_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 156 static int witness_dissect_element_AsyncNotify_response_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 157 static int witness_dissect_element_AsyncNotify_response__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 158 static int witness_dissect_element_RegisterEx_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 159 static int witness_dissect_element_RegisterEx_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 160 static int witness_dissect_element_RegisterEx_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 161 static int witness_dissect_element_RegisterEx_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 162 static int witness_dissect_element_RegisterEx_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 163 static int witness_dissect_element_RegisterEx_share_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 164 static int witness_dissect_element_RegisterEx_share_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 165 static int witness_dissect_element_RegisterEx_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 166 static int witness_dissect_element_RegisterEx_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 167 static int witness_dissect_element_RegisterEx_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 168 static int witness_dissect_element_RegisterEx_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 169 static int witness_dissect_element_RegisterEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 170 static int witness_dissect_element_RegisterEx_timeout(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_);
 171  #include "packet-dcerpc-witness-cnf.c"
 172
 173
 174 /* IDL: enum { */
 175 /* IDL:         WITNESS_V1=0x00010001, */
 176 /* IDL:         WITNESS_V2=0x00020000, */
 177 /* IDL: } */
 178
 179 int
 180 witness_dissect_enum_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 *param _U_)
 181 {
 182         guint32 parameter=0;
 183         if(param){
 184                 parameter=(guint32)*param;
 185         }
 186         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 187         if(param){
 188                 *param=(guint32)parameter;
 189         }
 190         return offset;
 191 }
 192
 193
 194 /* IDL: enum { */
 195 /* IDL:         UNKNOWN=0x00, */
 196 /* IDL:         AVAILABLE=0x01, */
 197 /* IDL:         UNAVAILABLE=0xff, */
 198 /* IDL: } */
 199
 200
 201 /* IDL: bitmap { */
 202 /* IDL:         IPv4_VALID =  0x01 , */
 203 /* IDL:         IPv6_VALID =  0x02 , */
 204 /* IDL:         WITNESS_IF =  0x04 , */
 205 /* IDL: } */
 206
 207 int
 208 witness_dissect_bitmap_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 209 {
 210         proto_item *item = NULL;
 211         proto_tree *tree = NULL;
 212
 213         guint32 flags;
 214         ALIGN_TO_4_BYTES;
 215
 216         if (parent_tree) {
 217                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, 4, DREP_ENC_INTEGER(drep));
 218                 tree = proto_item_add_subtree(item,ett_witness_witness_interfaceInfo_flags);
 219         }
 220
 221         offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep, -1, &flags);
 222         proto_item_append_text(item, ": ");
 223
 224         if (!flags)
 225                 proto_item_append_text(item, "(No values set)");
 226
 227         proto_tree_add_boolean(tree, hf_witness_witness_interfaceInfo_flags_IPv4_VALID, tvb, offset-4, 4, flags);
 228         if (flags&( 0x01 )){
 229                 proto_item_append_text(item, "IPv4_VALID");
 230                 if (flags & (~( 0x01 )))
 231                         proto_item_append_text(item, ", ");
 232         }
 233         flags&=(~( 0x01 ));
 234
 235         proto_tree_add_boolean(tree, hf_witness_witness_interfaceInfo_flags_IPv6_VALID, tvb, offset-4, 4, flags);
 236         if (flags&( 0x02 )){
 237                 proto_item_append_text(item, "IPv6_VALID");
 238                 if (flags & (~( 0x02 )))
 239                         proto_item_append_text(item, ", ");
 240         }
 241         flags&=(~( 0x02 ));
 242
 243         proto_tree_add_boolean(tree, hf_witness_witness_interfaceInfo_flags_WITNESS_IF, tvb, offset-4, 4, flags);
 244         if (flags&( 0x04 )){
 245                 proto_item_append_text(item, "WITNESS_IF");
 246                 if (flags & (~( 0x04 )))
 247                         proto_item_append_text(item, ", ");
 248         }
 249         flags&=(~( 0x04 ));
 250
 251         if (flags) {
 252                 proto_item_append_text(item, "Unknown bitmap value 0x%x", flags);
 253         }
 254
 255         return offset;
 256 }
 257
 258
 259 /* IDL: struct { */
 260 /* IDL:         [to_null(1)] [charset(UTF16)] uint16 group_name[260]; */
 261 /* IDL:         witness_version version; */
 262 /* IDL:         witness_interfaceInfo_state state; */
 263 /* IDL:         [flag(LIBNDR_FLAG_BIGENDIAN)] ipv4address ipv4; */
 264 /* IDL:         [flag(LIBNDR_FLAG_BIGENDIAN)] ipv6address ipv6; */
 265 /* IDL:         witness_interfaceInfo_flags flags; */
 266 /* IDL: } */
 267
 268 static int
 269 witness_dissect_element_interfaceInfo_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 270 {
 271         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_version, 0);
 272
 273         return offset;
 274 }
 275
 276 static int
 277 witness_dissect_element_interfaceInfo_state(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 278 {
 279         offset = witness_dissect_enum_interfaceInfo_state(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_state, 0);
 280
 281         return offset;
 282 }
 283
 284 static int
 285 witness_dissect_element_interfaceInfo_ipv4(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 286 {
 287         offset=PIDL_dissect_ipv4address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_ipv4, PIDL_SET_COL_INFO);
 288
 289         return offset;
 290 }
 291
 292 static int
 293 witness_dissect_element_interfaceInfo_ipv6(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 294 {
 295         offset=PIDL_dissect_ipv6address(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_ipv6, PIDL_SET_COL_INFO);
 296
 297         return offset;
 298 }
 299
 300 static int
 301 witness_dissect_element_interfaceInfo_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 302 {
 303         offset = witness_dissect_bitmap_interfaceInfo_flags(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceInfo_flags, 0);
 304
 305         return offset;
 306 }
 307
 308 int
 309 witness_dissect_struct_interfaceInfo(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 310 {
 311         proto_item *item = NULL;
 312         proto_tree *tree = NULL;
 313         int old_offset;
 314
 315         ALIGN_TO_4_BYTES;
 316
 317         old_offset = offset;
 318
 319         if (parent_tree) {
 320                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 321                 tree = proto_item_add_subtree(item, ett_witness_witness_interfaceInfo);
 322         }
 323
 324         offset = witness_dissect_element_interfaceInfo_group_name(tvb, offset, pinfo, tree, di, drep);
 325
 326         offset = witness_dissect_element_interfaceInfo_version(tvb, offset, pinfo, tree, di, drep);
 327
 328         offset = witness_dissect_element_interfaceInfo_state(tvb, offset, pinfo, tree, di, drep);
 329
 330         offset = witness_dissect_element_interfaceInfo_ipv4(tvb, offset, pinfo, tree, di, drep);
 331
 332         offset = witness_dissect_element_interfaceInfo_ipv6(tvb, offset, pinfo, tree, di, drep);
 333
 334         offset = witness_dissect_element_interfaceInfo_flags(tvb, offset, pinfo, tree, di, drep);
 335
 336
 337         proto_item_set_len(item, offset-old_offset);
 338
 339
 340         if (di->call_data->flags & DCERPC_IS_NDR64) {
 341                 ALIGN_TO_4_BYTES;
 342         }
 343
 344         return offset;
 345 }
 346
 347
 348 /* IDL: struct { */
 349 /* IDL:         uint32 num_interfaces; */
 350 /* IDL:         [unique(1)] [size_is(num_interfaces)] witness_interfaceInfo *interfaces; */
 351 /* IDL: } */
 352
 353 static int
 354 witness_dissect_element_interfaceList_num_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 355 {
 356         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_interfaceList_num_interfaces, 0);
 357
 358         return offset;
 359 }
 360
 361 static int
 362 witness_dissect_element_interfaceList_interfaces(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 363 {
 364         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_interfaceList_interfaces_, NDR_POINTER_UNIQUE, "Pointer to Interfaces (witness_interfaceInfo)",hf_witness_witness_interfaceList_interfaces);
 365
 366         return offset;
 367 }
 368
 369 static int
 370 witness_dissect_element_interfaceList_interfaces_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 371 {
 372         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_interfaceList_interfaces__);
 373
 374         return offset;
 375 }
 376
 377 static int
 378 witness_dissect_element_interfaceList_interfaces__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 379 {
 380         offset = witness_dissect_struct_interfaceInfo(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_interfaceList_interfaces,0);
 381
 382         return offset;
 383 }
 384
 385 int
 386 witness_dissect_struct_interfaceList(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *parent_tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 param _U_)
 387 {
 388         proto_item *item = NULL;
 389         proto_tree *tree = NULL;
 390         int old_offset;
 391
 392         ALIGN_TO_5_BYTES;
 393
 394         old_offset = offset;
 395
 396         if (parent_tree) {
 397                 item = proto_tree_add_item(parent_tree, hf_index, tvb, offset, -1, ENC_NA);
 398                 tree = proto_item_add_subtree(item, ett_witness_witness_interfaceList);
 399         }
 400
 401         offset = witness_dissect_element_interfaceList_num_interfaces(tvb, offset, pinfo, tree, di, drep);
 402
 403         offset = witness_dissect_element_interfaceList_interfaces(tvb, offset, pinfo, tree, di, drep);
 404
 405
 406         proto_item_set_len(item, offset-old_offset);
 407
 408
 409         if (di->call_data->flags & DCERPC_IS_NDR64) {
 410                 ALIGN_TO_5_BYTES;
 411         }
 412
 413         return offset;
 414 }
 415
 416
 417 /* IDL: enum { */
 418 /* IDL:         RESOURCE_CHANGE=1, */
 419 /* IDL:         CLIENT_MOVE=2, */
 420 /* IDL:         SHARE_MOVE=3, */
 421 /* IDL:         IP_CHANGE=4, */
 422 /* IDL: } */
 423
 424 int
 425 witness_dissect_enum_notifyResponse_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_, int hf_index _U_, guint32 *param _U_)
 426 {
 427         guint1632 parameter=0;
 428         if(param){
 429                 parameter=(guint1632)*param;
 430         }
 431         offset = dissect_ndr_uint1632(tvb, offset, pinfo, tree, di, drep, hf_index, &parameter);
 432         if(param){
 433                 *param=(guint32)parameter;
 434         }
 435         return offset;
 436 }
 437
 438
 439 /* IDL: struct { */
 440 /* IDL:         witness_notifyResponse_type message_type; */
 441 /* IDL:         uint32 length; */
 442 /* IDL:         uint32 num_messages; */
 443 /* IDL:         [unique(1)] [size_is(length)] uint8 *message_buffer; */
 444 /* IDL: } */
 445
 446 static int
 447 witness_dissect_element_notifyResponse_message_type(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 448 {
 449         offset = witness_dissect_enum_notifyResponse_type(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_message_type, 0);
 450
 451         return offset;
 452 }
 453
 454 static int
 455 witness_dissect_element_notifyResponse_length(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 456 {
 457         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_length, 0);
 458
 459         return offset;
 460 }
 461
 462 static int
 463 witness_dissect_element_notifyResponse_num_messages(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 464 {
 465         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_num_messages, 0);
 466
 467         return offset;
 468 }
 469
 470 static int
 471 witness_dissect_element_notifyResponse_message_buffer(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 472 {
 473         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_notifyResponse_message_buffer_, NDR_POINTER_UNIQUE, "Pointer to Message Buffer (uint8)",hf_witness_witness_notifyResponse_message_buffer);
 474
 475         return offset;
 476 }
 477
 478 static int
 479 witness_dissect_element_notifyResponse_message_buffer__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 480 {
 481         offset = PIDL_dissect_uint8(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_notifyResponse_message_buffer, 0);
 482
 483         return offset;
 484 }
 485
 486 static int
 487 witness_dissect_element_GetInterfaceList_interface_list(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 488 {
 489         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_GetInterfaceList_interface_list_, NDR_POINTER_REF, "Pointer to Interface List (witness_interfaceList)",hf_witness_witness_GetInterfaceList_interface_list);
 490
 491         return offset;
 492 }
 493
 494 static int
 495 witness_dissect_element_GetInterfaceList_interface_list_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 496 {
 497         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_GetInterfaceList_interface_list__, NDR_POINTER_UNIQUE, "Pointer to Interface List (witness_interfaceList)",hf_witness_witness_GetInterfaceList_interface_list);
 498
 499         return offset;
 500 }
 501
 502 static int
 503 witness_dissect_element_GetInterfaceList_interface_list__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 504 {
 505         offset = witness_dissect_struct_interfaceList(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_GetInterfaceList_interface_list,0);
 506
 507         return offset;
 508 }
 509
 510 /* IDL: WERROR witness_GetInterfaceList( */
 511 /* IDL: [out] [ref] witness_interfaceList **interface_list */
 512 /* IDL: ); */
 513
 514 static int
 515 witness_dissect_GetInterfaceList_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 516 {
 517         guint32 status;
 518
 519         pinfo->dcerpc_procedure_name="GetInterfaceList";
 520         offset = witness_dissect_element_GetInterfaceList_interface_list(tvb, offset, pinfo, tree, di, drep);
 521         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 522
 523         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
 524
 525         if (status != 0)
 526                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x"));
 527
 528         return offset;
 529 }
 530
 531 static int
 532 witness_dissect_GetInterfaceList_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 533 {
 534         pinfo->dcerpc_procedure_name="GetInterfaceList";
 535         return offset;
 536 }
 537
 538 static int
 539 witness_dissect_element_Register_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 540 {
 541         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_context_handle_, NDR_POINTER_REF, "Pointer to Context Handle (policy_handle)",hf_witness_context_handle);
 542
 543         return offset;
 544 }
 545
 546 static int
 547 witness_dissect_element_Register_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 548 {
 549         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_context_handle, PIDL_POLHND_OPEN);
 550
 551         return offset;
 552 }
 553
 554 static int
 555 witness_dissect_element_Register_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 556 {
 557         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_Register_version, 0);
 558
 559         return offset;
 560 }
 561
 562 static int
 563 witness_dissect_element_Register_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 564 {
 565         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_net_name_, NDR_POINTER_UNIQUE, "Pointer to Net Name (uint16)",hf_witness_witness_Register_net_name);
 566
 567         return offset;
 568 }
 569
 570 static int
 571 witness_dissect_element_Register_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 572 {
 573         char *data;
 574
 575         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_witness_witness_Register_net_name, FALSE, &data);
 576         proto_item_append_text(tree, ": %s", data);
 577
 578         return offset;
 579 }
 580
 581 static int
 582 witness_dissect_element_Register_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 583 {
 584         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_ip_address_, NDR_POINTER_UNIQUE, "Pointer to Ip Address (uint16)",hf_witness_witness_Register_ip_address);
 585
 586         return offset;
 587 }
 588
 589 static int
 590 witness_dissect_element_Register_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 591 {
 592         char *data;
 593
 594         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_witness_witness_Register_ip_address, FALSE, &data);
 595         proto_item_append_text(tree, ": %s", data);
 596
 597         return offset;
 598 }
 599
 600 static int
 601 witness_dissect_element_Register_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 602 {
 603         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_Register_client_computer_name_, NDR_POINTER_UNIQUE, "Pointer to Client Computer Name (uint16)",hf_witness_witness_Register_client_computer_name);
 604
 605         return offset;
 606 }
 607
 608 static int
 609 witness_dissect_element_Register_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 610 {
 611         char *data;
 612
 613         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_witness_witness_Register_client_computer_name, FALSE, &data);
 614         proto_item_append_text(tree, ": %s", data);
 615
 616         return offset;
 617 }
 618
 619 /* IDL: WERROR witness_Register( */
 620 /* IDL: [out] [ref] policy_handle *context_handle, */
 621 /* IDL: [in] witness_version version, */
 622 /* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *net_name, */
 623 /* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *ip_address, */
 624 /* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *client_computer_name */
 625 /* IDL: ); */
 626
 627 static int
 628 witness_dissect_Register_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 629 {
 630         guint32 status;
 631
 632         pinfo->dcerpc_procedure_name="Register";
 633         offset = witness_dissect_element_Register_context_handle(tvb, offset, pinfo, tree, di, drep);
 634         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 635
 636         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
 637
 638         if (status != 0)
 639                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x"));
 640
 641         return offset;
 642 }
 643
 644 static int
 645 witness_dissect_Register_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 646 {
 647         pinfo->dcerpc_procedure_name="Register";
 648         offset = witness_dissect_element_Register_version(tvb, offset, pinfo, tree, di, drep);
 649         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 650         offset = witness_dissect_element_Register_net_name(tvb, offset, pinfo, tree, di, drep);
 651         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 652         offset = witness_dissect_element_Register_ip_address(tvb, offset, pinfo, tree, di, drep);
 653         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 654         offset = witness_dissect_element_Register_client_computer_name(tvb, offset, pinfo, tree, di, drep);
 655         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 656         return offset;
 657 }
 658
 659 static int
 660 witness_dissect_element_UnRegister_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 661 {
 662         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_context_handle, PIDL_POLHND_CLOSE);
 663
 664         return offset;
 665 }
 666
 667 /* IDL: WERROR witness_UnRegister( */
 668 /* IDL: [in] policy_handle context_handle */
 669 /* IDL: ); */
 670
 671 static int
 672 witness_dissect_UnRegister_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 673 {
 674         guint32 status;
 675
 676         pinfo->dcerpc_procedure_name="UnRegister";
 677         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
 678
 679         if (status != 0)
 680                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x"));
 681
 682         return offset;
 683 }
 684
 685 static int
 686 witness_dissect_UnRegister_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 687 {
 688         pinfo->dcerpc_procedure_name="UnRegister";
 689         offset = witness_dissect_element_UnRegister_context_handle(tvb, offset, pinfo, tree, di, drep);
 690         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 691         return offset;
 692 }
 693
 694 static int
 695 witness_dissect_element_AsyncNotify_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 696 {
 697         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_context_handle, 0);
 698
 699         return offset;
 700 }
 701
 702 static int
 703 witness_dissect_element_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 704 {
 705         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_AsyncNotify_response_, NDR_POINTER_REF, "Pointer to Response (witness_notifyResponse)",hf_witness_witness_AsyncNotify_response);
 706
 707         return offset;
 708 }
 709
 710 static int
 711 witness_dissect_element_AsyncNotify_response_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 712 {
 713         offset = dissect_ndr_embedded_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_AsyncNotify_response__, NDR_POINTER_UNIQUE, "Pointer to Response (witness_notifyResponse)",hf_witness_witness_AsyncNotify_response);
 714
 715         return offset;
 716 }
 717
 718 static int
 719 witness_dissect_element_AsyncNotify_response__(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 720 {
 721         offset = witness_dissect_struct_notifyResponse(tvb,offset,pinfo,tree,di,drep,hf_witness_witness_AsyncNotify_response,0);
 722
 723         return offset;
 724 }
 725
 726 /* IDL: WERROR witness_AsyncNotify( */
 727 /* IDL: [in] policy_handle context_handle, */
 728 /* IDL: [out] [ref] witness_notifyResponse **response */
 729 /* IDL: ); */
 730
 731 static int
 732 witness_dissect_AsyncNotify_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 733 {
 734         guint32 status;
 735
 736         pinfo->dcerpc_procedure_name="AsyncNotify";
 737         offset = witness_dissect_element_AsyncNotify_response(tvb, offset, pinfo, tree, di, drep);
 738         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 739
 740         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
 741
 742         if (status != 0)
 743                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x"));
 744
 745         return offset;
 746 }
 747
 748 static int
 749 witness_dissect_AsyncNotify_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 750 {
 751         pinfo->dcerpc_procedure_name="AsyncNotify";
 752         offset = witness_dissect_element_AsyncNotify_context_handle(tvb, offset, pinfo, tree, di, drep);
 753         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 754         return offset;
 755 }
 756
 757 static int
 758 witness_dissect_element_RegisterEx_context_handle(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 759 {
 760         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_context_handle_, NDR_POINTER_REF, "Pointer to Context Handle (policy_handle)",hf_witness_witness_RegisterEx_context_handle);
 761
 762         return offset;
 763 }
 764
 765 static int
 766 witness_dissect_element_RegisterEx_context_handle_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 767 {
 768         offset = PIDL_dissect_policy_hnd(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_context_handle, 0);
 769
 770         return offset;
 771 }
 772
 773 static int
 774 witness_dissect_element_RegisterEx_version(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 775 {
 776         offset = witness_dissect_enum_version(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_version, 0);
 777
 778         return offset;
 779 }
 780
 781 static int
 782 witness_dissect_element_RegisterEx_net_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 783 {
 784         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_net_name_, NDR_POINTER_UNIQUE, "Pointer to Net Name (uint16)",hf_witness_witness_RegisterEx_net_name);
 785
 786         return offset;
 787 }
 788
 789 static int
 790 witness_dissect_element_RegisterEx_net_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 791 {
 792         char *data;
 793
 794         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_witness_witness_RegisterEx_net_name, FALSE, &data);
 795         proto_item_append_text(tree, ": %s", data);
 796
 797         return offset;
 798 }
 799
 800 static int
 801 witness_dissect_element_RegisterEx_share_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 802 {
 803         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_share_name_, NDR_POINTER_UNIQUE, "Pointer to Share Name (uint16)",hf_witness_witness_RegisterEx_share_name);
 804
 805         return offset;
 806 }
 807
 808 static int
 809 witness_dissect_element_RegisterEx_share_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 810 {
 811         char *data;
 812
 813         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_witness_witness_RegisterEx_share_name, FALSE, &data);
 814         proto_item_append_text(tree, ": %s", data);
 815
 816         return offset;
 817 }
 818
 819 static int
 820 witness_dissect_element_RegisterEx_ip_address(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 821 {
 822         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_ip_address_, NDR_POINTER_UNIQUE, "Pointer to Ip Address (uint16)",hf_witness_witness_RegisterEx_ip_address);
 823
 824         return offset;
 825 }
 826
 827 static int
 828 witness_dissect_element_RegisterEx_ip_address_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 829 {
 830         char *data;
 831
 832         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_witness_witness_RegisterEx_ip_address, FALSE, &data);
 833         proto_item_append_text(tree, ": %s", data);
 834
 835         return offset;
 836 }
 837
 838 static int
 839 witness_dissect_element_RegisterEx_client_computer_name(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 840 {
 841         offset = dissect_ndr_toplevel_pointer(tvb, offset, pinfo, tree, di, drep, witness_dissect_element_RegisterEx_client_computer_name_, NDR_POINTER_UNIQUE, "Pointer to Client Computer Name (uint16)",hf_witness_witness_RegisterEx_client_computer_name);
 842
 843         return offset;
 844 }
 845
 846 static int
 847 witness_dissect_element_RegisterEx_client_computer_name_(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 848 {
 849         char *data;
 850
 851         offset = dissect_ndr_cvstring(tvb, offset, pinfo, tree, di, drep, sizeof(guint16), hf_witness_witness_RegisterEx_client_computer_name, FALSE, &data);
 852         proto_item_append_text(tree, ": %s", data);
 853
 854         return offset;
 855 }
 856
 857 static int
 858 witness_dissect_element_RegisterEx_flags(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 859 {
 860         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_flags, 0);
 861
 862         return offset;
 863 }
 864
 865 static int
 866 witness_dissect_element_RegisterEx_timeout(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 867 {
 868         offset = PIDL_dissect_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_witness_RegisterEx_timeout, 0);
 869
 870         return offset;
 871 }
 872
 873 /* IDL: WERROR witness_RegisterEx( */
 874 /* IDL: [out] [ref] policy_handle *context_handle, */
 875 /* IDL: [in] witness_version version, */
 876 /* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *net_name, */
 877 /* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *share_name, */
 878 /* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *ip_address, */
 879 /* IDL: [unique(1)] [in] [charset(UTF16)] uint16 *client_computer_name, */
 880 /* IDL: [in] uint32 flags, */
 881 /* IDL: [in] uint32 timeout */
 882 /* IDL: ); */
 883
 884 static int
 885 witness_dissect_RegisterEx_response(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 886 {
 887         guint32 status;
 888
 889         pinfo->dcerpc_procedure_name="RegisterEx";
 890         offset = witness_dissect_element_RegisterEx_context_handle(tvb, offset, pinfo, tree, di, drep);
 891         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 892
 893         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep, hf_witness_werror, &status);
 894
 895         if (status != 0)
 896                 col_append_fstr(pinfo->cinfo, COL_INFO, ", Error: %s", val_to_str(status, WERR_errors, "Unknown DOS error 0x%08x"));
 897
 898         return offset;
 899 }
 900
 901 static int
 902 witness_dissect_RegisterEx_request(tvbuff_t *tvb _U_, int offset _U_, packet_info *pinfo _U_, proto_tree *tree _U_, dcerpc_info* di _U_, guint8 *drep _U_)
 903 {
 904         pinfo->dcerpc_procedure_name="RegisterEx";
 905         offset = witness_dissect_element_RegisterEx_version(tvb, offset, pinfo, tree, di, drep);
 906         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 907         offset = witness_dissect_element_RegisterEx_net_name(tvb, offset, pinfo, tree, di, drep);
 908         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 909         offset = witness_dissect_element_RegisterEx_share_name(tvb, offset, pinfo, tree, di, drep);
 910         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 911         offset = witness_dissect_element_RegisterEx_ip_address(tvb, offset, pinfo, tree, di, drep);
 912         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 913         offset = witness_dissect_element_RegisterEx_client_computer_name(tvb, offset, pinfo, tree, di, drep);
 914         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 915         offset = witness_dissect_element_RegisterEx_flags(tvb, offset, pinfo, tree, di, drep);
 916         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 917         offset = witness_dissect_element_RegisterEx_timeout(tvb, offset, pinfo, tree, di, drep);
 918         offset = dissect_deferred_pointers(pinfo, tvb, offset, di, drep);
 919         return offset;
 920 }
 921
 922
 923 static dcerpc_sub_dissector witness_dissectors[] = {
 924         { 0, "GetInterfaceList",
 925            witness_dissect_GetInterfaceList_request, witness_dissect_GetInterfaceList_response},
 926         { 1, "Register",
 927            witness_dissect_Register_request, witness_dissect_Register_response},
 928         { 2, "UnRegister",
 929            witness_dissect_UnRegister_request, witness_dissect_UnRegister_response},
 930         { 3, "AsyncNotify",
 931            witness_dissect_AsyncNotify_request, witness_dissect_AsyncNotify_response},
 932         { 4, "RegisterEx",
 933            witness_dissect_RegisterEx_request, witness_dissect_RegisterEx_response},
 934         { 0, NULL, NULL, NULL }
 935 };
 936
 937 void proto_register_dcerpc_witness(void)
 938 {
 939         static hf_register_info hf[] = {
 940         { &hf_witness_move_ipaddr_list_flags,
 941           { "Flags", "witness.move_ipaddr.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 942         { &hf_witness_witness_RegisterEx_context_handle,
 943           { "Context Handle", "witness.witness_RegisterEx.context_handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 944         { &hf_witness_witness_notifyResponse_num_messages,
 945           { "Num Messages", "witness.witness_notifyResponse.num_messages", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 946         { &hf_witness_witness_notifyResponse_message_type,
 947           { "Message Type", "witness.witness_notifyResponse.message_type", FT_UINT1632, BASE_DEC, VALS(witness_witness_notifyResponse_type_vals), 0, NULL, HFILL }},
 948         { &hf_witness_witness_RegisterEx_flags,
 949           { "Flags", "witness.witness_RegisterEx.flags", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 950         { &hf_witness_werror,
 951           { "Windows Error", "witness.werror", FT_UINT32, BASE_HEX, VALS(WERR_errors), 0, NULL, HFILL }},
 952         { &hf_witness_witness_Register_version,
 953           { "Version", "witness.witness_Register.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
 954         { &hf_witness_witness_Register_client_computer_name,
 955           { "Client Computer Name", "witness.witness_Register.client_computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 956         { &hf_witness_witness_interfaceList_num_interfaces,
 957           { "Num Interfaces", "witness.witness_interfaceList.num_interfaces", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 958         { &hf_witness_context_handle,
 959           { "Handle", "witness.handle", FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
 960         { &hf_witness_witness_interfaceList_interfaces,
 961           { "Interfaces", "witness.witness_interfaceList.interfaces", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 962         { &hf_witness_move_ipaddr_list_ipv6,
 963           { "IPv6", "witness.move_ipaddr.ipv6", FT_IPv6, BASE_NONE, NULL, 0, NULL, HFILL }},
 964         { &hf_witness_witness_AsyncNotify_response,
 965           { "Response", "witness.witness_AsyncNotify.response", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
 966         { &hf_witness_witness_RegisterEx_ip_address,
 967           { "Ip Address", "witness.witness_RegisterEx.ip_address", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 968         { &hf_witness_opnum,
 969           { "Operation", "witness.opnum", FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
 970         { &hf_witness_witness_interfaceInfo_version,
 971           { "Version", "witness.witness_interfaceInfo.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
 972         { &hf_witness_change_type,
 973           { "Type", "witness.change.type", FT_UINT32, BASE_HEX, VALS(witness_change_type_vals), 0, NULL, HFILL }},
 974         { &hf_witness_move_ipaddr_list_flags_ipv4,
 975           { "IPv4", "witness.move_ipaddr.ipv4_valid", FT_BOOLEAN, 32, TFS(&valid_tfs), 0x01, NULL, HFILL }},
 976         { &hf_dcerpc_array_max_count,
 977           { "Max Count", "dcerpc.array.max_count", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 978         { &hf_witness_witness_interfaceInfo_flags_WITNESS_IF,
 979           { "Witness If", "witness.witness_interfaceInfo_flags.WITNESS_IF", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_WITNESS_IF_tfs), ( 0x04 ), NULL, HFILL }},
 980         { &hf_witness_witness_RegisterEx_version,
 981           { "Version", "witness.witness_RegisterEx.version", FT_UINT32, BASE_DEC, VALS(witness_witness_version_vals), 0, NULL, HFILL }},
 982         { &hf_witness_witness_interfaceInfo_group_name,
 983           { "Group Name", "witness.witness_interfaceInfo.group_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
 984         { &hf_witness_witness_RegisterEx_timeout,
 985           { "Timeout", "witness.witness_RegisterEx.timeout", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
 986         { &hf_witness_witness_interfaceInfo_flags_IPv6_VALID,
 987           { "Ipv6 Valid", "witness.witness_interfaceInfo_flags.IPv6_VALID", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_IPv6_VALID_tfs), ( 0x02 ), NULL, HFILL }},
 988         { &hf_witness_move_ipaddr_list_flags_ipv6,
 989           { "IPv6", "witness.move_ipaddr.ipv6_valid", FT_BOOLEAN, 32, TFS(&valid_tfs), 0x02, NULL, HFILL }},
 990         { &hf_witness_witness_interfaceInfo_flags_IPv4_VALID,
 991           { "Ipv4 Valid", "witness.witness_interfaceInfo_flags.IPv4_VALID", FT_BOOLEAN, 32, TFS(&witness_interfaceInfo_flags_IPv4_VALID_tfs), ( 0x01 ), NULL, HFILL }},
 992         { &hf_witness_witness_interfaceInfo_flags,
 993           { "Flags", "witness.witness_interfaceInfo.flags", FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
 994         { &hf_witness_witness_interfaceInfo_ipv6,
 995           { "Ipv6", "witness.witness_interfaceInfo.ipv6", FT_IPv6, BASE_NONE, NULL, 0, NULL, HFILL }},
 996         { &hf_witness_witness_interfaceInfo_ipv4,
 997           { "Ipv4", "witness.witness_interfaceInfo.ipv4", FT_IPv4, BASE_NONE, NULL, 0, NULL, HFILL }},
 998         { &hf_witness_change_name,
 999           { "Name", "witness.change.name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1000         { &hf_witness_witness_RegisterEx_client_computer_name,
1001           { "Client Computer Name", "witness.witness_RegisterEx.client_computer_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1002         { &hf_witness_witness_RegisterEx_share_name,
1003           { "Share Name", "witness.witness_RegisterEx.share_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1004         { &hf_witness_witness_RegisterEx_net_name,
1005           { "Net Name", "witness.witness_RegisterEx.net_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1006         { &hf_witness_witness_interfaceInfo_state,
1007           { "State", "witness.witness_interfaceInfo.state", FT_UINT16, BASE_DEC, VALS(witness_witness_interfaceInfo_state_vals), 0, NULL, HFILL }},
1008         { &hf_witness_witness_notifyResponse_length,
1009           { "Length", "witness.witness_notifyResponse.length", FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
1010         { &hf_witness_move_ipaddr_list_ipv4,
1011           { "IPv4", "witness.move_ipaddr.ipv4", FT_IPv4, BASE_NONE, NULL, 0, NULL, HFILL }},
1012         { &hf_witness_witness_notifyResponse_message_buffer,
1013           { "Message Buffer", "witness.witness_notifyResponse.message_buffer", FT_UINT8, BASE_DEC, NULL, 0, NULL, HFILL }},
1014         { &hf_witness_witness_GetInterfaceList_interface_list,
1015           { "Interface List", "witness.witness_GetInterfaceList.interface_list", FT_NONE, BASE_NONE, NULL, 0, NULL, HFILL }},
1016         { &hf_witness_witness_Register_net_name,
1017           { "Net Name", "witness.witness_Register.net_name", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1018         { &hf_witness_witness_Register_ip_address,
1019           { "Ip Address", "witness.witness_Register.ip_address", FT_STRING, BASE_NONE, NULL, 0, NULL, HFILL }},
1020         };
1021
1022
1023         static gint *ett[] = {
1024                 &ett_witness_move_ipaddr_list_flags,
1025                 &ett_witness_move_ipaddr,
1026                 &ett_message_buffer,
1027                 &ett_dcerpc_witness,
1028                 &ett_witness_witness_interfaceInfo_flags,
1029                 &ett_witness_witness_interfaceInfo,
1030                 &ett_witness_witness_interfaceList,
1031                 &ett_witness_witness_notifyResponse,
1032         };
1033
1034         proto_dcerpc_witness = proto_register_protocol("SMB Witness Service", "WITNESS", "witness");
1035         proto_register_field_array(proto_dcerpc_witness, hf, array_length (hf));
1036         proto_register_subtree_array(ett, array_length(ett));
1037 }
1038
1039 void proto_reg_handoff_dcerpc_witness(void)
1040 {
1041         dcerpc_init_uuid(proto_dcerpc_witness, ett_dcerpc_witness,
1042                 &uuid_dcerpc_witness, ver_dcerpc_witness,
1043                 witness_dissectors, hf_witness_opnum);
1044 }