epan/dissectors/packet-dcerpc-spoolss.c

   1 /* packet-dcerpc-spoolss.c
   2  * Routines for SMB \PIPE\spoolss packet disassembly
   3  * Copyright 2001-2003, Tim Potter <tpot@samba.org>
   4  *
   5  * $Id$
   6  *
   7  * Wireshark - Network traffic analyzer
   8  * By Gerald Combs <gerald@wireshark.org>
   9  * Copyright 1998 Gerald Combs
  10  *
  11  * This program is free software; you can redistribute it and/or
  12  * modify it under the terms of the GNU General Public License
  13  * as published by the Free Software Foundation; either version 2
  14  * of the License, or (at your option) any later version.
  15  *
  16  * This program is distributed in the hope that it will be useful,
  17  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  * GNU General Public License for more details.
  20  *
  21  * You should have received a copy of the GNU General Public License
  22  * along with this program; if not, write to the Free Software
  23  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  24  */
  25
  26 /* TODO list:
  27
  28  - audit of item lengths
  29
  30 */
  31
  32 #include "config.h"
  33
  34 #include <glib.h>
  35 #include <string.h>
  36
  37 #include <epan/packet.h>
  38 #include <epan/wmem/wmem.h>
  39 #include "packet-dcerpc.h"
  40 #include "packet-dcerpc-nt.h"
  41 #include "packet-dcerpc-spoolss.h"
  42 #include "packet-windows-common.h"
  43
  44 /* GetPrinterDriver2 */
  45
  46 static int hf_clientmajorversion = -1;
  47 static int hf_clientminorversion = -1;
  48 static int hf_servermajorversion = -1;
  49 static int hf_serverminorversion = -1;
  50 static int hf_driverpath = -1;
  51 static int hf_datafile = -1;
  52 static int hf_configfile = -1;
  53 static int hf_helpfile = -1;
  54 static int hf_monitorname = -1;
  55 static int hf_defaultdatatype = -1;
  56 static int hf_driverinfo_cversion = -1;
  57 static int hf_dependentfiles = -1;
  58 static int hf_previousdrivernames = -1;
  59 static int hf_driverdate = -1;
  60 static int hf_padding = -1;
  61 static int hf_driver_version_low = -1;
  62 static int hf_driver_version_high = -1;
  63 static int hf_mfgname = -1;
  64 static int hf_oemurl = -1;
  65 static int hf_hardwareid= -1;
  66 static int hf_provider = -1;
  67
  68 /* GetPrinter */
  69
  70 /* Times */
  71
  72 static int hf_start_time = -1;
  73 static int hf_end_time = -1;
  74 static int hf_elapsed_time = -1;
  75
  76 /****************************************************************************/
  77
  78 /*
  79  * New hf index values - I'm in the process of doing a bit of a cleanup -tpot
  80  */
  81
  82 static int hf_opnum = -1;
  83 static int hf_hnd = -1;
  84 static int hf_rc = -1;
  85 static int hf_offered = -1;
  86 static int hf_needed = -1;
  87 static int hf_returned = -1;
  88 static int hf_buffer_size = -1;
  89 static int hf_buffer_data = -1;
  90 static int hf_string_parm_size = -1;
  91 static int hf_string_parm_data= -1;
  92 static int hf_offset = -1;
  93 static int hf_level = -1;
  94 static int hf_access_required = -1;
  95
  96 static int hf_printername = -1;
  97 static int hf_machinename = -1;
  98 static int hf_notifyname = -1;
  99 static int hf_printerdesc = -1;
 100 static int hf_printercomment = -1;
 101 static int hf_servername = -1;
 102 static int hf_sharename = -1;
 103 static int hf_portname = -1;
 104 static int hf_printerlocation = -1;
 105 static int hf_drivername = -1;
 106 static int hf_environment = -1;
 107 static int hf_username = -1;
 108 static int hf_documentname = -1;
 109 static int hf_outputfile = -1;
 110 static int hf_datatype = -1;
 111 static int hf_textstatus = -1;
 112 static int hf_sepfile = -1;
 113 static int hf_printprocessor = -1;
 114 static int hf_parameters = -1;
 115
 116 /* Printer information */
 117
 118 static int hf_printer_cjobs = -1;
 119 static int hf_printer_total_jobs = -1;
 120 static int hf_printer_total_bytes = -1;
 121 static int hf_printer_global_counter = -1;
 122 static int hf_printer_total_pages = -1;
 123 static int hf_printer_major_version = -1;
 124 static int hf_printer_build_version = -1;
 125 static int hf_printer_unk7 = -1;
 126 static int hf_printer_unk8 = -1;
 127 static int hf_printer_unk9 = -1;
 128 static int hf_printer_session_ctr = -1;
 129 static int hf_printer_unk11 = -1;
 130 static int hf_printer_printer_errors = -1;
 131 static int hf_printer_unk13 = -1;
 132 static int hf_printer_unk14 = -1;
 133 static int hf_printer_unk15 = -1;
 134 static int hf_printer_unk16 = -1;
 135 static int hf_printer_changeid = -1;
 136 static int hf_printer_unk18 = -1;
 137 static int hf_printer_unk20 = -1;
 138 static int hf_printer_c_setprinter = -1;
 139 static int hf_printer_unk22 = -1;
 140 static int hf_printer_unk23 = -1;
 141 static int hf_printer_unk24 = -1;
 142 static int hf_printer_unk25 = -1;
 143 static int hf_printer_unk26 = -1;
 144 static int hf_printer_unk27 = -1;
 145 static int hf_printer_unk28 = -1;
 146 static int hf_printer_unk29 = -1;
 147 static int hf_printer_flags = -1;
 148 static int hf_printer_priority = -1;
 149 static int hf_printer_default_priority = -1;
 150 static int hf_printer_jobs = -1;
 151 static int hf_printer_averageppm = -1;
 152 static int hf_printer_guid = -1;
 153 static int hf_printer_action = -1;
 154
 155 /* Printer data */
 156
 157 static int hf_printerdata = -1;
 158 static int hf_printerdata_key = -1;
 159 static int hf_printerdata_value = -1;
 160 static int hf_printerdata_type = -1;
 161 static int hf_printerdata_size = -1; /* Length of printer data */
 162 static int hf_printerdata_data = -1;
 163 static int hf_printerdata_data_sz = -1;
 164 static int hf_printerdata_data_dword = -1;
 165
 166 /* Devicemode */
 167
 168 static int hf_devmodectr_size = -1;
 169
 170 static int hf_devmode = -1;
 171 static int hf_devmode_size = -1;
 172 static int hf_devmode_spec_version = -1;
 173 static int hf_devmode_driver_version = -1;
 174 static int hf_devmode_size2 = -1;
 175 static int hf_devmode_driver_extra_len = -1;
 176 static int hf_devmode_fields = -1;
 177 static int hf_devmode_orientation = -1;
 178 static int hf_devmode_paper_size = -1;
 179 static int hf_devmode_paper_width = -1;
 180 static int hf_devmode_paper_length = -1;
 181 static int hf_devmode_scale = -1;
 182 static int hf_devmode_copies = -1;
 183 static int hf_devmode_default_source = -1;
 184 static int hf_devmode_print_quality = -1;
 185 static int hf_devmode_color = -1;
 186 static int hf_devmode_duplex = -1;
 187 static int hf_devmode_y_resolution = -1;
 188 static int hf_devmode_tt_option = -1;
 189 static int hf_devmode_collate = -1;
 190 static int hf_devmode_log_pixels = -1;
 191 static int hf_devmode_bits_per_pel = -1;
 192 static int hf_devmode_pels_width = -1;
 193 static int hf_devmode_pels_height = -1;
 194 static int hf_devmode_display_flags = -1;
 195 static int hf_devmode_display_freq = -1;
 196 static int hf_devmode_icm_method = -1;
 197 static int hf_devmode_icm_intent = -1;
 198 static int hf_devmode_media_type = -1;
 199 static int hf_devmode_dither_type = -1;
 200 static int hf_devmode_reserved1 = -1;
 201 static int hf_devmode_reserved2 = -1;
 202 static int hf_devmode_panning_width = -1;
 203 static int hf_devmode_panning_height = -1;
 204 static int hf_devmode_driver_extra = -1;
 205
 206 static int hf_devmode_fields_orientation = -1;
 207 static int hf_devmode_fields_papersize = -1;
 208 static int hf_devmode_fields_paperlength = -1;
 209 static int hf_devmode_fields_paperwidth = -1;
 210 static int hf_devmode_fields_scale = -1;
 211 static int hf_devmode_fields_position = -1;
 212 static int hf_devmode_fields_nup = -1;
 213 static int hf_devmode_fields_copies = -1;
 214 static int hf_devmode_fields_defaultsource = -1;
 215 static int hf_devmode_fields_printquality = -1;
 216 static int hf_devmode_fields_color = -1;
 217 static int hf_devmode_fields_duplex = -1;
 218 static int hf_devmode_fields_yresolution = -1;
 219 static int hf_devmode_fields_ttoption = -1;
 220 static int hf_devmode_fields_collate = -1;
 221 static int hf_devmode_fields_formname = -1;
 222 static int hf_devmode_fields_logpixels = -1;
 223 static int hf_devmode_fields_bitsperpel = -1;
 224 static int hf_devmode_fields_pelswidth = -1;
 225 static int hf_devmode_fields_pelsheight = -1;
 226 static int hf_devmode_fields_displayflags = -1;
 227 static int hf_devmode_fields_displayfrequency = -1;
 228 static int hf_devmode_fields_icmmethod = -1;
 229 static int hf_devmode_fields_icmintent = -1;
 230 static int hf_devmode_fields_mediatype = -1;
 231 static int hf_devmode_fields_dithertype = -1;
 232 static int hf_devmode_fields_panningwidth = -1;
 233 static int hf_devmode_fields_panningheight = -1;
 234
 235 /* Print job */
 236
 237 static int hf_job_id = -1;
 238 static int hf_job_priority = -1;
 239 static int hf_job_position = -1;
 240 static int hf_job_totalpages = -1;
 241 static int hf_job_totalbytes = -1;
 242 static int hf_job_pagesprinted = -1;
 243 static int hf_job_bytesprinted = -1;
 244 static int hf_job_size = -1;
 245
 246 static int hf_job_status = -1;
 247 static int hf_job_status_paused = -1;
 248 static int hf_job_status_error = -1;
 249 static int hf_job_status_deleting = -1;
 250 static int hf_job_status_spooling = -1;
 251 static int hf_job_status_printing = -1;
 252 static int hf_job_status_offline = -1;
 253 static int hf_job_status_paperout = -1;
 254 static int hf_job_status_printed = -1;
 255 static int hf_job_status_deleted = -1;
 256 static int hf_job_status_blocked = -1;
 257 static int hf_job_status_user_intervention = -1;
 258
 259 /* Forms */
 260
 261 static int hf_form = -1;
 262 static int hf_form_level = -1;
 263 static int hf_form_name = -1;
 264 static int hf_form_flags = -1;
 265 static int hf_form_unknown = -1;
 266 static int hf_form_width = -1;
 267 static int hf_form_height = -1;
 268 static int hf_form_left_margin = -1;
 269 static int hf_form_top_margin = -1;
 270 static int hf_form_horiz_len = -1;
 271 static int hf_form_vert_len = -1;
 272
 273 static int hf_enumforms_num = -1;
 274
 275 /* Print notify */
 276
 277 static int hf_notify_options_version = -1;
 278 static int hf_notify_options_flags = -1;
 279 static int hf_notify_options_flags_refresh = -1;
 280 static int hf_notify_options_count = -1;
 281 static int hf_notify_option_type = -1;
 282 static int hf_notify_option_reserved1 = -1;
 283 static int hf_notify_option_reserved2 = -1;
 284 static int hf_notify_option_reserved3 = -1;
 285 static int hf_notify_option_count = -1;
 286 static int hf_notify_option_data_count = -1;
 287 static int hf_notify_info_count = -1;
 288 static int hf_notify_info_version = -1;
 289 static int hf_notify_info_flags = -1;
 290 static int hf_notify_info_data_type = -1;
 291 static int hf_notify_info_data_count = -1;
 292 static int hf_notify_info_data_id = -1;
 293 static int hf_notify_info_data_value1 = -1;
 294 static int hf_notify_info_data_value2 = -1;
 295 static int hf_notify_info_data_bufsize = -1;
 296 static int hf_notify_info_data_buffer = -1;
 297 static int hf_notify_info_data_buffer_len = -1;
 298 static int hf_notify_info_data_buffer_data = -1;
 299
 300 static int hf_notify_field = -1;
 301
 302 static int hf_printerlocal = -1;
 303
 304 static int hf_rrpcn_changelow = -1;
 305 static int hf_rrpcn_changehigh = -1;
 306 static int hf_rrpcn_unk0 = -1;
 307 static int hf_rrpcn_unk1 = -1;
 308
 309 static int hf_replyopenprinter_unk0 = -1;
 310 static int hf_replyopenprinter_unk1 = -1;
 311
 312 /* Registry data types */
 313
 314 #define DCERPC_REG_NONE                        0
 315 #define DCERPC_REG_SZ                          1
 316 #define DCERPC_REG_EXPAND_SZ                   2
 317 #define DCERPC_REG_BINARY                      3
 318 #define DCERPC_REG_DWORD                       4
 319 #define DCERPC_REG_DWORD_LE                    4        /* DWORD, little endian
 320 */
 321 #define DCERPC_REG_DWORD_BE                    5        /* DWORD, big endian */
 322 #define DCERPC_REG_LINK                        6
 323 #define DCERPC_REG_MULTI_SZ                    7
 324 #define DCERPC_REG_RESOURCE_LIST               8
 325 #define DCERPC_REG_FULL_RESOURCE_DESCRIPTOR    9
 326 #define DCERPC_REG_RESOURCE_REQUIREMENTS_LIST 10
 327
 328 static const value_string reg_datatypes[] = {
 329         { DCERPC_REG_NONE, "REG_NONE" },
 330         { DCERPC_REG_SZ, "REG_SZ" },
 331         { DCERPC_REG_EXPAND_SZ, "REG_EXPAND_SZ" },
 332         { DCERPC_REG_BINARY, "REG_BINARY" },
 333         { DCERPC_REG_DWORD, "REG_DWORD" },
 334 /*        { DCERPC_REG_DWORD_LE, "REG_DWORD_LE" }, */
 335         { DCERPC_REG_DWORD_BE, "REG_DWORD_BE" },
 336         { DCERPC_REG_LINK, "REG_LINK" },
 337         { DCERPC_REG_MULTI_SZ, "REG_MULTI_SZ" },
 338         { DCERPC_REG_RESOURCE_LIST, "REG_RESOURCE_LIST" },
 339         { DCERPC_REG_FULL_RESOURCE_DESCRIPTOR, "REG_FULL_RESOURCE_DESCRIPTOR" },
 340         { DCERPC_REG_RESOURCE_REQUIREMENTS_LIST, "REG_RESOURCE_REQUIREMENTS_LIST" },
 341         {0, NULL }
 342 };
 343 static value_string_ext reg_datatypes_ext = VALUE_STRING_EXT_INIT(reg_datatypes);
 344
 345 /****************************************************************************/
 346
 347 /*
 348  * Dissect SPOOLSS specific access rights
 349  */
 350
 351 static int hf_server_access_admin = -1;
 352 static int hf_server_access_enum = -1;
 353 static int hf_printer_access_admin = -1;
 354 static int hf_printer_access_use = -1;
 355 static int hf_job_access_admin = -1;
 356
 357 static void
 358 spoolss_printer_specific_rights(tvbuff_t *tvb, gint offset, proto_tree *tree,
 359                                 guint32 access)
 360 {
 361         proto_tree_add_boolean(
 362                 tree, hf_printer_access_use, tvb, offset, 4, access);
 363
 364         proto_tree_add_boolean(
 365                 tree, hf_printer_access_admin, tvb, offset, 4, access);
 366 }
 367
 368 struct access_mask_info spoolss_printer_access_mask_info = {
 369         "SPOOLSS printer",
 370         spoolss_printer_specific_rights,
 371         NULL,                   /* Generic mapping table */
 372         NULL                    /* Standard mapping table */
 373 };
 374
 375 static void
 376 spoolss_printserver_specific_rights(tvbuff_t *tvb, gint offset,
 377                                     proto_tree *tree, guint32 access)
 378 {
 379         proto_tree_add_boolean(
 380                 tree, hf_server_access_enum, tvb, offset, 4, access);
 381
 382         proto_tree_add_boolean(
 383                 tree, hf_server_access_admin, tvb, offset, 4, access);
 384 }
 385
 386 struct access_mask_info spoolss_printserver_access_mask_info = {
 387         "SPOOLSS print server",
 388         spoolss_printserver_specific_rights,
 389         NULL,                   /* Generic mapping table */
 390         NULL                    /* Standard mapping table */
 391 };
 392
 393 static void
 394 spoolss_job_specific_rights(tvbuff_t *tvb, gint offset,
 395                             proto_tree *tree, guint32 access)
 396 {
 397         proto_tree_add_boolean(
 398                 tree, hf_job_access_admin, tvb, offset, 4, access);
 399 }
 400
 401 struct access_mask_info spoolss_job_access_mask_info = {
 402         "SPOOLSS job",
 403         spoolss_job_specific_rights,
 404         NULL,                   /* Generic mapping table */
 405         NULL                    /* Standard mapping table */
 406 };
 407
 408 /*
 409  * Routines to dissect a spoolss BUFFER
 410  */
 411
 412 typedef struct {
 413         tvbuff_t *tvb;
 414         proto_item *tree;       /* Proto tree buffer located in */
 415         proto_item *item;
 416 } BUFFER;
 417
 418 static gint ett_BUFFER = -1;
 419
 420 static int
 421 dissect_spoolss_buffer_data(tvbuff_t *tvb, int offset, packet_info *pinfo,
 422                             proto_tree *tree, dcerpc_info *di, guint8 *drep)
 423 {
 424         BUFFER *b = (BUFFER *)di->private_data;
 425         proto_item *item;
 426         guint32 size;
 427         const guint8 *data;
 428
 429         if (di->conformant_run)
 430                 return offset;
 431
 432         /* Dissect size and data */
 433
 434         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
 435                                     hf_buffer_size, &size);
 436
 437         offset = dissect_ndr_uint8s(tvb, offset, pinfo, NULL, di, drep,
 438                                     hf_buffer_data, size, &data);
 439
 440         item = proto_tree_add_item(
 441                 tree, hf_buffer_data, tvb, offset - size,
 442                 size, ENC_NA);
 443
 444         /* Return buffer info */
 445
 446         if (b) {
 447
 448                 /* I'm not sure about this.  Putting the buffer into
 449                    its own tvb makes sense and the dissection code is
 450                    much clearer, but the data is a proper subset of
 451                    the actual tvb.  Not adding the new data source
 452                    makes the hex display confusing as it switches
 453                    between the 'DCERPC over SMB' tvb and the buffer
 454                    tvb with no visual cues as to what is going on. */
 455
 456                 b->tvb = tvb_new_child_real_data(tvb, data, size, size);
 457                 add_new_data_source(pinfo, b->tvb, "SPOOLSS buffer");
 458
 459                 b->item = item;
 460                 b->tree = proto_item_add_subtree(item, ett_BUFFER);
 461         }
 462
 463         return offset;
 464 }
 465
 466 /* Dissect a spoolss buffer and return buffer data */
 467
 468 static int
 469 dissect_spoolss_buffer(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 470                        proto_tree *tree, dcerpc_info *di, guint8 *drep, BUFFER *b)
 471 {
 472         if (b)
 473                 memset(b, 0, sizeof(BUFFER));
 474
 475         di->private_data = b;
 476
 477         offset = dissect_ndr_pointer(
 478                 tvb, offset, pinfo, tree, di, drep,
 479                 dissect_spoolss_buffer_data, NDR_POINTER_UNIQUE,
 480                 "Buffer", -1);
 481
 482         return offset;
 483 }
 484
 485 static int
 486 dissect_spoolss_string_parm_data(tvbuff_t *tvb, int offset, packet_info *pinfo,
 487                             proto_tree *tree, dcerpc_info *di, guint8 *drep)
 488 {
 489         guint32 buffer_len, len;
 490         gchar *s;
 491         proto_item *item = NULL;
 492
 493         if (di->conformant_run)
 494                 return offset;
 495
 496         /* Dissect size and data */
 497
 498         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
 499                                 hf_string_parm_size, &buffer_len);
 500
 501         s = tvb_get_unicode_stringz(wmem_packet_scope(), tvb, offset, &len, ENC_LITTLE_ENDIAN);
 502
 503         if (tree && buffer_len) {
 504                 tvb_ensure_bytes_exist(tvb, offset, buffer_len);
 505
 506                 item = proto_tree_add_string(
 507                         tree, hf_string_parm_data, tvb, offset, len, s);
 508         }
 509         offset += buffer_len;
 510
 511         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", s);
 512
 513         /* Append string to upper level item */
 514         if (tree && item) {
 515                 item = item->parent != NULL ? item->parent : item;
 516                 proto_item_append_text(item, ": %s", s);
 517         }
 518
 519         return offset;
 520 }
 521
 522 /* Dissect a spoolss string parameter */
 523
 524 static int
 525 dissect_spoolss_string_parm(tvbuff_t *tvb, gint offset, packet_info *pinfo,
 526                        proto_tree *tree, dcerpc_info *di, guint8 *drep, const char *text)
 527 {
 528         offset = dissect_ndr_pointer(
 529                 tvb, offset, pinfo, tree, di, drep,
 530                 dissect_spoolss_string_parm_data, NDR_POINTER_UNIQUE,
 531                 text, -1);
 532
 533         return offset;
 534 }
 535
 536 /*
 537  * SYSTEM_TIME
 538  */
 539
 540 static gint ett_SYSTEM_TIME = -1;
 541
 542 static int hf_time_year = -1;
 543 static int hf_time_month = -1;
 544 static int hf_time_dow = -1;
 545 static int hf_time_day = -1;
 546 static int hf_time_hour = -1;
 547 static int hf_time_minute = -1;
 548 static int hf_time_second = -1;
 549 static int hf_time_msec = -1;
 550
 551 static int
 552 dissect_SYSTEM_TIME(tvbuff_t *tvb, int offset, packet_info *pinfo,
 553                     proto_tree *tree, dcerpc_info *di, guint8 *drep, const char *name,
 554                     gboolean add_subtree, char **data)
 555 {
 556         proto_item *item = NULL;
 557         proto_tree *subtree = tree;
 558         guint16 year, month, day, hour, minute, second, millisecond;
 559         char *str;
 560
 561         if (add_subtree) {
 562                 item = proto_tree_add_text(tree, tvb, offset, 16, "%s", name);
 563                 subtree = proto_item_add_subtree(item, ett_SYSTEM_TIME);
 564         }
 565
 566         offset = dissect_ndr_uint16(
 567                 tvb, offset, pinfo, subtree, di, drep, hf_time_year, &year);
 568
 569         offset = dissect_ndr_uint16(
 570                 tvb, offset, pinfo, subtree, di, drep, hf_time_month, &month);
 571
 572         offset = dissect_ndr_uint16(
 573                 tvb, offset, pinfo, subtree, di, drep, hf_time_dow, NULL);
 574
 575         offset = dissect_ndr_uint16(
 576                 tvb, offset, pinfo, subtree, di, drep, hf_time_day, &day);
 577
 578         offset = dissect_ndr_uint16(
 579                 tvb, offset, pinfo, subtree, di, drep, hf_time_hour, &hour);
 580
 581         offset = dissect_ndr_uint16(
 582                 tvb, offset, pinfo, subtree, di, drep, hf_time_minute, &minute);
 583
 584         offset = dissect_ndr_uint16(
 585                 tvb, offset, pinfo, subtree, di, drep, hf_time_second, &second);
 586
 587         offset = dissect_ndr_uint16(
 588                 tvb, offset, pinfo, subtree, di, drep, hf_time_msec, &millisecond);
 589
 590         str = wmem_strdup_printf(wmem_packet_scope(),
 591                               "%d/%02d/%02d %02d:%02d:%02d.%03d",
 592                               year, month, day, hour, minute, second,
 593                               millisecond);
 594
 595         if (add_subtree)
 596                 proto_item_append_text(item, ": %s", str);
 597
 598         if (data)
 599                 *data = str;
 600
 601         return offset;
 602 }
 603
 604 static int
 605 dissect_SYSTEM_TIME_ptr(tvbuff_t *tvb, int offset, packet_info *pinfo,
 606                         proto_tree *tree, dcerpc_info *di, guint8 *drep)
 607 {
 608         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 609         char *str;
 610
 611
 612         offset =  dissect_SYSTEM_TIME(
 613                 tvb, offset, pinfo, tree, di, drep, NULL, FALSE, &str);
 614         dcv->private_data = str;
 615
 616         return offset;
 617 }
 618
 619 /*
 620  * SpoolssClosePrinter
 621  */
 622
 623 static int
 624 SpoolssClosePrinter_q(tvbuff_t *tvb, int offset,
 625                                  packet_info *pinfo, proto_tree *tree,
 626                                  dcerpc_info *di, guint8 *drep _U_)
 627 {
 628         e_ctx_hnd policy_hnd;
 629         char *pol_name;
 630
 631         /* Parse packet */
 632
 633         offset = dissect_nt_policy_hnd(
 634                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, NULL,
 635                 FALSE, TRUE);
 636
 637         dcerpc_fetch_polhnd_data(&policy_hnd, &pol_name, NULL, NULL, NULL,
 638                              pinfo->fd->num);
 639
 640         if (pol_name)
 641                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 642                                 pol_name);
 643
 644         return offset;
 645 }
 646
 647 static int
 648 SpoolssClosePrinter_r(tvbuff_t *tvb, int offset,
 649                                  packet_info *pinfo, proto_tree *tree,
 650                                  dcerpc_info *di, guint8 *drep _U_)
 651 {
 652         /* Parse packet */
 653
 654         offset = dissect_nt_policy_hnd(
 655                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
 656                 FALSE, FALSE);
 657
 658
 659         offset = dissect_doserror(
 660                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
 661
 662         return offset;
 663 }
 664
 665 /* Dissect some printer data.  The get/set/enum printerdata routines all
 666    store value/data in a uint8 array.  We could use the ndr routines for
 667    this but that would result in one item for each byte in the printer
 668    data. */
 669
 670 static gint ett_printerdata_data = -1;
 671 static gint ett_printerdata_value = -1;
 672
 673 static int
 674 dissect_printerdata_data(tvbuff_t *tvb, int offset,
 675                                     packet_info *pinfo, proto_tree *tree,
 676                                     dcerpc_info *di, guint8 *drep _U_, guint32 type)
 677 {
 678         proto_item *item, *hidden_item;
 679         proto_tree *subtree;
 680         guint32 size;
 681
 682         item = proto_tree_add_text(tree, tvb, offset, 0, "Data");
 683
 684         subtree = proto_item_add_subtree(item, ett_printerdata_data);
 685
 686         offset = dissect_ndr_uint32(
 687                 tvb, offset, pinfo, subtree, di, drep, hf_printerdata_size, &size);
 688
 689         if (size) {
 690
 691                 offset = dissect_ndr_uint8s(
 692                         tvb, offset, pinfo, subtree, di, drep,
 693                         hf_printerdata_data, size, NULL);
 694
 695                 switch(type) {
 696                 case DCERPC_REG_SZ: {
 697                         char *data = tvb_get_unicode_string(NULL, tvb, offset - size, size, ENC_LITTLE_ENDIAN);
 698
 699                         proto_item_append_text(item, ": %s", data);
 700
 701                         col_append_fstr(
 702                                         pinfo->cinfo, COL_INFO, " = %s", data);
 703
 704                         hidden_item = proto_tree_add_string(
 705                                 tree, hf_printerdata_data_sz, tvb,
 706                                 offset - size, size, data);
 707                         PROTO_ITEM_SET_HIDDEN(hidden_item);
 708
 709                         g_free(data);
 710
 711                         break;
 712                 }
 713                 case DCERPC_REG_DWORD: {
 714                         guint32 data = tvb_get_letohl(tvb, offset - size);
 715
 716                         proto_item_append_text(item, ": 0x%08x", data);
 717
 718                         col_append_fstr(
 719                                         pinfo->cinfo, COL_INFO, " = 0x%08x",
 720                                         data);
 721
 722                         hidden_item = proto_tree_add_uint(
 723                                 tree, hf_printerdata_data_dword, tvb,
 724                                 offset - size, 4, data);
 725                         PROTO_ITEM_SET_HIDDEN(hidden_item);
 726
 727                         break;
 728                 }
 729                 case DCERPC_REG_BINARY:
 730                         col_append_str(
 731                                         pinfo->cinfo, COL_INFO,
 732                                         " = <binary data>");
 733                         break;
 734
 735                 default:
 736                         break;
 737                 }
 738         }
 739
 740         proto_item_set_len(item, size + 4);
 741
 742         return offset;
 743 }
 744
 745 /*
 746  * SpoolssGetPrinterData
 747  */
 748
 749 static int
 750 SpoolssGetPrinterData_q(tvbuff_t *tvb, int offset,
 751                                    packet_info *pinfo, proto_tree *tree,
 752                                    dcerpc_info *di, guint8 *drep _U_)
 753 {
 754         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 755         char *value_name;
 756         proto_item *hidden_item;
 757
 758         hidden_item = proto_tree_add_uint(
 759                 tree, hf_printerdata, tvb, offset, 0, 1);
 760         PROTO_ITEM_SET_HIDDEN(hidden_item);
 761
 762         /* Parse packet */
 763
 764         offset = dissect_nt_policy_hnd(
 765                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
 766                 FALSE, FALSE);
 767
 768
 769         value_name=NULL;
 770         offset = dissect_ndr_cvstring(
 771                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
 772                 hf_printerdata_value, TRUE, value_name ? NULL : &value_name);
 773         /* GetPrinterData() stores the printerdata in se_data */
 774         if(!pinfo->fd->flags.visited){
 775                 if(!dcv->se_data){
 776                         if(value_name){
 777                                 dcv->se_data = wmem_strdup(wmem_file_scope(), value_name);
 778                         }
 779                 }
 780         }
 781
 782         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", value_name);
 783
 784         offset = dissect_ndr_uint32(
 785                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
 786
 787         return offset;
 788 }
 789
 790 static int
 791 SpoolssGetPrinterData_r(tvbuff_t *tvb, int offset,
 792                                    packet_info *pinfo, proto_tree *tree,
 793                                    dcerpc_info *di, guint8 *drep _U_)
 794 {
 795         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 796         guint32 type;
 797         proto_item *hidden_item;
 798         const char *data;
 799
 800         hidden_item = proto_tree_add_uint(
 801                 tree, hf_printerdata, tvb, offset, 0, 1);
 802         PROTO_ITEM_SET_HIDDEN(hidden_item);
 803
 804         /* Parse packet */
 805
 806         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
 807                                     hf_printerdata_type, &type);
 808
 809         data = (const char *)(dcv->se_data ? dcv->se_data : "????");
 810
 811         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", data);
 812
 813         offset = dissect_printerdata_data(
 814                 tvb, offset, pinfo, tree, di, drep, type);
 815
 816         offset = dissect_ndr_uint32(
 817                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
 818
 819         offset = dissect_doserror(
 820                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
 821
 822         return offset;
 823 }
 824
 825 /*
 826  * SpoolssGetPrinterDataEx
 827  */
 828
 829 static int
 830 SpoolssGetPrinterDataEx_q(tvbuff_t *tvb, int offset,
 831                                      packet_info *pinfo, proto_tree *tree,
 832                                      dcerpc_info *di, guint8 *drep _U_)
 833 {
 834         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 835         char *key_name, *value_name;
 836         proto_item *hidden_item;
 837
 838         hidden_item = proto_tree_add_uint(
 839                 tree, hf_printerdata, tvb, offset, 0, 1);
 840         PROTO_ITEM_SET_HIDDEN(hidden_item);
 841
 842         /* Parse packet */
 843
 844         offset = dissect_nt_policy_hnd(
 845                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
 846                 FALSE, FALSE);
 847
 848         key_name=NULL;
 849         offset = dissect_ndr_cvstring(
 850                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
 851                 hf_printerdata_key, TRUE, &key_name);
 852
 853         value_name=NULL;
 854         offset = dissect_ndr_cvstring(
 855                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
 856                 hf_printerdata_value, TRUE, &value_name);
 857
 858         /* GetPrinterDataEx() stores the key/value in se_data */
 859         if(!pinfo->fd->flags.visited){
 860                 if(!dcv->se_data){
 861                         dcv->se_data = wmem_strdup_printf(wmem_file_scope(),
 862                                 "%s==%s",
 863                                 key_name?key_name:"",
 864                                 value_name?value_name:"");
 865                 }
 866         }
 867
 868         if (dcv->se_data)
 869                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
 870                                 (char *)dcv->se_data);
 871
 872         offset = dissect_ndr_uint32(
 873                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
 874
 875         return offset;
 876 }
 877
 878 static int
 879 SpoolssGetPrinterDataEx_r(tvbuff_t *tvb, int offset,
 880                                      packet_info *pinfo, proto_tree *tree,
 881                                      dcerpc_info *di, guint8 *drep _U_)
 882 {
 883         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 884         guint32 size, type;
 885         proto_item *hidden_item;
 886
 887         hidden_item = proto_tree_add_uint(
 888                 tree, hf_printerdata, tvb, offset, 0, 1);
 889         PROTO_ITEM_SET_HIDDEN(hidden_item);
 890
 891         /* Parse packet */
 892
 893         offset = dissect_ndr_uint32(
 894                 tvb, offset, pinfo, tree, di, drep, hf_printerdata_type, &type);
 895
 896         offset = dissect_ndr_uint32(
 897                 tvb, offset, pinfo, tree, di, drep, hf_returned, &size);
 898
 899         if (dcv->se_data) {
 900                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", (char *)dcv->se_data);
 901         }
 902
 903         if (size)
 904                 dissect_printerdata_data(tvb, offset, pinfo, tree, di, drep, type);
 905
 906         offset += size;
 907
 908         offset = dissect_ndr_uint32(
 909                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
 910
 911         offset = dissect_doserror(
 912                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
 913
 914         return offset;
 915 }
 916
 917 /*
 918  * SpoolssSetPrinterData
 919  */
 920
 921 static int
 922 SpoolssSetPrinterData_q(tvbuff_t *tvb, int offset,
 923                                    packet_info *pinfo, proto_tree *tree,
 924                                    dcerpc_info *di, guint8 *drep _U_)
 925 {
 926         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
 927         char *value_name;
 928         guint32 type;
 929         proto_item *hidden_item;
 930
 931         hidden_item = proto_tree_add_uint(
 932                 tree, hf_printerdata, tvb, offset, 0, 1);
 933         PROTO_ITEM_SET_HIDDEN(hidden_item);
 934
 935         /* Parse packet */
 936
 937         offset = dissect_nt_policy_hnd(
 938                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
 939                 FALSE, FALSE);
 940
 941         value_name=NULL;
 942         offset = dissect_ndr_cvstring(
 943                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
 944                 hf_printerdata_value, TRUE, &value_name);
 945
 946         /* GetPrinterDataEx() stores the key/value in se_data */
 947         if(!pinfo->fd->flags.visited){
 948                 if(!dcv->se_data){
 949                         dcv->se_data = wmem_strdup_printf(wmem_file_scope(),
 950                                 "%s", value_name?value_name:"");
 951                 }
 952         }
 953
 954
 955         if (dcv->se_data){
 956                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", (char *)dcv->se_data);
 957         }
 958
 959         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
 960                                     hf_printerdata_type, &type);
 961
 962         offset = dissect_printerdata_data(
 963                 tvb, offset, pinfo, tree, di, drep, type);
 964
 965         offset = dissect_ndr_uint32(
 966                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
 967
 968         return offset;
 969 }
 970
 971 static int
 972 SpoolssSetPrinterData_r(tvbuff_t *tvb, int offset,
 973                                    packet_info *pinfo, proto_tree *tree,
 974                                    dcerpc_info *di, guint8 *drep _U_)
 975 {
 976         proto_item *hidden_item;
 977
 978         hidden_item = proto_tree_add_uint(
 979                 tree, hf_printerdata, tvb, offset, 0, 1);
 980         PROTO_ITEM_SET_HIDDEN(hidden_item);
 981
 982         /* Parse packet */
 983
 984         offset = dissect_doserror(
 985                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
 986
 987         return offset;
 988 }
 989
 990 /*
 991  * SpoolssSetPrinterDataEx
 992  */
 993
 994 static int hf_setprinterdataex_max_len = -1;
 995 static int hf_setprinterdataex_real_len = -1;
 996 static int hf_setprinterdataex_data = -1;
 997
 998 static int
 999 SpoolssSetPrinterDataEx_q(tvbuff_t *tvb, int offset,
1000                                      packet_info *pinfo, proto_tree *tree,
1001                                      dcerpc_info *di, guint8 *drep _U_)
1002 {
1003         char *key_name, *value_name;
1004         guint32 max_len;
1005         proto_item *hidden_item;
1006
1007         hidden_item = proto_tree_add_uint(
1008                 tree, hf_printerdata, tvb, offset, 0, 1);
1009         PROTO_ITEM_SET_HIDDEN(hidden_item);
1010
1011         /* Parse packet */
1012
1013         offset = dissect_nt_policy_hnd(
1014                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
1015                 FALSE, FALSE);
1016
1017         offset = dissect_ndr_cvstring(
1018                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
1019                 hf_printerdata_key, TRUE, &key_name);
1020
1021         offset = dissect_ndr_cvstring(
1022                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
1023                 hf_printerdata_value, TRUE, &value_name);
1024
1025         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s/%s",
1026                                 key_name, value_name);
1027
1028         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
1029                                     hf_printerdata_type, NULL);
1030
1031         offset = dissect_ndr_uint32(
1032                 tvb, offset, pinfo, tree, di, drep,
1033                 hf_setprinterdataex_max_len, &max_len);
1034
1035         offset = dissect_ndr_uint8s(
1036                 tvb, offset, pinfo, tree, di, drep,
1037                 hf_setprinterdataex_data, max_len, NULL);
1038
1039         offset = dissect_ndr_uint32(
1040                 tvb, offset, pinfo, tree, di, drep,
1041                 hf_setprinterdataex_real_len, NULL);
1042
1043         return offset;
1044 }
1045
1046 static int
1047 SpoolssSetPrinterDataEx_r(tvbuff_t *tvb, int offset,
1048                                      packet_info *pinfo, proto_tree *tree,
1049                                      dcerpc_info *di, guint8 *drep _U_)
1050 {
1051         proto_item *hidden_item;
1052
1053         hidden_item = proto_tree_add_uint(
1054                 tree, hf_printerdata, tvb, offset, 0, 1);
1055         PROTO_ITEM_SET_HIDDEN(hidden_item);
1056
1057         /* Parse packet */
1058
1059         offset = dissect_doserror(
1060                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
1061
1062         return offset;
1063 }
1064
1065 /* XXX - "name" should be an hf_ value for an FT_STRING. */
1066 static int
1067 dissect_spoolss_uint16uni(tvbuff_t *tvb, int offset, packet_info *pinfo _U_,
1068                           proto_tree *tree, guint8 *drep _U_, char **data,
1069                           const char *name)
1070 {
1071         gint len, remaining;
1072         char *text;
1073
1074         if (offset % 2)
1075                 offset += 2 - (offset % 2);
1076
1077         /* Get remaining data in buffer as a string */
1078
1079         remaining = tvb_length_remaining(tvb, offset);
1080         if (remaining <= 0) {
1081                 if (data)
1082                         *data = g_strdup("");
1083                 return offset;
1084         }
1085
1086         text = tvb_get_unicode_string(NULL, tvb, offset, remaining, ENC_LITTLE_ENDIAN);
1087         len = (int)strlen(text);
1088
1089         proto_tree_add_text(tree, tvb, offset, len * 2, "%s: %s",
1090                             name ? name : "String", text);
1091
1092         if (data)
1093                 *data = text;
1094         else
1095                 g_free(text);
1096
1097         return offset + (len + 1) * 2;
1098 }
1099
1100 /*
1101  * DEVMODE
1102  */
1103
1104 /* Devicemode orientation values */
1105
1106 static const value_string devmode_orientation_vals[] =
1107 {
1108         { DEVMODE_ORIENTATION_PORTRAIT, "Portrait" },
1109         { DEVMODE_ORIENTATION_LANDSCAPE, "Landscape" },
1110         { 0, NULL }
1111 };
1112
1113 /* Paper size values.  International paper sizes is a fascinating
1114    topic.  No seriously!  (-: */
1115
1116 static const value_string devmode_papersize_vals[] =
1117 {
1118         { DEVMODE_PAPERSIZE_LETTER, "Letter" },
1119         { DEVMODE_PAPERSIZE_LETTERSMALL, "Letter (small)" },
1120         { DEVMODE_PAPERSIZE_TABLOID, "Tabloid" },
1121         { DEVMODE_PAPERSIZE_LEDGER, "Ledger" },
1122         { DEVMODE_PAPERSIZE_LEGAL, "Legal" },
1123         { DEVMODE_PAPERSIZE_STATEMENT, "Statement" },
1124         { DEVMODE_PAPERSIZE_EXECUTIVE, "Executive" },
1125         { DEVMODE_PAPERSIZE_A3, "A3" },
1126         { DEVMODE_PAPERSIZE_A4, "A4" },
1127         { DEVMODE_PAPERSIZE_A4SMALL, "A4 (small)" },
1128         { DEVMODE_PAPERSIZE_A5, "A5" },
1129         { DEVMODE_PAPERSIZE_B4, "B4" },
1130         { DEVMODE_PAPERSIZE_B5, "B5" },
1131         { DEVMODE_PAPERSIZE_FOLIO, "Folio" },
1132         { DEVMODE_PAPERSIZE_QUARTO, "Quarto" },
1133         { DEVMODE_PAPERSIZE_10X14, "10x14" },
1134         { DEVMODE_PAPERSIZE_11X17, "11x17" },
1135         { DEVMODE_PAPERSIZE_NOTE, "Note" },
1136         { DEVMODE_PAPERSIZE_ENV9, "Envelope #9" },
1137         { DEVMODE_PAPERSIZE_ENV10, "Envelope #10" },
1138         { DEVMODE_PAPERSIZE_ENV11, "Envelope #11" },
1139         { DEVMODE_PAPERSIZE_ENV12, "Envelope #12" },
1140         { DEVMODE_PAPERSIZE_ENV14, "Envelope #14" },
1141         { DEVMODE_PAPERSIZE_CSHEET, "C sheet" },
1142         { DEVMODE_PAPERSIZE_DSHEET, "D sheet" },
1143         { DEVMODE_PAPERSIZE_ESHEET, "E sheet" },
1144         { DEVMODE_PAPERSIZE_ENVDL, "Envelope DL" },
1145         { DEVMODE_PAPERSIZE_ENVC5, "Envelope C5" },
1146         { DEVMODE_PAPERSIZE_ENVC3, "Envelope C3" },
1147         { DEVMODE_PAPERSIZE_ENVC4, "Envelope C4" },
1148         { DEVMODE_PAPERSIZE_ENVC6, "Envelope C6" },
1149         { DEVMODE_PAPERSIZE_ENVC65, "Envelope C65" },
1150         { DEVMODE_PAPERSIZE_ENVB4, "Envelope B4" },
1151         { DEVMODE_PAPERSIZE_ENVB5, "Envelope B5" },
1152         { DEVMODE_PAPERSIZE_ENVB6, "Envelope B6" },
1153         { DEVMODE_PAPERSIZE_ENVITALY, "Envelope (Italy)" },
1154         { DEVMODE_PAPERSIZE_ENVMONARCH, "Envelope (Monarch)" },
1155         { DEVMODE_PAPERSIZE_ENVPERSONAL, "Envelope (Personal)" },
1156         { DEVMODE_PAPERSIZE_FANFOLDUS, "Fanfold (US)" },
1157         { DEVMODE_PAPERSIZE_FANFOLDSTDGERMAN, "Fanfold (Std German)" },
1158         { DEVMODE_PAPERSIZE_FANFOLDLGLGERMAN, "Fanfold (Legal German)" },
1159         { DEVMODE_PAPERSIZE_ISOB4, "B4 (ISO)" },
1160         { DEVMODE_PAPERSIZE_JAPANESEPOSTCARD, "Japanese postcard" },
1161         { DEVMODE_PAPERSIZE_9X11, "9x11" },
1162         { DEVMODE_PAPERSIZE_10X11, "10x11" },
1163         { DEVMODE_PAPERSIZE_15X11, "15x11" },
1164         { DEVMODE_PAPERSIZE_ENVINVITE, "Envelope (Invite)" },
1165         { DEVMODE_PAPERSIZE_RESERVED48, "Reserved (48)" },
1166         { DEVMODE_PAPERSIZE_RESERVED49, "Reserved (49)" },
1167         { DEVMODE_PAPERSIZE_LETTEREXTRA, "Letter (Extra)" },
1168         { DEVMODE_PAPERSIZE_LEGALEXTRA, "Legal (Extra)" },
1169         { DEVMODE_PAPERSIZE_TABLOIDEXTRA, "Tabloid (Extra)" },
1170         { DEVMODE_PAPERSIZE_A4EXTRA, "A4 (Extra)" },
1171         { DEVMODE_PAPERSIZE_LETTERTRANS, "Letter (Transverse)" },
1172         { DEVMODE_PAPERSIZE_A4TRANS, "A4 (Transverse)" },
1173         { DEVMODE_PAPERSIZE_LETTEREXTRATRANS, "Letter (Extra, Transverse)" },
1174         { DEVMODE_PAPERSIZE_APLUS, "A+" },
1175         { DEVMODE_PAPERSIZE_BPLUS, "B+" },
1176         { DEVMODE_PAPERSIZE_LETTERPLUS, "Letter+" },
1177         { DEVMODE_PAPERSIZE_A4PLUS, "A4+" },
1178         { DEVMODE_PAPERSIZE_A5TRANS, "A5 (Transverse)" },
1179         { DEVMODE_PAPERSIZE_B5TRANS, "B5 (Transverse)" },
1180         { DEVMODE_PAPERSIZE_A3EXTRA, "A3 (Extra)" },
1181         { DEVMODE_PAPERSIZE_A5EXTRA, "A5 (Extra)" },
1182         { DEVMODE_PAPERSIZE_B5EXTRA, "B5 (Extra)" },
1183         { DEVMODE_PAPERSIZE_A2, "A2" },
1184         { DEVMODE_PAPERSIZE_A3TRANS, "A3 (Transverse)" },
1185         { DEVMODE_PAPERSIZE_A3EXTRATRANS, "A3 (Extra, Transverse" },
1186         { DEVMODE_PAPERSIZE_DBLJAPANESEPOSTCARD, "Double Japanese Postcard" },
1187         { DEVMODE_PAPERSIZE_A6, "A6" },
1188         { DEVMODE_PAPERSIZE_JENVKAKU2, "Japanese Envelope (Kaku #2)" },
1189         { DEVMODE_PAPERSIZE_JENVKAKU3, "Japanese Envelope (Kaku #3)" },
1190         { DEVMODE_PAPERSIZE_JENVCHOU3, "Japanese Envelope (Chou #3)" },
1191         { DEVMODE_PAPERSIZE_JENVCHOU4, "Japaneve Envelope (Chou #4)" },
1192         { DEVMODE_PAPERSIZE_LETTERROT, "Letter (Rotated)" },
1193         { DEVMODE_PAPERSIZE_A3ROT, "A3 (Rotated)" },
1194         { DEVMODE_PAPERSIZE_A4ROT, "A4 (Rotated)" },
1195         { DEVMODE_PAPERSIZE_A5ROT, "A5 (Rotated)" },
1196         { DEVMODE_PAPERSIZE_B4JISROT, "B4 (JIS, Rotated)" },
1197         { DEVMODE_PAPERSIZE_B5JISROT, "B5 (JIS, Rotated)"},
1198         { DEVMODE_PAPERSIZE_JAPANESEPOSTCARDROT,
1199           "Japanese Postcard (Rotated)" },
1200         { DEVMODE_PAPERSIZE_DBLJAPANESEPOSTCARDROT82,
1201           "Double Japanese Postcard (Rotated)" },
1202         { DEVMODE_PAPERSIZE_A6ROT, "A6 (Rotated)" },
1203         { DEVMODE_PAPERSIZE_JENVKAKU2ROT,
1204           "Japanese Envelope (Kaku #2, Rotated)" },
1205         { DEVMODE_PAPERSIZE_JENVKAKU3ROT,
1206           "Japanese Envelope (Kaku #3, Rotated)" },
1207         { DEVMODE_PAPERSIZE_JENVCHOU3ROT,
1208           "Japanese Envelope (Chou #3, Rotated)" },
1209         { DEVMODE_PAPERSIZE_JENVCHOU4ROT,
1210           "Japanese Envelope (Chou #4, Rotated)" },
1211         { DEVMODE_PAPERSIZE_B6JIS, "B6 (JIS)" },
1212         { DEVMODE_PAPERSIZE_B6JISROT, "B6 (JIS, Rotated)" },
1213         { DEVMODE_PAPERSIZE_12X11, "12x11" },
1214         { DEVMODE_PAPERSIZE_JENVYOU4, "Japanese Envelope (You #4)" },
1215         { DEVMODE_PAPERSIZE_JENVYOU4ROT,
1216           "Japanese Envelope (You #4, Rotated" },
1217         { DEVMODE_PAPERSIZE_P16K, "PRC 16K" },
1218         { DEVMODE_PAPERSIZE_P32K, "PRC 32K" },
1219         { DEVMODE_PAPERSIZE_P32KBIG, "P32K (Big)" },
1220         { DEVMODE_PAPERSIZE_PENV1, "PRC Envelope #1" },
1221         { DEVMODE_PAPERSIZE_PENV2, "PRC Envelope #2" },
1222         { DEVMODE_PAPERSIZE_PENV3, "PRC Envelope #3" },
1223         { DEVMODE_PAPERSIZE_PENV4, "PRC Envelope #4" },
1224         { DEVMODE_PAPERSIZE_PENV5, "PRC Envelope #5" },
1225         { DEVMODE_PAPERSIZE_PENV6, "PRC Envelope #6" },
1226         { DEVMODE_PAPERSIZE_PENV7, "PRC Envelope #7" },
1227         { DEVMODE_PAPERSIZE_PENV8, "PRC Envelope #8" },
1228         { DEVMODE_PAPERSIZE_PENV9, "PRC Envelope #9" },
1229         { DEVMODE_PAPERSIZE_PENV10, "PRC Envelope #10" },
1230         { DEVMODE_PAPERSIZE_P16KROT, "PRC 16K (Rotated)" },
1231         { DEVMODE_PAPERSIZE_P32KROT, "PRC 32K (Rotated)" },
1232         { DEVMODE_PAPERSIZE_P32KBIGROT, "PRC 32K (Big, Rotated)" },
1233         { DEVMODE_PAPERSIZE_PENV1ROT, "PRC Envelope #1 (Rotated)" },
1234         { DEVMODE_PAPERSIZE_PENV2ROT, "PRC Envelope #2 (Rotated)" },
1235         { DEVMODE_PAPERSIZE_PENV3ROT, "PRC Envelope #3 (Rotated)" },
1236         { DEVMODE_PAPERSIZE_PENV4ROT, "PRC Envelope #4 (Rotated)" },
1237         { DEVMODE_PAPERSIZE_PENV5ROT, "PRC Envelope #5 (Rotated)" },
1238         { DEVMODE_PAPERSIZE_PENV6ROT, "PRC Envelope #6 (Rotated)" },
1239         { DEVMODE_PAPERSIZE_PENV7ROT, "PRC Envelope #7 (Rotated)" },
1240         { DEVMODE_PAPERSIZE_PENV8ROT, "PRC Envelope #8 (Rotated)" },
1241         { DEVMODE_PAPERSIZE_PENV9ROT, "PRC Envelope #9 (Rotated)" },
1242         { DEVMODE_PAPERSIZE_PENV10ROT, "PRC Envelope #10 (Rotated)" },
1243         { 0, NULL }
1244 };
1245 static value_string_ext devmode_papersize_vals_ext = VALUE_STRING_EXT_INIT(devmode_papersize_vals);
1246
1247 /* List of observed specversions */
1248
1249 static const value_string devmode_specversion_vals[] =
1250 {
1251         { 0x0320, "Observed" },
1252         { 0x0400, "Observed" },
1253         { 0x0401, "Observed" },
1254         { 0x040d, "Observed" },
1255         { 0, NULL }
1256 };
1257
1258 /* Paper sources */
1259
1260 static const value_string devmode_papersource_vals[] =
1261 {
1262         { DEVMODE_PAPERSOURCE_UPPER, "Upper" },
1263         { DEVMODE_PAPERSOURCE_LOWER, "Lower" },
1264         { DEVMODE_PAPERSOURCE_MIDDLE, "Middle" },
1265         { DEVMODE_PAPERSOURCE_MANUAL, "Manual" },
1266         { DEVMODE_PAPERSOURCE_ENV, "Envelope" },
1267         { DEVMODE_PAPERSOURCE_ENVMANUAL, "Envelope Manual" },
1268         { DEVMODE_PAPERSOURCE_AUTO, "Auto" },
1269         { DEVMODE_PAPERSOURCE_TRACTOR, "Tractor" },
1270         { DEVMODE_PAPERSOURCE_SMALLFMT, "Small Format" },
1271         { DEVMODE_PAPERSOURCE_LARGEFMAT, "Large Format" },
1272         { DEVMODE_PAPERSOURCE_LARGECAP, "Large Capacity" },
1273         { DEVMODE_PAPERSOURCE_CASSETTE, "Cassette" },
1274         { DEVMODE_PAPERSOURCE_FORMSRC, "Form Source" },
1275         { 0, NULL }
1276 };
1277 static value_string_ext devmode_papersource_vals_ext = VALUE_STRING_EXT_INIT(devmode_papersource_vals);
1278
1279 /* Print quality */
1280
1281 static const value_string devmode_printquality_vals[] =
1282 {
1283         { DEVMODE_PRINTQUALITY_HIGH, "High" },
1284         { DEVMODE_PRINTQUALITY_MEDIUM, "Medium" },
1285         { DEVMODE_PRINTQUALITY_LOW, "Low" },
1286         { DEVMODE_PRINTQUALITY_DRAFT, "Draft" },
1287         { 0, NULL }
1288 };
1289
1290 /* Color */
1291
1292 static const value_string devmode_colour_vals[] =
1293 {
1294         { DEVMODE_COLOUR_COLOUR, "Colour" },
1295         { DEVMODE_COLOUR_MONO, "Monochrome" },
1296         { 0, NULL }
1297 };
1298
1299 /* TrueType options */
1300
1301 static const value_string devmode_ttoption_vals[] =
1302 {
1303         { 0, "Not set" },
1304         { DEVMODE_TTOPTION_BITMAP, "Bitmap" },
1305         { DEVMODE_TTOPTION_DOWNLOAD, "Download" },
1306         { DEVMODE_TTOPTION_DOWNLOAD_OUTLINE, "Download outline" },
1307         { DEVMODE_TTOPTION_SUBDEV, "Substitute device fonts" },
1308         { 0, NULL }
1309 };
1310
1311 /* Collate info */
1312
1313 static const value_string devmode_collate_vals[] =
1314 {
1315         { DEVMODE_COLLATE_FALSE, "False" },
1316         { DEVMODE_COLLATE_TRUE, "True" },
1317         { 0, NULL }
1318 };
1319
1320 /* Duplex info */
1321
1322 static const value_string devmode_duplex_vals[] =
1323 {
1324         { DEVMODE_DUPLEX_SIMPLEX, "Simplex" },
1325         { DEVMODE_DUPLEX_VERT, "Vertical" },
1326         { DEVMODE_DUPLEX_HORIZ, "Horizontal" },
1327         { 0, NULL }
1328 };
1329
1330 static const value_string devmode_displayflags_vals[] =
1331 {
1332         { 0, "Colour" },
1333         { DEVMODE_DISPLAYFLAGS_GRAYSCALE, "Grayscale" },
1334         { DEVMODE_DISPLAYFLAGS_INTERLACED, "Interlaced" },
1335         { 0, NULL }
1336 };
1337
1338 static const value_string devmode_icmmethod_vals[] =
1339 {
1340         { DEVMODE_ICMMETHOD_NONE, "None" },
1341         { DEVMODE_ICMMETHOD_SYSTEM, "System" },
1342         { DEVMODE_ICMMETHOD_DRIVER, "Driver" },
1343         { DEVMODE_ICMMETHOD_DEVICE, "Device" },
1344         { 0, NULL }
1345 };
1346
1347 static const value_string devmode_icmintent_vals[] =
1348 {
1349         { 0, "Not set" },
1350         { DEVMODE_ICMINTENT_SATURATE, "Saturate" },
1351         { DEVMODE_ICMINTENT_CONTRAST, "Contrast" },
1352         { DEVMODE_ICMINTENT_COLORIMETRIC, "Colorimetric" },
1353         { DEVMODE_ICMINTENT_ABS_COLORIMETRIC, "Absolute colorimetric" },
1354         { 0, NULL }
1355 };
1356
1357 static const value_string devmode_mediatype_vals[] =
1358 {
1359         { 0, "Not set" },
1360         { DEVMODE_MEDIATYPE_STANDARD, "Standard" },
1361         { DEVMODE_MEDIATYPE_TRANSPARENCY, "Transparency" },
1362         { DEVMODE_MEDIATYPE_GLOSSY, "Glossy" },
1363         { 0, NULL }
1364 };
1365
1366 static const value_string devmode_dithertype_vals[] =
1367 {
1368         { 0, "Not set" },
1369         { DEVMODE_DITHERTYPE_NONE, "None" },
1370         { DEVMODE_DITHERTYPE_COARSE, "Coarse" },
1371         { DEVMODE_DITHERTYPE_LINE, "Line" },
1372         { DEVMODE_DITHERTYPE_LINEART, "Line art" },
1373         { DEVMODE_DITHERTYPE_ERRORDIFFUSION, "Error diffusion" },
1374         { DEVMODE_DITHERTYPE_RESERVED6, "Reserved 6" },
1375         { DEVMODE_DITHERTYPE_RESERVED7, "Reserved 7" },
1376         { DEVMODE_DITHERTYPE_GRAYSCALE, "Grayscale" },
1377         { 0, NULL }
1378 };
1379
1380 static gint ett_DEVMODE_fields = -1;
1381
1382 static int
1383 dissect_DEVMODE_fields(tvbuff_t *tvb, gint offset, packet_info *pinfo,
1384                        proto_tree *tree, dcerpc_info *di, guint8 *drep _U_, guint32 *pdata)
1385 {
1386         proto_item *item;
1387         proto_tree *subtree;
1388         guint32 fields;
1389         proto_item *hidden_item;
1390
1391         hidden_item = proto_tree_add_uint(
1392                 tree, hf_devmode, tvb, offset, 0, 1);
1393         PROTO_ITEM_SET_HIDDEN(hidden_item);
1394
1395         offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep,
1396                                     hf_devmode_fields, &fields);
1397
1398         item = proto_tree_add_text(tree, tvb, offset - 4, 4,
1399                                    "Fields: 0x%08x", fields);
1400
1401         subtree = proto_item_add_subtree(item, ett_DEVMODE_fields);
1402
1403         proto_tree_add_boolean(
1404                 subtree, hf_devmode_fields_orientation,
1405                 tvb, offset - 4, 4, fields);
1406
1407         proto_tree_add_boolean(
1408                 subtree, hf_devmode_fields_papersize,
1409                 tvb, offset - 4, 4, fields);
1410
1411         proto_tree_add_boolean(
1412                 subtree, hf_devmode_fields_paperlength,
1413                 tvb, offset - 4, 4, fields);
1414
1415         proto_tree_add_boolean(
1416                 subtree, hf_devmode_fields_paperwidth,
1417                 tvb, offset - 4, 4, fields);
1418
1419         proto_tree_add_boolean(
1420                 subtree, hf_devmode_fields_scale,
1421                 tvb, offset - 4, 4, fields);
1422
1423         proto_tree_add_boolean(
1424                 subtree, hf_devmode_fields_position,
1425                 tvb, offset - 4, 4, fields);
1426
1427         proto_tree_add_boolean(
1428                 subtree, hf_devmode_fields_nup,
1429                 tvb, offset - 4, 4, fields);
1430
1431         proto_tree_add_boolean(
1432                 subtree, hf_devmode_fields_copies,
1433                 tvb, offset - 4, 4, fields);
1434
1435         proto_tree_add_boolean(
1436                 subtree, hf_devmode_fields_defaultsource,
1437                 tvb, offset - 4, 4, fields);
1438
1439         proto_tree_add_boolean(
1440                 subtree, hf_devmode_fields_printquality,
1441                 tvb, offset - 4, 4, fields);
1442
1443         proto_tree_add_boolean(
1444                 subtree, hf_devmode_fields_color,
1445                 tvb, offset - 4, 4, fields);
1446
1447         proto_tree_add_boolean(
1448                 subtree, hf_devmode_fields_duplex,
1449                 tvb, offset - 4, 4, fields);
1450
1451         proto_tree_add_boolean(
1452                 subtree, hf_devmode_fields_yresolution,
1453                 tvb, offset - 4, 4, fields);
1454
1455         proto_tree_add_boolean(
1456                 subtree, hf_devmode_fields_ttoption,
1457                 tvb, offset - 4, 4, fields);
1458
1459         proto_tree_add_boolean(
1460                 subtree, hf_devmode_fields_collate,
1461                 tvb, offset - 4, 4, fields);
1462
1463         proto_tree_add_boolean(
1464                 subtree, hf_devmode_fields_formname,
1465                 tvb, offset - 4, 4, fields);
1466
1467         proto_tree_add_boolean(
1468                 subtree, hf_devmode_fields_logpixels,
1469                 tvb, offset - 4, 4, fields);
1470
1471         proto_tree_add_boolean(
1472                 subtree, hf_devmode_fields_bitsperpel,
1473                 tvb, offset - 4, 4, fields);
1474
1475         proto_tree_add_boolean(
1476                 subtree, hf_devmode_fields_pelswidth,
1477                 tvb, offset - 4, 4, fields);
1478
1479         proto_tree_add_boolean(
1480                 subtree, hf_devmode_fields_pelsheight,
1481                 tvb, offset - 4, 4, fields);
1482
1483         proto_tree_add_boolean(
1484                 subtree, hf_devmode_fields_displayflags,
1485                 tvb, offset - 4, 4, fields);
1486
1487         proto_tree_add_boolean(
1488                 subtree, hf_devmode_fields_displayfrequency,
1489                 tvb, offset - 4, 4, fields);
1490
1491         proto_tree_add_boolean(
1492                 subtree, hf_devmode_fields_icmmethod,
1493                 tvb, offset - 4, 4, fields);
1494
1495         proto_tree_add_boolean(
1496                 subtree, hf_devmode_fields_icmintent,
1497                 tvb, offset - 4, 4, fields);
1498
1499         proto_tree_add_boolean(
1500                 subtree, hf_devmode_fields_mediatype,
1501                 tvb, offset - 4, 4, fields);
1502
1503         proto_tree_add_boolean(
1504                 subtree, hf_devmode_fields_dithertype,
1505                 tvb, offset - 4, 4, fields);
1506
1507         proto_tree_add_boolean(
1508                 subtree, hf_devmode_fields_panningwidth,
1509                 tvb, offset - 4, 4, fields);
1510
1511         proto_tree_add_boolean(
1512                 subtree, hf_devmode_fields_panningheight,
1513                 tvb, offset - 4, 4, fields);
1514
1515         if (pdata)
1516                 *pdata = fields;
1517
1518         return offset;
1519 }
1520
1521 static gint ett_DEVMODE = -1;
1522
1523 static int
1524 dissect_DEVMODE(tvbuff_t *tvb, int offset, packet_info *pinfo,
1525                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
1526 {
1527         proto_item *item;
1528         proto_tree *subtree;
1529         guint16 driver_extra;
1530         gint16 print_quality;
1531         guint32 fields;
1532         int struct_start = offset;
1533
1534         if (di->conformant_run)
1535                 return offset;
1536
1537         item = proto_tree_add_text(tree, tvb, offset, 0, "Devicemode");
1538         subtree = proto_item_add_subtree(item, ett_DEVMODE);
1539
1540         offset = dissect_ndr_uint32(
1541                 tvb, offset, pinfo, subtree, di, drep, hf_devmode_size,
1542                 NULL);
1543
1544         /* The device name is stored in a 32-wchar buffer */
1545
1546         dissect_spoolss_uint16uni(tvb, offset, pinfo, subtree, drep, NULL,
1547                 "Devicename");
1548         offset += 64;
1549
1550         offset = dissect_ndr_uint16(
1551                 tvb, offset, pinfo, subtree, di, drep,
1552                 hf_devmode_spec_version, NULL);
1553
1554         offset = dissect_ndr_uint16(
1555                 tvb, offset, pinfo, subtree, di, drep,
1556                 hf_devmode_driver_version, NULL);
1557
1558         offset = dissect_ndr_uint16(
1559                 tvb, offset, pinfo, subtree, di, drep,
1560                 hf_devmode_size2, NULL);
1561
1562         offset = dissect_ndr_uint16(
1563                 tvb, offset, pinfo, subtree, di, drep,
1564                 hf_devmode_driver_extra_len, &driver_extra);
1565
1566         offset = dissect_DEVMODE_fields(
1567                 tvb, offset, pinfo, subtree, di, drep, &fields);
1568
1569         offset = dissect_ndr_uint16(
1570                 tvb, offset, pinfo, subtree, di, drep,
1571                 hf_devmode_orientation, NULL);
1572
1573         offset = dissect_ndr_uint16(
1574                 tvb, offset, pinfo, subtree, di, drep,
1575                 hf_devmode_paper_size, NULL);
1576
1577         offset = dissect_ndr_uint16(
1578                 tvb, offset, pinfo, subtree, di, drep,
1579                 hf_devmode_paper_length, NULL);
1580
1581         offset = dissect_ndr_uint16(
1582                 tvb, offset, pinfo, subtree, di, drep,
1583                 hf_devmode_paper_width, NULL);
1584
1585         offset = dissect_ndr_uint16(
1586                 tvb, offset, pinfo, subtree, di, drep,
1587                 hf_devmode_scale, NULL);
1588
1589         offset = dissect_ndr_uint16(
1590                 tvb, offset, pinfo, subtree, di, drep,
1591                 hf_devmode_copies, NULL);
1592
1593         offset = dissect_ndr_uint16(
1594                 tvb, offset, pinfo, subtree, di, drep,
1595                 hf_devmode_default_source, NULL);
1596
1597         offset = dissect_ndr_uint16(
1598                 tvb, offset, pinfo, NULL, di, drep,
1599                 hf_devmode_print_quality, &print_quality);
1600
1601         if (print_quality < 0)
1602                 proto_tree_add_item(
1603                         subtree, hf_devmode_print_quality, tvb,
1604                         offset - 2, 2, DREP_ENC_INTEGER(drep));
1605         else
1606                 proto_tree_add_text(
1607                         subtree, tvb, offset - 4, 4,
1608                         "Print Quality: %d dpi", print_quality);
1609
1610         offset = dissect_ndr_uint16(
1611                 tvb, offset, pinfo, subtree, di, drep,
1612                 hf_devmode_color, NULL);
1613
1614         offset = dissect_ndr_uint16(
1615                 tvb, offset, pinfo, subtree, di, drep,
1616                 hf_devmode_duplex, NULL);
1617
1618         offset = dissect_ndr_uint16(
1619                 tvb, offset, pinfo, subtree, di, drep,
1620                 hf_devmode_y_resolution, NULL);
1621
1622         offset = dissect_ndr_uint16(
1623                 tvb, offset, pinfo, subtree, di, drep,
1624                 hf_devmode_tt_option, NULL);
1625
1626         offset = dissect_ndr_uint16(
1627                 tvb, offset, pinfo, subtree, di, drep,
1628                 hf_devmode_collate, NULL);
1629
1630         dissect_spoolss_uint16uni(tvb, offset, pinfo, subtree, drep, NULL,
1631                 "Form name");
1632         offset += 64;
1633
1634         offset = dissect_ndr_uint16(
1635                 tvb, offset, pinfo, subtree, di, drep,
1636                 hf_devmode_log_pixels, NULL);
1637
1638         offset = dissect_ndr_uint32(
1639                 tvb, offset, pinfo, subtree, di, drep,
1640                 hf_devmode_bits_per_pel, NULL);
1641
1642         offset = dissect_ndr_uint32(
1643                 tvb, offset, pinfo, subtree, di, drep,
1644                 hf_devmode_pels_width, NULL);
1645
1646         offset = dissect_ndr_uint32(
1647                 tvb, offset, pinfo, subtree, di, drep,
1648                 hf_devmode_pels_height, NULL);
1649
1650         offset = dissect_ndr_uint32(
1651                 tvb, offset, pinfo, subtree, di, drep,
1652                 hf_devmode_display_flags, NULL);
1653
1654         offset = dissect_ndr_uint32(
1655                 tvb, offset, pinfo, subtree, di, drep,
1656                 hf_devmode_display_freq, NULL);
1657
1658         /* TODO: Some of the remaining fields are optional.  See
1659            rpc_parse/parse_spoolss.c in the Samba source for details. */
1660
1661         offset = dissect_ndr_uint32(
1662                 tvb, offset, pinfo, subtree, di, drep,
1663                 hf_devmode_icm_method, NULL);
1664
1665         offset = dissect_ndr_uint32(
1666                 tvb, offset, pinfo, subtree, di, drep,
1667                 hf_devmode_icm_intent, NULL);
1668
1669         offset = dissect_ndr_uint32(
1670                 tvb, offset, pinfo, subtree, di, drep,
1671                 hf_devmode_media_type, NULL);
1672
1673         offset = dissect_ndr_uint32(
1674                 tvb, offset, pinfo, subtree, di, drep,
1675                 hf_devmode_dither_type, NULL);
1676
1677         offset = dissect_ndr_uint32(
1678                 tvb, offset, pinfo, subtree, di, drep,
1679                 hf_devmode_reserved1, NULL);
1680
1681         offset = dissect_ndr_uint32(
1682                 tvb, offset, pinfo, subtree, di, drep,
1683                 hf_devmode_reserved2, NULL);
1684
1685         offset = dissect_ndr_uint32(
1686                 tvb, offset, pinfo, subtree, di, drep,
1687                 hf_devmode_panning_width, NULL);
1688
1689         offset = dissect_ndr_uint32(
1690                 tvb, offset, pinfo, subtree, di, drep,
1691                 hf_devmode_panning_height, NULL);
1692
1693         if (driver_extra)
1694                 offset = dissect_ndr_uint8s(
1695                         tvb, offset, pinfo, subtree, di, drep,
1696                         hf_devmode_driver_extra, driver_extra, NULL);
1697
1698         proto_item_set_len(item, offset - struct_start);
1699
1700         return offset;
1701 }
1702
1703 /*
1704  * DEVMODE_CTR
1705  */
1706
1707 static gint ett_DEVMODE_CTR = -1;
1708
1709 static int
1710 dissect_DEVMODE_CTR(tvbuff_t *tvb, int offset, packet_info *pinfo,
1711                                proto_tree *tree, dcerpc_info *di, guint8 *drep)
1712 {
1713         proto_item *item;
1714         proto_tree *subtree;
1715         guint32 size;
1716
1717         item = proto_tree_add_text(
1718                 tree, tvb, offset, 0, "Devicemode container");
1719
1720         subtree = proto_item_add_subtree(item, ett_DEVMODE_CTR);
1721
1722         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
1723                                     hf_devmodectr_size, &size);
1724
1725         offset = dissect_ndr_pointer(
1726                 tvb, offset, pinfo, subtree, di, drep,
1727                 dissect_DEVMODE, NDR_POINTER_UNIQUE, "Devicemode", -1);
1728
1729         return offset;
1730 }
1731
1732 /*
1733  * Relative string given by offset into the current buffer.  Note that
1734  * the offset for subsequent relstrs are against the structure start, not
1735  * the point where the offset is parsed from.
1736  */
1737
1738 static gint ett_RELSTR = -1;
1739
1740 static int
1741 dissect_spoolss_relstr(tvbuff_t *tvb, int offset, packet_info *pinfo,
1742                        proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index,
1743                        int struct_start, char **data)
1744 {
1745         proto_item *item;
1746         proto_tree *subtree;
1747         guint32 relstr_offset, relstr_start, relstr_end;
1748         char *text;
1749
1750         /* Peek ahead to read the string.  We need this for the
1751            proto_tree_add_string() call so filtering will work. */
1752
1753         offset = dissect_ndr_uint32(
1754                 tvb, offset, pinfo, NULL, di, drep, hf_offset, &relstr_offset);
1755
1756         relstr_start = relstr_offset + struct_start;
1757
1758         if (relstr_offset) {
1759                 relstr_end = dissect_spoolss_uint16uni(
1760                         tvb, relstr_start, pinfo, NULL, drep, &text, NULL);
1761         } else {                        /* relstr_offset == 0 is a NULL string */
1762                 text = g_strdup("");
1763                 relstr_end = relstr_start;
1764         }
1765
1766         /* OK now add the proto item with the string value */
1767
1768         item = proto_tree_add_string(tree, hf_index, tvb, relstr_start, relstr_end - relstr_start, text);
1769         subtree = proto_item_add_subtree(item, ett_RELSTR);
1770
1771         dissect_ndr_uint32(
1772                 tvb, offset - 4, pinfo, subtree, di, drep, hf_offset, NULL);
1773
1774         if (relstr_offset)
1775                 dissect_spoolss_uint16uni(
1776                         tvb, relstr_start, pinfo, subtree, drep, NULL, NULL);
1777
1778         if (data)
1779                 *data = text;
1780         else
1781                 g_free(text);
1782
1783         return offset;
1784 }
1785
1786 /* An array of relative strings.  This is currently just a copy of the
1787    dissect_spoolss_relstr() function as I can't find an example driver that
1788    has more than one dependent file. */
1789
1790 static gint ett_RELSTR_ARRAY = -1;
1791
1792 static int
1793 dissect_spoolss_relstrarray(tvbuff_t *tvb, int offset, packet_info *pinfo,
1794                             proto_tree *tree, dcerpc_info *di, guint8 *drep, int hf_index,
1795                             int struct_start, char **data)
1796 {
1797         proto_item *item;
1798         proto_tree *subtree;
1799         guint32 relstr_offset, relstr_start/*, relstr_end, relstr_len*/;
1800         char *text;
1801
1802         item = proto_tree_add_string(tree, hf_index, tvb, offset, 4, "");
1803
1804         subtree = proto_item_add_subtree(item, ett_RELSTR_ARRAY);
1805
1806         offset = dissect_ndr_uint32(
1807                 tvb, offset, pinfo, subtree, di, drep, hf_offset, &relstr_offset);
1808
1809         /* A relative offset of zero is a NULL string */
1810
1811         relstr_start = relstr_offset + struct_start;
1812
1813         if (relstr_offset)
1814                 /*relstr_end = */dissect_spoolss_uint16uni(
1815                         tvb, relstr_start, pinfo, subtree, drep, &text, NULL);
1816         else {
1817                 text = g_strdup("NULL");
1818                 /*relstr_end = offset;*/
1819         }
1820
1821         /*relstr_len = relstr_end - relstr_start;*/
1822
1823         proto_item_append_text(item, "%s", text);
1824
1825         if (data)
1826                 *data = text;
1827         else
1828                 g_free(text);
1829
1830         return offset;
1831 }
1832
1833 /*
1834  * PRINTER_INFO_0
1835  */
1836
1837 static int hf_printer_status = -1;
1838
1839 static const value_string printer_status_vals[] =
1840 {
1841         { PRINTER_STATUS_OK, "OK" },
1842         { PRINTER_STATUS_PAUSED, "Paused" },
1843         { PRINTER_STATUS_ERROR, "Error" },
1844         { PRINTER_STATUS_PENDING_DELETION, "Pending deletion" },
1845         { PRINTER_STATUS_PAPER_JAM, "Paper jam" },
1846         { PRINTER_STATUS_PAPER_OUT, "Paper out" },
1847         { PRINTER_STATUS_MANUAL_FEED, "Manual feed" },
1848         { PRINTER_STATUS_PAPER_PROBLEM, "Paper problem" },
1849         { PRINTER_STATUS_OFFLINE, "Offline" },
1850         { PRINTER_STATUS_IO_ACTIVE, "IO active" },
1851         { PRINTER_STATUS_BUSY, "Busy" },
1852         { PRINTER_STATUS_PRINTING, "Printing" },
1853         { PRINTER_STATUS_OUTPUT_BIN_FULL, "Output bin full" },
1854         { PRINTER_STATUS_NOT_AVAILABLE, "Not available" },
1855         { PRINTER_STATUS_WAITING, "Waiting" },
1856         { PRINTER_STATUS_PROCESSING, "Processing" },
1857         { PRINTER_STATUS_INITIALIZING, "Initialising" },
1858         { PRINTER_STATUS_WARMING_UP, "Warming up" },
1859         { PRINTER_STATUS_TONER_LOW, "Toner low" },
1860         { PRINTER_STATUS_NO_TONER, "No toner" },
1861         { PRINTER_STATUS_PAGE_PUNT, "Page punt" },
1862         { PRINTER_STATUS_USER_INTERVENTION, "User intervention" },
1863         { PRINTER_STATUS_OUT_OF_MEMORY, "Out of memory" },
1864         { PRINTER_STATUS_DOOR_OPEN, "Door open" },
1865         { PRINTER_STATUS_SERVER_UNKNOWN, "Server unknown" },
1866         { PRINTER_STATUS_POWER_SAVE, "Power save" },
1867         { 0, NULL }
1868 };
1869 static value_string_ext printer_status_vals_ext = VALUE_STRING_EXT_INIT(printer_status_vals);
1870
1871 static gint ett_PRINTER_INFO_0 = -1;
1872
1873 static int
1874 dissect_PRINTER_INFO_0(tvbuff_t *tvb, int offset,
1875                                   packet_info *pinfo, proto_tree *tree,
1876                                   dcerpc_info *di, guint8 *drep)
1877 {
1878         offset = dissect_spoolss_relstr(
1879                 tvb, offset, pinfo, tree, di, drep, hf_printername,
1880                 0, NULL);
1881
1882         offset = dissect_spoolss_relstr(
1883                 tvb, offset, pinfo, tree, di, drep, hf_servername,
1884                 0, NULL);
1885
1886         offset = dissect_ndr_uint32(
1887                 tvb, offset, pinfo, tree, di, drep, hf_printer_cjobs, NULL);
1888
1889         offset = dissect_ndr_uint32(
1890                 tvb, offset, pinfo, tree, di, drep, hf_printer_total_jobs,
1891                 NULL);
1892
1893         offset = dissect_ndr_uint32(
1894                 tvb, offset, pinfo, tree, di, drep, hf_printer_total_bytes,
1895                 NULL);
1896
1897         offset = dissect_SYSTEM_TIME(
1898                 tvb, offset, pinfo, tree, di, drep, "Unknown time", TRUE, NULL);
1899
1900         offset = dissect_ndr_uint32(
1901                 tvb, offset, pinfo, tree, di, drep, hf_printer_global_counter,
1902                 NULL);
1903
1904         offset = dissect_ndr_uint32(
1905                 tvb, offset, pinfo, tree, di, drep, hf_printer_total_pages,
1906                 NULL);
1907
1908         offset = dissect_ndr_uint16(
1909                 tvb, offset, pinfo, tree, di, drep, hf_printer_major_version,
1910                 NULL);
1911
1912         offset = dissect_ndr_uint16(
1913                 tvb, offset, pinfo, tree, di, drep, hf_printer_build_version,
1914                 NULL);
1915
1916         offset = dissect_ndr_uint32(
1917                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk7, NULL);
1918
1919         offset = dissect_ndr_uint32(
1920                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk8, NULL);
1921
1922         offset = dissect_ndr_uint32(
1923                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk9, NULL);
1924
1925         offset = dissect_ndr_uint32(
1926                 tvb, offset, pinfo, tree, di, drep, hf_printer_session_ctr,
1927                 NULL);
1928
1929         offset = dissect_ndr_uint32( tvb, offset, pinfo, tree, di, drep,
1930                 hf_printer_unk11, NULL);
1931
1932         offset = dissect_ndr_uint32( tvb, offset, pinfo, tree, di, drep,
1933                 hf_printer_printer_errors, NULL);
1934
1935         offset = dissect_ndr_uint32(
1936                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk13, NULL);
1937
1938         offset = dissect_ndr_uint32(
1939                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk14, NULL);
1940
1941         offset = dissect_ndr_uint32(
1942                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk15, NULL);
1943
1944         offset = dissect_ndr_uint32(
1945                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk16, NULL);
1946
1947         offset = dissect_ndr_uint32(
1948                 tvb, offset, pinfo, tree, di, drep, hf_printer_changeid, NULL);
1949
1950         offset = dissect_ndr_uint32(
1951                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk18, NULL);
1952
1953         offset = dissect_ndr_uint32(
1954                 tvb, offset, pinfo, tree, di, drep, hf_printer_status, NULL);
1955
1956         offset = dissect_ndr_uint32(
1957                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk20, NULL);
1958
1959         offset = dissect_ndr_uint32(
1960                 tvb, offset, pinfo, tree, di, drep, hf_printer_c_setprinter,
1961                 NULL);
1962
1963         offset = dissect_ndr_uint16(
1964                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk22, NULL);
1965
1966         offset = dissect_ndr_uint16(
1967                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk23, NULL);
1968
1969         offset = dissect_ndr_uint16(
1970                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk24, NULL);
1971
1972         offset = dissect_ndr_uint16(
1973                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk25, NULL);
1974
1975         offset = dissect_ndr_uint16(
1976                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk26, NULL);
1977
1978         offset = dissect_ndr_uint16(
1979                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk27, NULL);
1980
1981         offset = dissect_ndr_uint16(
1982                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk28, NULL);
1983
1984         offset = dissect_ndr_uint16(
1985                 tvb, offset, pinfo, tree, di, drep, hf_printer_unk29, NULL);
1986
1987         return offset;
1988 }
1989
1990 /*
1991  * PRINTER_INFO_1
1992  */
1993
1994 static gint ett_PRINTER_INFO_1 = -1;
1995
1996 static int
1997 dissect_PRINTER_INFO_1(tvbuff_t *tvb, int offset,
1998                                   packet_info *pinfo, proto_tree *tree,
1999                                   dcerpc_info *di, guint8 *drep)
2000 {
2001         offset = dissect_ndr_uint32(
2002                 tvb, offset, pinfo, tree, di, drep,
2003                 hf_printer_flags, NULL);
2004
2005         offset = dissect_spoolss_relstr(
2006                 tvb, offset, pinfo, tree, di, drep, hf_printerdesc,
2007                 0, NULL);
2008
2009         offset = dissect_spoolss_relstr(
2010                 tvb, offset, pinfo, tree, di, drep, hf_printername,
2011                 0, NULL);
2012
2013         offset = dissect_spoolss_relstr(
2014                 tvb, offset, pinfo, tree, di, drep, hf_printercomment,
2015                 0, NULL);
2016
2017         return offset;
2018 }
2019
2020 /* Job status */
2021
2022 static const true_false_string tfs_job_status_paused = {
2023         "Job is paused",
2024         "Job is not paused"
2025 };
2026
2027 static const true_false_string tfs_job_status_error = {
2028         "Job has an error",
2029         "Job is OK"
2030 };
2031
2032 static const true_false_string tfs_job_status_deleting = {
2033         "Job is being deleted",
2034         "Job is not being deleted"
2035 };
2036
2037 static const true_false_string tfs_job_status_spooling = {
2038         "Job is being spooled",
2039         "Job is not being spooled"
2040 };
2041
2042 static const true_false_string tfs_job_status_printing = {
2043         "Job is being printed",
2044         "Job is not being printed"
2045 };
2046
2047 static const true_false_string tfs_job_status_offline = {
2048         "Job is offline",
2049         "Job is not offline"
2050 };
2051
2052 static const true_false_string tfs_job_status_paperout = {
2053         "Job is out of paper",
2054         "Job is not out of paper"
2055 };
2056
2057 static const true_false_string tfs_job_status_printed = {
2058         "Job has completed printing",
2059         "Job has not completed printing"
2060 };
2061
2062 static const true_false_string tfs_job_status_deleted = {
2063         "Job has been deleted",
2064         "Job has not been deleted"
2065 };
2066
2067 static const true_false_string tfs_job_status_blocked = {
2068         "Job has been blocked",
2069         "Job has not been blocked"
2070 };
2071
2072 static const true_false_string tfs_job_status_user_intervention = {
2073         "User intervention required",
2074         "User intervention not required"
2075 };
2076
2077 static gint ett_job_status = -1;
2078
2079 static int
2080 dissect_job_status(tvbuff_t *tvb, int offset, packet_info *pinfo,
2081                    proto_tree *tree, dcerpc_info *di, guint8 *drep)
2082 {
2083         proto_item *item;
2084         proto_tree *subtree;
2085         guint32 status;
2086
2087         offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep,
2088                                     hf_job_status, &status);
2089
2090         item = proto_tree_add_text(tree, tvb, offset - 4, 4,
2091                                    "Status: 0x%08x", status);
2092
2093         subtree = proto_item_add_subtree(item, ett_job_status);
2094
2095         proto_tree_add_boolean(
2096                 subtree, hf_job_status_user_intervention, tvb, offset - 4, 4,
2097                 status);
2098
2099         proto_tree_add_boolean(
2100                 subtree, hf_job_status_blocked, tvb, offset - 4, 4, status);
2101
2102         proto_tree_add_boolean(
2103                 subtree, hf_job_status_deleted, tvb, offset - 4, 4, status);
2104
2105         proto_tree_add_boolean(
2106                 subtree, hf_job_status_printed, tvb, offset - 4, 4, status);
2107
2108         proto_tree_add_boolean(
2109                 subtree, hf_job_status_paperout, tvb, offset - 4, 4, status);
2110
2111         proto_tree_add_boolean(
2112                 subtree, hf_job_status_offline, tvb, offset - 4, 4, status);
2113
2114         proto_tree_add_boolean(
2115                 subtree, hf_job_status_printing, tvb, offset - 4, 4, status);
2116
2117         proto_tree_add_boolean(
2118                 subtree, hf_job_status_spooling, tvb, offset - 4, 4, status);
2119
2120         proto_tree_add_boolean(
2121                 subtree, hf_job_status_deleting, tvb, offset - 4, 4, status);
2122
2123         proto_tree_add_boolean(
2124                 subtree, hf_job_status_error, tvb, offset - 4, 4, status);
2125
2126         proto_tree_add_boolean(
2127                 subtree, hf_job_status_paused, tvb, offset - 4, 4, status);
2128
2129         return offset;
2130 }
2131
2132 /* Printer attributes */
2133
2134 static gint ett_printer_attributes = -1;
2135
2136 static int hf_printer_attributes = -1;
2137 static int hf_printer_attributes_queued = -1;
2138 static int hf_printer_attributes_direct = -1;
2139 static int hf_printer_attributes_default = -1;
2140 static int hf_printer_attributes_shared = -1;
2141 static int hf_printer_attributes_network = -1;
2142 static int hf_printer_attributes_hidden = -1;
2143 static int hf_printer_attributes_local = -1;
2144 static int hf_printer_attributes_enable_devq = -1;
2145 static int hf_printer_attributes_keep_printed_jobs = -1;
2146 static int hf_printer_attributes_do_complete_first = -1;
2147 static int hf_printer_attributes_work_offline = -1;
2148 static int hf_printer_attributes_enable_bidi = -1;
2149 static int hf_printer_attributes_raw_only = -1;
2150 static int hf_printer_attributes_published = -1;
2151
2152 static const true_false_string tfs_printer_attributes_queued = {
2153         "Printer starts printing after last page spooled",
2154         "Printer starts printing while spooling"
2155 };
2156
2157 static const true_false_string tfs_printer_attributes_direct = {
2158         "Jobs sent directly to printer",
2159         "Jobs are spooled to printer before printing"
2160 };
2161
2162 static const true_false_string tfs_printer_attributes_default = {
2163         "Printer is the default printer",
2164         "Printer is not the default printer"
2165 };
2166
2167 static const true_false_string tfs_printer_attributes_shared = {
2168         "Printer is shared",
2169         "Printer is not shared"
2170 };
2171
2172 static const true_false_string tfs_printer_attributes_network = {
2173         "Printer is a network printer connection",
2174         "Printer is not a network printer connection"
2175 };
2176
2177 static const true_false_string tfs_printer_attributes_hidden = {
2178         "Reserved",
2179         "Reserved"
2180 };
2181
2182 static const true_false_string tfs_printer_attributes_local = {
2183         "Printer is a local printer",
2184         "Printer is not a local printer"
2185 };
2186
2187 static const true_false_string tfs_printer_attributes_enable_devq = {
2188         "Call DevQueryPrint",
2189         "Do not call DevQueryPrint"
2190 };
2191
2192 static const true_false_string tfs_printer_attributes_keep_printed_jobs = {
2193         "Jobs are kept after they are printed",
2194         "Jobs are deleted after printing"
2195 };
2196
2197 static const true_false_string tfs_printer_attributes_do_complete_first = {
2198         "Jobs that have completed spooling are scheduled before still spooling jobs",
2199         "Jobs are scheduled in the order they start spooling"
2200 };
2201
2202 static const true_false_string tfs_printer_attributes_work_offline = {
2203         "The printer is currently connected",
2204         "The printer is currently not connected"
2205 };
2206
2207 static const true_false_string tfs_printer_attributes_enable_bidi = {
2208         "Bidirectional communications are supported",
2209         "Bidirectional communications are not supported"
2210 };
2211
2212 static const true_false_string tfs_printer_attributes_raw_only = {
2213         "Only raw data type print jobs can be spooled",
2214         "All data type print jobs can be spooled"
2215 };
2216
2217 static const true_false_string tfs_printer_attributes_published = {
2218         "Printer is published in the directory",
2219         "Printer is not published in the directory"
2220 };
2221
2222 static int
2223 dissect_printer_attributes(tvbuff_t *tvb, int offset, packet_info *pinfo,
2224                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
2225 {
2226         proto_item *item;
2227         proto_tree *subtree;
2228         guint32 attributes;
2229
2230         offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep,
2231                                     hf_printer_attributes, &attributes);
2232
2233         item = proto_tree_add_text(tree, tvb, offset - 4, 4,
2234                                    "Attributes: 0x%08x", attributes);
2235
2236         subtree = proto_item_add_subtree(item, ett_printer_attributes);
2237
2238         proto_tree_add_boolean(
2239                 subtree, hf_printer_attributes_published,
2240                 tvb, offset - 4, 4, attributes);
2241
2242         proto_tree_add_boolean(
2243                 subtree, hf_printer_attributes_raw_only,
2244                 tvb, offset - 4, 4, attributes);
2245
2246         proto_tree_add_boolean(
2247                 subtree, hf_printer_attributes_enable_bidi,
2248                 tvb, offset - 4, 4, attributes);
2249
2250         proto_tree_add_boolean(
2251                 subtree, hf_printer_attributes_work_offline,
2252                 tvb, offset - 4, 4, attributes);
2253
2254         proto_tree_add_boolean(
2255                 subtree, hf_printer_attributes_do_complete_first,
2256                 tvb, offset - 4, 4, attributes);
2257
2258         proto_tree_add_boolean(
2259                 subtree, hf_printer_attributes_keep_printed_jobs,
2260                 tvb, offset - 4, 4, attributes);
2261
2262         proto_tree_add_boolean(
2263                 subtree, hf_printer_attributes_enable_devq,
2264                 tvb, offset - 4, 4, attributes);
2265
2266         proto_tree_add_boolean(
2267                 subtree, hf_printer_attributes_local,
2268                 tvb, offset - 4, 4, attributes);
2269
2270         proto_tree_add_boolean(
2271                 subtree, hf_printer_attributes_hidden,
2272                 tvb, offset - 4, 4, attributes);
2273
2274         proto_tree_add_boolean(
2275                 subtree, hf_printer_attributes_network,
2276                 tvb, offset - 4, 4, attributes);
2277
2278         proto_tree_add_boolean(
2279                 subtree, hf_printer_attributes_shared,
2280                 tvb, offset - 4, 4, attributes);
2281
2282         proto_tree_add_boolean(
2283                 subtree, hf_printer_attributes_default,
2284                 tvb, offset - 4, 4, attributes);
2285
2286         proto_tree_add_boolean(
2287                 subtree, hf_printer_attributes_direct,
2288                 tvb, offset - 4, 4, attributes);
2289
2290         proto_tree_add_boolean(
2291                 subtree, hf_printer_attributes_queued,
2292                 tvb, offset - 4, 4, attributes);
2293
2294         return offset;
2295 }
2296
2297 /*
2298  * PRINTER_INFO_2
2299  */
2300
2301 static gint ett_PRINTER_INFO_2 = -1;
2302
2303 static int
2304 dissect_PRINTER_INFO_2(tvbuff_t *tvb, int offset,
2305                                   packet_info *pinfo, proto_tree *tree,
2306                                   dcerpc_info *di, guint8 *drep)
2307 {
2308         guint32 devmode_offset, secdesc_offset;
2309
2310         offset = dissect_spoolss_relstr(
2311                 tvb, offset, pinfo, tree, di, drep, hf_servername,
2312                 0, NULL);
2313
2314         offset = dissect_spoolss_relstr(
2315                 tvb, offset, pinfo, tree, di, drep, hf_printername,
2316                 0, NULL);
2317
2318         offset = dissect_spoolss_relstr(
2319                 tvb, offset, pinfo, tree, di, drep, hf_sharename,
2320                 0, NULL);
2321
2322         offset = dissect_spoolss_relstr(
2323                 tvb, offset, pinfo, tree, di, drep, hf_portname,
2324                 0, NULL);
2325
2326         offset = dissect_spoolss_relstr(
2327                 tvb, offset, pinfo, tree, di, drep, hf_drivername,
2328                 0, NULL);
2329
2330         offset = dissect_spoolss_relstr(
2331                 tvb, offset, pinfo, tree, di, drep, hf_printercomment,
2332                 0, NULL);
2333
2334         offset = dissect_spoolss_relstr(
2335                 tvb, offset, pinfo, tree, di, drep, hf_printerlocation,
2336                 0, NULL);
2337
2338         offset = dissect_ndr_uint32(
2339                 tvb, offset, pinfo, NULL, di, drep, hf_offset,
2340                 &devmode_offset);
2341
2342         dissect_DEVMODE(tvb, devmode_offset - 4, pinfo, tree, di, drep);
2343
2344         offset = dissect_spoolss_relstr(
2345                 tvb, offset, pinfo, tree, di, drep, hf_sepfile,
2346                 0, NULL);
2347
2348         offset = dissect_spoolss_relstr(
2349                 tvb, offset, pinfo, tree, di, drep, hf_printprocessor,
2350                 0, NULL);
2351
2352         offset = dissect_spoolss_relstr(
2353                 tvb, offset, pinfo, tree, di, drep, hf_datatype,
2354                 0, NULL);
2355
2356         offset = dissect_spoolss_relstr(
2357                 tvb, offset, pinfo, tree, di, drep, hf_parameters,
2358                 0, NULL);
2359
2360         /*
2361          * XXX - what *is* the length of this security descriptor?
2362          * "prs_PRINTER_INFO_2()" is passed to "defer_ptr()", but
2363          * "defer_ptr" takes, as an argument, a function with a
2364          * different calling sequence from "prs_PRINTER_INFO_2()",
2365          * lacking the "len" argument, so that won't work.
2366          */
2367
2368         offset = dissect_ndr_uint32(
2369                 tvb, offset, pinfo, NULL, di, drep, hf_offset,
2370                 &secdesc_offset);
2371
2372         dissect_nt_sec_desc(
2373                 tvb, secdesc_offset, pinfo, tree, drep,
2374                 FALSE, -1,
2375                 &spoolss_printer_access_mask_info);
2376
2377         offset = dissect_printer_attributes(tvb, offset, pinfo, tree, di, drep);
2378
2379         offset = dissect_ndr_uint32(
2380                 tvb, offset, pinfo, NULL, di, drep, hf_printer_priority,
2381                 NULL);
2382
2383         offset = dissect_ndr_uint32(
2384                 tvb, offset, pinfo, NULL, di, drep,
2385                 hf_printer_default_priority, NULL);
2386
2387         offset = dissect_ndr_uint32(
2388                 tvb, offset, pinfo, NULL, di, drep, hf_start_time, NULL);
2389
2390         offset = dissect_ndr_uint32(
2391                 tvb, offset, pinfo, NULL, di, drep, hf_end_time, NULL);
2392
2393         offset = dissect_ndr_uint32(
2394                 tvb, offset, pinfo, tree, di, drep,
2395                 hf_printer_status, NULL);
2396
2397         offset = dissect_ndr_uint32(
2398                 tvb, offset, pinfo, NULL, di, drep, hf_printer_jobs,
2399                 NULL);
2400
2401         offset = dissect_ndr_uint32(
2402                 tvb, offset, pinfo, NULL, di, drep,
2403                 hf_printer_averageppm, NULL);
2404
2405         return offset;
2406 }
2407
2408 /*
2409  * PRINTER_INFO_3
2410  */
2411
2412 static gint ett_PRINTER_INFO_3 = -1;
2413
2414 static int
2415 dissect_PRINTER_INFO_3(tvbuff_t *tvb, int offset,
2416                                   packet_info *pinfo, proto_tree *tree,
2417                                   dcerpc_info *di, guint8 *drep)
2418 {
2419         offset = dissect_ndr_uint32(
2420                 tvb, offset, pinfo, tree, di, drep,
2421                 hf_printer_flags, NULL);
2422
2423         offset = dissect_nt_sec_desc(
2424                 tvb, offset, pinfo, tree, drep,
2425                 FALSE, -1,
2426                 &spoolss_printer_access_mask_info);
2427
2428         return offset;
2429 }
2430
2431 /*
2432  * PRINTER_INFO_7
2433  */
2434
2435 static gint ett_PRINTER_INFO_7 = -1;
2436
2437 static const value_string getprinter_action_vals[] = {
2438         { DS_PUBLISH, "Publish" },
2439         { DS_UNPUBLISH, "Unpublish" },
2440         { DS_UPDATE, "Update" },
2441
2442         /* Not sure what the constant values are here */
2443
2444 /*      { DS_PENDING, "Pending" }, */
2445 /*      { DS_REPUBLISH, "Republish" }, */
2446
2447         { 0, NULL }
2448 };
2449
2450 static int
2451 dissect_PRINTER_INFO_7(tvbuff_t *tvb, int offset,
2452                                   packet_info *pinfo, proto_tree *tree,
2453                                   dcerpc_info *di, guint8 *drep)
2454 {
2455         offset = dissect_spoolss_relstr(
2456                 tvb, offset, pinfo, tree, di, drep, hf_printer_guid,
2457                 0, NULL);
2458
2459         offset = dissect_ndr_uint32(
2460                 tvb, offset, pinfo, tree, di, drep,
2461                 hf_printer_action, NULL);
2462
2463         return offset;
2464 }
2465
2466 /*
2467  * PRINTER_DATATYPE structure
2468  */
2469
2470 static gint ett_PRINTER_DATATYPE = -1;
2471
2472 static int
2473 dissect_PRINTER_DATATYPE(tvbuff_t *tvb, int offset,
2474                                     packet_info *pinfo, proto_tree *tree,
2475                                     dcerpc_info *di, guint8 *drep _U_)
2476 {
2477         if (di->conformant_run)
2478                 return offset;
2479
2480         offset = dissect_ndr_cvstring(
2481                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
2482                 hf_datatype, TRUE, NULL);
2483
2484         return offset;
2485 }
2486
2487 /*
2488  * USER_LEVEL_1 structure
2489  */
2490
2491 static gint ett_USER_LEVEL_1 = -1;
2492
2493 static int hf_userlevel_size = -1;
2494 static int hf_userlevel_client = -1;
2495 static int hf_userlevel_user = -1;
2496 static int hf_userlevel_build = -1;
2497 static int hf_userlevel_major = -1;
2498 static int hf_userlevel_minor = -1;
2499 static int hf_userlevel_processor = -1;
2500
2501 static int
2502 dissect_USER_LEVEL_1(tvbuff_t *tvb, int offset,
2503                                 packet_info *pinfo, proto_tree *tree,
2504                                 dcerpc_info *di, guint8 *drep)
2505 {
2506         guint32 level;
2507
2508         /* Guy has pointed out that this dissection looks wrong.  In
2509            the wireshark output for a USER_LEVEL_1 it looks like the
2510            info level and container pointer are transposed.  I'm not
2511            even sure this structure is a container. */
2512
2513         offset = dissect_ndr_uint32(
2514                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
2515
2516         offset = dissect_ndr_uint32(
2517                 tvb, offset, pinfo, tree, di, drep, hf_userlevel_size, NULL);
2518
2519         offset = dissect_ndr_str_pointer_item(
2520                 tvb, offset, pinfo, tree, di, drep, NDR_POINTER_UNIQUE,
2521                 "Client", hf_userlevel_client, 0);
2522
2523         offset = dissect_ndr_str_pointer_item(
2524                 tvb, offset, pinfo, tree, di, drep, NDR_POINTER_UNIQUE,
2525                 "User", hf_userlevel_user, 0);
2526
2527         offset = dissect_ndr_uint32(
2528                 tvb, offset, pinfo, tree, di, drep, hf_userlevel_build, NULL);
2529
2530         offset = dissect_ndr_uint32(
2531                 tvb, offset, pinfo, tree, di, drep, hf_userlevel_major, NULL);
2532
2533         offset = dissect_ndr_uint32(
2534                 tvb, offset, pinfo, tree, di, drep, hf_userlevel_minor, NULL);
2535
2536         offset = dissect_ndr_uint32(
2537                 tvb, offset, pinfo, tree, di, drep, hf_userlevel_processor, NULL);
2538
2539         return offset;
2540 }
2541
2542 /*
2543  * USER_LEVEL_CTR structure
2544  */
2545
2546 static gint ett_USER_LEVEL_CTR = -1;
2547
2548 static int
2549 dissect_USER_LEVEL_CTR(tvbuff_t *tvb, int offset,
2550                                   packet_info *pinfo, proto_tree *tree,
2551                                   dcerpc_info *di, guint8 *drep)
2552 {
2553         proto_item *item;
2554         proto_tree *subtree;
2555         guint32 level;
2556
2557         if (di->conformant_run)
2558                 return offset;
2559
2560         item = proto_tree_add_text(
2561                 tree, tvb, offset, 0, "User level container");
2562
2563         subtree = proto_item_add_subtree(item, ett_USER_LEVEL_CTR);
2564
2565         offset = dissect_ndr_uint32(
2566                 tvb, offset, pinfo, subtree, di, drep, hf_level, &level);
2567
2568         switch(level) {
2569         case 1:
2570                 offset = dissect_ndr_pointer(
2571                         tvb, offset, pinfo, subtree, di, drep,
2572                         dissect_USER_LEVEL_1, NDR_POINTER_UNIQUE,
2573                         "User level 1", -1);
2574                 break;
2575         default:
2576                 proto_tree_add_text(
2577                         tree, tvb, offset, 0,
2578                         "[Info level %d not decoded]", level);
2579                 break;
2580         }
2581
2582         return offset;
2583 }
2584
2585 /*
2586  * SpoolssOpenPrinterEx
2587  */
2588
2589 static int
2590 SpoolssOpenPrinterEx_q(tvbuff_t *tvb, int offset,
2591                                   packet_info *pinfo, proto_tree *tree,
2592                                   dcerpc_info *di, guint8 *drep _U_)
2593 {
2594         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
2595         char *name;
2596
2597         /* Parse packet */
2598
2599         dcv->private_data=NULL;
2600         offset = dissect_ndr_pointer_cb(
2601                 tvb, offset, pinfo, tree, di, drep,
2602                 dissect_ndr_wchar_cvstring, NDR_POINTER_UNIQUE,
2603                 "Printer name", hf_printername, cb_wstr_postprocess,
2604                 GINT_TO_POINTER(CB_STR_COL_INFO | CB_STR_SAVE | 1));
2605         name = (char *)dcv->private_data;
2606
2607         /* OpenPrinterEx() stores the key/value in se_data */
2608         if(!pinfo->fd->flags.visited){
2609                 if(!dcv->se_data){
2610                         dcv->se_data = wmem_strdup_printf(wmem_file_scope(),
2611                                 "%s", name?name:"");
2612                 }
2613         }
2614
2615         offset = dissect_ndr_pointer(
2616                 tvb, offset, pinfo, tree, di, drep,
2617                 dissect_PRINTER_DATATYPE, NDR_POINTER_UNIQUE,
2618                 "Printer datatype", -1);
2619
2620         offset = dissect_DEVMODE_CTR(tvb, offset, pinfo, tree, di, drep);
2621
2622         name=(char *)dcv->se_data;
2623         if (name) {
2624                 if (name[0] == '\\' && name[1] == '\\')
2625                         name += 2;
2626
2627                 /* Determine if we are opening a printer or a print server */
2628
2629                 if (strchr(name, '\\'))
2630                         offset = dissect_nt_access_mask(
2631                                 tvb, offset, pinfo, tree, di, drep,
2632                                 hf_access_required,
2633                                 &spoolss_printer_access_mask_info, NULL);
2634                 else
2635                         offset = dissect_nt_access_mask(
2636                                 tvb, offset, pinfo, tree, di, drep,
2637                                 hf_access_required,
2638                                 &spoolss_printserver_access_mask_info, NULL);
2639         } else {
2640
2641                 /* We can't decide what type of object being opened */
2642
2643                 offset = dissect_nt_access_mask(
2644                         tvb, offset, pinfo, tree, di, drep, hf_access_required,
2645                         NULL, NULL);
2646         }
2647
2648         offset = dissect_USER_LEVEL_CTR(tvb, offset, pinfo, tree, di, drep);
2649
2650         return offset;
2651 }
2652
2653 static int
2654 SpoolssOpenPrinterEx_r(tvbuff_t *tvb, int offset,
2655                                   packet_info *pinfo, proto_tree *tree,
2656                                   dcerpc_info *di, guint8 *drep _U_)
2657 {
2658         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
2659         e_ctx_hnd policy_hnd;
2660         proto_item *hnd_item;
2661         guint32 status;
2662
2663         /* Parse packet */
2664
2665         offset = dissect_nt_policy_hnd(
2666                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, &hnd_item,
2667                 TRUE, FALSE);
2668
2669         offset = dissect_doserror(
2670                 tvb, offset, pinfo, tree, di, drep, hf_rc, &status);
2671
2672         if( status == 0 ){
2673                 const char *pol_name;
2674
2675                 if (dcv->se_data){
2676                         pol_name = wmem_strdup_printf(wmem_packet_scope(),
2677                                 "OpenPrinterEx(%s)", (char *)dcv->se_data);
2678                 } else {
2679                         pol_name = "Unknown OpenPrinterEx() handle";
2680                 }
2681                 if(!pinfo->fd->flags.visited){
2682                         dcerpc_store_polhnd_name(&policy_hnd, pinfo, pol_name);
2683                 }
2684
2685                 if(hnd_item)
2686                         proto_item_append_text(hnd_item, ": %s", pol_name);
2687         }
2688
2689         return offset;
2690 }
2691
2692 static const value_string printer_notify_option_data_vals[] = {
2693         { PRINTER_NOTIFY_SERVER_NAME, "Server name" },
2694         { PRINTER_NOTIFY_PRINTER_NAME, "Printer name" },
2695         { PRINTER_NOTIFY_SHARE_NAME, "Share name" },
2696         { PRINTER_NOTIFY_PORT_NAME, "Port name" },
2697         { PRINTER_NOTIFY_DRIVER_NAME, "Driver name" },
2698         { PRINTER_NOTIFY_COMMENT, "Comment" },
2699         { PRINTER_NOTIFY_LOCATION, "Location" },
2700         { PRINTER_NOTIFY_DEVMODE, "Devmode" },
2701         { PRINTER_NOTIFY_SEPFILE, "Sepfile" },
2702         { PRINTER_NOTIFY_PRINT_PROCESSOR, "Print processor" },
2703         { PRINTER_NOTIFY_PARAMETERS, "Parameters" },
2704         { PRINTER_NOTIFY_DATATYPE, "Datatype" },
2705         { PRINTER_NOTIFY_SECURITY_DESCRIPTOR, "Security descriptor" },
2706         { PRINTER_NOTIFY_ATTRIBUTES, "Attributes" },
2707         { PRINTER_NOTIFY_PRIORITY, "Priority" },
2708         { PRINTER_NOTIFY_DEFAULT_PRIORITY, "Default priority" },
2709         { PRINTER_NOTIFY_START_TIME, "Start time" },
2710         { PRINTER_NOTIFY_UNTIL_TIME, "Until time" },
2711         { PRINTER_NOTIFY_STATUS, "Status" },
2712         { PRINTER_NOTIFY_STATUS_STRING, "Status string" },
2713         { PRINTER_NOTIFY_CJOBS, "Cjobs" },
2714         { PRINTER_NOTIFY_AVERAGE_PPM, "Average PPM" },
2715         { PRINTER_NOTIFY_TOTAL_PAGES, "Total pages" },
2716         { PRINTER_NOTIFY_PAGES_PRINTED, "Pages printed" },
2717         { PRINTER_NOTIFY_TOTAL_BYTES, "Total bytes" },
2718         { PRINTER_NOTIFY_BYTES_PRINTED, "Bytes printed" },
2719         { 0, NULL}
2720 };
2721 static value_string_ext printer_notify_option_data_vals_ext = VALUE_STRING_EXT_INIT(printer_notify_option_data_vals);
2722
2723 static const value_string job_notify_option_data_vals[] = {
2724         { JOB_NOTIFY_PRINTER_NAME, "Printer name" },
2725         { JOB_NOTIFY_MACHINE_NAME, "Machine name" },
2726         { JOB_NOTIFY_PORT_NAME, "Port name" },
2727         { JOB_NOTIFY_USER_NAME, "User name" },
2728         { JOB_NOTIFY_NOTIFY_NAME, "Notify name" },
2729         { JOB_NOTIFY_DATATYPE, "Data type" },
2730         { JOB_NOTIFY_PRINT_PROCESSOR, "Print processor" },
2731         { JOB_NOTIFY_PARAMETERS, "Parameters" },
2732         { JOB_NOTIFY_DRIVER_NAME, "Driver name" },
2733         { JOB_NOTIFY_DEVMODE, "Devmode" },
2734         { JOB_NOTIFY_STATUS, "Status" },
2735         { JOB_NOTIFY_STATUS_STRING, "Status string" },
2736         { JOB_NOTIFY_SECURITY_DESCRIPTOR, "Security descriptor" },
2737         { JOB_NOTIFY_DOCUMENT, "Document" },
2738         { JOB_NOTIFY_PRIORITY, "Priority" },
2739         { JOB_NOTIFY_POSITION, "Position" },
2740         { JOB_NOTIFY_SUBMITTED, "Submitted" },
2741         { JOB_NOTIFY_START_TIME, "Start time" },
2742         { JOB_NOTIFY_UNTIL_TIME, "Until time" },
2743         { JOB_NOTIFY_TIME, "Time" },
2744         { JOB_NOTIFY_TOTAL_PAGES, "Total pages" },
2745         { JOB_NOTIFY_PAGES_PRINTED, "Pages printed" },
2746         { JOB_NOTIFY_TOTAL_BYTES, "Total bytes" },
2747         { JOB_NOTIFY_BYTES_PRINTED, "Bytes printed" },
2748         { 0, NULL}
2749 };
2750 static value_string_ext job_notify_option_data_vals_ext = VALUE_STRING_EXT_INIT(job_notify_option_data_vals);
2751
2752 static int
2753 dissect_notify_field(tvbuff_t *tvb, int offset, packet_info *pinfo,
2754                      proto_tree *tree, dcerpc_info *di, guint8 *drep, guint16 type,
2755                      guint16 *data)
2756 {
2757         guint16 field;
2758         const char *str;
2759
2760         offset = dissect_ndr_uint16(
2761                 tvb, offset, pinfo, NULL, di, drep,
2762                 hf_notify_field, &field);
2763
2764         switch(type) {
2765         case PRINTER_NOTIFY_TYPE:
2766                 str = val_to_str_ext_const(field, &printer_notify_option_data_vals_ext,
2767                                  "Unknown");
2768                 break;
2769         case JOB_NOTIFY_TYPE:
2770                 str = val_to_str_ext_const(field, &job_notify_option_data_vals_ext,
2771                                  "Unknown");
2772                 break;
2773         default:
2774                 str = "Unknown notify type";
2775                 break;
2776         }
2777
2778         proto_tree_add_text(tree, tvb, offset - 2, 2,
2779                             "Field: %s (%d)", str, field);
2780
2781         if (data)
2782                 *data = field;
2783
2784         return offset;
2785 }
2786
2787 static int
2788 dissect_NOTIFY_OPTION_DATA(tvbuff_t *tvb, int offset, packet_info *pinfo,
2789                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
2790 {
2791         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
2792         guint32 count, i;
2793         guint16 type;
2794
2795         if (di->conformant_run)
2796                 return offset;
2797
2798         offset = dissect_ndr_uint32(
2799                 tvb, offset, pinfo, tree, di, drep,
2800                 hf_notify_option_data_count, &count);
2801
2802         type = GPOINTER_TO_INT(dcv->private_data);
2803
2804         for (i = 0; i < count; i++)
2805                 offset = dissect_notify_field(
2806                         tvb, offset, pinfo, tree, di, drep, type, NULL);
2807
2808         return offset;
2809 }
2810
2811 static const value_string printer_notify_types[] =
2812 {
2813         { PRINTER_NOTIFY_TYPE, "Printer notify" },
2814         { JOB_NOTIFY_TYPE, "Job notify" },
2815         { 0, NULL }
2816 };
2817
2818 static const
2819 char *notify_plural(int count)
2820 {
2821         if (count == 1)
2822                 return "notification";
2823
2824         return "notifies";
2825 }
2826
2827 static gint ett_NOTIFY_OPTION = -1;
2828
2829 static int
2830 dissect_NOTIFY_OPTION(tvbuff_t *tvb, int offset, packet_info *pinfo,
2831                       proto_tree *tree, dcerpc_info *di, guint8 *drep)
2832 {
2833         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
2834         proto_item *item;
2835         proto_tree *subtree;
2836         guint16 type;
2837         guint32 count;
2838
2839         item = proto_tree_add_text(tree, tvb, offset, 0, "Notify Option");
2840
2841         subtree = proto_item_add_subtree(item, ett_NOTIFY_OPTION);
2842
2843         offset = dissect_ndr_uint16(tvb, offset, pinfo, subtree, di, drep,
2844                                     hf_notify_option_type, &type);
2845
2846         proto_item_append_text(
2847                 item, ": %s", val_to_str(type, printer_notify_types,
2848                                          "Unknown (%d)"));
2849
2850         offset = dissect_ndr_uint16(tvb, offset, pinfo, subtree, di, drep,
2851                                     hf_notify_option_reserved1, NULL);
2852
2853         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
2854                                     hf_notify_option_reserved2, NULL);
2855
2856         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
2857                                     hf_notify_option_reserved3, NULL);
2858
2859         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
2860                                     hf_notify_option_count, &count);
2861
2862         proto_item_append_text(
2863                 item, ", %d %s", count, notify_plural(count));
2864
2865         dcv->private_data = GINT_TO_POINTER((int)type);
2866
2867         offset = dissect_ndr_pointer(
2868                 tvb, offset, pinfo, subtree, di, drep,
2869                 dissect_NOTIFY_OPTION_DATA, NDR_POINTER_UNIQUE,
2870                 "Notify Option Data", -1);
2871
2872         return offset;
2873 }
2874
2875 static int
2876 dissect_NOTIFY_OPTIONS_ARRAY(tvbuff_t *tvb, int offset,
2877                              packet_info *pinfo, proto_tree *tree,
2878                              dcerpc_info *di, guint8 *drep)
2879 {
2880         /* Why is a check for di->conformant_run not required here? */
2881
2882         offset = dissect_ndr_ucarray(
2883                 tvb, offset, pinfo, tree, di, drep, dissect_NOTIFY_OPTION);
2884
2885         return offset;
2886 }
2887
2888 static gint ett_notify_options_flags = -1;
2889
2890 static const true_false_string tfs_notify_options_flags_refresh = {
2891         "Data for all monitored fields is present",
2892         "Data for all monitored fields not present"
2893 };
2894
2895 static int
2896 dissect_notify_options_flags(tvbuff_t *tvb, int offset, packet_info *pinfo,
2897                              proto_tree *tree, dcerpc_info *di, guint8 *drep)
2898 {
2899         proto_item *item;
2900         proto_tree *subtree;
2901         guint32 flags;
2902
2903         offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep,
2904                                     hf_notify_options_flags,
2905                                     &flags);
2906
2907         item = proto_tree_add_text(tree, tvb, offset - 4, 4,
2908                                    "Flags: 0x%08x", flags);
2909
2910         subtree = proto_item_add_subtree(item, ett_notify_options_flags);
2911
2912         proto_tree_add_boolean(
2913                 subtree, hf_notify_options_flags_refresh,
2914                 tvb, offset, 4, flags);
2915
2916         return offset;
2917 }
2918
2919 static int
2920 dissect_NOTIFY_OPTIONS_ARRAY_CTR(tvbuff_t *tvb, int offset,
2921                                  packet_info *pinfo, proto_tree *tree,
2922                                  dcerpc_info *di, guint8 *drep)
2923 {
2924         if (di->conformant_run)
2925                 return offset;
2926
2927         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
2928                                     hf_notify_options_version, NULL);
2929
2930         offset = dissect_notify_options_flags(tvb, offset, pinfo, tree, di, drep);
2931
2932         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
2933                                     hf_notify_options_count, NULL);
2934
2935         offset = dissect_ndr_pointer(
2936                 tvb, offset, pinfo, tree, di, drep,
2937                 dissect_NOTIFY_OPTIONS_ARRAY, NDR_POINTER_UNIQUE,
2938                 "Notify Options Array", -1);
2939
2940         return offset;
2941 }
2942
2943 /*
2944  * SpoolssRFFPCNEX
2945  */
2946
2947 static gint ett_rffpcnex_flags = -1;
2948
2949 static int hf_rffpcnex_flags = -1;
2950 static int hf_rffpcnex_options = -1;
2951
2952 static int hf_rffpcnex_flags_add_printer = -1;
2953 static int hf_rffpcnex_flags_set_printer = -1;
2954 static int hf_rffpcnex_flags_delete_printer = -1;
2955 static int hf_rffpcnex_flags_failed_printer_connection = -1;
2956
2957 static const true_false_string tfs_rffpcnex_flags_add_printer = {
2958         "Notify on add printer",
2959         "Don't notify on add printer"
2960 };
2961
2962 static const true_false_string tfs_rffpcnex_flags_set_printer = {
2963         "Notify on set printer",
2964         "Don't notify on set printer"
2965 };
2966
2967 static const true_false_string tfs_rffpcnex_flags_delete_printer = {
2968         "Notify on delete printer",
2969         "Don't notify on delete printer"
2970 };
2971
2972 static const true_false_string tfs_rffpcnex_flags_failed_connection_printer = {
2973         "Notify on failed printer connection",
2974         "Don't notify on failed printer connection"
2975 };
2976
2977 static int hf_rffpcnex_flags_add_job = -1;
2978 static int hf_rffpcnex_flags_set_job = -1;
2979 static int hf_rffpcnex_flags_delete_job = -1;
2980 static int hf_rffpcnex_flags_write_job = -1;
2981
2982 static const true_false_string tfs_rffpcnex_flags_add_job = {
2983         "Notify on add job",
2984         "Don't notify on add job"
2985 };
2986
2987 static const true_false_string tfs_rffpcnex_flags_set_job = {
2988         "Notify on set job",
2989         "Don't notify on set job"
2990 };
2991
2992 static const true_false_string tfs_rffpcnex_flags_delete_job = {
2993         "Notify on delete job",
2994         "Don't notify on delete job"
2995 };
2996
2997 static const true_false_string tfs_rffpcnex_flags_write_job = {
2998         "Notify on writejob",
2999         "Don't notify on write job"
3000 };
3001
3002 static int hf_rffpcnex_flags_add_form = -1;
3003 static int hf_rffpcnex_flags_set_form = -1;
3004 static int hf_rffpcnex_flags_delete_form = -1;
3005
3006 static const true_false_string tfs_rffpcnex_flags_add_form = {
3007         "Notify on add form",
3008         "Don't notify on add form"
3009 };
3010
3011 static const true_false_string tfs_rffpcnex_flags_set_form = {
3012         "Notify on set form",
3013         "Don't notify on set form"
3014 };
3015
3016 static const true_false_string tfs_rffpcnex_flags_delete_form = {
3017         "Notify on delete form",
3018         "Don't notify on delete form"
3019 };
3020
3021 static int hf_rffpcnex_flags_add_port = -1;
3022 static int hf_rffpcnex_flags_configure_port = -1;
3023 static int hf_rffpcnex_flags_delete_port = -1;
3024
3025 static const true_false_string tfs_rffpcnex_flags_add_port = {
3026         "Notify on add port",
3027         "Don't notify on add port"
3028 };
3029
3030 static const true_false_string tfs_rffpcnex_flags_configure_port = {
3031         "Notify on configure port",
3032         "Don't notify on configure port"
3033 };
3034
3035 static const true_false_string tfs_rffpcnex_flags_delete_port = {
3036         "Notify on delete port",
3037         "Don't notify on delete port"
3038 };
3039
3040 static int hf_rffpcnex_flags_add_print_processor = -1;
3041 static int hf_rffpcnex_flags_delete_print_processor = -1;
3042
3043 static const true_false_string tfs_rffpcnex_flags_add_print_processor = {
3044         "Notify on add driver",
3045         "Don't notify on add driver"
3046 };
3047
3048 static const true_false_string tfs_rffpcnex_flags_delete_print_processor = {
3049         "Notify on add driver",
3050         "Don't notify on add driver"
3051 };
3052
3053 static int hf_rffpcnex_flags_add_driver = -1;
3054 static int hf_rffpcnex_flags_set_driver = -1;
3055 static int hf_rffpcnex_flags_delete_driver = -1;
3056
3057 static const true_false_string tfs_rffpcnex_flags_add_driver = {
3058         "Notify on add driver",
3059         "Don't notify on add driver"
3060 };
3061
3062 static const true_false_string tfs_rffpcnex_flags_set_driver = {
3063         "Notify on set driver",
3064         "Don't notify on set driver"
3065 };
3066
3067 static const true_false_string tfs_rffpcnex_flags_delete_driver = {
3068         "Notify on delete driver",
3069         "Don't notify on delete driver"
3070 };
3071
3072 static int hf_rffpcnex_flags_timeout = -1;
3073
3074 static const true_false_string tfs_rffpcnex_flags_timeout = {
3075         "Notify on timeout",
3076         "Don't notify on timeout"
3077 };
3078
3079 static int
3080 SpoolssRFFPCNEX_q(tvbuff_t *tvb, int offset,
3081                              packet_info *pinfo, proto_tree *tree,
3082                              dcerpc_info *di, guint8 *drep _U_)
3083 {
3084         guint32 flags;
3085         proto_item *flags_item;
3086         proto_tree *flags_subtree;
3087
3088         /* Parse packet */
3089
3090         offset = dissect_nt_policy_hnd(
3091                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
3092                 FALSE, FALSE);
3093
3094         offset = dissect_ndr_uint32(tvb, offset, pinfo, NULL, di, drep,
3095                                     hf_rffpcnex_flags, &flags);
3096
3097         flags_item = proto_tree_add_text(tree, tvb, offset - 4, 4,
3098                                          "Flags: 0x%08x", flags);
3099
3100         flags_subtree = proto_item_add_subtree(flags_item, ett_rffpcnex_flags);
3101
3102         proto_tree_add_boolean(
3103                 flags_subtree, hf_rffpcnex_flags_timeout, tvb,
3104                 offset - 4, 4, flags);
3105
3106         proto_tree_add_boolean(
3107                 flags_subtree, hf_rffpcnex_flags_delete_driver, tvb,
3108                 offset - 4, 4, flags);
3109
3110         proto_tree_add_boolean(
3111                 flags_subtree, hf_rffpcnex_flags_set_driver, tvb,
3112                 offset - 4, 4, flags);
3113
3114         proto_tree_add_boolean(
3115                 flags_subtree, hf_rffpcnex_flags_add_driver, tvb,
3116                 offset - 4, 4, flags);
3117
3118         proto_tree_add_boolean(
3119                 flags_subtree,
3120                 hf_rffpcnex_flags_delete_print_processor, tvb,
3121                 offset - 4, 4, flags);
3122
3123         proto_tree_add_boolean(
3124                 flags_subtree, hf_rffpcnex_flags_add_print_processor,
3125                 tvb, offset - 4, 4, flags);
3126
3127         proto_tree_add_boolean(
3128                 flags_subtree, hf_rffpcnex_flags_delete_port, tvb,
3129                 offset - 4, 4, flags);
3130
3131         proto_tree_add_boolean(
3132                 flags_subtree, hf_rffpcnex_flags_configure_port, tvb,
3133                 offset - 4, 4, flags);
3134
3135         proto_tree_add_boolean(
3136                 flags_subtree, hf_rffpcnex_flags_add_port, tvb,
3137                 offset - 4, 4, flags);
3138
3139         proto_tree_add_boolean(
3140                 flags_subtree, hf_rffpcnex_flags_delete_form, tvb,
3141                 offset - 4, 4, flags);
3142
3143         proto_tree_add_boolean(
3144                 flags_subtree, hf_rffpcnex_flags_set_form, tvb,
3145                 offset - 4, 4, flags);
3146
3147         proto_tree_add_boolean(
3148                 flags_subtree, hf_rffpcnex_flags_add_form, tvb,
3149                 offset - 4, 4, flags);
3150
3151         proto_tree_add_boolean(
3152                 flags_subtree, hf_rffpcnex_flags_write_job, tvb,
3153                 offset - 4, 4, flags);
3154
3155         proto_tree_add_boolean(
3156                 flags_subtree, hf_rffpcnex_flags_delete_job, tvb,
3157                 offset - 4, 4, flags);
3158
3159         proto_tree_add_boolean(
3160                 flags_subtree, hf_rffpcnex_flags_set_job, tvb,
3161                 offset - 4, 4, flags);
3162
3163         proto_tree_add_boolean(
3164                 flags_subtree, hf_rffpcnex_flags_add_job, tvb,
3165                 offset - 4, 4, flags);
3166
3167         proto_tree_add_boolean(
3168                 flags_subtree,
3169                 hf_rffpcnex_flags_failed_printer_connection, tvb,
3170                 offset - 4, 4, flags);
3171
3172         proto_tree_add_boolean(
3173                 flags_subtree, hf_rffpcnex_flags_delete_printer, tvb,
3174                 offset - 4, 4, flags);
3175
3176         proto_tree_add_boolean(
3177                 flags_subtree, hf_rffpcnex_flags_set_printer, tvb,
3178                 offset - 4, 4, flags);
3179
3180         proto_tree_add_boolean(
3181                 flags_subtree, hf_rffpcnex_flags_add_printer, tvb,
3182                 offset - 4, 4, flags);
3183
3184         if (flags & SPOOLSS_PRINTER_CHANGE_PRINTER)
3185                 proto_item_append_text(flags_item, ", change printer");
3186
3187         if (flags & SPOOLSS_PRINTER_CHANGE_JOB)
3188                 proto_item_append_text(flags_item, ", change job");
3189
3190         if (flags & SPOOLSS_PRINTER_CHANGE_FORM)
3191                 proto_item_append_text(flags_item, ", change form");
3192
3193         if (flags & SPOOLSS_PRINTER_CHANGE_PORT)
3194                 proto_item_append_text(flags_item, ", change port");
3195
3196         if (flags & SPOOLSS_PRINTER_CHANGE_PRINTER_DRIVER)
3197                 proto_item_append_text(flags_item, ", change printer driver");
3198
3199         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
3200                                     hf_rffpcnex_options, NULL);
3201
3202         offset = dissect_ndr_str_pointer_item(
3203                 tvb, offset, pinfo, tree, di, drep, NDR_POINTER_UNIQUE,
3204                 "Server", hf_servername, 0);
3205
3206         offset = dissect_ndr_uint32(
3207                 tvb, offset, pinfo, tree, di, drep, hf_printerlocal, NULL);
3208
3209         offset = dissect_ndr_pointer(
3210                 tvb, offset, pinfo, tree, di, drep,
3211                 dissect_NOTIFY_OPTIONS_ARRAY_CTR, NDR_POINTER_UNIQUE,
3212                 "Notify Options Container", -1);
3213
3214         return offset;
3215 }
3216
3217 static int
3218 SpoolssRFFPCNEX_r(tvbuff_t *tvb, int offset,
3219                              packet_info *pinfo, proto_tree *tree,
3220                              dcerpc_info *di, guint8 *drep _U_)
3221 {
3222         /* Parse packet */
3223
3224         offset = dissect_doserror(
3225                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
3226
3227         return offset;
3228 }
3229
3230 /*
3231  * SpoolssReplyOpenPrinter
3232  */
3233
3234 static int
3235 SpoolssReplyOpenPrinter_q(tvbuff_t *tvb, int offset,
3236                                      packet_info *pinfo, proto_tree *tree,
3237                                      dcerpc_info *di, guint8 *drep _U_)
3238 {
3239         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
3240         guint32 printerlocal;
3241         char *name;
3242
3243         /* Parse packet */
3244         name=NULL;
3245         offset = dissect_ndr_cvstring(
3246                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
3247                 hf_servername, TRUE, &name);
3248         /* ReplyOpenPrinter() stores the printername in se_data */
3249         if(!pinfo->fd->flags.visited){
3250                 if(!dcv->se_data){
3251                         if(name){
3252                                 dcv->se_data = wmem_strdup(wmem_file_scope(), name);
3253                         }
3254                 }
3255         }
3256
3257         if (name)
3258                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", name);
3259
3260         offset = dissect_ndr_uint32(
3261                 tvb, offset, pinfo, tree, di, drep, hf_printerlocal,
3262                 &printerlocal);
3263
3264         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
3265                                     hf_printerdata_type, NULL);
3266
3267         offset = dissect_ndr_uint32(
3268                 tvb, offset, pinfo, tree, di, drep, hf_replyopenprinter_unk0,
3269                 NULL);
3270
3271         offset = dissect_ndr_uint32(
3272                 tvb, offset, pinfo, tree, di, drep, hf_replyopenprinter_unk1,
3273                 NULL);
3274
3275         return offset;
3276 }
3277
3278 static int
3279 SpoolssReplyOpenPrinter_r(tvbuff_t *tvb, int offset,
3280                                      packet_info *pinfo, proto_tree *tree,
3281                                      dcerpc_info *di, guint8 *drep _U_)
3282 {
3283         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
3284         e_ctx_hnd policy_hnd;
3285         proto_item *hnd_item;
3286         guint32 status;
3287
3288         /* Parse packet */
3289
3290         offset = dissect_nt_policy_hnd(
3291                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, &hnd_item,
3292                 TRUE, FALSE);
3293
3294         offset = dissect_doserror(
3295                 tvb, offset, pinfo, tree, di, drep, hf_rc, &status);
3296
3297         if( status == 0 ){
3298                 const char *pol_name;
3299
3300                 if (dcv->se_data){
3301                         pol_name = wmem_strdup_printf(wmem_packet_scope(),
3302                                 "ReplyOpenPrinter(%s)", (char *)dcv->se_data);
3303                 } else {
3304                         pol_name = "Unknown ReplyOpenPrinter() handle";
3305                 }
3306                 if(!pinfo->fd->flags.visited){
3307                         dcerpc_store_polhnd_name(&policy_hnd, pinfo, pol_name);
3308                 }
3309
3310                 if(hnd_item)
3311                         proto_item_append_text(hnd_item, ": %s", pol_name);
3312         }
3313
3314         return offset;
3315 }
3316
3317 /*
3318  * SpoolssGetPrinter
3319  */
3320
3321
3322 static int
3323 SpoolssGetPrinter_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
3324                                proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
3325 {
3326         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
3327         guint32 level;
3328
3329         /* Parse packet */
3330
3331         offset = dissect_nt_policy_hnd(
3332                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
3333                 FALSE, FALSE);
3334
3335         offset = dissect_ndr_uint32(
3336                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
3337
3338         /* GetPrinter() stores the level in se_data */
3339         if(!pinfo->fd->flags.visited){
3340                         dcv->se_data = GINT_TO_POINTER((int)level);
3341         }
3342
3343
3344         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
3345
3346         offset = dissect_spoolss_buffer(
3347                 tvb, offset, pinfo, tree, di, drep, NULL);
3348
3349         offset = dissect_ndr_uint32(
3350                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
3351
3352         return offset;
3353 }
3354
3355 static gint ett_PRINTER_INFO = -1;
3356
3357 static int
3358 SpoolssGetPrinter_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
3359                                 proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
3360 {
3361         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
3362         BUFFER buffer;
3363         gint16 level = GPOINTER_TO_INT(dcv->se_data);
3364         proto_item *item;
3365         proto_tree *subtree = NULL;
3366
3367         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
3368
3369         /* Parse packet */
3370
3371         offset = dissect_spoolss_buffer(
3372                 tvb, offset, pinfo, tree, di, drep, &buffer);
3373
3374         if (buffer.tvb) {
3375                 switch(level) {
3376                 case 0:
3377                 case 1:
3378                 case 2:
3379                 case 3:
3380                 case 7:
3381                         item = proto_tree_add_text(
3382                                 buffer.tree, buffer.tvb, 0, -1,
3383                                 "Print info level %d", level);
3384
3385                         subtree = proto_item_add_subtree(
3386                                 item, ett_PRINTER_INFO);
3387                         break;
3388                 }
3389
3390                 switch(level) {
3391                 case 0:
3392                         dissect_PRINTER_INFO_0(
3393                                 buffer.tvb, 0, pinfo, subtree, di, drep);
3394                         break;
3395                 case 1:
3396                         dissect_PRINTER_INFO_1(
3397                                 buffer.tvb, 0, pinfo, subtree, di, drep);
3398                         break;
3399                 case 2:
3400                         dissect_PRINTER_INFO_2(
3401                                 buffer.tvb, 0, pinfo, subtree, di, drep);
3402                         break;
3403                 case 3:
3404                         dissect_PRINTER_INFO_3(
3405                                 buffer.tvb, 0, pinfo, subtree, di, drep);
3406                         break;
3407                 case 7:
3408                         dissect_PRINTER_INFO_7(
3409                                 buffer.tvb, 0, pinfo, subtree, di, drep);
3410                         break;
3411                 default:
3412                         proto_tree_add_text(
3413                                 buffer.tree, buffer.tvb, 0, -1,
3414                                 "[Unknown printer info level %d]", level);
3415                         break;
3416                 }
3417         }
3418
3419         offset = dissect_ndr_uint32(
3420                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
3421
3422         offset = dissect_doserror(
3423                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
3424
3425         return offset;
3426 }
3427
3428 /*
3429  * SEC_DESC_BUF
3430  */
3431
3432 static gint ett_SEC_DESC_BUF = -1;
3433
3434 static int hf_secdescbuf_maxlen = -1;
3435 static int hf_secdescbuf_undoc = -1;
3436 static int hf_secdescbuf_len = -1;
3437
3438 static int
3439 dissect_SEC_DESC_BUF(tvbuff_t *tvb, int offset, packet_info *pinfo,
3440                      proto_tree *tree, dcerpc_info *di, guint8 *drep)
3441 {
3442         proto_item *item;
3443         proto_tree *subtree;
3444         guint32 len;
3445
3446         /* XXX: I think this is really a array of bytes which can be
3447            dissected using dissect_ndr_cvstring().  The dissected data
3448            can be passed to dissect_nt_sec_desc().  The problem is that
3449            dissect_nt_cvstring() passes back a char * where it really
3450            should pass back a tvb. */
3451
3452         item = proto_tree_add_text(
3453                 tree, tvb, offset, 0, "Security descriptor buffer");
3454
3455         subtree = proto_item_add_subtree(item, ett_SEC_DESC_BUF);
3456
3457         offset = dissect_ndr_uint32(
3458                 tvb, offset, pinfo, subtree, di, drep,
3459                 hf_secdescbuf_maxlen, NULL);
3460
3461         offset = dissect_ndr_uint32(
3462                 tvb, offset, pinfo, subtree, di, drep,
3463                 hf_secdescbuf_undoc, NULL);
3464
3465         offset = dissect_ndr_uint32(
3466                 tvb, offset, pinfo, subtree, di, drep,
3467                 hf_secdescbuf_len, &len);
3468
3469         dissect_nt_sec_desc(
3470                 tvb, offset, pinfo, subtree, drep, TRUE, len,
3471                 &spoolss_printer_access_mask_info);
3472
3473         offset += len;
3474
3475         return offset;
3476 }
3477
3478 /*
3479  * SPOOL_PRINTER_INFO_LEVEL
3480  */
3481
3482 static gint ett_SPOOL_PRINTER_INFO_LEVEL = -1;
3483
3484 /* spool printer info */
3485
3486 static int hf_spool_printer_info_devmode_ptr = -1;
3487 static int hf_spool_printer_info_secdesc_ptr = -1;
3488
3489 static int
3490 dissect_SPOOL_PRINTER_INFO(tvbuff_t *tvb, int offset, packet_info *pinfo,
3491                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
3492 {
3493         proto_item *item;
3494         proto_tree *subtree;
3495         guint32 level;
3496
3497         item = proto_tree_add_text(
3498                 tree, tvb, offset, 0, "Spool printer info level");
3499
3500         subtree = proto_item_add_subtree(item, ett_SPOOL_PRINTER_INFO_LEVEL);
3501
3502         offset = dissect_ndr_uint32(
3503                 tvb, offset, pinfo, subtree, di, drep, hf_level, &level);
3504
3505         switch(level) {
3506         case 3: {
3507                 guint32 devmode_ptr, secdesc_ptr;
3508
3509                 /* I can't seem to get this working with the correct
3510                    dissect_ndr_pointer() function so let's cheat and
3511                    dissect the pointers by hand. )-: */
3512
3513                 offset = dissect_ndr_uint32(
3514                         tvb, offset, pinfo, subtree, di, drep,
3515                         hf_spool_printer_info_devmode_ptr,
3516                         &devmode_ptr);
3517
3518                 offset = dissect_ndr_uint32(
3519                         tvb, offset, pinfo, subtree, di, drep,
3520                         hf_spool_printer_info_secdesc_ptr,
3521                         &secdesc_ptr);
3522
3523                 if (devmode_ptr)
3524                         offset = dissect_DEVMODE_CTR(
3525                                 tvb, offset, pinfo, subtree, di, drep);
3526
3527                 if (secdesc_ptr)
3528                         offset = dissect_SEC_DESC_BUF(
3529                                 tvb, offset, pinfo, subtree, di, drep);
3530
3531         break;
3532         }
3533         case 2:
3534         default:
3535                 proto_tree_add_text(
3536                         subtree, tvb, offset, 0,
3537                         "[Unknown spool printer info level %d]", level);
3538                 break;
3539         }
3540
3541         return offset;
3542 }
3543
3544 /*
3545  * SpoolssSetPrinter
3546  */
3547
3548 static int hf_setprinter_cmd = -1;
3549
3550 static const value_string setprinter_cmd_vals[] = {
3551         { SPOOLSS_PRINTER_CONTROL_UNPAUSE, "Unpause" },
3552         { SPOOLSS_PRINTER_CONTROL_PAUSE, "Pause" },
3553         { SPOOLSS_PRINTER_CONTROL_RESUME, "Resume" },
3554         { SPOOLSS_PRINTER_CONTROL_PURGE, "Purge" },
3555         { SPOOLSS_PRINTER_CONTROL_SET_STATUS, "Set status" },
3556         { 0, NULL }
3557 };
3558
3559 static int
3560 SpoolssSetPrinter_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
3561                                proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
3562 {
3563         guint32 level;
3564
3565         /* Parse packet */
3566
3567         offset = dissect_nt_policy_hnd(
3568                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
3569                 FALSE, FALSE);
3570
3571         offset = dissect_ndr_uint32(
3572                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
3573
3574         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
3575
3576         offset = dissect_SPOOL_PRINTER_INFO(
3577                 tvb, offset, pinfo, tree, di, drep);
3578
3579         offset = dissect_ndr_uint32(
3580                 tvb, offset, pinfo, tree, di, drep,
3581                 hf_setprinter_cmd, NULL);
3582
3583         return offset;
3584 }
3585
3586 static int
3587 SpoolssSetPrinter_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
3588                                 proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
3589 {
3590         /* Parse packet */
3591
3592         offset = dissect_doserror(
3593                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
3594
3595         return offset;
3596 }
3597
3598 /*
3599  * FORM_REL
3600  */
3601
3602 static const value_string form_type_vals[] =
3603 {
3604         { SPOOLSS_FORM_USER, "User" },
3605         { SPOOLSS_FORM_BUILTIN, "Builtin" },
3606         { SPOOLSS_FORM_PRINTER, "Printer" },
3607         { 0, NULL }
3608 };
3609
3610 static gint ett_FORM_REL = -1;
3611
3612 static int
3613 dissect_FORM_REL(tvbuff_t *tvb, int offset, packet_info *pinfo,
3614                             proto_tree *tree, dcerpc_info *di, guint8 *drep, int struct_start)
3615 {
3616         proto_item *item;
3617         proto_tree *subtree;
3618         guint32 flags;
3619         int item_start = offset;
3620         char *name = NULL;
3621
3622         item = proto_tree_add_text(tree, tvb, offset, 0, "Form");
3623
3624         subtree = proto_item_add_subtree(item, ett_FORM_REL);
3625
3626         offset = dissect_ndr_uint32(
3627                 tvb, offset, pinfo, subtree, di, drep, hf_form_flags, &flags);
3628
3629         offset = dissect_spoolss_relstr(
3630                 tvb, offset, pinfo, subtree, di, drep, hf_form_name,
3631                 struct_start, &name);
3632
3633         if (name) {
3634                 proto_item_append_text(item, ": %s", name);
3635                 g_free(name);
3636         }
3637
3638         offset = dissect_ndr_uint32(
3639                 tvb, offset, pinfo, subtree, di, drep,
3640                 hf_form_width, NULL);
3641
3642         offset = dissect_ndr_uint32(
3643                 tvb, offset, pinfo, subtree, di, drep,
3644                 hf_form_height, NULL);
3645
3646         offset = dissect_ndr_uint32(
3647                 tvb, offset, pinfo, subtree, di, drep,
3648                 hf_form_left_margin, NULL);
3649
3650         offset = dissect_ndr_uint32(
3651                 tvb, offset, pinfo, subtree, di, drep,
3652                 hf_form_top_margin, NULL);
3653
3654         offset = dissect_ndr_uint32(
3655                 tvb, offset, pinfo, subtree, di, drep,
3656                 hf_form_horiz_len, NULL);
3657
3658         offset = dissect_ndr_uint32(
3659                 tvb, offset, pinfo, subtree, di, drep,
3660                 hf_form_vert_len, NULL);
3661
3662         proto_item_set_len(item, offset - item_start);
3663
3664         return offset;
3665 }
3666
3667 /*
3668  * SpoolssEnumForms
3669  */
3670
3671 static int
3672 SpoolssEnumForms_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
3673                               proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
3674 {
3675         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
3676         guint32 level;
3677         proto_item *hidden_item;
3678
3679         hidden_item = proto_tree_add_uint(
3680                 tree, hf_form, tvb, offset, 0, 1);
3681         PROTO_ITEM_SET_HIDDEN(hidden_item);
3682
3683         /* Parse packet */
3684
3685         offset = dissect_nt_policy_hnd(
3686                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
3687                 FALSE, FALSE);
3688
3689         offset = dissect_ndr_uint32(
3690                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
3691
3692         /* EnumForms() stores the level in se_data */
3693         if(!pinfo->fd->flags.visited){
3694                         dcv->se_data = GINT_TO_POINTER((int)level);
3695         }
3696
3697         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
3698
3699         offset = dissect_spoolss_buffer(
3700                 tvb, offset, pinfo, tree, di, drep, NULL);
3701
3702         offset = dissect_ndr_uint32(
3703                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
3704
3705         return offset;
3706 }
3707
3708 static int
3709 SpoolssEnumForms_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
3710                               proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
3711 {
3712         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
3713         BUFFER buffer;
3714         guint32 level = GPOINTER_TO_UINT(dcv->se_data), i, count;
3715         int buffer_offset;
3716         proto_item *hidden_item;
3717
3718         hidden_item = proto_tree_add_uint(
3719                 tree, hf_form, tvb, offset, 0, 1);
3720         PROTO_ITEM_SET_HIDDEN(hidden_item);
3721
3722         /* Parse packet */
3723
3724         offset = dissect_spoolss_buffer(
3725                 tvb, offset, pinfo, tree, di, drep, &buffer);
3726
3727         offset = dissect_ndr_uint32(
3728                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
3729
3730         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
3731
3732         offset = dissect_ndr_uint32(
3733                 tvb, offset, pinfo, tree, di, drep, hf_enumforms_num, &count);
3734
3735         /* Unfortunately this array isn't in NDR format so we can't
3736            use prs_array().  The other weird thing is the
3737            struct_start being inside the loop rather than outside.
3738            Very strange. */
3739
3740         buffer_offset = 0;
3741
3742         for (i = 0; i < count; i++) {
3743                 int struct_start = buffer_offset;
3744
3745                 buffer_offset = dissect_FORM_REL(
3746                         buffer.tvb, buffer_offset, pinfo, buffer.tree, di, drep,
3747                         struct_start);
3748         }
3749
3750         offset = dissect_doserror(
3751                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
3752
3753         return offset;
3754 }
3755
3756 /*
3757  * SpoolssDeletePrinter
3758  */
3759
3760 static int
3761 SpoolssDeletePrinter_q(tvbuff_t *tvb, int offset,
3762                                   packet_info *pinfo, proto_tree *tree,
3763                                   dcerpc_info *di, guint8 *drep _U_)
3764 {
3765         /* Parse packet */
3766
3767         offset = dissect_nt_policy_hnd(
3768                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
3769                 FALSE, FALSE);
3770
3771         return offset;
3772 }
3773
3774 static int
3775 SpoolssDeletePrinter_r(tvbuff_t *tvb, int offset,
3776                                   packet_info *pinfo, proto_tree *tree,
3777                                   dcerpc_info *di, guint8 *drep _U_)
3778 {
3779         /* Parse packet */
3780
3781         offset = dissect_nt_policy_hnd(
3782                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
3783                 FALSE, FALSE);
3784
3785         offset = dissect_doserror(
3786                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
3787
3788         return offset;
3789 }
3790
3791 static int
3792 SpoolssAddPrinterEx_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
3793                                  proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
3794 {
3795         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
3796         e_ctx_hnd policy_hnd;
3797         proto_item *hnd_item;
3798         guint32 status;
3799
3800         /* Parse packet */
3801
3802         offset = dissect_nt_policy_hnd(
3803                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, &hnd_item,
3804                 TRUE, FALSE);
3805
3806         offset = dissect_doserror(
3807                 tvb, offset, pinfo, tree, di, drep, hf_rc, &status);
3808
3809         if( status == 0 ){
3810                 const char *pol_name;
3811
3812                 if (dcv->se_data){
3813                         pol_name = wmem_strdup_printf(wmem_packet_scope(),
3814                                 "AddPrinterEx(%s)", (char *)dcv->se_data);
3815                 } else {
3816                         pol_name = "Unknown AddPrinterEx() handle";
3817                 }
3818                 if(!pinfo->fd->flags.visited){
3819                         dcerpc_store_polhnd_name(&policy_hnd, pinfo, pol_name);
3820                 }
3821
3822                 if(hnd_item)
3823                         proto_item_append_text(hnd_item, ": %s", pol_name);
3824         }
3825
3826         return offset;
3827 }
3828
3829 /*
3830  * SpoolssEnumPrinterData
3831  */
3832
3833 static int hf_enumprinterdata_enumindex = -1;
3834 static int hf_enumprinterdata_value_offered = -1;
3835 static int hf_enumprinterdata_data_offered = -1;
3836 static int hf_enumprinterdata_value_len = -1;
3837 static int hf_enumprinterdata_value_needed = -1;
3838 static int hf_enumprinterdata_data_needed = -1;
3839
3840 static int
3841 SpoolssEnumPrinterData_q(tvbuff_t *tvb, int offset,
3842                                     packet_info *pinfo, proto_tree *tree,
3843                                     dcerpc_info *di, guint8 *drep _U_)
3844 {
3845         guint32 ndx;
3846         proto_item *hidden_item;
3847
3848         hidden_item = proto_tree_add_uint(
3849                 tree, hf_printerdata, tvb, offset, 0, 1);
3850         PROTO_ITEM_SET_HIDDEN(hidden_item);
3851
3852         /* Parse packet */
3853
3854         offset = dissect_nt_policy_hnd(
3855                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
3856                 FALSE, FALSE);
3857
3858         offset = dissect_ndr_uint32(
3859                 tvb, offset, pinfo, tree, di, drep,
3860                 hf_enumprinterdata_enumindex, &ndx);
3861
3862         col_append_fstr(pinfo->cinfo, COL_INFO, ", index %d", ndx);
3863
3864         offset = dissect_ndr_uint32(
3865                 tvb, offset, pinfo, tree, di, drep,
3866                 hf_enumprinterdata_value_offered, NULL);
3867
3868         offset = dissect_ndr_uint32(
3869                 tvb, offset, pinfo, tree, di, drep,
3870                 hf_enumprinterdata_data_offered, NULL);
3871
3872         return offset;
3873 }
3874
3875 static int
3876 SpoolssEnumPrinterData_r(tvbuff_t *tvb, int offset,
3877                                     packet_info *pinfo, proto_tree *tree,
3878                                     dcerpc_info *di, guint8 *drep _U_)
3879 {
3880         guint32 value_len, type;
3881         char *value;
3882         proto_item *value_item;
3883         proto_tree *value_subtree;
3884         proto_item *hidden_item;
3885
3886         hidden_item = proto_tree_add_uint(
3887                 tree, hf_printerdata, tvb, offset, 0, 1);
3888         PROTO_ITEM_SET_HIDDEN(hidden_item);
3889
3890         /* Parse packet */
3891
3892         value_item = proto_tree_add_text(tree, tvb, offset, 0, "Value");
3893
3894         value_subtree = proto_item_add_subtree(
3895                 value_item, ett_printerdata_value);
3896
3897         offset = dissect_ndr_uint32(
3898                 tvb, offset, pinfo, value_subtree, di, drep,
3899                 hf_enumprinterdata_value_len, &value_len);
3900
3901         if (value_len) {
3902                 dissect_spoolss_uint16uni(
3903                         tvb, offset, pinfo, value_subtree, drep, &value,
3904                         "Value name");
3905
3906                 offset += value_len * 2;
3907
3908                 if (value && value[0])
3909                         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", value);
3910
3911                 proto_item_append_text(value_item, ": %s", value);
3912
3913                 hidden_item = proto_tree_add_string(
3914                         tree, hf_printerdata_value, tvb, offset, 0, value);
3915                 PROTO_ITEM_SET_HIDDEN(hidden_item);
3916
3917                 g_free(value);
3918         }
3919
3920         proto_item_set_len(value_item, value_len * 2 + 4);
3921
3922         offset = dissect_ndr_uint32(
3923                 tvb, offset, pinfo, value_subtree, di, drep,
3924                 hf_enumprinterdata_value_needed, NULL);
3925
3926         offset = dissect_ndr_uint32(
3927                 tvb, offset, pinfo, tree, di, drep, hf_printerdata_type, &type);
3928
3929         offset = dissect_printerdata_data(
3930                 tvb, offset, pinfo, tree, di, drep, type);
3931
3932         offset = dissect_ndr_uint32(
3933                 tvb, offset, pinfo, tree, di, drep,
3934                 hf_enumprinterdata_data_needed, NULL);
3935
3936         offset = dissect_doserror(
3937                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
3938
3939         return offset;
3940 }
3941
3942 /*
3943  * SpoolssEnumPrinters
3944  */
3945
3946 static gint ett_enumprinters_flags = -1;
3947
3948 static int hf_enumprinters_flags = -1;
3949 static int hf_enumprinters_flags_local = -1;
3950 static int hf_enumprinters_flags_name = -1;
3951 static int hf_enumprinters_flags_shared = -1;
3952 static int hf_enumprinters_flags_default = -1;
3953 static int hf_enumprinters_flags_connections = -1;
3954 static int hf_enumprinters_flags_network = -1;
3955 static int hf_enumprinters_flags_remote = -1;
3956
3957 static int
3958 SpoolssEnumPrinters_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
3959                                  proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
3960 {
3961         guint32 level, flags;
3962         proto_tree *flags_subtree;
3963         proto_item *flags_item;
3964         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
3965
3966         /* Parse packet */
3967
3968         offset = dissect_ndr_uint32(
3969                 tvb, offset, pinfo, NULL, di, drep,
3970                 hf_enumprinters_flags, &flags);
3971
3972         flags_item = proto_tree_add_text(tree, tvb, offset - 4, 4,
3973                                          "Flags: 0x%08x", flags);
3974
3975         flags_subtree = proto_item_add_subtree(
3976                 flags_item, ett_enumprinters_flags);
3977
3978         proto_tree_add_boolean(
3979                 flags_subtree, hf_enumprinters_flags_network, tvb,
3980                 offset - 4, 4, flags);
3981
3982         proto_tree_add_boolean(
3983                 flags_subtree, hf_enumprinters_flags_shared, tvb,
3984                 offset - 4, 4, flags);
3985
3986         proto_tree_add_boolean(
3987                 flags_subtree, hf_enumprinters_flags_remote, tvb,
3988                 offset - 4, 4, flags);
3989
3990         proto_tree_add_boolean(
3991                 flags_subtree, hf_enumprinters_flags_name, tvb,
3992                 offset - 4, 4, flags);
3993
3994         proto_tree_add_boolean(
3995                 flags_subtree, hf_enumprinters_flags_connections, tvb,
3996                 offset - 4, 4, flags);
3997
3998         proto_tree_add_boolean(
3999                 flags_subtree, hf_enumprinters_flags_local, tvb,
4000                 offset - 4, 4, flags);
4001
4002         proto_tree_add_boolean(
4003                 flags_subtree, hf_enumprinters_flags_default, tvb,
4004                 offset - 4, 4, flags);
4005
4006         offset = dissect_ndr_str_pointer_item(
4007                 tvb, offset, pinfo, tree, di, drep,
4008                 NDR_POINTER_UNIQUE, "Server name", hf_servername, 0);
4009
4010         offset = dissect_ndr_uint32(
4011                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
4012
4013         /* GetPrinter() stores the level in se_data */
4014         if(!pinfo->fd->flags.visited){
4015                 dcv->se_data = GINT_TO_POINTER((int)level);
4016         }
4017
4018         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
4019
4020         offset = dissect_spoolss_buffer(
4021                 tvb, offset, pinfo, tree, di, drep, NULL);
4022
4023         offset = dissect_ndr_uint32(
4024                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
4025
4026         return offset;
4027 }
4028
4029 static int
4030 SpoolssEnumPrinters_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4031                                  proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4032 {
4033         guint32 num_drivers;
4034         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4035         gint16 level = GPOINTER_TO_INT(dcv->se_data);
4036         BUFFER buffer;
4037         proto_item *item;
4038         proto_tree *subtree = NULL;
4039
4040         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
4041
4042         /* Parse packet */
4043
4044         offset = dissect_spoolss_buffer(
4045                 tvb, offset, pinfo, tree, di, drep, &buffer);
4046
4047         if (buffer.tvb) {
4048                 switch(level) {
4049                 case 0:
4050                 case 1:
4051                 case 2:
4052                 case 3:
4053                 case 7:
4054                         item = proto_tree_add_text(
4055                                 buffer.tree, buffer.tvb, 0, -1,
4056                                 "Printer info level %d", level);
4057                         subtree = proto_item_add_subtree(
4058                                 item, ett_PRINTER_INFO);
4059                         break;
4060                 }
4061                 switch(level) {
4062                 case 0:
4063                         dissect_PRINTER_INFO_0(
4064                                 buffer.tvb, 0, pinfo, subtree, di, drep);
4065                         break;
4066                 case 1:
4067                         dissect_PRINTER_INFO_1(
4068                                 buffer.tvb, 0, pinfo, subtree, di, drep);
4069                         break;
4070                 case 2:
4071                         dissect_PRINTER_INFO_2(
4072                                 buffer.tvb, 0, pinfo, subtree, di, drep);
4073                         break;
4074                 case 3:
4075                         dissect_PRINTER_INFO_3(
4076                                 buffer.tvb, 0, pinfo, subtree, di, drep);
4077                         break;
4078                 case 7:
4079                         dissect_PRINTER_INFO_7(
4080                                 buffer.tvb, 0, pinfo, subtree, di, drep);
4081                         break;
4082                 default:
4083                         proto_tree_add_text(
4084                                 buffer.tree, buffer.tvb, 0, -1,
4085                                 "[Unknown printer info level %d]", level);
4086                         break;
4087                 }
4088         }
4089
4090         offset = dissect_ndr_uint32(
4091                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
4092
4093         offset = dissect_ndr_uint32(
4094                 tvb, offset, pinfo, tree, di, drep, hf_returned,
4095                 &num_drivers);
4096
4097         offset = dissect_doserror(
4098                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4099
4100         return offset;
4101 }
4102
4103 /*
4104  * AddPrinterDriver
4105  */
4106 static int
4107 SpoolssAddPrinterDriver_r(tvbuff_t *tvb, int offset,
4108                                      packet_info *pinfo, proto_tree *tree,
4109                                      dcerpc_info *di, guint8 *drep _U_)
4110 {
4111         /* Parse packet */
4112
4113         offset = dissect_doserror(
4114                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4115
4116         return offset;
4117 }
4118
4119 /*
4120  * FORM_1
4121  */
4122
4123 static gint ett_FORM_1 = -1;
4124
4125 static int
4126 dissect_FORM_1(tvbuff_t *tvb, int offset, packet_info *pinfo,
4127                           proto_tree *tree, dcerpc_info *di, guint8 *drep)
4128 {
4129         proto_item *item;
4130         proto_tree *subtree;
4131         guint32 flags;
4132
4133         item = proto_tree_add_text(tree, tvb, offset, 0, "Form level 1");
4134
4135         subtree = proto_item_add_subtree(item, ett_FORM_1);
4136
4137         offset = dissect_ndr_str_pointer_item(
4138                 tvb, offset, pinfo, subtree, di, drep, NDR_POINTER_UNIQUE,
4139                 "Name", hf_form_name, 0);
4140
4141         /* Eek - we need to know whether this pointer was NULL or not.
4142            Currently there is not any way to do this. */
4143
4144         if (tvb_length_remaining(tvb, offset) <= 0)
4145                 goto done;
4146
4147         offset = dissect_ndr_uint32(
4148                 tvb, offset, pinfo, subtree, di, drep, hf_form_flags, &flags);
4149
4150         offset = dissect_ndr_uint32(
4151                 tvb, offset, pinfo, subtree, di, drep,
4152                 hf_form_unknown, NULL);
4153
4154         offset = dissect_ndr_uint32(
4155                 tvb, offset, pinfo, subtree, di, drep,
4156                 hf_form_width, NULL);
4157
4158         offset = dissect_ndr_uint32(
4159                 tvb, offset, pinfo, subtree, di, drep,
4160                 hf_form_height, NULL);
4161
4162         offset = dissect_ndr_uint32(
4163                 tvb, offset, pinfo, subtree, di, drep,
4164                 hf_form_left_margin, NULL);
4165
4166         offset = dissect_ndr_uint32(
4167                 tvb, offset, pinfo, subtree, di, drep,
4168                 hf_form_top_margin, NULL);
4169
4170         offset = dissect_ndr_uint32(
4171                 tvb, offset, pinfo, subtree, di, drep,
4172                 hf_form_horiz_len, NULL);
4173
4174         offset = dissect_ndr_uint32(
4175                 tvb, offset, pinfo, subtree, di, drep,
4176                 hf_form_vert_len, NULL);
4177
4178  done:
4179         return offset;
4180 }
4181
4182 /*
4183  * FORM_CTR
4184  */
4185
4186 static gint ett_FORM_CTR = -1;
4187
4188 static int
4189 dissect_FORM_CTR(tvbuff_t *tvb, int offset,
4190                             packet_info *pinfo, proto_tree *tree,
4191                             dcerpc_info *di, guint8 *drep)
4192 {
4193         proto_item *item;
4194         proto_tree *subtree;
4195         guint32 level;
4196
4197         item = proto_tree_add_text(tree, tvb, offset, 0, "Form container");
4198
4199         subtree = proto_item_add_subtree(item, ett_FORM_CTR);
4200
4201         offset = dissect_ndr_uint32(
4202                 tvb, offset, pinfo, subtree, di, drep, hf_form_level, &level);
4203
4204         switch(level) {
4205         case 1:
4206                 offset = dissect_FORM_1(tvb, offset, pinfo, subtree, di, drep);
4207                 break;
4208
4209         default:
4210                 proto_tree_add_text(
4211                         subtree, tvb, offset, 0,
4212                         "[Unknown form info level %d]", level);
4213                 break;
4214         }
4215
4216         return offset;
4217 }
4218
4219 /*
4220  * AddForm
4221  */
4222
4223 static int
4224 SpoolssAddForm_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
4225                             proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4226 {
4227         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4228         guint32 level;
4229         proto_item *hidden_item;
4230
4231         hidden_item = proto_tree_add_uint(
4232                 tree, hf_form, tvb, offset, 0, 1);
4233         PROTO_ITEM_SET_HIDDEN(hidden_item);
4234
4235         /* Parse packet */
4236
4237         offset = dissect_nt_policy_hnd(
4238                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
4239                 FALSE, FALSE);
4240
4241         offset = dissect_ndr_uint32(
4242                 tvb, offset, pinfo, tree, di, drep, hf_form_level, &level);
4243
4244         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
4245
4246         /* AddForm() stores the level in se_data */
4247         if(!pinfo->fd->flags.visited){
4248                         dcv->se_data = GUINT_TO_POINTER((int)level);
4249         }
4250
4251         offset = dissect_FORM_CTR(tvb, offset, pinfo, tree, di, drep);
4252
4253         return offset;
4254 }
4255
4256 static int
4257 SpoolssAddForm_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4258                             proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4259 {
4260         proto_item *hidden_item;
4261
4262         hidden_item = proto_tree_add_uint(
4263                 tree, hf_form, tvb, offset, 0, 1);
4264         PROTO_ITEM_SET_HIDDEN(hidden_item);
4265
4266         /* Parse packet */
4267
4268         offset = dissect_doserror(
4269                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4270
4271         return offset;
4272 }
4273
4274 /*
4275  * DeleteForm
4276  */
4277
4278 static int
4279 SpoolssDeleteForm_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
4280                                proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4281 {
4282         proto_item *hidden_item;
4283         char *name = NULL;
4284
4285         hidden_item = proto_tree_add_uint(
4286                 tree, hf_form, tvb, offset, 0, 1);
4287         PROTO_ITEM_SET_HIDDEN(hidden_item);
4288
4289         /* Parse packet */
4290
4291         offset = dissect_nt_policy_hnd(
4292                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
4293                 FALSE, FALSE);
4294
4295         offset = dissect_ndr_cvstring(
4296                 tvb, offset, pinfo, tree, di, drep,
4297                 sizeof(guint16), hf_form_name, TRUE, &name);
4298
4299         if (name)
4300                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", name);
4301
4302         return offset;
4303 }
4304
4305 static int
4306 SpoolssDeleteForm_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4307                             proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4308 {
4309         proto_item *hidden_item;
4310
4311         hidden_item = proto_tree_add_uint(
4312                 tree, hf_form, tvb, offset, 0, 1);
4313         PROTO_ITEM_SET_HIDDEN(hidden_item);
4314
4315         /* Parse packet */
4316
4317         offset = dissect_doserror(
4318                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4319
4320         return offset;
4321 }
4322
4323 /*
4324  * SetForm
4325  */
4326
4327 static int
4328 SpoolssSetForm_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
4329                             proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4330 {
4331         char *name = NULL;
4332         guint32 level;
4333         proto_item *hidden_item;
4334
4335         hidden_item = proto_tree_add_uint(
4336                 tree, hf_form, tvb, offset, 0, 1);
4337         PROTO_ITEM_SET_HIDDEN(hidden_item);
4338
4339         /* Parse packet */
4340
4341         offset = dissect_nt_policy_hnd(
4342                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
4343                 FALSE, FALSE);
4344
4345         offset = dissect_ndr_cvstring(
4346                 tvb, offset, pinfo, tree, di, drep,
4347                 sizeof(guint16), hf_form_name, TRUE, &name);
4348
4349         if (name)
4350                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", name);
4351
4352         offset = dissect_ndr_uint32(
4353                 tvb, offset, pinfo, tree, di, drep, hf_form_level, &level);
4354
4355         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
4356
4357         offset = dissect_FORM_CTR(tvb, offset, pinfo, tree, di, drep);
4358
4359         return offset;
4360 }
4361
4362 static int
4363 SpoolssSetForm_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4364                             proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4365 {
4366         proto_item *hidden_item;
4367
4368         hidden_item = proto_tree_add_uint(
4369                 tree, hf_form, tvb, offset, 0, 1);
4370         PROTO_ITEM_SET_HIDDEN(hidden_item);
4371
4372         /* Parse packet */
4373
4374         offset = dissect_doserror(
4375                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4376
4377         return offset;
4378 }
4379
4380 /*
4381  * GetForm
4382  */
4383
4384 static int
4385 SpoolssGetForm_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
4386                             proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4387 {
4388         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4389         proto_item *hidden_item;
4390         guint32 level;
4391         char *name;
4392
4393         hidden_item = proto_tree_add_uint(
4394                 tree, hf_form, tvb, offset, 0, 1);
4395         PROTO_ITEM_SET_HIDDEN(hidden_item);
4396
4397         /* Parse packet */
4398
4399         offset = dissect_nt_policy_hnd(
4400                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
4401                 FALSE, FALSE);
4402
4403         offset = dissect_ndr_cvstring(
4404                 tvb, offset, pinfo, tree, di, drep,
4405                 sizeof(guint16), hf_form_name, TRUE, &name);
4406
4407         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", name);
4408
4409         offset = dissect_ndr_uint32(
4410                 tvb, offset, pinfo, tree, di, drep, hf_form_level, &level);
4411
4412         /* GetForm() stores the level in se_data */
4413         if(!pinfo->fd->flags.visited){
4414                         dcv->se_data = GUINT_TO_POINTER((int)level);
4415         }
4416
4417         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d",
4418                                 level);
4419
4420         offset = dissect_spoolss_buffer(tvb, offset, pinfo, tree, di, drep, NULL);
4421
4422         offset = dissect_ndr_uint32(
4423                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
4424
4425         return offset;
4426 }
4427
4428 static int
4429 SpoolssGetForm_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4430                             proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4431 {
4432         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4433         BUFFER buffer;
4434         guint32 level = GPOINTER_TO_UINT(dcv->se_data);
4435         proto_item *hidden_item;
4436
4437         hidden_item = proto_tree_add_uint(
4438                 tree, hf_form, tvb, offset, 0, 1);
4439         PROTO_ITEM_SET_HIDDEN(hidden_item);
4440
4441         /* Parse packet */
4442
4443         offset = dissect_spoolss_buffer(
4444                 tvb, offset, pinfo, tree, di, drep, &buffer);
4445
4446         offset = dissect_ndr_uint32(
4447                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
4448
4449         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
4450
4451         if (buffer.tvb) {
4452                 int buffer_offset = 0;
4453
4454                 switch(level) {
4455                 case 1: {
4456                         int struct_start = buffer_offset;
4457
4458                         /*buffer_offset = */dissect_FORM_REL(
4459                                 buffer.tvb, buffer_offset, pinfo, tree, di, drep,
4460                                 struct_start);
4461                         break;
4462                 }
4463
4464                 default:
4465                         proto_tree_add_text(
4466                                 buffer.tree, buffer.tvb, buffer_offset, -1,
4467                                 "[Unknown form info level %d]", level);
4468                         break;
4469                 }
4470         }
4471
4472         offset = dissect_doserror(
4473                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4474
4475         return offset;
4476 }
4477
4478
4479 /* A generic reply function that just parses the status code.  Useful for
4480    unimplemented dissectors so the status code can be inserted into the
4481    INFO column. */
4482
4483 static int
4484 SpoolssGeneric_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4485                             proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4486 {
4487         int len = tvb_length(tvb);
4488
4489         proto_tree_add_text(tree, tvb, offset, 0,
4490                             "[Unimplemented dissector: SPOOLSS]");
4491
4492         offset = dissect_doserror(
4493                 tvb, len - 4, pinfo, tree, di, drep, hf_rc, NULL);
4494
4495         return offset;
4496 }
4497
4498 /*
4499  * JOB_INFO_1
4500  */
4501
4502 static gint ett_JOB_INFO_1 = -1;
4503
4504 static int
4505 dissect_spoolss_JOB_INFO_1(tvbuff_t *tvb, int offset, packet_info *pinfo,
4506                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
4507 {
4508         proto_item *item;
4509         proto_tree *subtree;
4510         int struct_start = offset;
4511         char *document_name;
4512
4513         item = proto_tree_add_text(tree, tvb, offset, 0, "Job info level 1");
4514
4515         subtree = proto_item_add_subtree(item, ett_JOB_INFO_1);
4516
4517         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
4518                                     hf_job_id, NULL);
4519
4520         offset = dissect_spoolss_relstr(
4521                 tvb, offset, pinfo, subtree, di, drep, hf_printername,
4522                 struct_start, NULL);
4523
4524         offset = dissect_spoolss_relstr(
4525                 tvb, offset, pinfo, subtree, di, drep, hf_servername,
4526                 struct_start, NULL);
4527
4528         offset = dissect_spoolss_relstr(
4529                 tvb, offset, pinfo, subtree, di, drep, hf_username,
4530                 struct_start, NULL);
4531
4532         offset = dissect_spoolss_relstr(
4533                 tvb, offset, pinfo, subtree, di, drep, hf_documentname,
4534                 struct_start, &document_name);
4535
4536         proto_item_append_text(item, ": %s", document_name);
4537         g_free(document_name);
4538
4539         offset = dissect_spoolss_relstr(
4540                 tvb, offset, pinfo, subtree, di, drep, hf_datatype,
4541                 struct_start, NULL);
4542
4543         offset = dissect_spoolss_relstr(
4544                 tvb, offset, pinfo, subtree, di, drep, hf_textstatus,
4545                 struct_start, NULL);
4546
4547         offset = dissect_job_status(tvb, offset, pinfo, subtree, di, drep);
4548
4549         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
4550                                     hf_job_priority, NULL);
4551
4552         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
4553                                     hf_job_position, NULL);
4554
4555         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
4556                                     hf_job_totalpages, NULL);
4557
4558         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
4559                                     hf_job_pagesprinted, NULL);
4560
4561         offset = dissect_SYSTEM_TIME(
4562                 tvb, offset, pinfo, subtree, di, drep, "Job Submission Time",
4563                 TRUE, NULL);
4564
4565         proto_item_set_len(item, offset - struct_start);
4566
4567         return offset;
4568 }
4569
4570 /*
4571  * JOB_INFO_2
4572  */
4573
4574 static gint ett_JOB_INFO_2 = -1;
4575
4576 static int
4577 dissect_spoolss_JOB_INFO_2(tvbuff_t *tvb, int offset, packet_info *pinfo,
4578                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
4579 {
4580         proto_item *item;
4581         proto_tree *subtree;
4582         int struct_start = offset;
4583         char *document_name;
4584         guint32 devmode_offset, secdesc_offset;
4585
4586         item = proto_tree_add_text(tree, tvb, offset, 0, "Job info level 2");
4587
4588         subtree = proto_item_add_subtree(item, ett_JOB_INFO_2);
4589
4590         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
4591                                     hf_job_id, NULL);
4592
4593         offset = dissect_spoolss_relstr(
4594                 tvb, offset, pinfo, subtree, di, drep, hf_printername,
4595                 struct_start, NULL);
4596
4597         offset = dissect_spoolss_relstr(
4598                 tvb, offset, pinfo, subtree, di, drep, hf_machinename,
4599                 struct_start, NULL);
4600
4601         offset = dissect_spoolss_relstr(
4602                 tvb, offset, pinfo, subtree, di, drep, hf_username,
4603                 struct_start, NULL);
4604
4605         offset = dissect_spoolss_relstr(
4606                 tvb, offset, pinfo, subtree, di, drep, hf_documentname,
4607                 struct_start, &document_name);
4608
4609         proto_item_append_text(item, ": %s", document_name);
4610         g_free(document_name);
4611
4612         offset = dissect_spoolss_relstr(
4613                 tvb, offset, pinfo, subtree, di, drep, hf_notifyname,
4614                 struct_start, NULL);
4615
4616         offset = dissect_spoolss_relstr(
4617                 tvb, offset, pinfo, subtree, di, drep, hf_datatype,
4618                 struct_start, NULL);
4619
4620         offset = dissect_spoolss_relstr(
4621                 tvb, offset, pinfo, subtree, di, drep, hf_printprocessor,
4622                 struct_start, NULL);
4623
4624         offset = dissect_spoolss_relstr(
4625                 tvb, offset, pinfo, subtree, di, drep, hf_parameters,
4626                 struct_start, NULL);
4627
4628         offset = dissect_spoolss_relstr(
4629                 tvb, offset, pinfo, subtree, di, drep, hf_drivername,
4630                 struct_start, NULL);
4631
4632         offset = dissect_ndr_uint32(
4633                 tvb, offset, pinfo, NULL, di, drep, hf_offset,
4634                 &devmode_offset);
4635
4636         dissect_DEVMODE(
4637                 tvb, devmode_offset - 4 + struct_start, pinfo, subtree, di, drep);
4638
4639         offset = dissect_spoolss_relstr(
4640                 tvb, offset, pinfo, subtree, di, drep, hf_textstatus,
4641                 struct_start, NULL);
4642
4643         offset = dissect_ndr_uint32(
4644                 tvb, offset, pinfo, NULL, di, drep, hf_offset,
4645                 &secdesc_offset);
4646
4647         dissect_nt_sec_desc(
4648                 tvb, secdesc_offset, pinfo, subtree, drep,
4649                 FALSE, -1,
4650                 &spoolss_job_access_mask_info);
4651
4652         offset = dissect_job_status(tvb, offset, pinfo, subtree, di, drep);
4653
4654         offset = dissect_ndr_uint32(
4655                 tvb, offset, pinfo, subtree, di, drep, hf_job_priority, NULL);
4656
4657         offset = dissect_ndr_uint32(
4658                 tvb, offset, pinfo, subtree, di, drep, hf_job_position, NULL);
4659
4660         offset = dissect_ndr_uint32(
4661                 tvb, offset, pinfo, NULL, di, drep, hf_start_time, NULL);
4662
4663         offset = dissect_ndr_uint32(
4664                 tvb, offset, pinfo, NULL, di, drep, hf_end_time, NULL);
4665
4666         offset = dissect_ndr_uint32(
4667                 tvb, offset, pinfo, subtree, di, drep, hf_job_totalpages, NULL);
4668
4669         offset = dissect_ndr_uint32(
4670                 tvb, offset, pinfo, subtree, di, drep, hf_job_size, NULL);
4671
4672         offset = dissect_SYSTEM_TIME(
4673                 tvb, offset, pinfo, subtree, di, drep, "Job Submission Time",
4674                 TRUE, NULL);
4675
4676         offset = dissect_ndr_uint32(
4677                 tvb, offset, pinfo, NULL, di, drep, hf_elapsed_time, NULL);
4678
4679         offset = dissect_ndr_uint32(
4680                 tvb, offset, pinfo, subtree, di, drep, hf_job_pagesprinted, NULL);
4681
4682         proto_item_set_len(item, offset - struct_start);
4683
4684         return offset;
4685 }
4686
4687 /*
4688  * EnumJobs
4689  */
4690
4691 static int hf_enumjobs_firstjob = -1;
4692 static int hf_enumjobs_numjobs = -1;
4693
4694 static int
4695 SpoolssEnumJobs_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
4696                              proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4697 {
4698         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4699         guint32 level;
4700
4701         /* Parse packet */
4702
4703         offset = dissect_nt_policy_hnd(
4704                 tvb, offset, pinfo, tree, di, drep,
4705                 hf_hnd, NULL, NULL, FALSE, FALSE);
4706
4707         offset = dissect_ndr_uint32(
4708                 tvb, offset, pinfo, tree, di, drep, hf_enumjobs_firstjob, NULL);
4709
4710         offset = dissect_ndr_uint32(
4711                 tvb, offset, pinfo, tree, di, drep, hf_enumjobs_numjobs, NULL);
4712
4713         offset = dissect_ndr_uint32(
4714                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
4715
4716         /* EnumJobs() stores the level in se_data */
4717         if(!pinfo->fd->flags.visited){
4718                         dcv->se_data = GUINT_TO_POINTER((int)level);
4719         }
4720
4721         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
4722
4723         offset = dissect_spoolss_buffer(tvb, offset, pinfo, tree, di, drep, NULL);
4724
4725         offset = dissect_ndr_uint32(
4726                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
4727
4728         return offset;
4729 }
4730
4731 static int
4732 SpoolssEnumJobs_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4733                              proto_tree *tree, dcerpc_info *di, guint8 *drep _U_)
4734 {
4735         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4736         gint16 level = GPOINTER_TO_UINT(dcv->se_data);
4737         BUFFER buffer;
4738         guint32 num_jobs, i;
4739         int buffer_offset;
4740
4741         /* Parse packet */
4742
4743         offset = dissect_spoolss_buffer(
4744                 tvb, offset, pinfo, tree, di, drep, &buffer);
4745
4746         offset = dissect_ndr_uint32(
4747                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
4748
4749         offset = dissect_ndr_uint32(
4750                 tvb, offset, pinfo, tree, di, drep, hf_enumjobs_numjobs,
4751                 &num_jobs);
4752
4753         buffer_offset = 0;
4754
4755         for (i = 0; i < num_jobs; i++) {
4756                 switch(level) {
4757                 case 1:
4758                         buffer_offset = dissect_spoolss_JOB_INFO_1(
4759                                 buffer.tvb, buffer_offset, pinfo,
4760                                 buffer.tree, di, drep);
4761                         break;
4762                 case 2:
4763                         buffer_offset = dissect_spoolss_JOB_INFO_2(
4764                                 buffer.tvb, buffer_offset, pinfo,
4765                                 buffer.tree, di, drep);
4766                         break;
4767                 default:
4768                         proto_tree_add_text(
4769                                 buffer.tree, buffer.tvb, 0, -1,
4770                                 "[Unknown job info level %d]", level);
4771                         break;
4772                 }
4773
4774         }
4775
4776         offset = dissect_doserror(
4777                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4778
4779         return offset;
4780 }
4781
4782 /*
4783  * SetJob
4784  */
4785
4786 static const value_string setjob_commands[] = {
4787         { JOB_CONTROL_PAUSE, "Pause" },
4788         { JOB_CONTROL_RESUME, "Resume" },
4789         { JOB_CONTROL_CANCEL, "Cancel" },
4790         { JOB_CONTROL_RESTART, "Restart" },
4791         { JOB_CONTROL_DELETE, "Delete" },
4792         { 0, NULL }
4793 };
4794
4795 static int hf_setjob_cmd = -1;
4796
4797 static int
4798 SpoolssSetJob_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
4799                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
4800 {
4801         guint32 jobid, cmd;
4802
4803         /* Parse packet */
4804
4805         offset = dissect_nt_policy_hnd(
4806                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
4807                 FALSE, FALSE);
4808
4809         offset = dissect_ndr_uint32(
4810                 tvb, offset, pinfo, tree, di, drep, hf_job_id, &jobid);
4811
4812         offset = dissect_ndr_uint32(
4813                 tvb, offset, pinfo, tree, di, drep, hf_level, NULL);
4814
4815         offset = dissect_ndr_uint32(
4816                 tvb, offset, pinfo, tree, di, drep, hf_setjob_cmd, &cmd);
4817
4818         col_append_fstr(
4819                         pinfo->cinfo, COL_INFO, ", %s jobid %d",
4820                         val_to_str(cmd, setjob_commands, "Unknown (%d)"),
4821                         jobid);
4822
4823         return offset;
4824 }
4825
4826 static int
4827 SpoolssSetJob_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4828                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
4829 {
4830         /* Parse packet */
4831
4832         offset = dissect_doserror(
4833                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4834
4835         return offset;
4836 }
4837
4838 /*
4839  * GetJob
4840  */
4841
4842 static int
4843 SpoolssGetJob_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
4844                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
4845 {
4846         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4847         guint32 level, jobid;
4848
4849         /* Parse packet */
4850
4851         offset = dissect_nt_policy_hnd(
4852                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
4853                 FALSE, FALSE);
4854
4855         offset = dissect_ndr_uint32(
4856                 tvb, offset, pinfo, tree, di, drep, hf_job_id, &jobid);
4857
4858         offset = dissect_ndr_uint32(
4859                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
4860
4861         /* GetJob() stores the level in se_data */
4862         if(!pinfo->fd->flags.visited){
4863                         dcv->se_data = GUINT_TO_POINTER((int)level);
4864         }
4865
4866         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d, jobid %d",
4867                                 level, jobid);
4868
4869         offset = dissect_spoolss_buffer(tvb, offset, pinfo, tree, di, drep, NULL);
4870
4871         offset = dissect_ndr_uint32(
4872                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
4873
4874         return offset;
4875 }
4876
4877 static int
4878 SpoolssGetJob_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
4879                         proto_tree *tree, dcerpc_info *di, guint8 *drep)
4880 {
4881         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
4882         gint32 level = GPOINTER_TO_UINT(dcv->se_data);
4883         BUFFER buffer;
4884
4885         /* Parse packet */
4886
4887         offset = dissect_spoolss_buffer(tvb, offset, pinfo, tree, di, drep,
4888                                         &buffer);
4889
4890         if (buffer.tvb) {
4891                 int buffer_offset = 0;
4892
4893                 switch(level) {
4894                 case 1:
4895                         /*buffer_offset = */dissect_spoolss_JOB_INFO_1(
4896                                 buffer.tvb, buffer_offset, pinfo,
4897                                 buffer.tree, di, drep);
4898                         break;
4899                 case 2:
4900                 default:
4901                         proto_tree_add_text(
4902                                 buffer.tree, buffer.tvb, buffer_offset, -1,
4903                                 "[Unknown job info level %d]", level);
4904                         break;
4905                 }
4906         }
4907
4908         offset = dissect_ndr_uint32(
4909                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
4910
4911         offset = dissect_doserror(
4912                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4913
4914         return offset;
4915 }
4916
4917 /*
4918  * StartPagePrinter
4919  */
4920
4921 static int
4922 SpoolssStartPagePrinter_q(tvbuff_t *tvb, int offset,
4923                                      packet_info *pinfo, proto_tree *tree,
4924                                      dcerpc_info *di, guint8 *drep)
4925 {
4926         e_ctx_hnd policy_hnd;
4927         char *pol_name;
4928
4929         /* Parse packet */
4930
4931         offset = dissect_nt_policy_hnd(
4932                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, NULL,
4933                 FALSE, FALSE);
4934
4935         dcerpc_fetch_polhnd_data(&policy_hnd, &pol_name, NULL, NULL, NULL,
4936                              pinfo->fd->num);
4937
4938         if (pol_name)
4939                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
4940                                 pol_name);
4941
4942         return offset;
4943 }
4944
4945 static int
4946 SpoolssStartPagePrinter_r(tvbuff_t *tvb, int offset,
4947                                      packet_info *pinfo, proto_tree *tree,
4948                                      dcerpc_info *di, guint8 *drep)
4949 {
4950         /* Parse packet */
4951
4952         offset = dissect_doserror(
4953                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4954
4955         return offset;
4956 }
4957
4958 /*
4959  * EndPagePrinter
4960  */
4961
4962 static int
4963 SpoolssEndPagePrinter_q(tvbuff_t *tvb, int offset,
4964                                    packet_info *pinfo, proto_tree *tree,
4965                                    dcerpc_info *di, guint8 *drep)
4966 {
4967         e_ctx_hnd policy_hnd;
4968         char *pol_name;
4969
4970         /* Parse packet */
4971
4972         offset = dissect_nt_policy_hnd(
4973                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, NULL,
4974                 FALSE, FALSE);
4975
4976         dcerpc_fetch_polhnd_data(&policy_hnd, &pol_name, NULL, NULL, NULL,
4977                              pinfo->fd->num);
4978
4979         if (pol_name)
4980                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
4981                                 pol_name);
4982
4983         return offset;
4984 }
4985
4986 static int
4987 SpoolssEndPagePrinter_r(tvbuff_t *tvb, int offset,
4988                                    packet_info *pinfo, proto_tree *tree,
4989                                    dcerpc_info *di, guint8 *drep)
4990 {
4991         /* Parse packet */
4992
4993         offset = dissect_doserror(
4994                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
4995
4996         return offset;
4997 }
4998
4999 /*
5000  * DOC_INFO_1
5001  */
5002
5003 static gint ett_DOC_INFO_1 = -1;
5004
5005 static int
5006 dissect_spoolss_doc_info_1(tvbuff_t *tvb, int offset, packet_info *pinfo,
5007                            proto_tree *tree, dcerpc_info *di, guint8 *drep)
5008 {
5009         proto_item *item;
5010         proto_tree *subtree;
5011
5012         item = proto_tree_add_text(
5013                 tree, tvb, offset, 0, "Document info level 1");
5014
5015         subtree = proto_item_add_subtree(item, ett_DOC_INFO_1);
5016
5017         offset = dissect_ndr_str_pointer_item(
5018                 tvb, offset, pinfo, subtree, di, drep, NDR_POINTER_UNIQUE,
5019                 "Document name", hf_documentname, 0);
5020
5021         offset = dissect_ndr_str_pointer_item(
5022                 tvb, offset, pinfo, subtree, di, drep, NDR_POINTER_UNIQUE,
5023                 "Output file", hf_outputfile, 0);
5024
5025         offset = dissect_ndr_str_pointer_item(
5026                 tvb, offset, pinfo, subtree, di, drep, NDR_POINTER_UNIQUE,
5027                 "Data type", hf_datatype, 0);
5028
5029         return offset;
5030 }
5031
5032 static int
5033 dissect_spoolss_doc_info_data(tvbuff_t *tvb, int offset, packet_info *pinfo,
5034                               proto_tree *tree, dcerpc_info *di, guint8 *drep)
5035 {
5036         if (di->conformant_run)
5037                 return offset;
5038
5039         return dissect_spoolss_doc_info_1(tvb, offset, pinfo, tree, di, drep);
5040 }
5041
5042 /*
5043  * DOC_INFO
5044  */
5045
5046 static gint ett_DOC_INFO = -1;
5047
5048 static int
5049 dissect_spoolss_doc_info(tvbuff_t *tvb, int offset, packet_info *pinfo,
5050                          proto_tree *tree, dcerpc_info *di, guint8 *drep)
5051 {
5052         proto_item *item;
5053         proto_tree *subtree;
5054         guint32 level;
5055
5056         item = proto_tree_add_text(
5057                 tree, tvb, offset, 0, "Document info");
5058
5059         subtree = proto_item_add_subtree(item, ett_DOC_INFO);
5060
5061         offset = dissect_ndr_uint32(
5062                 tvb, offset, pinfo, subtree, di, drep, hf_level, &level);
5063
5064         offset = dissect_ndr_pointer(
5065                 tvb, offset, pinfo, subtree, di, drep,
5066                 dissect_spoolss_doc_info_data,
5067                 NDR_POINTER_UNIQUE, "Document info", -1);
5068
5069         return offset;
5070 }
5071
5072 /*
5073  * DOC_INFO_CTR
5074  */
5075
5076 static gint ett_DOC_INFO_CTR = -1;
5077
5078 static int
5079 dissect_spoolss_doc_info_ctr(tvbuff_t *tvb, int offset, packet_info *pinfo,
5080                              proto_tree *tree, dcerpc_info *di, guint8 *drep)
5081 {
5082         proto_item *item;
5083         proto_tree *subtree;
5084
5085         item = proto_tree_add_text(
5086                 tree, tvb, offset, 0, "Document info container");
5087
5088         subtree = proto_item_add_subtree(item, ett_DOC_INFO_CTR);
5089
5090         offset = dissect_ndr_uint32(
5091                 tvb, offset, pinfo, subtree, di, drep, hf_level, NULL);
5092
5093         offset = dissect_spoolss_doc_info(
5094                 tvb, offset, pinfo, subtree, di, drep);
5095
5096         return offset;
5097 }
5098
5099 /*
5100  * StartDocPrinter
5101  */
5102
5103 static int
5104 SpoolssStartDocPrinter_q(tvbuff_t *tvb, int offset,
5105                                     packet_info *pinfo, proto_tree *tree,
5106                                     dcerpc_info *di, guint8 *drep)
5107 {
5108         e_ctx_hnd policy_hnd;
5109         char *pol_name;
5110
5111         /* Parse packet */
5112
5113         offset = dissect_nt_policy_hnd(
5114                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, NULL,
5115                 FALSE, FALSE);
5116
5117         dcerpc_fetch_polhnd_data(&policy_hnd, &pol_name, NULL, NULL, NULL,
5118                              pinfo->fd->num);
5119
5120         if (pol_name)
5121                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
5122                                 pol_name);
5123
5124         offset = dissect_spoolss_doc_info_ctr(tvb, offset, pinfo, tree, di, drep);
5125
5126         return offset;
5127 }
5128
5129 static int
5130 SpoolssStartDocPrinter_r(tvbuff_t *tvb, int offset,
5131                                     packet_info *pinfo, proto_tree *tree,
5132                                     dcerpc_info *di, guint8 *drep)
5133 {
5134         /* Parse packet */
5135
5136         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
5137                                     hf_job_id, NULL);
5138
5139         offset = dissect_doserror(
5140                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
5141
5142         return offset;
5143 }
5144
5145 /*
5146  * EndDocPrinter
5147  */
5148
5149 static int
5150 SpoolssEndDocPrinter_q(tvbuff_t *tvb, int offset,
5151                                   packet_info *pinfo, proto_tree *tree,
5152                                   dcerpc_info *di, guint8 *drep)
5153 {
5154         e_ctx_hnd policy_hnd;
5155         char *pol_name;
5156
5157         /* Parse packet */
5158
5159         offset = dissect_nt_policy_hnd(
5160                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, NULL,
5161                 FALSE, FALSE);
5162
5163         dcerpc_fetch_polhnd_data(&policy_hnd, &pol_name, NULL, NULL, NULL,
5164                              pinfo->fd->num);
5165
5166         if (pol_name)
5167                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
5168                                 pol_name);
5169
5170
5171         return offset;
5172 }
5173
5174 static int
5175 SpoolssEndDocPrinter_r(tvbuff_t *tvb, int offset,
5176                                   packet_info *pinfo, proto_tree *tree,
5177                                   dcerpc_info *di, guint8 *drep)
5178 {
5179         /* Parse packet */
5180
5181         offset = dissect_doserror(
5182                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
5183
5184         return offset;
5185 }
5186
5187 /*
5188  * WritePrinter
5189  */
5190
5191 static gint ett_writeprinter_buffer = -1;
5192
5193 static int hf_writeprinter_numwritten = -1;
5194
5195 static int
5196 SpoolssWritePrinter_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
5197                                  proto_tree *tree, dcerpc_info *di, guint8 *drep)
5198 {
5199         e_ctx_hnd policy_hnd;
5200         char *pol_name;
5201         guint32 size;
5202         proto_item *item;
5203         proto_tree *subtree;
5204
5205         /* Parse packet */
5206
5207         offset = dissect_nt_policy_hnd(
5208                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, NULL,
5209                 FALSE, FALSE);
5210
5211         dcerpc_fetch_polhnd_data(&policy_hnd, &pol_name, NULL, NULL, NULL,
5212                              pinfo->fd->num);
5213
5214         if (pol_name)
5215                 col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
5216                                 pol_name);
5217
5218         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
5219                                     hf_buffer_size, &size);
5220
5221         col_append_fstr(pinfo->cinfo, COL_INFO, ", %d bytes", size);
5222
5223         item = proto_tree_add_text(tree, tvb, offset, 0, "Buffer");
5224
5225         subtree = proto_item_add_subtree(item, ett_writeprinter_buffer);
5226
5227         offset = dissect_ndr_uint8s(tvb, offset, pinfo, subtree, di, drep,
5228                                     hf_buffer_data, size, NULL);
5229
5230         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
5231                                     hf_buffer_size, NULL);
5232
5233         proto_item_set_len(item, size + 4);
5234
5235         return offset;
5236 }
5237
5238 static int
5239 SpoolssWritePrinter_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
5240                                  proto_tree *tree, dcerpc_info *di, guint8 *drep)
5241 {
5242         guint32 size;
5243
5244         /* Parse packet */
5245
5246         offset = dissect_ndr_uint32(
5247                 tvb, offset, pinfo, tree, di, drep, hf_writeprinter_numwritten,
5248                 &size);
5249
5250         col_append_fstr(
5251                         pinfo->cinfo, COL_INFO, ", %d bytes written", size);
5252
5253         offset = dissect_doserror(
5254                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
5255
5256         return offset;
5257 }
5258
5259 /*
5260  * DeletePrinterData
5261  */
5262
5263 static int
5264 SpoolssDeletePrinterData_q(tvbuff_t *tvb, int offset,
5265                                       packet_info *pinfo, proto_tree *tree,
5266                                       dcerpc_info *di, guint8 *drep)
5267 {
5268         char *value_name;
5269         proto_item *hidden_item;
5270
5271         hidden_item = proto_tree_add_uint(
5272                 tree, hf_printerdata, tvb, offset, 0, 1);
5273         PROTO_ITEM_SET_HIDDEN(hidden_item);
5274
5275         /* Parse packet */
5276
5277         offset = dissect_nt_policy_hnd(
5278                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
5279                 FALSE, FALSE);
5280
5281         offset = dissect_ndr_cvstring(
5282                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
5283                 hf_printerdata_value, TRUE, &value_name);
5284
5285         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", value_name);
5286
5287         return offset;
5288 }
5289
5290 static int
5291 SpoolssDeletePrinterData_r(tvbuff_t *tvb, int offset,
5292                                       packet_info *pinfo, proto_tree *tree,
5293                                       dcerpc_info *di, guint8 *drep)
5294 {
5295         proto_item *hidden_item;
5296
5297         hidden_item = proto_tree_add_uint(
5298                 tree, hf_printerdata, tvb, offset, 0, 1);
5299         PROTO_ITEM_SET_HIDDEN(hidden_item);
5300
5301         /* Parse packet */
5302
5303         offset = dissect_doserror(
5304                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
5305
5306         return offset;
5307 }
5308
5309 /*
5310  * DRIVER_INFO_1
5311  */
5312
5313 static gint ett_DRIVER_INFO_1 = -1;
5314
5315 static int
5316 dissect_DRIVER_INFO_1(tvbuff_t *tvb, int offset,
5317                                  packet_info *pinfo, proto_tree *tree,
5318                                  dcerpc_info *di, guint8 *drep)
5319 {
5320         proto_item *item;
5321         proto_tree *subtree;
5322         int struct_start = offset;
5323
5324         item = proto_tree_add_text(
5325                 tree, tvb, offset, 0, "Driver info level 1");
5326
5327         subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_1);
5328
5329         offset = dissect_spoolss_relstr(
5330                 tvb, offset, pinfo, subtree, di, drep, hf_drivername,
5331                 struct_start, NULL);
5332
5333         return offset;
5334 }
5335
5336 /*
5337  * DRIVER_INFO_2
5338  */
5339
5340 static const value_string driverinfo_cversion_vals[] =
5341 {
5342         { 0, "Windows 95/98/Me" },
5343         { 2, "Windows NT 4.0" },
5344         { 3, "Windows 2000/XP" },
5345         { 0, NULL }
5346 };
5347
5348 static gint ett_DRIVER_INFO_2 = -1;
5349
5350 static int
5351 dissect_DRIVER_INFO_2(tvbuff_t *tvb, int offset,
5352          packet_info *pinfo, proto_tree *tree,
5353          dcerpc_info *di, guint8 *drep)
5354 {
5355         proto_item *item;
5356         proto_tree *subtree;
5357         int struct_start = offset;
5358
5359         item = proto_tree_add_text(
5360                         tree, tvb, offset, 0, "Driver info level 2");
5361
5362         subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_2);
5363
5364         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
5365                         hf_driverinfo_cversion, NULL);
5366
5367         offset = dissect_spoolss_relstr(
5368                         tvb, offset, pinfo, subtree, di, drep, hf_drivername,
5369                         struct_start, NULL);
5370
5371         offset = dissect_spoolss_relstr(
5372                         tvb, offset, pinfo, subtree, di, drep, hf_environment,
5373                         struct_start, NULL);
5374
5375         offset = dissect_spoolss_relstr(
5376                         tvb, offset, pinfo, subtree, di, drep, hf_driverpath,
5377                         struct_start, NULL);
5378
5379         offset = dissect_spoolss_relstr(
5380                         tvb, offset, pinfo, subtree, di, drep, hf_datafile,
5381                         struct_start, NULL);
5382
5383         offset = dissect_spoolss_relstr(
5384                         tvb, offset, pinfo, subtree, di, drep, hf_configfile,
5385                         struct_start, NULL);
5386
5387         return offset;
5388 }
5389
5390 /*
5391  * DRIVER_INFO_3
5392  */
5393
5394 static gint ett_DRIVER_INFO_3 = -1;
5395
5396 static int
5397 dissect_DRIVER_INFO_3(tvbuff_t *tvb, int offset,
5398                                  packet_info *pinfo, proto_tree *tree,
5399                                  dcerpc_info *di, guint8 *drep)
5400 {
5401         proto_item *item;
5402         proto_tree *subtree;
5403         int struct_start = offset;
5404
5405         item = proto_tree_add_text(
5406                 tree, tvb, offset, 0, "Driver info level 3");
5407
5408         subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_3);
5409
5410         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
5411                                     hf_driverinfo_cversion, NULL);
5412
5413         offset = dissect_spoolss_relstr(
5414                 tvb, offset, pinfo, subtree, di, drep, hf_drivername,
5415                 struct_start, NULL);
5416
5417         offset = dissect_spoolss_relstr(
5418                 tvb, offset, pinfo, subtree, di, drep, hf_environment,
5419                 struct_start, NULL);
5420
5421         offset = dissect_spoolss_relstr(
5422                 tvb, offset, pinfo, subtree, di, drep, hf_driverpath,
5423                 struct_start, NULL);
5424
5425         offset = dissect_spoolss_relstr(
5426                 tvb, offset, pinfo, subtree, di, drep, hf_datafile,
5427                 struct_start, NULL);
5428
5429         offset = dissect_spoolss_relstr(
5430                 tvb, offset, pinfo, subtree, di, drep, hf_configfile,
5431                 struct_start, NULL);
5432
5433         offset = dissect_spoolss_relstr(
5434                 tvb, offset, pinfo, subtree, di, drep, hf_helpfile,
5435                 struct_start, NULL);
5436
5437         offset = dissect_spoolss_relstrarray(
5438                 tvb, offset, pinfo, subtree, di, drep, hf_dependentfiles,
5439                 struct_start, NULL);
5440
5441         offset = dissect_spoolss_relstr(
5442                 tvb, offset, pinfo, subtree, di, drep, hf_monitorname,
5443                 struct_start, NULL);
5444
5445         offset = dissect_spoolss_relstr(
5446                 tvb, offset, pinfo, subtree, di, drep, hf_defaultdatatype,
5447                 struct_start, NULL);
5448
5449         return offset;
5450 }
5451
5452
5453 /*
5454         DRIVER_INFO_6
5455 */
5456
5457 static gint ett_DRIVER_INFO_6 = -1;
5458
5459 static int
5460 dissect_DRIVER_INFO_6(tvbuff_t *tvb, int offset,
5461                                  packet_info *pinfo, proto_tree *tree,
5462                                  dcerpc_info *di, guint8 *drep)
5463 {
5464         proto_item *item;
5465         proto_tree *subtree;
5466         int struct_start = offset;
5467
5468         item = proto_tree_add_text(
5469                         tree, tvb, offset, 0, "Driver info level 6");
5470
5471         subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_6);
5472
5473         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
5474                         hf_driverinfo_cversion, NULL);
5475
5476         offset = dissect_spoolss_relstr(
5477                         tvb, offset, pinfo, subtree, di, drep, hf_drivername,
5478                         struct_start, NULL);
5479
5480         offset = dissect_spoolss_relstr(
5481                         tvb, offset, pinfo, subtree, di, drep, hf_environment,
5482                         struct_start, NULL);
5483
5484         offset = dissect_spoolss_relstr(
5485                         tvb, offset, pinfo, subtree, di, drep, hf_driverpath,
5486                         struct_start, NULL);
5487
5488         offset = dissect_spoolss_relstr(
5489                         tvb, offset, pinfo, subtree, di, drep, hf_datafile,
5490                         struct_start, NULL);
5491
5492         offset = dissect_spoolss_relstr(
5493                         tvb, offset, pinfo, subtree, di, drep, hf_configfile,
5494                         struct_start, NULL);
5495
5496         offset = dissect_spoolss_relstr(
5497                         tvb, offset, pinfo, subtree, di, drep, hf_helpfile,
5498                         struct_start, NULL);
5499
5500         offset = dissect_spoolss_relstrarray(
5501                         tvb, offset, pinfo, subtree, di, drep, hf_dependentfiles,
5502                         struct_start, NULL);
5503
5504         offset = dissect_spoolss_relstr(
5505                         tvb, offset, pinfo, subtree, di, drep, hf_monitorname,
5506                         struct_start, NULL);
5507
5508         offset = dissect_spoolss_relstr(
5509                         tvb, offset, pinfo, subtree, di, drep, hf_defaultdatatype,
5510                         struct_start, NULL);
5511
5512         offset = dissect_spoolss_relstrarray(
5513                         tvb, offset, pinfo, subtree, di, drep, hf_previousdrivernames,
5514                         struct_start, NULL);
5515
5516         offset = dissect_ndr_nt_NTTIME (
5517                         tvb, offset, pinfo, subtree, di, drep,hf_driverdate);
5518
5519         offset = dissect_ndr_uint32(
5520                         tvb, offset, pinfo, subtree, di, drep, hf_padding,
5521                         NULL);
5522
5523         offset = dissect_ndr_uint32(
5524                         tvb, offset, pinfo, subtree, di, drep, hf_driver_version_low,
5525                         NULL);
5526
5527         offset = dissect_ndr_uint32(
5528                         tvb, offset, pinfo, subtree, di, drep, hf_driver_version_high,
5529                         NULL);
5530
5531
5532         offset = dissect_spoolss_relstr(
5533                         tvb, offset, pinfo, subtree, di, drep, hf_mfgname,
5534                         struct_start, NULL);
5535
5536         offset = dissect_spoolss_relstr(
5537                         tvb, offset, pinfo, subtree, di, drep, hf_oemurl,
5538                         struct_start, NULL);
5539
5540         offset = dissect_spoolss_relstr(
5541                         tvb, offset, pinfo, subtree, di, drep, hf_hardwareid,
5542                         struct_start, NULL);
5543
5544         offset = dissect_spoolss_relstr(
5545                         tvb, offset, pinfo, subtree, di, drep, hf_provider,
5546                         struct_start, NULL);
5547
5548         return offset;
5549 }
5550
5551
5552 static gint ett_DRIVER_INFO_101 = -1;
5553
5554 static int
5555 dissect_DRIVER_INFO_101(tvbuff_t *tvb, int offset,
5556                                  packet_info *pinfo, proto_tree *tree,
5557                                  dcerpc_info *di, guint8 *drep)
5558 {
5559         proto_item *item;
5560         proto_tree *subtree;
5561         int struct_start = offset;
5562
5563         item = proto_tree_add_text(
5564                         tree, tvb, offset, 0, "Driver info level 101");
5565
5566         subtree = proto_item_add_subtree(item, ett_DRIVER_INFO_101);
5567
5568         offset = dissect_ndr_uint32(tvb, offset, pinfo, subtree, di, drep,
5569                         hf_driverinfo_cversion, NULL);
5570
5571         offset = dissect_spoolss_relstr(
5572                         tvb, offset, pinfo, subtree, di, drep, hf_drivername,
5573                         struct_start, NULL);
5574
5575         offset = dissect_spoolss_relstr(
5576                         tvb, offset, pinfo, subtree, di, drep, hf_environment,
5577                         struct_start, NULL);
5578
5579         proto_tree_add_text(subtree,tvb,offset,0,"Unknown Data Follows");
5580
5581         return offset;
5582 }
5583 /*
5584  * EnumPrinterDrivers
5585  */
5586
5587 static int
5588 SpoolssEnumPrinterDrivers_q(tvbuff_t *tvb, int offset,
5589                                        packet_info *pinfo, proto_tree *tree,
5590                                        dcerpc_info *di, guint8 *drep)
5591 {
5592         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
5593         guint32 level;
5594
5595         /* Parse packet */
5596
5597         offset = dissect_ndr_str_pointer_item(
5598                 tvb, offset, pinfo, tree, di, drep, NDR_POINTER_UNIQUE,
5599                 "Name", hf_servername, 0);
5600
5601         offset = dissect_ndr_str_pointer_item(
5602                 tvb, offset, pinfo, tree, di, drep, NDR_POINTER_UNIQUE,
5603                 "Environment", hf_environment, 0);
5604
5605         offset = dissect_ndr_uint32(
5606                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
5607
5608         /* EnumPrinterDrivers() stores the level in se_data */
5609         if(!pinfo->fd->flags.visited){
5610                         dcv->se_data = GUINT_TO_POINTER((int)level);
5611         }
5612
5613         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
5614
5615         offset = dissect_spoolss_buffer(tvb, offset, pinfo, tree, di, drep, NULL);
5616
5617         offset = dissect_ndr_uint32(
5618                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
5619
5620         return offset;
5621 }
5622
5623 static int
5624 SpoolssEnumPrinterDrivers_r(tvbuff_t *tvb, int offset,
5625                                        packet_info *pinfo, proto_tree *tree,
5626                                        dcerpc_info *di, guint8 *drep)
5627 {
5628         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
5629         guint32 level = GPOINTER_TO_UINT(dcv->se_data), num_drivers, i;
5630         int buffer_offset;
5631         BUFFER buffer;
5632
5633         /* Parse packet */
5634
5635         offset = dissect_spoolss_buffer(tvb, offset, pinfo, tree, di, drep,
5636                                         &buffer);
5637
5638         offset = dissect_ndr_uint32(
5639                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
5640
5641         offset = dissect_ndr_uint32(
5642                 tvb, offset, pinfo, tree, di, drep, hf_returned,
5643                 &num_drivers);
5644
5645         buffer_offset = 0;
5646
5647         for (i = 0; i < num_drivers; i++) {
5648                 switch(level) {
5649                 case 1:
5650                         buffer_offset = dissect_DRIVER_INFO_1(
5651                                 buffer.tvb, buffer_offset, pinfo,
5652                                 buffer.tree, di, drep);
5653                         break;
5654                 case 2:
5655                         buffer_offset = dissect_DRIVER_INFO_2(
5656                                 buffer.tvb, buffer_offset, pinfo,
5657                                 buffer.tree, di, drep);
5658                         break;
5659                 case 3:
5660                         buffer_offset = dissect_DRIVER_INFO_3(
5661                                 buffer.tvb, buffer_offset, pinfo,
5662                                 buffer.tree, di, drep);
5663                         break;
5664                 case 6:
5665                         buffer_offset = dissect_DRIVER_INFO_6(
5666                                 buffer.tvb, buffer_offset, pinfo,
5667                                 buffer.tree, di, drep);
5668                         break;
5669                 case 101:
5670                         /*buffer_offset =*/ dissect_DRIVER_INFO_101(
5671                                 buffer.tvb, buffer_offset, pinfo,
5672                                 buffer.tree, di, drep);
5673                         /*break;*/
5674                         goto done; /*Not entirely imeplemented*/
5675                 default:
5676                         proto_tree_add_text(
5677                                 buffer.tree, buffer.tvb, buffer_offset, -1,
5678                                 "[Unknown driver info level %d]", level);
5679                         goto done;
5680                 }
5681         }
5682
5683 done:
5684         offset = dissect_doserror(
5685                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
5686
5687         return offset;
5688 }
5689
5690 /*
5691  * GetPrinterDriver2
5692  */
5693
5694 static int
5695 SpoolssGetPrinterDriver2_q(tvbuff_t *tvb, int offset,
5696                                       packet_info *pinfo, proto_tree *tree,
5697                                       dcerpc_info *di, guint8 *drep)
5698 {
5699         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
5700         e_ctx_hnd policy_hnd;
5701         char *pol_name;
5702         guint32 level;
5703
5704         /* Parse packet */
5705
5706         offset = dissect_nt_policy_hnd(
5707                 tvb, offset, pinfo, tree, di, drep, hf_hnd, &policy_hnd, NULL,
5708                 FALSE, FALSE);
5709
5710         dcerpc_fetch_polhnd_data(&policy_hnd, &pol_name, NULL, NULL, NULL,
5711                              pinfo->fd->num);
5712
5713         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s",
5714                                 pol_name);
5715
5716         offset = dissect_ndr_str_pointer_item(
5717                 tvb, offset, pinfo, tree, di, drep, NDR_POINTER_UNIQUE,
5718                 "Environment", hf_environment, 0);
5719
5720         offset = dissect_ndr_uint32(
5721                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
5722
5723         /* GetPrinterDriver2() stores the level in se_data */
5724         if(!pinfo->fd->flags.visited){
5725                         dcv->se_data = GUINT_TO_POINTER((int)level);
5726         }
5727
5728         col_append_fstr(pinfo->cinfo, COL_INFO, ", level %d", level);
5729
5730         offset = dissect_spoolss_buffer(tvb, offset, pinfo, tree, di, drep, NULL);
5731
5732         offset = dissect_ndr_uint32(
5733                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
5734
5735         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
5736                                     hf_clientmajorversion, NULL);
5737
5738         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
5739                                     hf_clientminorversion, NULL);
5740
5741         return offset;
5742 }
5743
5744 static int
5745 SpoolssGetPrinterDriver2_r(tvbuff_t *tvb, int offset,
5746                                       packet_info *pinfo, proto_tree *tree,
5747                                       dcerpc_info *di, guint8 *drep)
5748 {
5749         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
5750         guint32 level = GPOINTER_TO_UINT(dcv->se_data);
5751         BUFFER buffer;
5752
5753         /* Parse packet */
5754
5755         offset = dissect_spoolss_buffer(tvb, offset, pinfo, tree, di, drep,
5756                                         &buffer);
5757
5758         if (buffer.tvb) {
5759                 switch(level) {
5760                 case 1:
5761                         dissect_DRIVER_INFO_1(
5762                                 buffer.tvb, 0, pinfo, buffer.tree, di, drep);
5763                         break;
5764                 case 2:
5765                         dissect_DRIVER_INFO_2(
5766                                 buffer.tvb, 0, pinfo, buffer.tree, di, drep);
5767                         break;
5768                 case 3:
5769                         dissect_DRIVER_INFO_3(
5770                                 buffer.tvb, 0, pinfo, buffer.tree, di, drep);
5771                         break;
5772                 case 6:
5773                         dissect_DRIVER_INFO_6(
5774                                 buffer.tvb, 0, pinfo, buffer.tree, di, drep);
5775                         break;
5776                 case 101:
5777                         dissect_DRIVER_INFO_101(
5778                                 buffer.tvb, 0, pinfo, buffer.tree, di, drep);
5779                         break;
5780                 default:
5781                         proto_tree_add_text(
5782                                 buffer.tree, buffer.tvb, 0, -1,
5783                                 "[Unknown driver info level %d]", level);
5784                         break;
5785                 }
5786         }
5787
5788         offset = dissect_ndr_uint32(
5789                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
5790
5791         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
5792                                     hf_servermajorversion, NULL);
5793
5794         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
5795                                     hf_serverminorversion, NULL);
5796
5797         offset = dissect_doserror(
5798                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
5799
5800         return offset;
5801 }
5802
5803 static int
5804 dissect_notify_info_data_buffer(tvbuff_t *tvb, int offset, packet_info *pinfo,
5805                                 proto_tree *tree, dcerpc_info *di, guint8 *drep)
5806 {
5807         guint32 len;
5808
5809         offset = dissect_ndr_uint32(
5810                 tvb, offset, pinfo, tree, di, drep,
5811                 hf_notify_info_data_buffer_len, &len);
5812
5813         offset = dissect_ndr_uint16s(
5814                 tvb, offset, pinfo, tree, di, drep,
5815                 hf_notify_info_data_buffer_data, len);
5816
5817         return offset;
5818 }
5819
5820 static void
5821 cb_notify_str_postprocess(packet_info *pinfo _U_,
5822                                       proto_tree *tree _U_,
5823                                       proto_item *item, dcerpc_info *di _U_, tvbuff_t *tvb,
5824                                       int start_offset, int end_offset,
5825                                       void *callback_args)
5826 {
5827         gint levels, hf_index = GPOINTER_TO_INT(callback_args);
5828         guint32 len;
5829         char *s;
5830         proto_item *hidden_item;
5831
5832         /* Align start_offset on 4-byte boundary. */
5833
5834         if (start_offset % 4)
5835                 start_offset += 4 - (start_offset % 4);
5836
5837         /* Get string length */
5838
5839         len = tvb_get_letohl(tvb, start_offset);
5840
5841         s = tvb_get_unicode_string(NULL,
5842                 tvb, start_offset + 4, (end_offset - start_offset - 4), ENC_LITTLE_ENDIAN);
5843
5844         /* Append string to upper-level proto_items */
5845
5846         levels = 2;
5847
5848         if (levels > 0 && item && s && s[0]) {
5849                 proto_item_append_text(item, ": %s", s);
5850                 item = item->parent;
5851                 levels--;
5852                 if (levels > 0) {
5853                         proto_item_append_text(item, ": %s", s);
5854                         item = item->parent;
5855                         levels--;
5856                         while (levels > 0) {
5857                                 proto_item_append_text(item, " %s", s);
5858                                 item = item->parent;
5859                                 levels--;
5860                         }
5861                 }
5862         }
5863
5864         /* Add hidden field so filter brings up any notify data */
5865
5866         if (hf_index != -1) {
5867                 hidden_item = proto_tree_add_string(
5868                         tree, hf_index, tvb, start_offset, len, s);
5869                 PROTO_ITEM_SET_HIDDEN(hidden_item);
5870         }
5871
5872         g_free(s);
5873 }
5874
5875 /* Return the hf_index for a printer notify field.  This is used to
5876    add a hidden string to the display so that filtering will bring
5877    up relevant notify data. */
5878
5879 static int
5880 printer_notify_hf_index(int field)
5881 {
5882         int result = -1;
5883
5884         switch(field) {
5885         case PRINTER_NOTIFY_SERVER_NAME:
5886                 result = hf_servername;
5887                 break;
5888         case PRINTER_NOTIFY_PRINTER_NAME:
5889                 result = hf_printername;
5890                 break;
5891         case PRINTER_NOTIFY_SHARE_NAME:
5892                 result = hf_sharename;
5893                 break;
5894         case PRINTER_NOTIFY_PORT_NAME:
5895                 result = hf_portname;
5896                 break;
5897         case PRINTER_NOTIFY_DRIVER_NAME:
5898                 result = hf_drivername;
5899                 break;
5900         case PRINTER_NOTIFY_COMMENT:
5901                 result = hf_printercomment;
5902                 break;
5903         case PRINTER_NOTIFY_LOCATION:
5904                 result = hf_printerlocation;
5905                 break;
5906         case PRINTER_NOTIFY_SEPFILE:
5907                 result = hf_sepfile;
5908                 break;
5909         case PRINTER_NOTIFY_PRINT_PROCESSOR:
5910                 result = hf_printprocessor;
5911                 break;
5912         case PRINTER_NOTIFY_PARAMETERS:
5913                 result = hf_parameters;
5914                 break;
5915         case PRINTER_NOTIFY_DATATYPE:
5916                 result = hf_parameters;
5917                 break;
5918         }
5919
5920         return result;
5921 }
5922
5923 static int
5924 job_notify_hf_index(int field)
5925 {
5926         int result = -1;
5927
5928         switch(field) {
5929         case JOB_NOTIFY_PRINTER_NAME:
5930                 result = hf_printername;
5931                 break;
5932         case JOB_NOTIFY_MACHINE_NAME:
5933                 result = hf_machinename;
5934                 break;
5935         case JOB_NOTIFY_PORT_NAME:
5936                 result = hf_portname;
5937                 break;
5938         case JOB_NOTIFY_USER_NAME:
5939                 result = hf_username;
5940                 break;
5941         case JOB_NOTIFY_NOTIFY_NAME:
5942                 result = hf_notifyname;
5943                 break;
5944         case JOB_NOTIFY_DATATYPE:
5945                 result = hf_datatype;
5946                 break;
5947         case JOB_NOTIFY_PRINT_PROCESSOR:
5948                 result = hf_printprocessor;
5949                 break;
5950         case JOB_NOTIFY_DRIVER_NAME:
5951                 result = hf_drivername;
5952                 break;
5953         case JOB_NOTIFY_DOCUMENT:
5954                 result = hf_documentname;
5955                 break;
5956         case JOB_NOTIFY_PRIORITY:
5957                 result = hf_job_priority;
5958                 break;
5959         case JOB_NOTIFY_POSITION:
5960                 result = hf_job_position;
5961                 break;
5962         case JOB_NOTIFY_TOTAL_PAGES:
5963                 result = hf_job_totalpages;
5964                 break;
5965         case JOB_NOTIFY_PAGES_PRINTED:
5966                 result = hf_job_pagesprinted;
5967                 break;
5968         case JOB_NOTIFY_TOTAL_BYTES:
5969                 result = hf_job_totalbytes;
5970                 break;
5971         case JOB_NOTIFY_BYTES_PRINTED:
5972                 result = hf_job_bytesprinted;
5973                 break;
5974         }
5975
5976         return result;
5977 }
5978
5979 static int
5980 dissect_NOTIFY_INFO_DATA_printer(tvbuff_t *tvb, int offset, packet_info *pinfo,
5981                                  proto_tree *tree, proto_item *item,
5982                                  dcerpc_info *di, guint8 *drep, guint16 field)
5983 {
5984         guint32 value1;
5985
5986         switch (field) {
5987
5988                 /* String notify data */
5989
5990         case PRINTER_NOTIFY_SERVER_NAME:
5991         case PRINTER_NOTIFY_PRINTER_NAME:
5992         case PRINTER_NOTIFY_SHARE_NAME:
5993         case PRINTER_NOTIFY_DRIVER_NAME:
5994         case PRINTER_NOTIFY_COMMENT:
5995         case PRINTER_NOTIFY_LOCATION:
5996         case PRINTER_NOTIFY_SEPFILE:
5997         case PRINTER_NOTIFY_PRINT_PROCESSOR:
5998         case PRINTER_NOTIFY_PARAMETERS:
5999         case PRINTER_NOTIFY_DATATYPE:
6000         case PRINTER_NOTIFY_PORT_NAME:
6001
6002                 offset = dissect_ndr_uint32(
6003                         tvb, offset, pinfo, tree, di, drep,
6004                         hf_notify_info_data_bufsize, &value1);
6005
6006                 offset = dissect_ndr_pointer_cb(
6007                         tvb, offset, pinfo, tree, di, drep,
6008                         dissect_notify_info_data_buffer,
6009                         NDR_POINTER_UNIQUE, "String",
6010                         hf_notify_info_data_buffer,
6011                         cb_notify_str_postprocess,
6012                         GINT_TO_POINTER(printer_notify_hf_index(field)));
6013
6014                 break;
6015
6016         case PRINTER_NOTIFY_ATTRIBUTES:
6017
6018                 /* Value 1 is the printer attributes */
6019
6020                 offset = dissect_printer_attributes(
6021                         tvb, offset, pinfo, tree, di, drep);
6022
6023                 offset = dissect_ndr_uint32(
6024                         tvb, offset, pinfo, NULL, di, drep,
6025                         hf_notify_info_data_value2, NULL);
6026
6027                 break;
6028
6029         case PRINTER_NOTIFY_STATUS: {
6030                 guint32 status;
6031
6032                 /* Value 1 is the printer status */
6033
6034                 offset = dissect_ndr_uint32(
6035                         tvb, offset, pinfo, tree, di, drep,
6036                         hf_printer_status, &status);
6037
6038                 offset = dissect_ndr_uint32(
6039                         tvb, offset, pinfo, NULL, di, drep,
6040                         hf_notify_info_data_value2, NULL);
6041
6042                 proto_item_append_text(
6043                         item, ": %s",
6044                         val_to_str_ext_const(status, &printer_status_vals_ext, "Unknown"));
6045
6046                 break;
6047         }
6048
6049                 /* Unknown notify data */
6050
6051         case PRINTER_NOTIFY_SECURITY_DESCRIPTOR: /* Secdesc */
6052         case PRINTER_NOTIFY_DEVMODE: /* Devicemode */
6053
6054                 offset = dissect_ndr_uint32(
6055                         tvb, offset, pinfo, tree, di, drep,
6056                         hf_notify_info_data_bufsize, &value1);
6057
6058                 offset = dissect_ndr_pointer(
6059                         tvb, offset, pinfo, tree, di, drep,
6060                         dissect_notify_info_data_buffer,
6061                         NDR_POINTER_UNIQUE, "Buffer",
6062                         hf_notify_info_data_buffer);
6063
6064                 break;
6065
6066         default:
6067                 offset = dissect_ndr_uint32(
6068                         tvb, offset, pinfo, tree, di, drep,
6069                         hf_notify_info_data_value1, NULL);
6070
6071                 offset = dissect_ndr_uint32(
6072                         tvb, offset, pinfo, tree, di, drep,
6073                         hf_notify_info_data_value2, NULL);
6074
6075                 break;
6076         }
6077         return offset;
6078 }
6079
6080 static void
6081 notify_job_time_cb(packet_info *pinfo _U_, proto_tree *tree _U_,
6082                                proto_item *item, dcerpc_info *di, tvbuff_t *tvb _U_,
6083                                int start_offset _U_, int end_offset _U_,
6084                                void *callback_args _U_)
6085 {
6086         dcerpc_call_value *dcv = (dcerpc_call_value *)di->call_data;
6087         char *str = (char *)dcv->private_data;
6088
6089         /* Append job string stored in dcv->private_data by
6090            dissect_SYSTEM_TIME_ptr() in the current item as well
6091            as the parent. */
6092
6093         proto_item_append_text(item, ": %s", str);
6094
6095         if (item)
6096                 proto_item_append_text(item->parent, ": %s", str);
6097 }
6098
6099 static int
6100 dissect_NOTIFY_INFO_DATA_job(tvbuff_t *tvb, int offset, packet_info *pinfo,
6101                              proto_tree *tree, proto_item *item, dcerpc_info *di, guint8 *drep,
6102                              guint16 field)
6103 {
6104         guint32 value1;
6105         proto_item *hidden_item;
6106
6107         switch (field) {
6108
6109                 /* String notify data */
6110
6111         case JOB_NOTIFY_PRINTER_NAME:
6112         case JOB_NOTIFY_MACHINE_NAME:
6113         case JOB_NOTIFY_PORT_NAME:
6114         case JOB_NOTIFY_USER_NAME:
6115         case JOB_NOTIFY_NOTIFY_NAME:
6116         case JOB_NOTIFY_DATATYPE:
6117         case JOB_NOTIFY_PRINT_PROCESSOR:
6118         case JOB_NOTIFY_PARAMETERS:
6119         case JOB_NOTIFY_DRIVER_NAME:
6120         case JOB_NOTIFY_STATUS_STRING:
6121         case JOB_NOTIFY_DOCUMENT:
6122
6123                 offset = dissect_ndr_uint32(
6124                         tvb, offset, pinfo, tree, di, drep,
6125                         hf_notify_info_data_bufsize, &value1);
6126
6127                 offset = dissect_ndr_pointer_cb(
6128                         tvb, offset, pinfo, tree, di, drep,
6129                         dissect_notify_info_data_buffer,
6130                         NDR_POINTER_UNIQUE, "String",
6131                         hf_notify_info_data_buffer,
6132                         cb_notify_str_postprocess,
6133                         GINT_TO_POINTER(job_notify_hf_index(field)));
6134
6135                 break;
6136
6137         case JOB_NOTIFY_STATUS:
6138                 offset = dissect_job_status(
6139                         tvb, offset, pinfo, tree, di, drep);
6140
6141                 offset = dissect_ndr_uint32(
6142                         tvb, offset, pinfo, NULL, di, drep,
6143                         hf_notify_info_data_value2, NULL);
6144
6145                 break;
6146
6147         case JOB_NOTIFY_SUBMITTED:
6148
6149                 /* SYSTEM_TIME */
6150
6151                 offset = dissect_ndr_uint32(
6152                         tvb, offset, pinfo, tree, di, drep,
6153                         hf_notify_info_data_buffer_len, NULL);
6154
6155                 offset = dissect_ndr_pointer_cb(
6156                         tvb, offset, pinfo, tree, di, drep,
6157                         dissect_SYSTEM_TIME_ptr, NDR_POINTER_UNIQUE,
6158                         "Time submitted", -1, notify_job_time_cb, NULL);
6159
6160                 break;
6161
6162         case JOB_NOTIFY_PRIORITY:
6163         case JOB_NOTIFY_POSITION:
6164         case JOB_NOTIFY_TOTAL_PAGES:
6165         case JOB_NOTIFY_PAGES_PRINTED:
6166         case JOB_NOTIFY_TOTAL_BYTES:
6167         case JOB_NOTIFY_BYTES_PRINTED: {
6168                 guint32 value;
6169
6170                 offset = dissect_ndr_uint32(
6171                         tvb, offset, pinfo, tree, di, drep,
6172                         hf_notify_info_data_value1, &value);
6173
6174                 offset = dissect_ndr_uint32(
6175                         tvb, offset, pinfo, tree, di, drep,
6176                         hf_notify_info_data_value2, NULL);
6177
6178                 proto_item_append_text(item, ": %d", value);
6179
6180                 hidden_item = proto_tree_add_uint(
6181                         tree, job_notify_hf_index(field), tvb,
6182                         offset, 4, value);
6183                 PROTO_ITEM_SET_HIDDEN(hidden_item);
6184
6185                 break;
6186         }
6187
6188                 /* Unknown notify data */
6189
6190         case JOB_NOTIFY_DEVMODE:
6191
6192                 offset = dissect_ndr_uint32(
6193                         tvb, offset, pinfo, tree, di, drep,
6194                         hf_notify_info_data_bufsize, &value1);
6195
6196                 offset = dissect_ndr_pointer(
6197                         tvb, offset, pinfo, tree, di, drep,
6198                         dissect_notify_info_data_buffer,
6199                         NDR_POINTER_UNIQUE, "Buffer",
6200                         hf_notify_info_data_buffer);
6201
6202                 break;
6203
6204         default:
6205                 offset = dissect_ndr_uint32(
6206                         tvb, offset, pinfo, tree, di, drep,
6207                         hf_notify_info_data_value1, NULL);
6208
6209                 offset = dissect_ndr_uint32(
6210                         tvb, offset, pinfo, tree, di, drep,
6211                         hf_notify_info_data_value2, NULL);
6212         }
6213         return offset;
6214 }
6215
6216 static gint ett_NOTIFY_INFO_DATA = -1;
6217
6218 static int
6219 dissect_NOTIFY_INFO_DATA(tvbuff_t *tvb, int offset, packet_info *pinfo,
6220                          proto_tree *tree, dcerpc_info *di, guint8 *drep)
6221 {
6222         proto_item *item;
6223         proto_tree *subtree;
6224         guint32 count;
6225         guint16 type, field;
6226         const char *field_string;
6227
6228         item = proto_tree_add_text(tree, tvb, offset, 0, "%s", "");
6229
6230         subtree = proto_item_add_subtree(item, ett_NOTIFY_INFO_DATA);
6231
6232         offset = dissect_ndr_uint16(
6233                 tvb, offset, pinfo, subtree, di, drep,
6234                 hf_notify_info_data_type, &type);
6235
6236         offset = dissect_notify_field(
6237                 tvb, offset, pinfo, subtree, di, drep, type, &field);
6238
6239         switch(type) {
6240         case PRINTER_NOTIFY_TYPE:
6241                 field_string = val_to_str_ext(
6242                         field, &printer_notify_option_data_vals_ext,
6243                         "Unknown (%d)");
6244                 break;
6245         case JOB_NOTIFY_TYPE:
6246                 field_string = val_to_str_ext(
6247                         field, &job_notify_option_data_vals_ext,
6248                         "Unknown (%d)");
6249                 break;
6250         default:
6251                 field_string = "Unknown field";
6252                 break;
6253         }
6254
6255         proto_item_append_text(
6256                 item, "%s, %s",
6257                 val_to_str(type, printer_notify_types, "Unknown (%d)"),
6258                 field_string);
6259
6260         offset = dissect_ndr_uint32(
6261                 tvb, offset, pinfo, subtree, di, drep,
6262                 hf_notify_info_data_count, &count);
6263
6264         offset = dissect_ndr_uint32(
6265                 tvb, offset, pinfo, subtree, di, drep,
6266                 hf_notify_info_data_id, NULL);
6267
6268         offset = dissect_ndr_uint32(
6269                 tvb, offset, pinfo, subtree, di, drep,
6270                 hf_notify_info_data_count, NULL);
6271
6272         /* The value here depends on (type, field) */
6273
6274         switch (type) {
6275         case PRINTER_NOTIFY_TYPE:
6276                 offset = dissect_NOTIFY_INFO_DATA_printer(
6277                         tvb, offset, pinfo, subtree, item, di, drep, field);
6278                 break;
6279         case JOB_NOTIFY_TYPE:
6280                 offset = dissect_NOTIFY_INFO_DATA_job(
6281                         tvb, offset, pinfo, subtree, item, di, drep, field);
6282                 break;
6283         default:
6284                 proto_tree_add_text(
6285                         tree, tvb, offset, 0,
6286                         "[Unknown notify type %d]", type);
6287                 break;
6288         }
6289
6290         return offset;
6291 }
6292
6293 static int
6294 dissect_NOTIFY_INFO(tvbuff_t *tvb, int offset, packet_info *pinfo,
6295                     proto_tree *tree, dcerpc_info *di, guint8 *drep)
6296 {
6297         guint32 count;
6298
6299         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
6300                                     hf_notify_info_version, NULL);
6301
6302         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
6303                                     hf_notify_info_flags, NULL);
6304
6305         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
6306                                     hf_notify_info_count, &count);
6307
6308         if (!di->conformant_run)
6309                 col_append_fstr(
6310                         pinfo->cinfo, COL_INFO, ", %d %s", count,
6311                         notify_plural(count));
6312
6313         offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, di, drep,
6314                                      dissect_NOTIFY_INFO_DATA);
6315
6316         return offset;
6317 }
6318
6319 /*
6320  * RFNPCNEX
6321  */
6322
6323 static int
6324 SpoolssRFNPCNEX_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
6325                              proto_tree *tree, dcerpc_info *di, guint8 *drep)
6326 {
6327         guint32 changeid;
6328
6329         /* Parse packet */
6330
6331         offset = dissect_nt_policy_hnd(
6332                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
6333                 FALSE, FALSE);
6334
6335         offset = dissect_ndr_uint32(
6336                 tvb, offset, pinfo, tree, di, drep, hf_rrpcn_changelow, &changeid);
6337
6338         col_append_fstr(
6339                         pinfo->cinfo, COL_INFO, ", changeid %d", changeid);
6340
6341         offset = dissect_ndr_pointer(
6342                 tvb, offset, pinfo, tree, di, drep,
6343                 dissect_NOTIFY_OPTIONS_ARRAY_CTR, NDR_POINTER_UNIQUE,
6344                 "Notify Options Array Container", -1);
6345
6346         return offset;
6347 }
6348
6349 static int
6350 SpoolssRFNPCNEX_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
6351                              proto_tree *tree, dcerpc_info *di, guint8 *drep)
6352 {
6353         /* Parse packet */
6354
6355         offset = dissect_ndr_pointer(
6356                 tvb, offset, pinfo, tree, di, drep,
6357                 dissect_NOTIFY_INFO, NDR_POINTER_UNIQUE,
6358                 "Notify Info", -1);
6359
6360         offset = dissect_doserror(
6361                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
6362
6363         return offset;
6364 }
6365
6366 /*
6367  * RRPCN
6368  */
6369
6370 static int
6371 SpoolssRRPCN_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
6372                           proto_tree *tree, dcerpc_info *di, guint8 *drep)
6373 {
6374         guint32 changeid;
6375
6376         /* Parse packet */
6377
6378         offset = dissect_nt_policy_hnd(
6379                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
6380                 FALSE, FALSE);
6381
6382         offset = dissect_ndr_uint32(
6383                 tvb, offset, pinfo, tree, di, drep, hf_rrpcn_changelow, &changeid);
6384
6385         col_append_fstr(
6386                         pinfo->cinfo, COL_INFO, ", changeid %d", changeid);
6387
6388         offset = dissect_ndr_uint32(
6389                 tvb, offset, pinfo, tree, di, drep, hf_rrpcn_changehigh, NULL);
6390
6391         offset = dissect_ndr_uint32(
6392                 tvb, offset, pinfo, tree, di, drep, hf_rrpcn_unk0, NULL);
6393
6394         offset = dissect_ndr_uint32(
6395                 tvb, offset, pinfo, tree, di, drep, hf_rrpcn_unk1, NULL);
6396
6397         offset = dissect_ndr_pointer(
6398                 tvb, offset, pinfo, tree, di, drep,
6399                 dissect_NOTIFY_INFO, NDR_POINTER_UNIQUE,
6400                 "Notify Info", -1);
6401
6402         /* Notify info */
6403
6404         return offset;
6405 }
6406
6407 static int
6408 SpoolssRRPCN_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
6409                           proto_tree *tree, dcerpc_info *di, guint8 *drep)
6410 {
6411         /* Parse packet */
6412
6413         offset = dissect_ndr_uint32(
6414                 tvb, offset, pinfo, tree, di, drep, hf_rrpcn_unk0, NULL);
6415
6416         offset = dissect_doserror(
6417                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
6418
6419         return offset;
6420 }
6421
6422 /*
6423  * ReplyClosePrinter
6424  */
6425
6426 static int
6427 SpoolssReplyClosePrinter_q(tvbuff_t *tvb, int offset,
6428                                       packet_info *pinfo, proto_tree *tree,
6429                                       dcerpc_info *di, guint8 *drep)
6430 {
6431         /* Parse packet */
6432
6433         offset = dissect_nt_policy_hnd(
6434                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
6435                 FALSE, TRUE);
6436
6437         return offset;
6438 }
6439
6440 static int
6441 SpoolssReplyClosePrinter_r(tvbuff_t *tvb, int offset,
6442                                       packet_info *pinfo, proto_tree *tree,
6443                                       dcerpc_info *di, guint8 *drep)
6444 {
6445         /* Parse packet */
6446
6447         offset = dissect_nt_policy_hnd(
6448                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
6449                 FALSE, FALSE);
6450
6451         offset = dissect_doserror(
6452                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
6453
6454         return offset;
6455 }
6456
6457 /*
6458  * FCPN
6459  */
6460
6461 static int
6462 SpoolssFCPN_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
6463                         proto_tree *tree, dcerpc_info *di, guint8 *drep)
6464 {
6465         /* Parse packet */
6466
6467         offset = dissect_nt_policy_hnd(
6468                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
6469                 FALSE, FALSE);
6470
6471         return offset;
6472 }
6473
6474 static int
6475 SpoolssFCPN_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
6476                         proto_tree *tree, dcerpc_info *di, guint8 *drep)
6477 {
6478         /* Parse packet */
6479
6480         offset = dissect_doserror(
6481                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
6482
6483         return offset;
6484 }
6485
6486 /*
6487  * RouterReplyPrinter
6488  */
6489
6490 static int hf_routerreplyprinter_condition = -1;
6491 static int hf_routerreplyprinter_unknown1 = -1;
6492 static int hf_routerreplyprinter_changeid = -1;
6493
6494 static int
6495 SpoolssRouterReplyPrinter_q(tvbuff_t *tvb, int offset, packet_info *pinfo,
6496                                        proto_tree *tree, dcerpc_info *di, guint8 *drep)
6497 {
6498         /* Parse packet */
6499
6500         offset = dissect_nt_policy_hnd(
6501                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
6502                 FALSE, FALSE);
6503
6504         offset = dissect_ndr_uint32(
6505                 tvb, offset, pinfo, tree, di, drep,
6506                 hf_routerreplyprinter_condition, NULL);
6507
6508         offset = dissect_ndr_uint32(
6509                 tvb, offset, pinfo, tree, di, drep,
6510                 hf_routerreplyprinter_unknown1, NULL);
6511
6512         offset = dissect_ndr_uint32(
6513                 tvb, offset, pinfo, tree, di, drep,
6514                 hf_routerreplyprinter_changeid, NULL);
6515
6516         return offset;
6517 }
6518
6519 static int
6520 SpoolssRouterReplyPrinter_r(tvbuff_t *tvb, int offset, packet_info *pinfo,
6521                                        proto_tree *tree, dcerpc_info *di, guint8 *drep)
6522 {
6523         /* Parse packet */
6524
6525         offset = dissect_doserror(
6526                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
6527
6528         return offset;
6529 }
6530
6531 static int hf_keybuffer_size = -1;
6532
6533 static int
6534 dissect_spoolss_keybuffer(tvbuff_t *tvb, int offset, packet_info *pinfo,
6535                           proto_tree *tree, dcerpc_info *di, guint8 *drep)
6536 {
6537         guint32 size;
6538         int end_offset;
6539
6540         if (di->conformant_run)
6541                 return offset;
6542
6543         /* Dissect size and data */
6544
6545         offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, di, drep,
6546                                     hf_keybuffer_size, &size);
6547
6548         end_offset = offset + (size*2);
6549         if (end_offset < offset) {
6550                 /*
6551                  * Overflow - make the end offset one past the end of
6552                  * the packet data, so we throw an exception (as the
6553                  * size is almost certainly too big).
6554                  */
6555                 end_offset = tvb_reported_length_remaining(tvb, offset) + 1;
6556         }
6557
6558         while (offset < end_offset)
6559                 offset = dissect_spoolss_uint16uni(
6560                         tvb, offset, pinfo, tree, drep, NULL, "Key");
6561
6562         return offset;
6563 }
6564
6565
6566 static int
6567 SpoolssEnumPrinterKey_q(tvbuff_t *tvb, int offset,
6568                                    packet_info *pinfo, proto_tree *tree,
6569                                    dcerpc_info *di, guint8 *drep)
6570 {
6571         char *key_name;
6572
6573         /* Parse packet */
6574
6575         offset = dissect_nt_policy_hnd(
6576                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
6577                 FALSE, FALSE);
6578
6579         offset = dissect_ndr_cvstring(
6580                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
6581                 hf_printerdata_key, TRUE, &key_name);
6582
6583         if (!key_name[0])
6584                 key_name = (char*)"\"\"";
6585
6586         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", key_name);
6587
6588         offset = dissect_ndr_uint32(
6589                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
6590
6591         return offset;
6592 }
6593
6594 static int
6595 SpoolssEnumPrinterKey_r(tvbuff_t *tvb, int offset,
6596                                    packet_info *pinfo, proto_tree *tree,
6597                                    dcerpc_info *di, guint8 *drep)
6598 {
6599         /* Parse packet */
6600
6601         offset = dissect_spoolss_keybuffer(tvb, offset, pinfo, tree, di, drep);
6602
6603         offset = dissect_ndr_uint32(
6604                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
6605
6606         offset = dissect_doserror(
6607                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
6608
6609         return offset;
6610 }
6611
6612 static int hf_enumprinterdataex_name_offset = -1;
6613 static int hf_enumprinterdataex_name_len = -1;
6614 static int hf_enumprinterdataex_val_offset = -1;
6615 static int hf_enumprinterdataex_val_len = -1;
6616 static int hf_enumprinterdataex_val_dword_low = -1;
6617 static int hf_enumprinterdataex_val_dword_high = -1;
6618
6619 static int
6620 SpoolssEnumPrinterDataEx_q(tvbuff_t *tvb, int offset,
6621                                       packet_info *pinfo, proto_tree *tree,
6622                                       dcerpc_info *di, guint8 *drep)
6623 {
6624         char *key_name;
6625         proto_item *hidden_item;
6626
6627         hidden_item = proto_tree_add_uint(
6628                 tree, hf_printerdata, tvb, offset, 0, 1);
6629         PROTO_ITEM_SET_HIDDEN(hidden_item);
6630
6631         /* Parse packet */
6632
6633         offset = dissect_nt_policy_hnd(
6634                 tvb, offset, pinfo, tree, di, drep, hf_hnd, NULL, NULL,
6635                 FALSE, FALSE);
6636
6637         offset = dissect_ndr_cvstring(
6638                 tvb, offset, pinfo, tree, di, drep, sizeof(guint16),
6639                 hf_printerdata_key, TRUE, &key_name);
6640
6641         col_append_fstr(pinfo->cinfo, COL_INFO, ", %s", key_name);
6642
6643         offset = dissect_ndr_uint32(
6644                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
6645
6646         return offset;
6647 }
6648
6649 static gint ett_printer_enumdataex_value = -1;
6650
6651 static int
6652 dissect_spoolss_printer_enum_values(tvbuff_t *tvb, int offset,
6653                                     packet_info *pinfo, proto_tree *tree,
6654                                     dcerpc_info *di, guint8 *drep)
6655 {
6656         guint32 start_offset = offset;
6657         guint32 name_offset, name_len, val_offset, val_len, val_type;
6658         char *name;
6659         proto_item *item;
6660         proto_tree *subtree;
6661
6662         /* Get offset of value name */
6663
6664         offset = dissect_ndr_uint32(
6665                 tvb, offset, pinfo, NULL, di, drep,
6666                 hf_enumprinterdataex_name_offset, &name_offset);
6667
6668         offset = dissect_ndr_uint32(
6669                 tvb, offset, pinfo, NULL, di, drep,
6670                 hf_enumprinterdataex_name_len, &name_len);
6671
6672         dissect_spoolss_uint16uni(
6673                 tvb, start_offset + name_offset, pinfo, NULL, drep,
6674                 &name, "Name");
6675
6676         item = proto_tree_add_text(tree, tvb, offset, 0, "Name: ");
6677
6678         subtree = proto_item_add_subtree(item, ett_printer_enumdataex_value);
6679
6680         proto_item_append_text(item, "%s", name);
6681
6682         proto_tree_add_text(
6683                 subtree, tvb, offset - 8, 4, "Name offset: %d", name_offset);
6684
6685         proto_tree_add_text(
6686                 subtree, tvb, offset - 4, 4, "Name len: %d", name_len);
6687
6688         proto_tree_add_text(
6689                 subtree, tvb, start_offset + name_offset, ((int)strlen(name) + 1) * 2,
6690                 "Name: %s", name);
6691
6692         offset = dissect_ndr_uint32(
6693                 tvb, offset, pinfo, subtree, di, drep, hf_printerdata_type,
6694                 &val_type);
6695
6696         offset = dissect_ndr_uint32(
6697                 tvb, offset, pinfo, subtree, di, drep,
6698                 hf_enumprinterdataex_val_offset, &val_offset);
6699
6700         offset = dissect_ndr_uint32(
6701                 tvb, offset, pinfo, subtree, di, drep,
6702                 hf_enumprinterdataex_val_len, &val_len);
6703
6704         if (val_len == 0) {
6705                 proto_tree_add_text(subtree, tvb, start_offset + val_offset, 4,
6706                                     "Value: (null)");
6707                 goto done;
6708         }
6709
6710         switch(val_type) {
6711         case DCERPC_REG_DWORD: {
6712                 guint32 value;
6713                 guint16 low, high;
6714                 int offset2 = start_offset + val_offset;
6715
6716                 /* Needs to be broken into two 16-byte ints because it may
6717                    not be aligned. */
6718
6719                 offset2 = dissect_ndr_uint16(
6720                         tvb, offset2, pinfo, subtree, di, drep,
6721                         hf_enumprinterdataex_val_dword_low, &low);
6722
6723                 /*offset2 = */dissect_ndr_uint16(
6724                         tvb, offset2, pinfo, subtree, di, drep,
6725                         hf_enumprinterdataex_val_dword_high, &high);
6726
6727                 value = (high << 16) | low;
6728
6729                 proto_tree_add_text(subtree, tvb, start_offset + val_offset, 4,
6730                                     "Value: %d", value);
6731
6732                 proto_item_append_text(item, ", Value: %d", value);
6733
6734                 break;
6735         }
6736         case DCERPC_REG_SZ: {
6737                 char *value;
6738
6739                 dissect_spoolss_uint16uni(
6740                         tvb, start_offset + val_offset, pinfo, subtree, drep,
6741                         &value, "Value");
6742
6743                 proto_item_append_text(item, ", Value: %s", value);
6744
6745                 g_free(value);
6746
6747                 break;
6748         }
6749         case DCERPC_REG_BINARY:
6750
6751                 /* FIXME: nicer way to display this */
6752
6753                 proto_tree_add_text(
6754                         subtree, tvb, start_offset + val_offset, val_len,
6755                         "Value: <binary data>");
6756                 break;
6757
6758         case DCERPC_REG_MULTI_SZ:
6759
6760                 /* FIXME: implement REG_MULTI_SZ support */
6761
6762                 proto_tree_add_text(
6763                         subtree, tvb, start_offset + val_offset, val_len,
6764                         "Value: <REG_MULTI_SZ not implemented>");
6765                 break;
6766
6767         default:
6768                 proto_tree_add_text(
6769                         subtree, tvb, start_offset + val_offset, val_len,
6770                         "%s: unknown type %d", name, val_type);
6771         }
6772
6773  done:
6774         g_free(name);
6775
6776         return offset;
6777 }
6778
6779 static gint ett_PRINTER_DATA_CTR = -1;
6780
6781 static int
6782 SpoolssEnumPrinterDataEx_r(tvbuff_t *tvb, int offset,
6783                                    packet_info *pinfo, proto_tree *tree,
6784                                    dcerpc_info *di, guint8 *drep)
6785 {
6786         guint32 size, num_values;
6787         proto_item *hidden_item;
6788
6789         hidden_item = proto_tree_add_uint(
6790                 tree, hf_printerdata, tvb, offset, 0, 1);
6791         PROTO_ITEM_SET_HIDDEN(hidden_item);
6792
6793         /* Parse packet */
6794
6795         offset = dissect_ndr_uint32(
6796                 tvb, offset, pinfo, tree, di, drep,
6797                 hf_buffer_size, &size);
6798
6799         dissect_ndr_uint32(
6800                 tvb, offset + size + 4, pinfo, NULL, di, drep, hf_returned,
6801                 &num_values);
6802
6803         if (size) {
6804                 proto_item *item;
6805                 proto_tree *subtree;
6806                 int offset2 = offset;
6807                 guint32 i;
6808
6809                 item = proto_tree_add_text(
6810                         tree, tvb, offset, 0, "Printer data");
6811
6812                 subtree = proto_item_add_subtree(item, ett_PRINTER_DATA_CTR);
6813
6814                 for (i=0; i < num_values; i++)
6815                         offset2 = dissect_spoolss_printer_enum_values(
6816                                 tvb, offset2, pinfo, subtree, di, drep);
6817         }
6818
6819         offset += size;
6820
6821         offset = dissect_ndr_uint32(
6822                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
6823
6824         offset = dissect_ndr_uint32(
6825                 tvb, offset, pinfo, tree, di, drep, hf_returned, NULL);
6826
6827         offset = dissect_doserror(
6828                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
6829
6830         return offset;
6831 }
6832
6833 static int
6834 SpoolssGetPrinterDriverDirectory_q(tvbuff_t *tvb, int offset,
6835                                       packet_info *pinfo, proto_tree *tree,
6836                                       dcerpc_info *di, guint8 *drep)
6837 {
6838         guint32 level;
6839
6840         /* Parse packet */
6841
6842         offset = dissect_ndr_str_pointer_item(
6843                 tvb, offset, pinfo, tree, di, drep, NDR_POINTER_UNIQUE,
6844                 "Name", hf_servername, 0);
6845
6846         offset = dissect_ndr_str_pointer_item(
6847                 tvb, offset, pinfo, tree, di, drep, NDR_POINTER_UNIQUE,
6848                 "Environment", hf_environment, 0);
6849
6850         offset = dissect_ndr_uint32(
6851                 tvb, offset, pinfo, tree, di, drep, hf_level, &level);
6852
6853         offset = dissect_spoolss_buffer(
6854                 tvb, offset, pinfo, tree, di, drep, NULL);
6855
6856         offset = dissect_ndr_uint32(
6857                 tvb, offset, pinfo, tree, di, drep, hf_offered, NULL);
6858
6859         return offset;
6860 }
6861
6862 static int
6863 SpoolssGetPrinterDriverDirectory_r(tvbuff_t *tvb, int offset,
6864                                       packet_info *pinfo, proto_tree *tree,
6865                                       dcerpc_info *di, guint8 *drep)
6866 {
6867         /* Parse packet */
6868
6869         offset = dissect_spoolss_string_parm(
6870                 tvb, offset, pinfo, tree, di, drep, "Directory");
6871
6872         offset = dissect_ndr_uint32(
6873                 tvb, offset, pinfo, tree, di, drep, hf_needed, NULL);
6874
6875         offset = dissect_doserror(
6876                 tvb, offset, pinfo, tree, di, drep, hf_rc, NULL);
6877
6878         return offset;
6879 }
6880
6881 /*
6882  * List of subdissectors for this pipe.
6883  */
6884
6885 static dcerpc_sub_dissector dcerpc_spoolss_dissectors[] = {
6886         { SPOOLSS_ENUMPRINTERS, "EnumPrinters",
6887           SpoolssEnumPrinters_q, SpoolssEnumPrinters_r },
6888         { SPOOLSS_OPENPRINTER, "OpenPrinter",
6889           NULL, SpoolssGeneric_r },
6890         { SPOOLSS_SETJOB, "SetJob",
6891           SpoolssSetJob_q, SpoolssSetJob_r },
6892         { SPOOLSS_GETJOB, "GetJob",
6893           SpoolssGetJob_q, SpoolssGetJob_r },
6894         { SPOOLSS_ENUMJOBS, "EnumJobs",
6895           SpoolssEnumJobs_q, SpoolssEnumJobs_r },
6896         { SPOOLSS_ADDPRINTER, "AddPrinter",
6897           NULL, SpoolssGeneric_r },
6898         { SPOOLSS_DELETEPRINTER, "DeletePrinter",
6899           SpoolssDeletePrinter_q, SpoolssDeletePrinter_r },
6900         { SPOOLSS_SETPRINTER, "SetPrinter",
6901           SpoolssSetPrinter_q, SpoolssSetPrinter_r },
6902         { SPOOLSS_GETPRINTER, "GetPrinter",
6903           SpoolssGetPrinter_q, SpoolssGetPrinter_r },
6904         { SPOOLSS_ADDPRINTERDRIVER, "AddPrinterDriver",
6905           NULL, SpoolssAddPrinterDriver_r },
6906         { SPOOLSS_ENUMPRINTERDRIVERS, "EnumPrinterDrivers",
6907           SpoolssEnumPrinterDrivers_q, SpoolssEnumPrinterDrivers_r },
6908         { SPOOLSS_GETPRINTERDRIVER, "GetPrinterDriver",
6909           NULL, SpoolssGeneric_r },
6910         { SPOOLSS_GETPRINTERDRIVERDIRECTORY, "GetPrinterDriverDirectory",
6911           SpoolssGetPrinterDriverDirectory_q, SpoolssGetPrinterDriverDirectory_r },
6912         { SPOOLSS_DELETEPRINTERDRIVER, "DeletePrinterDriver",
6913           NULL, SpoolssGeneric_r },
6914         { SPOOLSS_ADDPRINTPROCESSOR, "AddPrintProcessor",
6915           NULL, SpoolssGeneric_r },
6916         { SPOOLSS_ENUMPRINTPROCESSORS, "EnumPrintProcessor",
6917           NULL, SpoolssGeneric_r },
6918         { SPOOLSS_GETPRINTPROCESSORDIRECTORY, "GetPrintProcessorDirectory",
6919           NULL, SpoolssGeneric_r },
6920         { SPOOLSS_STARTDOCPRINTER, "StartDocPrinter",
6921           SpoolssStartDocPrinter_q, SpoolssStartDocPrinter_r },
6922         { SPOOLSS_STARTPAGEPRINTER, "StartPagePrinter",
6923           SpoolssStartPagePrinter_q, SpoolssStartPagePrinter_r },
6924         { SPOOLSS_WRITEPRINTER, "WritePrinter",
6925           SpoolssWritePrinter_q, SpoolssWritePrinter_r },
6926         { SPOOLSS_ENDPAGEPRINTER, "EndPagePrinter",
6927           SpoolssEndPagePrinter_q, SpoolssEndPagePrinter_r },
6928         { SPOOLSS_ABORTPRINTER, "AbortPrinter",
6929           NULL, SpoolssGeneric_r },
6930         { SPOOLSS_READPRINTER, "ReadPrinter",
6931           NULL, SpoolssGeneric_r },
6932         { SPOOLSS_ENDDOCPRINTER, "EndDocPrinter",
6933           SpoolssEndDocPrinter_q, SpoolssEndDocPrinter_r },
6934         { SPOOLSS_ADDJOB, "AddJob",
6935           NULL, SpoolssGeneric_r },
6936         { SPOOLSS_SCHEDULEJOB, "ScheduleJob",
6937           NULL, SpoolssGeneric_r },
6938         { SPOOLSS_GETPRINTERDATA, "GetPrinterData",
6939           SpoolssGetPrinterData_q, SpoolssGetPrinterData_r },
6940         { SPOOLSS_SETPRINTERDATA, "SetPrinterData",
6941           SpoolssSetPrinterData_q, SpoolssSetPrinterData_r },
6942         { SPOOLSS_WAITFORPRINTERCHANGE, "WaitForPrinterChange",
6943           NULL, SpoolssGeneric_r },
6944         { SPOOLSS_CLOSEPRINTER, "ClosePrinter",
6945           SpoolssClosePrinter_q, SpoolssClosePrinter_r },
6946         { SPOOLSS_ADDFORM, "AddForm",
6947           SpoolssAddForm_q, SpoolssAddForm_r },
6948         { SPOOLSS_DELETEFORM, "DeleteForm",
6949           SpoolssDeleteForm_q, SpoolssDeleteForm_r },
6950         { SPOOLSS_GETFORM, "GetForm",
6951           SpoolssGetForm_q, SpoolssGetForm_r },
6952         { SPOOLSS_SETFORM, "SetForm",
6953           SpoolssSetForm_q, SpoolssSetForm_r },
6954         { SPOOLSS_ENUMFORMS, "EnumForms",
6955           SpoolssEnumForms_q, SpoolssEnumForms_r },
6956         { SPOOLSS_ENUMPORTS, "EnumPorts",
6957           NULL, SpoolssGeneric_r },
6958         { SPOOLSS_ENUMMONITORS, "EnumMonitors",
6959           NULL, SpoolssGeneric_r },
6960         { SPOOLSS_ADDPORT, "AddPort",
6961           NULL, SpoolssGeneric_r },
6962         { SPOOLSS_CONFIGUREPORT, "ConfigurePort",
6963           NULL, SpoolssGeneric_r },
6964         { SPOOLSS_DELETEPORT, "DeletePort",
6965           NULL, SpoolssGeneric_r },
6966         { SPOOLSS_CREATEPRINTERIC, "CreatePrinterIC",
6967           NULL, SpoolssGeneric_r },
6968         { SPOOLSS_PLAYGDISCRIPTONPRINTERIC, "PlayDiscriptOnPrinterIC",
6969           NULL, SpoolssGeneric_r },
6970         { SPOOLSS_DELETEPRINTERIC, "DeletePrinterIC",
6971           NULL, SpoolssGeneric_r },
6972         { SPOOLSS_ADDPRINTERCONNECTION, "AddPrinterConnection",
6973           NULL, SpoolssGeneric_r },
6974         { SPOOLSS_DELETEPRINTERCONNECTION, "DeletePrinterConnection",
6975           NULL, SpoolssGeneric_r },
6976         { SPOOLSS_PRINTERMESSAGEBOX, "PrinterMessageBox",
6977           NULL, SpoolssGeneric_r },
6978         { SPOOLSS_ADDMONITOR, "AddMonitor",
6979           NULL, SpoolssGeneric_r },
6980         { SPOOLSS_DELETEMONITOR, "DeleteMonitor",
6981           NULL, SpoolssGeneric_r },
6982         { SPOOLSS_DELETEPRINTPROCESSOR, "DeletePrintProcessor",
6983           NULL, SpoolssGeneric_r },
6984         { SPOOLSS_ADDPRINTPROVIDER, "AddPrintProvider",
6985           NULL, SpoolssGeneric_r },
6986         { SPOOLSS_DELETEPRINTPROVIDER, "DeletePrintProvider",
6987           NULL, SpoolssGeneric_r },
6988         { SPOOLSS_ENUMPRINTPROCDATATYPES, "EnumPrintProcDataTypes",
6989           NULL, SpoolssGeneric_r },
6990         { SPOOLSS_RESETPRINTER, "ResetPrinter",
6991           NULL, SpoolssGeneric_r },
6992         { SPOOLSS_GETPRINTERDRIVER2, "GetPrinterDriver2",
6993           SpoolssGetPrinterDriver2_q, SpoolssGetPrinterDriver2_r },
6994         { SPOOLSS_FINDFIRSTPRINTERCHANGENOTIFICATION,
6995           "FindFirstPrinterChangeNotification",
6996           NULL, SpoolssGeneric_r },
6997         { SPOOLSS_FINDNEXTPRINTERCHANGENOTIFICATION,
6998           "FindNextPrinterChangeNotification",
6999           NULL, SpoolssGeneric_r },
7000         { SPOOLSS_FCPN, "FCPN",
7001           SpoolssFCPN_q, SpoolssFCPN_r },
7002         { SPOOLSS_ROUTERFINDFIRSTPRINTERNOTIFICATIONOLD,
7003           "RouterFindFirstPrinterNotificationOld",
7004           NULL, SpoolssGeneric_r },
7005         { SPOOLSS_REPLYOPENPRINTER, "ReplyOpenPrinter",
7006           SpoolssReplyOpenPrinter_q, SpoolssReplyOpenPrinter_r },
7007         { SPOOLSS_ROUTERREPLYPRINTER, "RouterReplyPrinter",
7008           SpoolssRouterReplyPrinter_q, SpoolssRouterReplyPrinter_r },
7009         { SPOOLSS_REPLYCLOSEPRINTER, "ReplyClosePrinter",
7010           SpoolssReplyClosePrinter_q, SpoolssReplyClosePrinter_r },
7011         { SPOOLSS_ADDPORTEX, "AddPortEx",
7012           NULL, SpoolssGeneric_r },
7013         { SPOOLSS_REMOTEFINDFIRSTPRINTERCHANGENOTIFICATION,
7014           "RemoteFindFirstPrinterChangeNotification",
7015           NULL, SpoolssGeneric_r },
7016         { SPOOLSS_SPOOLERINIT, "SpoolerInit",
7017           NULL, SpoolssGeneric_r },
7018         { SPOOLSS_RESETPRINTEREX, "ResetPrinterEx",
7019           NULL, SpoolssGeneric_r },
7020         { SPOOLSS_RFFPCNEX, "RFFPCNEX",
7021           SpoolssRFFPCNEX_q, SpoolssRFFPCNEX_r },
7022         { SPOOLSS_RRPCN, "RRPCN",
7023           SpoolssRRPCN_q, SpoolssRRPCN_r },
7024         { SPOOLSS_RFNPCNEX, "RFNPCNEX",
7025           SpoolssRFNPCNEX_q, SpoolssRFNPCNEX_r },
7026         { SPOOLSS_OPENPRINTEREX, "OpenPrinterEx",
7027           SpoolssOpenPrinterEx_q, SpoolssOpenPrinterEx_r },
7028         { SPOOLSS_ADDPRINTEREX, "AddPrinterEx",
7029           NULL, SpoolssAddPrinterEx_r },
7030         { SPOOLSS_ENUMPRINTERDATA, "EnumPrinterData",
7031           SpoolssEnumPrinterData_q, SpoolssEnumPrinterData_r },
7032         { SPOOLSS_DELETEPRINTERDATA, "DeletePrinterData",
7033           SpoolssDeletePrinterData_q, SpoolssDeletePrinterData_r },
7034         { SPOOLSS_GETPRINTERDATAEX, "GetPrinterDataEx",
7035           SpoolssGetPrinterDataEx_q, SpoolssGetPrinterDataEx_r },
7036         { SPOOLSS_SETPRINTERDATAEX, "SetPrinterDataEx",
7037           SpoolssSetPrinterDataEx_q, SpoolssSetPrinterDataEx_r },
7038         { SPOOLSS_ENUMPRINTERDATAEX, "EnumPrinterDataEx",
7039           SpoolssEnumPrinterDataEx_q, SpoolssEnumPrinterDataEx_r },
7040         { SPOOLSS_ENUMPRINTERKEY, "EnumPrinterKey",
7041           SpoolssEnumPrinterKey_q, SpoolssEnumPrinterKey_r },
7042         { SPOOLSS_DELETEPRINTERDATAEX, "DeletePrinterDataEx",
7043           NULL, SpoolssGeneric_r },
7044         { SPOOLSS_DELETEPRINTERDRIVEREX, "DeletePrinterDriverEx",
7045           NULL, SpoolssGeneric_r },
7046         { SPOOLSS_ADDPRINTERDRIVEREX, "AddPrinterDriverEx",
7047           NULL, SpoolssGeneric_r },
7048
7049         { 0, NULL, NULL, NULL },
7050 };
7051
7052 /*
7053  * Dissector initialisation function
7054  */
7055
7056 /* Protocol registration */
7057
7058 static int proto_dcerpc_spoolss = -1;
7059 static gint ett_dcerpc_spoolss = -1;
7060
7061 void
7062 proto_register_dcerpc_spoolss(void)
7063 {
7064         static hf_register_info hf[] = {
7065
7066                 /* GetPrinterDriver2 */
7067
7068                 { &hf_clientmajorversion,
7069                   { "Client major version", "spoolss.clientmajorversion", FT_UINT32, BASE_DEC,
7070                     NULL, 0x0, "Client printer driver major version", HFILL }},
7071                 { &hf_clientminorversion,
7072                   { "Client minor version", "spoolss.clientminorversion", FT_UINT32, BASE_DEC,
7073                     NULL, 0x0, "Client printer driver minor version", HFILL }},
7074                 { &hf_servermajorversion,
7075                   { "Server major version", "spoolss.servermajorversion", FT_UINT32, BASE_DEC,
7076                     NULL, 0x0, "Server printer driver major version", HFILL }},
7077                 { &hf_serverminorversion,
7078                   { "Server minor version", "spoolss.serverminorversion", FT_UINT32, BASE_DEC,
7079                     NULL, 0x0, "Server printer driver minor version", HFILL }},
7080                 { &hf_driverpath,
7081                   { "Driver path", "spoolss.driverpath", FT_STRING, BASE_NONE,
7082                     NULL, 0, NULL, HFILL }},
7083                 { &hf_datafile,
7084                   { "Data file", "spoolss.datafile", FT_STRING, BASE_NONE,
7085                     NULL, 0, NULL, HFILL }},
7086                 { &hf_configfile,
7087                   { "Config file", "spoolss.configfile", FT_STRING, BASE_NONE,
7088                     NULL, 0, "Printer name", HFILL }},
7089                 { &hf_helpfile,
7090                   { "Help file", "spoolss.helpfile", FT_STRING, BASE_NONE,
7091                     NULL, 0, NULL, HFILL }},
7092                 { &hf_monitorname,
7093                   { "Monitor name", "spoolss.monitorname", FT_STRING, BASE_NONE,
7094                     NULL, 0, NULL, HFILL }},
7095                 { &hf_defaultdatatype,
7096                   { "Default data type", "spoolss.defaultdatatype", FT_STRING, BASE_NONE,
7097                     NULL, 0, NULL, HFILL }},
7098                 { &hf_driverinfo_cversion,
7099                   { "Driver version", "spoolss.driverversion", FT_UINT32, BASE_DEC,
7100                     VALS(driverinfo_cversion_vals), 0, "Printer name", HFILL }},
7101                 { &hf_dependentfiles,
7102                   { "Dependent files", "spoolss.dependentfiles", FT_STRING, BASE_NONE,
7103                     NULL, 0, NULL, HFILL }},
7104
7105                 { &hf_printer_status,
7106                   { "Status", "spoolss.printer_status", FT_UINT32, BASE_DEC|BASE_EXT_STRING,
7107                     &printer_status_vals_ext, 0, NULL, HFILL }},
7108
7109                 { &hf_previousdrivernames,
7110                   { "Previous Driver Names", "spoolss.previousdrivernames", FT_STRING, BASE_NONE,
7111                     NULL, 0, NULL, HFILL }},
7112
7113                 { &hf_driverdate,
7114                   { "Driver Date", "spoolss.driverdate", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL,
7115                     NULL, 0, "Date of driver creation", HFILL }},
7116
7117                 { &hf_padding,
7118                   { "Padding", "spoolss.padding", FT_UINT32, BASE_HEX,
7119                     NULL, 0, "Some padding - conveys no semantic information", HFILL }},
7120
7121                 { &hf_driver_version_low,
7122                   { "Minor Driver Version", "spoolss.minordriverversion", FT_UINT32, BASE_DEC,
7123                     NULL, 0, "Driver Version Low", HFILL }},
7124
7125                 { &hf_driver_version_high,
7126                   { "Major Driver Version", "spoolss.majordriverversion", FT_UINT32, BASE_DEC,
7127                     NULL, 0, "Driver Version High", HFILL }},
7128
7129                 { &hf_mfgname,
7130                   { "Mfgname", "spoolss.mfgname", FT_STRING, BASE_NONE,
7131                     NULL, 0, "Manufacturer Name", HFILL }},
7132
7133                 { &hf_oemurl,
7134                   { "OEM URL", "spoolss.oemrul", FT_STRING, BASE_NONE,
7135                     NULL, 0, "OEM URL - Website of Vendor", HFILL }},
7136
7137                 { &hf_hardwareid,
7138                   { "Hardware ID", "spoolss.hardwareid", FT_STRING, BASE_NONE,
7139                     NULL, 0, "Hardware Identification Information", HFILL }},
7140
7141                 { &hf_provider,
7142                   { "Provider", "spoolss.provider", FT_STRING, BASE_NONE,
7143                     NULL, 0, "Provider of Driver", HFILL }},
7144
7145                 /* Setprinter RPC */
7146
7147                 { &hf_setprinter_cmd,
7148                   { "Command", "spoolss.setprinter_cmd", FT_UINT32, BASE_DEC,
7149                    VALS(setprinter_cmd_vals), 0, NULL, HFILL }},
7150
7151                 /* Enumprinters */
7152
7153                 { &hf_enumprinters_flags,
7154                   { "Flags", "spoolss.enumprinters.flags",
7155                     FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
7156
7157                 { &hf_enumprinters_flags_local,
7158                   { "Enum local", "spoolss.enumprinters.flags.enum_local",
7159                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7160                     PRINTER_ENUM_LOCAL, NULL, HFILL }},
7161
7162                 { &hf_enumprinters_flags_name,
7163                   { "Enum name", "spoolss.enumprinters.flags.enum_name",
7164                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7165                     PRINTER_ENUM_NAME, NULL, HFILL }},
7166
7167                 { &hf_enumprinters_flags_shared,
7168                   { "Enum shared", "spoolss.enumprinters.flags.enum_shared",
7169                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7170                     PRINTER_ENUM_SHARED, NULL, HFILL }},
7171
7172                 { &hf_enumprinters_flags_default,
7173                   { "Enum default", "spoolss.enumprinters.flags.enum_default",
7174                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7175                     PRINTER_ENUM_DEFAULT, NULL, HFILL }},
7176
7177                 { &hf_enumprinters_flags_connections,
7178                   { "Enum connections", "spoolss.enumprinters.flags.enum_connections",
7179                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7180                     PRINTER_ENUM_CONNECTIONS, NULL, HFILL }},
7181
7182                 { &hf_enumprinters_flags_network,
7183                   { "Enum network", "spoolss.enumprinters.flags.enum_network",
7184                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7185                     PRINTER_ENUM_NETWORK, NULL, HFILL }},
7186
7187                 { &hf_enumprinters_flags_remote,
7188                   { "Enum remote", "spoolss.enumprinters.flags.enum_remote",
7189                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7190                     PRINTER_ENUM_REMOTE, NULL, HFILL }},
7191
7192                 /* GetPrinter */
7193
7194                 { &hf_start_time,
7195                   { "Start time", "spoolss.start_time",
7196                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7197
7198                 { &hf_end_time,
7199                   { "End time", "spoolss.end_time",
7200                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7201
7202                 { &hf_elapsed_time,
7203                   { "Elapsed time", "spoolss.elapsed_time",
7204                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7205
7206                 /*
7207                  * New hf index values
7208                  */
7209
7210                 { &hf_opnum,
7211                   { "Operation", "spoolss.opnum", FT_UINT16, BASE_DEC,
7212                     NULL, 0x0, NULL, HFILL }},
7213
7214                 { &hf_hnd,
7215                   { "Context handle", "spoolss.hnd", FT_BYTES, BASE_NONE,
7216                     NULL, 0x0, "SPOOLSS policy handle", HFILL }},
7217
7218                 { &hf_rc,
7219                   { "Return code", "spoolss.rc", FT_UINT32, BASE_HEX,
7220                     VALS(DOS_errors), 0x0, "SPOOLSS return code", HFILL }},
7221
7222                 { &hf_offered,
7223                   { "Offered", "spoolss.offered", FT_UINT32, BASE_DEC,
7224                     NULL, 0x0, "Size of buffer offered in this request",
7225                     HFILL }},
7226
7227                 { &hf_needed,
7228                   { "Needed", "spoolss.needed", FT_UINT32, BASE_DEC,
7229                     NULL, 0x0, "Size of buffer required for request", HFILL }},
7230
7231                 { &hf_returned,
7232                   { "Returned", "spoolss.returned", FT_UINT32, BASE_DEC,
7233                     NULL, 0x0, "Number of items returned", HFILL }},
7234
7235                 { &hf_buffer_size,
7236                   { "Buffer size", "spoolss.buffer.size", FT_UINT32, BASE_DEC,
7237                     NULL, 0x0, "Size of buffer", HFILL }},
7238
7239                 { &hf_buffer_data,
7240                   { "Buffer data", "spoolss.buffer.data", FT_BYTES, BASE_NONE,
7241                     NULL, 0x0, "Contents of buffer", HFILL }},
7242
7243                 { &hf_string_parm_size,
7244                   { "String buffer size", "spoolss.string.buffersize", FT_UINT32, BASE_DEC,
7245                     NULL, 0x0, "Size of string buffer", HFILL }},
7246
7247                 { &hf_string_parm_data,
7248                   { "String data", "spoolss.string.data", FT_STRINGZ, BASE_NONE,
7249                     NULL, 0x0, "Contents of string", HFILL }},
7250
7251                 { &hf_offset,
7252                   { "Offset", "spoolss.offset", FT_UINT32, BASE_DEC,
7253                     NULL, 0x0, "Offset of data", HFILL }},
7254
7255                 { &hf_level,
7256                   { "Info level", "spoolss.enumjobs.level", FT_UINT32,
7257                     BASE_DEC, NULL, 0x0, NULL, HFILL }},
7258
7259
7260                 { &hf_printername,
7261                   { "Printer name", "spoolss.printername", FT_STRING,
7262                     BASE_NONE, NULL, 0, NULL, HFILL }},
7263
7264                 { &hf_machinename,
7265                   { "Machine name", "spoolss.machinename", FT_STRING,
7266                     BASE_NONE, NULL, 0, NULL, HFILL }},
7267
7268                 { &hf_notifyname,
7269                   { "Notify name", "spoolss.notifyname", FT_STRING,
7270                     BASE_NONE, NULL, 0, NULL, HFILL }},
7271
7272                 { &hf_printerdesc,
7273                   { "Printer description", "spoolss.printerdesc", FT_STRING,
7274                     BASE_NONE, NULL, 0, NULL, HFILL }},
7275
7276                 { &hf_printercomment,
7277                   { "Printer comment", "spoolss.printercomment", FT_STRING,
7278                     BASE_NONE, NULL, 0, NULL, HFILL }},
7279
7280                 { &hf_servername,
7281                   { "Server name", "spoolss.servername", FT_STRING, BASE_NONE,
7282                     NULL, 0, NULL, HFILL }},
7283
7284                 { &hf_sharename,
7285                   { "Share name", "spoolss.sharename", FT_STRING, BASE_NONE,
7286                     NULL, 0, NULL, HFILL }},
7287
7288                 { &hf_portname,
7289                   { "Port name", "spoolss.portname", FT_STRING, BASE_NONE,
7290                     NULL, 0, NULL, HFILL }},
7291
7292                 { &hf_printerlocation,
7293                   { "Printer location", "spoolss.printerlocation", FT_STRING,
7294                     BASE_NONE, NULL, 0, NULL, HFILL }},
7295
7296                 { &hf_environment,
7297                   { "Environment name", "spoolss.environment", FT_STRING,
7298                     BASE_NONE, NULL, 0, NULL, HFILL }},
7299
7300                 { &hf_drivername,
7301                   { "Driver name", "spoolss.drivername", FT_STRING, BASE_NONE,
7302                     NULL, 0, NULL, HFILL }},
7303
7304                 { &hf_username,
7305                   { "User name", "spoolss.username", FT_STRING, BASE_NONE,
7306                     NULL, 0, NULL, HFILL }},
7307
7308                 { &hf_documentname,
7309                   { "Document name", "spoolss.document", FT_STRING, BASE_NONE,
7310                     NULL, 0, NULL, HFILL }},
7311
7312                 { &hf_outputfile,
7313                   { "Output file", "spoolss.outputfile", FT_STRING, BASE_NONE,
7314                     NULL, 0, NULL, HFILL }},
7315
7316                 { &hf_datatype,
7317                   { "Datatype", "spoolss.Datatype", FT_STRING, BASE_NONE,
7318                     NULL, 0, NULL, HFILL }},
7319
7320                 { &hf_textstatus,
7321                   { "Text status", "spoolss.textstatus", FT_STRING, BASE_NONE,
7322                     NULL, 0, NULL, HFILL }},
7323
7324                 { &hf_sepfile,
7325                   { "Separator file", "spoolss.setpfile", FT_STRING, BASE_NONE,
7326                     NULL, 0, NULL, HFILL }},
7327
7328                 { &hf_parameters,
7329                   { "Parameters", "spoolss.parameters", FT_STRING, BASE_NONE,
7330                     NULL, 0, NULL, HFILL }},
7331
7332                 { &hf_printprocessor,
7333                   { "Print processor", "spoolss.printprocessor", FT_STRING,
7334                     BASE_NONE, NULL, 0, NULL, HFILL }},
7335
7336                 /* Printer data */
7337
7338                 { &hf_printerdata,
7339                   { "Data", "spoolss.printerdata", FT_UINT32,
7340                     BASE_HEX, NULL, 0, NULL, HFILL }},
7341
7342                 { &hf_printerdata_key,
7343                   { "Key", "spoolss.printerdata.key", FT_STRING,
7344                     BASE_NONE, NULL, 0, "Printer data key", HFILL }},
7345
7346                 { &hf_printerdata_value,
7347                   { "Value", "spoolss.printerdata.value",
7348                     FT_STRING, BASE_NONE, NULL, 0, "Printer data value",
7349                     HFILL }},
7350
7351                 { &hf_printerdata_type,
7352                   { "Type", "spoolss.printerdata.type",
7353                     FT_UINT32, BASE_DEC|BASE_EXT_STRING, &reg_datatypes_ext, 0,
7354                     "Printer data type", HFILL }},
7355
7356                 { &hf_printerdata_size,
7357                   { "Size", "spoolss.printerdata.size",
7358                     FT_UINT32, BASE_DEC, NULL, 0, "Printer data size",
7359                     HFILL }},
7360
7361                 { &hf_printerdata_data,
7362                   { "Data", "spoolss.printerdata.data", FT_BYTES, BASE_NONE,
7363                     NULL, 0x0, "Printer data", HFILL }},
7364
7365                 { &hf_printerdata_data_dword,
7366                   { "DWORD data", "spoolss.printerdata.data.dword",
7367                     FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
7368
7369                 { &hf_printerdata_data_sz,
7370                   { "String data", "spoolss.printerdata.data.sz",
7371                     FT_STRING, BASE_NONE, NULL, 0, NULL,
7372                     HFILL }},
7373
7374                 /* Devicemode */
7375
7376                 { &hf_devmodectr_size,
7377                   { "Devicemode ctr size", "spoolss.devicemodectr.size",
7378                     FT_UINT32, BASE_DEC, NULL, 0, NULL,
7379                     HFILL }},
7380
7381                 { &hf_devmode,
7382                   { "Devicemode", "spoolss.devmode", FT_UINT32,
7383                     BASE_HEX, NULL, 0, NULL, HFILL }},
7384
7385                 { &hf_devmode_size,
7386                   { "Size", "spoolss.devmode.size",
7387                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7388
7389                 { &hf_devmode_spec_version,
7390                   { "Spec version", "spoolss.devmode.spec_version",
7391                     FT_UINT16, BASE_DEC, VALS(devmode_specversion_vals),
7392                     0, NULL, HFILL }},
7393
7394                 { &hf_devmode_driver_version,
7395                   { "Driver version", "spoolss.devmode.driver_version",
7396                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
7397
7398                 { &hf_devmode_size2,
7399                   { "Size2", "spoolss.devmode.size2",
7400                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
7401
7402                 { &hf_devmode_fields,
7403                   { "Fields", "spoolss.devmode.fields",
7404                     FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
7405
7406                 { &hf_devmode_orientation,
7407                   { "Orientation", "spoolss.devmode.orientation",
7408                     FT_UINT16, BASE_DEC, VALS(devmode_orientation_vals),
7409                     0, NULL, HFILL }},
7410
7411                 { &hf_devmode_paper_size,
7412                   { "Paper size", "spoolss.devmode.paper_size",
7413                     FT_UINT16, BASE_DEC|BASE_EXT_STRING, &devmode_papersize_vals_ext,
7414                     0, NULL, HFILL }},
7415
7416                 { &hf_devmode_paper_width,
7417                   { "Paper width", "spoolss.devmode.paper_width",
7418                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
7419
7420                 { &hf_devmode_paper_length,
7421                   { "Paper length", "spoolss.devmode.paper_length",
7422                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
7423
7424                 { &hf_devmode_scale,
7425                   { "Scale", "spoolss.devmode.scale",
7426                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
7427
7428                 { &hf_devmode_copies,
7429                   { "Copies", "spoolss.devmode.copies",
7430                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
7431
7432                 { &hf_devmode_default_source,
7433                   { "Default source", "spoolss.devmode.default_source",
7434                     FT_UINT16, BASE_DEC|BASE_EXT_STRING, &devmode_papersource_vals_ext,
7435                     0, NULL, HFILL }},
7436
7437                 { &hf_devmode_print_quality,
7438                   { "Print quality", "spoolss.devmode.print_quality",
7439                     FT_UINT16, BASE_DEC, VALS(devmode_printquality_vals),
7440                     0, NULL, HFILL }},
7441
7442                 { &hf_devmode_color,
7443                   { "Color", "spoolss.devmode.color",
7444                     FT_UINT16, BASE_DEC, VALS(devmode_colour_vals), 0,
7445                     NULL, HFILL }},
7446
7447                 { &hf_devmode_duplex,
7448                   { "Duplex", "spoolss.devmode.duplex",
7449                     FT_UINT16, BASE_DEC, VALS(devmode_duplex_vals), 0,
7450                     NULL, HFILL }},
7451
7452                 { &hf_devmode_y_resolution,
7453                   { "Y resolution", "spoolss.devmode.y_resolution",
7454                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
7455
7456                 { &hf_devmode_tt_option,
7457                   { "TT option", "spoolss.devmode.tt_option",
7458                     FT_UINT16, BASE_DEC, VALS(devmode_ttoption_vals), 0,
7459                     NULL, HFILL }},
7460
7461                 { &hf_devmode_collate,
7462                   { "Collate", "spoolss.devmode.collate",
7463                     FT_UINT16, BASE_DEC, VALS(devmode_collate_vals), 0,
7464                     NULL, HFILL }},
7465
7466                 { &hf_devmode_log_pixels,
7467                   { "Log pixels", "spoolss.devmode.log_pixels",
7468                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
7469
7470                 { &hf_devmode_bits_per_pel,
7471                   { "Bits per pel", "spoolss.devmode.bits_per_pel",
7472                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7473
7474                 { &hf_devmode_pels_width,
7475                   { "Pels width", "spoolss.devmode.pels_width",
7476                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7477
7478                 { &hf_devmode_pels_height,
7479                   { "Pels height", "spoolss.devmode.pels_height",
7480                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7481
7482                 { &hf_devmode_display_flags,
7483                   { "Display flags", "spoolss.devmode.display_flags",
7484                     FT_UINT32, BASE_DEC, VALS(devmode_displayflags_vals), 0,
7485                     NULL, HFILL }},
7486
7487                 { &hf_devmode_display_freq,
7488                   { "Display frequency", "spoolss.devmode.display_freq",
7489                     FT_UINT32, BASE_DEC, NULL, 0, NULL,
7490                     HFILL }},
7491
7492                 { &hf_devmode_icm_method,
7493                   { "ICM method", "spoolss.devmode.icm_method",
7494                     FT_UINT32, BASE_DEC, VALS(devmode_icmmethod_vals), 0,
7495                     NULL, HFILL }},
7496
7497                 { &hf_devmode_icm_intent,
7498                   { "ICM intent", "spoolss.devmode.icm_intent",
7499                     FT_UINT32, BASE_DEC, VALS(devmode_icmintent_vals), 0,
7500                     NULL, HFILL }},
7501
7502                 { &hf_devmode_media_type,
7503                   { "Media type", "spoolss.devmode.media_type",
7504                     FT_UINT32, BASE_DEC, VALS(devmode_mediatype_vals), 0,
7505                     NULL, HFILL }},
7506
7507                 { &hf_devmode_dither_type,
7508                   { "Dither type", "spoolss.devmode.dither_type",
7509                     FT_UINT32, BASE_DEC, VALS(devmode_dithertype_vals), 0,
7510                     NULL, HFILL }},
7511
7512                 { &hf_devmode_reserved1,
7513                   { "Reserved1", "spoolss.devmode.reserved1",
7514                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7515
7516                 { &hf_devmode_reserved2,
7517                   { "Reserved2", "spoolss.devmode.reserved2",
7518                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7519
7520                 { &hf_devmode_panning_width,
7521                   { "Panning width", "spoolss.devmode.panning_width",
7522                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7523
7524                 { &hf_devmode_panning_height,
7525                   { "Panning height", "spoolss.devmode.panning_height",
7526                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7527
7528                 { &hf_devmode_driver_extra_len,
7529                   { "Driver extra length",
7530                     "spoolss.devmode.driver_extra_len",
7531                     FT_UINT32, BASE_DEC, NULL, 0, NULL,
7532                     HFILL }},
7533
7534                 { &hf_devmode_driver_extra,
7535                   { "Driver extra", "spoolss.devmode.driver_extra",
7536                     FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
7537
7538                 /* Devicemode fields */
7539
7540                 { &hf_devmode_fields_orientation,
7541                   { "Orientation", "spoolss.devmode.fields.orientation",
7542                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7543                     DEVMODE_ORIENTATION, NULL, HFILL }},
7544
7545                 { &hf_devmode_fields_papersize,
7546                   { "Paper size", "spoolss.devmode.fields.paper_size",
7547                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7548                     DEVMODE_PAPERSIZE, NULL, HFILL }},
7549
7550                 { &hf_devmode_fields_paperlength,
7551                   { "Paper length", "spoolss.devmode.fields.paper_length",
7552                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7553                     DEVMODE_PAPERLENGTH, NULL, HFILL }},
7554
7555                 { &hf_devmode_fields_paperwidth,
7556                   { "Paper width", "spoolss.devmode.fields.paper_width",
7557                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7558                     DEVMODE_PAPERWIDTH, NULL, HFILL }},
7559
7560                 { &hf_devmode_fields_scale,
7561                   { "Scale", "spoolss.devmode.fields.scale",
7562                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7563                     DEVMODE_SCALE, NULL, HFILL }},
7564
7565                 { &hf_devmode_fields_position,
7566                   { "Position", "spoolss.devmode.fields.position",
7567                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7568                     DEVMODE_POSITION, NULL, HFILL }},
7569
7570                 { &hf_devmode_fields_nup,
7571                   { "N-up", "spoolss.devmode.fields.nup",
7572                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7573                     DEVMODE_NUP, NULL, HFILL }},
7574
7575                 { &hf_devmode_fields_copies,
7576                   { "Copies", "spoolss.devmode.fields.copies",
7577                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7578                     DEVMODE_COPIES, NULL, HFILL }},
7579
7580                 { &hf_devmode_fields_defaultsource,
7581                   { "Default source", "spoolss.devmode.fields.default_source",
7582                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7583                     DEVMODE_DEFAULTSOURCE, NULL, HFILL }},
7584
7585                 { &hf_devmode_fields_printquality,
7586                   { "Print quality", "spoolss.devmode.fields.print_quality",
7587                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7588                     DEVMODE_PRINTQUALITY, NULL, HFILL }},
7589
7590                 { &hf_devmode_fields_color,
7591                   { "Color", "spoolss.devmode.fields.color",
7592                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7593                     DEVMODE_COLOR, NULL, HFILL }},
7594
7595                 { &hf_devmode_fields_duplex,
7596                   { "Duplex", "spoolss.devmode.fields.duplex",
7597                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7598                     DEVMODE_DUPLEX, NULL, HFILL }},
7599
7600                 { &hf_devmode_fields_yresolution,
7601                   { "Y resolution", "spoolss.devmode.fields.y_resolution",
7602                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7603                     DEVMODE_YRESOLUTION, NULL, HFILL }},
7604
7605                 { &hf_devmode_fields_ttoption,
7606                   { "TT option", "spoolss.devmode.fields.tt_option",
7607                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7608                     DEVMODE_TTOPTION, NULL, HFILL }},
7609
7610                 { &hf_devmode_fields_collate,
7611                   { "Collate", "spoolss.devmode.fields.collate",
7612                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7613                     DEVMODE_COLLATE, NULL, HFILL }},
7614
7615                 { &hf_devmode_fields_formname,
7616                   { "Form name", "spoolss.devmode.fields.form_name",
7617                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7618                     DEVMODE_FORMNAME, NULL, HFILL }},
7619
7620                 { &hf_devmode_fields_logpixels,
7621                   { "Log pixels", "spoolss.devmode.fields.log_pixels",
7622                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7623                     DEVMODE_LOGPIXELS, NULL, HFILL }},
7624
7625                 { &hf_devmode_fields_bitsperpel,
7626                   { "Bits per pel", "spoolss.devmode.fields.bits_per_pel",
7627                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7628                     DEVMODE_BITSPERPEL, NULL, HFILL }},
7629
7630                 { &hf_devmode_fields_pelswidth,
7631                   { "Pels width", "spoolss.devmode.fields.pels_width",
7632                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7633                     DEVMODE_PELSWIDTH, NULL, HFILL }},
7634
7635                 { &hf_devmode_fields_pelsheight,
7636                   { "Pels height", "spoolss.devmode.fields.pels_height",
7637                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7638                     DEVMODE_PELSHEIGHT, NULL, HFILL }},
7639
7640                 { &hf_devmode_fields_displayflags,
7641                   { "Display flags", "spoolss.devmode.fields.display_flags",
7642                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7643                     DEVMODE_DISPLAYFLAGS, NULL, HFILL }},
7644
7645                 { &hf_devmode_fields_displayfrequency,
7646                   { "Display frequency",
7647                     "spoolss.devmode.fields.display_frequency",
7648                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7649                     DEVMODE_DISPLAYFREQUENCY, NULL, HFILL }},
7650
7651                 { &hf_devmode_fields_icmmethod,
7652                   { "ICM method", "spoolss.devmode.fields.icm_method",
7653                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7654                     DEVMODE_ICMMETHOD, NULL, HFILL }},
7655
7656                 { &hf_devmode_fields_icmintent,
7657                   { "ICM intent", "spoolss.devmode.fields.icm_intent",
7658                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7659                     DEVMODE_ICMINTENT, NULL, HFILL }},
7660
7661                 { &hf_devmode_fields_mediatype,
7662                   { "Media type", "spoolss.devmode.fields.media_type",
7663                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7664                     DEVMODE_MEDIATYPE, NULL, HFILL }},
7665
7666                 { &hf_devmode_fields_dithertype,
7667                   { "Dither type", "spoolss.devmode.fields.dither_type",
7668                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7669                     DEVMODE_DITHERTYPE, NULL, HFILL }},
7670
7671                 { &hf_devmode_fields_panningwidth,
7672                   { "Panning width", "spoolss.devmode.fields.panning_width",
7673                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7674                     DEVMODE_PANNINGWIDTH, NULL, HFILL }},
7675
7676                 { &hf_devmode_fields_panningheight,
7677                   { "Panning height", "spoolss.devmode.fields.panning_height",
7678                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
7679                     DEVMODE_PANNINGHEIGHT, NULL, HFILL }},
7680
7681                 /* EnumPrinterData RPC */
7682
7683                 { &hf_enumprinterdata_enumindex,
7684                   { "Enum index", "spoolss.enumprinterdata.enumindex",
7685                     FT_UINT32, BASE_DEC, NULL, 0x0,
7686                     "Index for start of enumeration", HFILL }},
7687
7688                 { &hf_enumprinterdata_value_offered,
7689                   { "Value size offered",
7690                     "spoolss.enumprinterdata.value_offered", FT_UINT32,
7691                     BASE_DEC, NULL, 0x0,
7692                     "Buffer size offered for printerdata value", HFILL }},
7693
7694                 { &hf_enumprinterdata_data_offered,
7695                   { "Data size offered",
7696                     "spoolss.enumprinterdata.data_offered", FT_UINT32,
7697                     BASE_DEC, NULL, 0x0,
7698                     "Buffer size offered for printerdata data", HFILL }},
7699
7700                 { &hf_enumprinterdata_value_len,
7701                   { "Value length",
7702                     "spoolss.enumprinterdata.value_len", FT_UINT32,
7703                     BASE_DEC, NULL, 0x0,
7704                     "Size of printerdata value", HFILL }},
7705
7706                 { &hf_enumprinterdata_value_needed,
7707                   { "Value size needed",
7708                     "spoolss.enumprinterdata.value_needed", FT_UINT32,
7709                     BASE_DEC, NULL, 0x0,
7710                     "Buffer size needed for printerdata value", HFILL }},
7711
7712                 { &hf_enumprinterdata_data_needed,
7713                   { "Data size needed",
7714                     "spoolss.enumprinterdata.data_needed", FT_UINT32, BASE_DEC,
7715                     NULL, 0x0, "Buffer size needed for printerdata data",
7716                     HFILL }},
7717
7718                 /* Print jobs */
7719
7720                 { &hf_job_id,
7721                   { "Job ID", "spoolss.job.id", FT_UINT32, BASE_DEC,
7722                     NULL, 0x0, "Job identification number", HFILL }},
7723
7724                 { &hf_job_status,
7725                   { "Job status", "spoolss.job.status", FT_UINT32, BASE_DEC,
7726                     NULL, 0x0, NULL, HFILL }},
7727
7728                 { &hf_job_status_paused,
7729                   { "Paused", "spoolss.job.status.paused", FT_BOOLEAN, 32,
7730                     TFS(&tfs_job_status_paused), JOB_STATUS_PAUSED,
7731                     NULL, HFILL }},
7732
7733                 { &hf_job_status_error,
7734                   { "Error", "spoolss.job.status.error", FT_BOOLEAN, 32,
7735                     TFS(&tfs_job_status_error), JOB_STATUS_ERROR,
7736                     NULL, HFILL }},
7737
7738                 { &hf_job_status_deleting,
7739                   { "Deleting", "spoolss.job.status.deleting", FT_BOOLEAN, 32,
7740                     TFS(&tfs_job_status_deleting), JOB_STATUS_DELETING,
7741                     NULL, HFILL }},
7742
7743                 { &hf_job_status_spooling,
7744                   { "Spooling", "spoolss.job.status.spooling", FT_BOOLEAN, 32,
7745                     TFS(&tfs_job_status_spooling), JOB_STATUS_SPOOLING,
7746                     NULL, HFILL }},
7747
7748                 { &hf_job_status_printing,
7749                   { "Printing", "spoolss.job.status.printing", FT_BOOLEAN, 32,
7750                     TFS(&tfs_job_status_printing), JOB_STATUS_PRINTING,
7751                     NULL, HFILL }},
7752
7753                 { &hf_job_status_offline,
7754                   { "Offline", "spoolss.job.status.offline", FT_BOOLEAN, 32,
7755                     TFS(&tfs_job_status_offline), JOB_STATUS_OFFLINE,
7756                     NULL, HFILL }},
7757
7758                 { &hf_job_status_paperout,
7759                   { "Paperout", "spoolss.job.status.paperout", FT_BOOLEAN, 32,
7760                     TFS(&tfs_job_status_paperout), JOB_STATUS_PAPEROUT,
7761                     NULL, HFILL }},
7762
7763                 { &hf_job_status_printed,
7764                   { "Printed", "spoolss.job.status.printed", FT_BOOLEAN, 32,
7765                     TFS(&tfs_job_status_printed), JOB_STATUS_PRINTED,
7766                     NULL, HFILL }},
7767
7768                 { &hf_job_status_deleted,
7769                   { "Deleted", "spoolss.job.status.deleted", FT_BOOLEAN, 32,
7770                     TFS(&tfs_job_status_deleted), JOB_STATUS_DELETED,
7771                     NULL, HFILL }},
7772
7773                 { &hf_job_status_blocked,
7774                   { "Blocked", "spoolss.job.status.blocked", FT_BOOLEAN, 32,
7775                     TFS(&tfs_job_status_blocked), JOB_STATUS_BLOCKED,
7776                     NULL, HFILL }},
7777
7778                 { &hf_job_status_user_intervention,
7779                   { "User intervention",
7780                     "spoolss.job.status.user_intervention", FT_BOOLEAN, 32,
7781                     TFS(&tfs_job_status_user_intervention),
7782                     JOB_STATUS_USER_INTERVENTION, NULL,
7783                     HFILL }},
7784
7785                 { &hf_job_priority,
7786                   { "Job priority", "spoolss.job.priority", FT_UINT32,
7787                     BASE_DEC, NULL, 0x0, NULL, HFILL }},
7788
7789                 { &hf_job_position,
7790                   { "Job position", "spoolss.job.position", FT_UINT32,
7791                     BASE_DEC, NULL, 0x0, NULL, HFILL }},
7792
7793                 { &hf_job_totalpages,
7794                   { "Job total pages", "spoolss.job.totalpages", FT_UINT32,
7795                     BASE_DEC, NULL, 0x0, NULL, HFILL }},
7796
7797                 { &hf_job_totalbytes,
7798                   { "Job total bytes", "spoolss.job.totalbytes", FT_UINT32,
7799                     BASE_DEC, NULL, 0x0, NULL, HFILL }},
7800
7801                 { &hf_job_bytesprinted,
7802                   { "Job bytes printed", "spoolss.job.bytesprinted",
7803                     FT_UINT32, BASE_DEC, NULL, 0x0, NULL,
7804                     HFILL }},
7805
7806                 { &hf_job_pagesprinted,
7807                   { "Job pages printed", "spoolss.job.pagesprinted",
7808                     FT_UINT32, BASE_DEC, NULL, 0x0, NULL,
7809                     HFILL }},
7810
7811                 { &hf_job_size,
7812                   { "Job size", "spoolss.job.size", FT_UINT32, BASE_DEC,
7813                     NULL, 0x0, NULL, HFILL }},
7814
7815                 /* Forms */
7816
7817                 { &hf_form,
7818                   { "Data", "spoolss.form", FT_UINT32,
7819                     BASE_HEX, NULL, 0, NULL, HFILL }},
7820
7821                 { &hf_form_level,
7822                   { "Level", "spoolss.form.level", FT_UINT32,
7823                     BASE_DEC, NULL, 0, NULL, HFILL }},
7824
7825                 { &hf_form_name,
7826                   { "Name", "spoolss.form.name", FT_STRING, BASE_NONE,
7827                     NULL, 0, NULL, HFILL }},
7828
7829                 { &hf_form_flags,
7830                   { "Flags", "spoolss.form.flags", FT_UINT32,
7831                     BASE_DEC, VALS(form_type_vals), 0, NULL, HFILL }},
7832
7833                 { &hf_form_unknown,
7834                   { "Unknown", "spoolss.form.unknown", FT_UINT32,
7835                     BASE_HEX, NULL, 0, NULL, HFILL }},
7836
7837                 { &hf_form_width,
7838                   { "Width", "spoolss.form.width", FT_UINT32,
7839                     BASE_DEC, NULL, 0, NULL, HFILL }},
7840
7841                 { &hf_form_height,
7842                   { "Height", "spoolss.form.height", FT_UINT32,
7843                     BASE_DEC, NULL, 0, NULL, HFILL }},
7844
7845                 { &hf_form_left_margin,
7846                   { "Left margin", "spoolss.form.left", FT_UINT32,
7847                     BASE_DEC, NULL, 0, "Left", HFILL }},
7848
7849                 { &hf_form_top_margin,
7850                   { "Top", "spoolss.form.top", FT_UINT32,
7851                     BASE_DEC, NULL, 0, NULL, HFILL }},
7852
7853                 { &hf_form_horiz_len,
7854                   { "Horizontal", "spoolss.form.horiz", FT_UINT32,
7855                     BASE_DEC, NULL, 0, NULL, HFILL }},
7856
7857                 { &hf_form_vert_len,
7858                   { "Vertical", "spoolss.form.vert", FT_UINT32,
7859                     BASE_DEC, NULL, 0, NULL, HFILL }},
7860
7861                 { &hf_enumforms_num,
7862                   { "Num", "spoolss.enumforms.num", FT_UINT32,
7863                     BASE_DEC, NULL, 0, NULL, HFILL }},
7864
7865                 /* Print notify */
7866
7867                 { &hf_notify_options_version,
7868                   { "Version", "spoolss.notify_options.version", FT_UINT32,
7869                     BASE_DEC, NULL, 0, NULL, HFILL }},
7870
7871                 { &hf_notify_options_flags,
7872                   { "Flags", "spoolss.notify_options.flags", FT_UINT32,
7873                     BASE_DEC, NULL, 0, NULL, HFILL }},
7874
7875                 { &hf_notify_options_count,
7876                   { "Count", "spoolss.notify_options.count", FT_UINT32,
7877                     BASE_DEC, NULL, 0, NULL, HFILL }},
7878
7879                 { &hf_notify_option_type,
7880                   { "Type", "spoolss.notify_option.type", FT_UINT16, BASE_DEC,
7881                     VALS(printer_notify_types), 0, NULL, HFILL }},
7882
7883                 { &hf_notify_option_reserved1,
7884                   { "Reserved1", "spoolss.notify_option.reserved1", FT_UINT16,
7885                     BASE_DEC, NULL, 0, NULL, HFILL }},
7886
7887                 { &hf_notify_option_reserved2,
7888                   { "Reserved2", "spoolss.notify_option.reserved2", FT_UINT32,
7889                     BASE_DEC, NULL, 0, NULL, HFILL }},
7890
7891                 { &hf_notify_option_reserved3,
7892                   { "Reserved3", "spoolss.notify_option.reserved3", FT_UINT32,
7893                     BASE_DEC, NULL, 0, NULL, HFILL }},
7894
7895                 { &hf_notify_option_count,
7896                   { "Count", "spoolss.notify_option.count", FT_UINT32,
7897                     BASE_DEC, NULL, 0, NULL, HFILL }},
7898
7899                 { &hf_notify_option_data_count,
7900                   { "Count", "spoolss.notify_option_data.count", FT_UINT32,
7901                     BASE_DEC, NULL, 0, NULL, HFILL }},
7902
7903                 { &hf_notify_options_flags_refresh,
7904                   { "Refresh", "spoolss.notify_options.flags", FT_BOOLEAN, 32,
7905                     TFS(&tfs_notify_options_flags_refresh),
7906                     PRINTER_NOTIFY_OPTIONS_REFRESH, NULL, HFILL }},
7907
7908                 { &hf_notify_info_count,
7909                   { "Count", "spoolss.notify_info.count", FT_UINT32, BASE_DEC,
7910                     NULL, 0, NULL, HFILL }},
7911
7912                 { &hf_notify_info_version,
7913                   { "Version", "spoolss.notify_info.version", FT_UINT32,
7914                     BASE_DEC, NULL, 0, NULL, HFILL }},
7915
7916                 { &hf_notify_info_flags,
7917                   { "Flags", "spoolss.notify_info.flags", FT_UINT32, BASE_HEX,
7918                     NULL, 0, NULL, HFILL }},
7919
7920                 { &hf_notify_info_data_type,
7921                   { "Type", "spoolss.notify_info_data.type", FT_UINT16,
7922                     BASE_DEC, VALS(printer_notify_types), 0, NULL, HFILL }},
7923
7924                 { &hf_notify_field,
7925                   { "Field", "spoolss.notify_field", FT_UINT16, BASE_DEC,
7926                     NULL, 0, NULL, HFILL }},
7927
7928                 { &hf_notify_info_data_count,
7929                   { "Count", "spoolss.notify_info_data.count", FT_UINT32,
7930                     BASE_DEC, NULL, 0, NULL, HFILL }},
7931
7932                 { &hf_notify_info_data_id,
7933                   { "Job Id", "spoolss.notify_info_data.jobid", FT_UINT32,
7934                     BASE_DEC, NULL, 0, NULL, HFILL }},
7935
7936                 { &hf_notify_info_data_value1,
7937                   { "Value1", "spoolss.notify_info_data.value1", FT_UINT32,
7938                     BASE_HEX, NULL, 0, NULL, HFILL }},
7939
7940                 { &hf_notify_info_data_value2,
7941                   { "Value2", "spoolss.notify_info_data.value2", FT_UINT32,
7942                     BASE_HEX, NULL, 0, NULL, HFILL }},
7943
7944                 { &hf_notify_info_data_bufsize,
7945                   { "Buffer size", "spoolss.notify_info_data.bufsize",
7946                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
7947
7948                 { &hf_notify_info_data_buffer,
7949                   { "Buffer", "spoolss.notify_info_data.buffer", FT_UINT32,
7950                     BASE_HEX, NULL, 0, NULL, HFILL }},
7951
7952                 { &hf_notify_info_data_buffer_len,
7953                   { "Buffer length", "spoolss.notify_info_data.buffer.len",
7954                     FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
7955
7956                 { &hf_notify_info_data_buffer_data,
7957                   { "Buffer data", "spoolss.notify_info_data.buffer.data",
7958                     FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
7959
7960                 /* RffpCNex RPC */
7961
7962                 { &hf_rffpcnex_options,
7963                   { "Options", "spoolss.rffpcnex.options", FT_UINT32, BASE_DEC,
7964                     NULL, 0, "RFFPCNEX options", HFILL }},
7965
7966                 { &hf_printerlocal, /* XXX: move me */
7967                   { "Printer local", "spoolss.printer_local", FT_UINT32,
7968                     BASE_DEC, NULL, 0, NULL, HFILL }},
7969
7970                 { &hf_rffpcnex_flags,
7971                   { "RFFPCNEX flags", "spoolss.rffpcnex.flags", FT_UINT32,
7972                     BASE_DEC, NULL, 0, NULL, HFILL }},
7973
7974                 { &hf_rffpcnex_flags_add_printer,
7975                   { "Add printer", "spoolss.rffpcnex.flags.add_printer",
7976                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_add_printer),
7977                     SPOOLSS_PRINTER_CHANGE_ADD_PRINTER, NULL,
7978                     HFILL }},
7979
7980                 { &hf_rffpcnex_flags_set_printer,
7981                   { "Set printer", "spoolss.rffpcnex.flags.set_printer",
7982                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_set_printer),
7983                     SPOOLSS_PRINTER_CHANGE_SET_PRINTER, NULL,
7984                     HFILL }},
7985
7986                 { &hf_rffpcnex_flags_delete_printer,
7987                   { "Delete printer", "spoolss.rffpcnex.flags.delete_printer",
7988                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_delete_printer),
7989                     SPOOLSS_PRINTER_CHANGE_DELETE_PRINTER, NULL,
7990                     HFILL }},
7991
7992                 { &hf_rffpcnex_flags_add_job,
7993                   { "Add job", "spoolss.rffpcnex.flags.add_job",
7994                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_add_job),
7995                     SPOOLSS_PRINTER_CHANGE_ADD_JOB, NULL, HFILL }},
7996
7997                 { &hf_rffpcnex_flags_set_job,
7998                   { "Set job", "spoolss.rffpcnex.flags.set_job",
7999                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_set_job),
8000                     SPOOLSS_PRINTER_CHANGE_SET_JOB, NULL, HFILL }},
8001
8002                 { &hf_rffpcnex_flags_delete_job,
8003                   { "Delete job", "spoolss.rffpcnex.flags.delete_job",
8004                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_delete_job),
8005                     SPOOLSS_PRINTER_CHANGE_DELETE_JOB, NULL, HFILL }},
8006
8007                 { &hf_rffpcnex_flags_write_job,
8008                   { "Write job", "spoolss.rffpcnex.flags.write_job",
8009                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_write_job),
8010                     SPOOLSS_PRINTER_CHANGE_WRITE_JOB, NULL, HFILL }},
8011
8012                 { &hf_rffpcnex_flags_add_form,
8013                   { "Add form", "spoolss.rffpcnex.flags.add_form",
8014                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_add_form),
8015                     SPOOLSS_PRINTER_CHANGE_ADD_FORM, NULL, HFILL }},
8016
8017                 { &hf_rffpcnex_flags_set_form,
8018                   { "Set form", "spoolss.rffpcnex.flags.set_form",
8019                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_set_form),
8020                     SPOOLSS_PRINTER_CHANGE_SET_FORM, NULL, HFILL }},
8021
8022                 { &hf_rffpcnex_flags_delete_form,
8023                   { "Delete form", "spoolss.rffpcnex.flags.delete_form",
8024                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_delete_form),
8025                     SPOOLSS_PRINTER_CHANGE_DELETE_FORM, NULL,
8026                     HFILL }},
8027
8028                 { &hf_rffpcnex_flags_add_port,
8029                   { "Add port", "spoolss.rffpcnex.flags.add_port",
8030                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_add_port),
8031                     SPOOLSS_PRINTER_CHANGE_ADD_PORT, NULL, HFILL }},
8032
8033                 { &hf_rffpcnex_flags_configure_port,
8034                   { "Configure port", "spoolss.rffpcnex.flags.configure_port",
8035                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_configure_port),
8036                     SPOOLSS_PRINTER_CHANGE_CONFIGURE_PORT, NULL,
8037                     HFILL }},
8038
8039                 { &hf_rffpcnex_flags_delete_port,
8040                   { "Delete port", "spoolss.rffpcnex.flags.delete_port",
8041                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_delete_port),
8042                     SPOOLSS_PRINTER_CHANGE_DELETE_PORT, NULL,
8043                     HFILL }},
8044
8045                 { &hf_rffpcnex_flags_add_print_processor,
8046                   { "Add processor", "spoolss.rffpcnex.flags.add_processor",
8047                     FT_BOOLEAN, 32,
8048                     TFS(&tfs_rffpcnex_flags_add_print_processor),
8049                     SPOOLSS_PRINTER_CHANGE_ADD_PRINT_PROCESSOR,
8050                     NULL, HFILL }},
8051
8052                 { &hf_rffpcnex_flags_delete_print_processor,
8053                   { "Delete processor",
8054                     "spoolss.rffpcnex.flags.delete_processor", FT_BOOLEAN, 32,
8055                     TFS(&tfs_rffpcnex_flags_delete_print_processor),
8056                     SPOOLSS_PRINTER_CHANGE_DELETE_PRINT_PROCESSOR,
8057                     NULL, HFILL }},
8058
8059                 { &hf_rffpcnex_flags_add_driver,
8060                   { "Add driver", "spoolss.rffpcnex.flags.add_driver",
8061                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_add_driver),
8062                     SPOOLSS_PRINTER_CHANGE_ADD_PRINTER_DRIVER, NULL,
8063                     HFILL }},
8064
8065                 { &hf_rffpcnex_flags_set_driver,
8066                   { "Set driver", "spoolss.rffpcnex.flags.set_driver",
8067                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_set_driver),
8068                     SPOOLSS_PRINTER_CHANGE_SET_PRINTER_DRIVER, NULL,
8069                     HFILL }},
8070
8071                 { &hf_rffpcnex_flags_delete_driver,
8072                   { "Delete driver", "spoolss.rffpcnex.flags.delete_driver",
8073                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_delete_driver),
8074                     SPOOLSS_PRINTER_CHANGE_DELETE_PRINTER_DRIVER,
8075                     NULL, HFILL }},
8076
8077                 { &hf_rffpcnex_flags_timeout,
8078                   { "Timeout", "spoolss.rffpcnex.flags.timeout",
8079                     FT_BOOLEAN, 32, TFS(&tfs_rffpcnex_flags_timeout),
8080                     SPOOLSS_PRINTER_CHANGE_TIMEOUT, NULL, HFILL }},
8081
8082                 { &hf_rffpcnex_flags_failed_printer_connection,
8083                   { "Failed printer connection",
8084                     "spoolss.rffpcnex.flags.failed_connection_printer",
8085                     FT_BOOLEAN, 32,
8086                     TFS(&tfs_rffpcnex_flags_failed_connection_printer),
8087                     SPOOLSS_PRINTER_CHANGE_FAILED_CONNECTION_PRINTER,
8088                     NULL, HFILL }},
8089
8090                 /* RRPCN RPC */
8091
8092                 { &hf_rrpcn_changelow,
8093                   { "Change low", "spoolss.rrpcn.changelow", FT_UINT32,
8094                     BASE_DEC, NULL, 0, NULL, HFILL }},
8095
8096                 { &hf_rrpcn_changehigh,
8097                   { "Change high", "spoolss.rrpcn.changehigh", FT_UINT32,
8098                     BASE_DEC, NULL, 0, NULL, HFILL }},
8099
8100                 { &hf_rrpcn_unk0,
8101                   { "Unknown 0", "spoolss.rrpcn.unk0", FT_UINT32, BASE_DEC,
8102                     NULL, 0, NULL, HFILL }},
8103
8104                 { &hf_rrpcn_unk1,
8105                   { "Unknown 1", "spoolss.rrpcn.unk1", FT_UINT32, BASE_DEC,
8106                     NULL, 0, NULL, HFILL }},
8107
8108                 /* ReplyOpenPrinter RPC */
8109
8110                 { &hf_replyopenprinter_unk0,
8111                   { "Unknown 0", "spoolss.replyopenprinter.unk0", FT_UINT32,
8112                     BASE_DEC, NULL, 0, NULL, HFILL }},
8113
8114                 { &hf_replyopenprinter_unk1,
8115                   { "Unknown 1", "spoolss.replyopenprinter.unk1", FT_UINT32,
8116                     BASE_DEC, NULL, 0, NULL, HFILL }},
8117
8118                 /* Printer attributes */
8119
8120                 { &hf_printer_attributes,
8121                   { "Attributes", "spoolss.printer_attributes", FT_UINT32,
8122                     BASE_HEX, NULL, 0, NULL, HFILL }},
8123
8124                 { &hf_printer_attributes_queued,
8125                   { "Queued", "spoolss.printer_attributes.queued", FT_BOOLEAN,
8126                     32, TFS(&tfs_printer_attributes_queued),
8127                     PRINTER_ATTRIBUTE_QUEUED, NULL, HFILL }},
8128
8129                 { &hf_printer_attributes_direct,
8130                   { "Direct", "spoolss.printer_attributes.direct", FT_BOOLEAN,
8131                     32, TFS(&tfs_printer_attributes_direct),
8132                     PRINTER_ATTRIBUTE_DIRECT, NULL, HFILL }},
8133
8134                 { &hf_printer_attributes_default,
8135                   { "Default (9x/ME only)",
8136                     "spoolss.printer_attributes.default",FT_BOOLEAN,
8137                     32, TFS(&tfs_printer_attributes_default),
8138                     PRINTER_ATTRIBUTE_DEFAULT, "Default", HFILL }},
8139
8140                 { &hf_printer_attributes_shared,
8141                   { "Shared", "spoolss.printer_attributes.shared", FT_BOOLEAN,
8142                     32, TFS(&tfs_printer_attributes_shared),
8143                     PRINTER_ATTRIBUTE_SHARED, NULL, HFILL }},
8144
8145                 { &hf_printer_attributes_network,
8146                   { "Network", "spoolss.printer_attributes.network",
8147                     FT_BOOLEAN, 32, TFS(&tfs_printer_attributes_network),
8148                     PRINTER_ATTRIBUTE_NETWORK, NULL, HFILL }},
8149
8150                 { &hf_printer_attributes_hidden,
8151                   { "Hidden", "spoolss.printer_attributes.hidden", FT_BOOLEAN,
8152                     32, TFS(&tfs_printer_attributes_hidden),
8153                     PRINTER_ATTRIBUTE_HIDDEN, NULL, HFILL }},
8154
8155                 { &hf_printer_attributes_local,
8156                   { "Local", "spoolss.printer_attributes.local", FT_BOOLEAN,
8157                     32, TFS(&tfs_printer_attributes_local),
8158                     PRINTER_ATTRIBUTE_LOCAL, NULL, HFILL }},
8159
8160                 { &hf_printer_attributes_enable_devq,
8161                   { "Enable devq", "spoolss.printer_attributes.enable_devq",
8162                     FT_BOOLEAN, 32, TFS(&tfs_printer_attributes_enable_devq),
8163                     PRINTER_ATTRIBUTE_ENABLE_DEVQ, "Enable evq", HFILL }},
8164
8165                 { &hf_printer_attributes_keep_printed_jobs,
8166                   { "Keep printed jobs",
8167                     "spoolss.printer_attributes.keep_printed_jobs", FT_BOOLEAN,
8168                     32, TFS(&tfs_printer_attributes_keep_printed_jobs),
8169                     PRINTER_ATTRIBUTE_KEEPPRINTEDJOBS, NULL,
8170                     HFILL }},
8171
8172                 { &hf_printer_attributes_do_complete_first,
8173                   { "Do complete first",
8174                     "spoolss.printer_attributes.do_complete_first", FT_BOOLEAN,
8175                     32, TFS(&tfs_printer_attributes_do_complete_first),
8176                     PRINTER_ATTRIBUTE_DO_COMPLETE_FIRST, NULL,
8177                     HFILL }},
8178
8179                 { &hf_printer_attributes_work_offline,
8180                   { "Work offline (9x/ME only)",
8181                     "spoolss.printer_attributes.work_offline", FT_BOOLEAN,
8182                     32, TFS(&tfs_printer_attributes_work_offline),
8183                     PRINTER_ATTRIBUTE_WORK_OFFLINE, "Work offline", HFILL }},
8184
8185                 { &hf_printer_attributes_enable_bidi,
8186                   { "Enable bidi (9x/ME only)",
8187                     "spoolss.printer_attributes.enable_bidi", FT_BOOLEAN,
8188                     32, TFS(&tfs_printer_attributes_enable_bidi),
8189                     PRINTER_ATTRIBUTE_ENABLE_BIDI, "Enable bidi", HFILL }},
8190
8191                 { &hf_printer_attributes_raw_only,
8192                   { "Raw only", "spoolss.printer_attributes.raw_only",
8193                     FT_BOOLEAN, 32, TFS(&tfs_printer_attributes_raw_only),
8194                     PRINTER_ATTRIBUTE_RAW_ONLY, NULL, HFILL }},
8195
8196                 { &hf_printer_attributes_published,
8197                   { "Published", "spoolss.printer_attributes.published",
8198                     FT_BOOLEAN, 32, TFS(&tfs_printer_attributes_published),
8199                     PRINTER_ATTRIBUTE_PUBLISHED, NULL, HFILL }},
8200
8201                 /* Timestamps */
8202
8203                 { &hf_time_year,
8204                   { "Year", "spoolss.time.year", FT_UINT32, BASE_DEC,
8205                     NULL, 0x0, NULL, HFILL }},
8206
8207                 { &hf_time_month,
8208                   { "Month", "spoolss.time.month", FT_UINT32, BASE_DEC,
8209                     NULL, 0x0, NULL, HFILL }},
8210
8211                 { &hf_time_dow,
8212                   { "Day of week", "spoolss.time.dow", FT_UINT32, BASE_DEC,
8213                     NULL, 0x0, NULL, HFILL }},
8214
8215                 { &hf_time_day,
8216                   { "Day", "spoolss.time.day", FT_UINT32, BASE_DEC,
8217                     NULL, 0x0, NULL, HFILL }},
8218
8219                 { &hf_time_hour,
8220                   { "Hour", "spoolss.time.hour", FT_UINT32, BASE_DEC,
8221                     NULL, 0x0, NULL, HFILL }},
8222
8223                 { &hf_time_minute,
8224                   { "Minute", "spoolss.time.minute", FT_UINT32, BASE_DEC,
8225                     NULL, 0x0, NULL, HFILL }},
8226
8227                 { &hf_time_second,
8228                   { "Second", "spoolss.time.second", FT_UINT32, BASE_DEC,
8229                     NULL, 0x0, NULL, HFILL }},
8230
8231                 { &hf_time_msec,
8232                   { "Millisecond", "spoolss.time.msec", FT_UINT32, BASE_DEC,
8233                     NULL, 0x0, NULL, HFILL }},
8234
8235                 /* Userlevel */
8236
8237                 { &hf_userlevel_size,
8238                   { "Size", "spoolss.userlevel.size",
8239                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8240
8241                 { &hf_userlevel_client,
8242                   { "Client", "spoolss.userlevel.client", FT_STRING,
8243                     BASE_NONE, NULL, 0, NULL, HFILL }},
8244
8245                 { &hf_userlevel_user,
8246                   { "User", "spoolss.userlevel.user", FT_STRING,
8247                     BASE_NONE, NULL, 0, NULL, HFILL }},
8248
8249                 { &hf_userlevel_build,
8250                   { "Build", "spoolss.userlevel.build",
8251                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8252
8253                 { &hf_userlevel_major,
8254                   { "Major", "spoolss.userlevel.major",
8255                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8256
8257                 { &hf_userlevel_minor,
8258                   { "Minor", "spoolss.userlevel.minor",
8259                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8260
8261                 { &hf_userlevel_processor,
8262                   { "Processor", "spoolss.userlevel.processor",
8263                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8264
8265                 /* EnumprinterdataEx RPC */
8266
8267                 { &hf_enumprinterdataex_name_offset,
8268                   { "Name offset", "spoolss.enumprinterdataex.name_offset",
8269                     FT_UINT32, BASE_DEC, NULL, 0x0,
8270                     NULL, HFILL }},
8271
8272                 { &hf_enumprinterdataex_name_len,
8273                   { "Name len", "spoolss.enumprinterdataex.name_len",
8274                     FT_UINT32, BASE_DEC, NULL, 0x0,
8275                     NULL, HFILL }},
8276
8277                 { &hf_enumprinterdataex_val_offset,
8278                   { "Value offset", "spoolss.enumprinterdataex.value_offset",
8279                     FT_UINT32, BASE_DEC, NULL, 0x0,
8280                     NULL, HFILL }},
8281
8282                 { &hf_enumprinterdataex_val_len,
8283                   { "Value len", "spoolss.enumprinterdataex.value_len",
8284                     FT_UINT32, BASE_DEC, NULL, 0x0,
8285                     NULL, HFILL }},
8286
8287                 { &hf_enumprinterdataex_val_dword_high,
8288                   { "DWORD value (high)",
8289                     "spoolss.enumprinterdataex.val_dword.high",
8290                     FT_UINT16, BASE_DEC, NULL, 0x0,
8291                     NULL, HFILL }},
8292
8293                 { &hf_enumprinterdataex_val_dword_low,
8294                   { "DWORD value (low)",
8295                     "spoolss.enumprinterdataex.val_dword.low",
8296                     FT_UINT16, BASE_DEC, NULL, 0x0,
8297                     NULL, HFILL }},
8298
8299                 /* RouterReplyPrinter RPC */
8300
8301                 { &hf_routerreplyprinter_condition,
8302                   { "Condition", "spoolss.routerreplyprinter.condition",
8303                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8304
8305                 { &hf_routerreplyprinter_unknown1,
8306                   { "Unknown1", "spoolss.routerreplyprinter.unknown1",
8307                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8308
8309                 { &hf_routerreplyprinter_changeid,
8310                   { "Change id", "spoolss.routerreplyprinter.changeid",
8311                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8312
8313                 /* EnumPrinterKey RPC */
8314
8315                 { &hf_keybuffer_size,
8316                   { "Key Buffer size", "spoolss.keybuffer.size", FT_UINT32,
8317                     BASE_DEC, NULL, 0x0, "Size of buffer", HFILL }},
8318
8319                 /* SetJob RPC */
8320
8321                 { &hf_setjob_cmd,
8322                   { "Set job command", "spoolss.setjob.cmd", FT_UINT32,
8323                     BASE_DEC, VALS(setjob_commands), 0x0, "Printer data name",
8324                     HFILL }},
8325
8326                 /* EnumJobs RPC */
8327
8328                 { &hf_enumjobs_firstjob,
8329                   { "First job", "spoolss.enumjobs.firstjob", FT_UINT32,
8330                     BASE_DEC, NULL, 0x0, "Index of first job to return",
8331                     HFILL }},
8332
8333                 { &hf_enumjobs_numjobs,
8334                   { "Num jobs", "spoolss.enumjobs.numjobs", FT_UINT32,
8335                     BASE_DEC, NULL, 0x0, "Number of jobs to return", HFILL }},
8336
8337                 /* Security descriptor buffer */
8338
8339                 { &hf_secdescbuf_maxlen,
8340                   { "Max len", "spoolss.secdescbuf.max_len",
8341                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8342
8343                 { &hf_secdescbuf_undoc,
8344                   { "Undocumented", "spoolss.secdescbuf.undoc",
8345                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8346
8347                 { &hf_secdescbuf_len,
8348                   { "Length", "spoolss.secdescbuf.len",
8349                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8350
8351                 /* Spool printer info */
8352
8353                 { &hf_spool_printer_info_devmode_ptr,
8354                   { "Devmode pointer", "spoolss.spoolprinterinfo.devmode_ptr",
8355                     FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
8356
8357                 { &hf_spool_printer_info_secdesc_ptr,
8358                   { "Secdesc pointer", "spoolss.spoolprinterinfo.secdesc_ptr",
8359                     FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
8360
8361                 /* WritePrinter RPC */
8362
8363                 { &hf_writeprinter_numwritten,
8364                   { "Num written", "spoolss.writeprinter.numwritten",
8365                     FT_UINT32, BASE_DEC, NULL, 0x0, "Number of bytes written",
8366                     HFILL }},
8367
8368                 /* Setprinterdataex RPC */
8369
8370                 { &hf_setprinterdataex_max_len,
8371                   { "Max len", "spoolss.setprinterdataex.max_len",
8372                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8373
8374                 { &hf_setprinterdataex_real_len,
8375                   { "Real len", "spoolss.setprinterdataex.real_len",
8376                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8377
8378                 { &hf_setprinterdataex_data,
8379                   { "Data", "spoolss.setprinterdataex.data",
8380                     FT_BYTES, BASE_NONE, NULL, 0, NULL, HFILL }},
8381
8382                 /* Specific access rights */
8383
8384                 { &hf_access_required,
8385                   { "Access required", "spoolss.access_required",
8386                     FT_UINT32, BASE_HEX, NULL, 0x0, NULL,
8387                     HFILL }},
8388
8389                 { &hf_server_access_admin,
8390                   { "Server admin", "spoolss.access_mask.server_admin",
8391                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
8392                     SERVER_ACCESS_ADMINISTER, NULL, HFILL }},
8393
8394                 { &hf_server_access_enum,
8395                   { "Server enum", "spoolss.access_mask.server_enum",
8396                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
8397                     SERVER_ACCESS_ENUMERATE, NULL, HFILL }},
8398
8399                 { &hf_printer_access_admin,
8400                   { "Printer admin", "spoolss.access_mask.printer_admin",
8401                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
8402                     PRINTER_ACCESS_ADMINISTER, NULL, HFILL }},
8403
8404                 { &hf_printer_access_use,
8405                   { "Printer use", "spoolss.access_mask.printer_use",
8406                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
8407                     PRINTER_ACCESS_USE, NULL, HFILL }},
8408
8409                 { &hf_job_access_admin,
8410                   { "Job admin", "spoolss.access_mask.job_admin",
8411                     FT_BOOLEAN, 32, TFS(&tfs_set_notset),
8412                     JOB_ACCESS_ADMINISTER, NULL, HFILL }},
8413
8414                 /* Printer information */
8415
8416                 { &hf_printer_cjobs,
8417                   { "CJobs", "spoolss.printer.cjobs", FT_UINT32,
8418                     BASE_DEC, NULL, 0, NULL, HFILL }},
8419
8420                 { &hf_printer_total_jobs,
8421                   { "Total jobs", "spoolss.printer.total_jobs", FT_UINT32,
8422                     BASE_DEC, NULL, 0, NULL, HFILL }},
8423
8424                 { &hf_printer_total_bytes,
8425                   { "Total bytes", "spoolss.printer.total_bytes", FT_UINT32,
8426                     BASE_DEC, NULL, 0, NULL, HFILL }},
8427
8428                 { &hf_printer_global_counter,
8429                   { "Global counter", "spoolss.printer.global_counter",
8430                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8431
8432                 { &hf_printer_total_pages,
8433                   { "Total pages", "spoolss.printer.total_pages", FT_UINT32,
8434                     BASE_DEC, NULL, 0, NULL, HFILL }},
8435
8436                 { &hf_printer_major_version,
8437                   { "Major version", "spoolss.printer.major_version",
8438                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8439
8440                 { &hf_printer_build_version,
8441                   { "Build version", "spoolss.printer.build_version",
8442                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8443
8444                 { &hf_printer_unk7,
8445                   { "Unknown 7", "spoolss.printer.unknown7", FT_UINT32,
8446                     BASE_DEC, NULL, 0, NULL, HFILL }},
8447
8448                 { &hf_printer_unk8,
8449                   { "Unknown 8", "spoolss.printer.unknown8", FT_UINT32,
8450                     BASE_DEC, NULL, 0, NULL, HFILL }},
8451
8452                 { &hf_printer_unk9,
8453                   { "Unknown 9", "spoolss.printer.unknown9", FT_UINT32,
8454                     BASE_DEC, NULL, 0, NULL, HFILL }},
8455
8456                 { &hf_printer_session_ctr,
8457                   { "Session counter", "spoolss.printer.session_ctr",
8458                     FT_UINT32, BASE_DEC, NULL, 0, "Sessopm counter", HFILL }},
8459
8460                 { &hf_printer_unk11,
8461                   { "Unknown 11", "spoolss.printer.unknown11", FT_UINT32,
8462                     BASE_DEC, NULL, 0, NULL, HFILL }},
8463
8464                 { &hf_printer_printer_errors,
8465                   { "Printer errors", "spoolss.printer.printer_errors",
8466                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8467
8468                 { &hf_printer_unk13,
8469                   { "Unknown 13", "spoolss.printer.unknown13", FT_UINT32,
8470                     BASE_DEC, NULL, 0, NULL, HFILL }},
8471
8472                 { &hf_printer_unk14,
8473                   { "Unknown 14", "spoolss.printer.unknown14", FT_UINT32,
8474                     BASE_DEC, NULL, 0, NULL, HFILL }},
8475
8476                 { &hf_printer_unk15,
8477                   { "Unknown 15", "spoolss.printer.unknown15", FT_UINT32,
8478                     BASE_DEC, NULL, 0, NULL, HFILL }},
8479
8480                 { &hf_printer_unk16,
8481                   { "Unknown 16", "spoolss.printer.unknown16", FT_UINT32,
8482                     BASE_DEC, NULL, 0, NULL, HFILL }},
8483
8484                 { &hf_printer_changeid,
8485                   { "Change id", "spoolss.printer.changeid", FT_UINT32,
8486                     BASE_DEC, NULL, 0, NULL, HFILL }},
8487
8488                 { &hf_printer_unk18,
8489                   { "Unknown 18", "spoolss.printer.unknown18", FT_UINT32,
8490                     BASE_DEC, NULL, 0, NULL, HFILL }},
8491
8492                 { &hf_printer_unk20,
8493                   { "Unknown 20", "spoolss.printer.unknown20", FT_UINT32,
8494                     BASE_DEC, NULL, 0, NULL, HFILL }},
8495
8496                 { &hf_printer_c_setprinter,
8497                   { "Csetprinter", "spoolss.printer.c_setprinter",
8498                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8499
8500                 { &hf_printer_unk22,
8501                   { "Unknown 22", "spoolss.printer.unknown22",
8502                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8503
8504                 { &hf_printer_unk23,
8505                   { "Unknown 23", "spoolss.printer.unknown23",
8506                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8507
8508                 { &hf_printer_unk24,
8509                   { "Unknown 24", "spoolss.printer.unknown24",
8510                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8511
8512                 { &hf_printer_unk25,
8513                   { "Unknown 25", "spoolss.printer.unknown25",
8514                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8515
8516                 { &hf_printer_unk26,
8517                   { "Unknown 26", "spoolss.printer.unknown26",
8518                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8519
8520                 { &hf_printer_unk27,
8521                   { "Unknown 27", "spoolss.printer.unknown27",
8522                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8523
8524                 { &hf_printer_unk28,
8525                   { "Unknown 28", "spoolss.printer.unknown28",
8526                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8527
8528                 { &hf_printer_unk29,
8529                   { "Unknown 29", "spoolss.printer.unknown29",
8530                     FT_UINT16, BASE_DEC, NULL, 0, NULL, HFILL }},
8531
8532                 { &hf_printer_flags,
8533                   { "Flags", "spoolss.printer.flags",
8534                     FT_UINT32, BASE_HEX, NULL, 0, NULL, HFILL }},
8535
8536                 { &hf_printer_priority,
8537                   { "Priority", "spoolss.printer.priority",
8538                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8539
8540                 { &hf_printer_default_priority,
8541                   { "Default Priority", "spoolss.printer.default_priority",
8542                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8543
8544                 { &hf_printer_averageppm,
8545                   { "Average PPM", "spoolss.printer.averageppm",
8546                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8547
8548                 { &hf_printer_jobs,
8549                   { "Jobs", "spoolss.printer.jobs",
8550                     FT_UINT32, BASE_DEC, NULL, 0, NULL, HFILL }},
8551
8552                 { &hf_printer_guid,
8553                   { "GUID", "spoolss.printer.guid", FT_STRING,
8554                     BASE_NONE, NULL, 0, NULL, HFILL }},
8555
8556                 { &hf_printer_action,
8557                   { "Action", "spoolss.printer.action", FT_UINT32, BASE_DEC,
8558                    VALS(getprinter_action_vals), 0, NULL, HFILL }},
8559         };
8560
8561         static gint *ett[] = {
8562                 &ett_dcerpc_spoolss,
8563                 &ett_PRINTER_DATATYPE,
8564                 &ett_DEVMODE_CTR,
8565                 &ett_DEVMODE,
8566                 &ett_DEVMODE_fields,
8567                 &ett_USER_LEVEL_CTR,
8568                 &ett_USER_LEVEL_1,
8569                 &ett_BUFFER,
8570                 &ett_PRINTER_INFO,
8571                 &ett_SPOOL_PRINTER_INFO_LEVEL,
8572                 &ett_PRINTER_INFO_0,
8573                 &ett_PRINTER_INFO_1,
8574                 &ett_PRINTER_INFO_2,
8575                 &ett_PRINTER_INFO_3,
8576                 &ett_PRINTER_INFO_7,
8577                 &ett_RELSTR,
8578                 &ett_RELSTR_ARRAY,
8579                 &ett_FORM_REL,
8580                 &ett_FORM_CTR,
8581                 &ett_FORM_1,
8582                 &ett_JOB_INFO_1,
8583                 &ett_JOB_INFO_2,
8584                 &ett_SEC_DESC_BUF,
8585                 &ett_SYSTEM_TIME,
8586                 &ett_DOC_INFO_1,
8587                 &ett_DOC_INFO,
8588                 &ett_DOC_INFO_CTR,
8589                 &ett_printerdata_value,
8590                 &ett_printerdata_data,
8591                 &ett_writeprinter_buffer,
8592                 &ett_DRIVER_INFO_1,
8593                 &ett_DRIVER_INFO_2,
8594                 &ett_DRIVER_INFO_3,
8595                 &ett_DRIVER_INFO_6,
8596                 &ett_DRIVER_INFO_101,
8597                 &ett_rffpcnex_flags,
8598                 &ett_notify_options_flags,
8599                 &ett_NOTIFY_INFO_DATA,
8600                 &ett_NOTIFY_OPTION,
8601                 &ett_printer_attributes,
8602                 &ett_job_status,
8603                 &ett_enumprinters_flags,
8604                 &ett_PRINTER_DATA_CTR,
8605                 &ett_printer_enumdataex_value,
8606         };
8607
8608         proto_dcerpc_spoolss = proto_register_protocol(
8609                 "Microsoft Spool Subsystem", "SPOOLSS", "spoolss");
8610
8611         proto_register_field_array(proto_dcerpc_spoolss, hf, array_length(hf));
8612
8613         proto_register_subtree_array(ett, array_length(ett));
8614 }
8615
8616 /* Protocol handoff */
8617
8618 static e_uuid_t uuid_dcerpc_spoolss = {
8619         0x12345678, 0x1234, 0xabcd,
8620         { 0xef, 0x00, 0x01, 0x23, 0x45, 0x67, 0x89, 0xab }
8621 };
8622
8623 static guint16 ver_dcerpc_spoolss = 1;
8624
8625 void
8626 proto_reg_handoff_dcerpc_spoolss(void)
8627 {
8628
8629         /* Register protocol as dcerpc */
8630
8631         dcerpc_init_uuid(proto_dcerpc_spoolss, ett_dcerpc_spoolss,
8632                          &uuid_dcerpc_spoolss, ver_dcerpc_spoolss,
8633                          dcerpc_spoolss_dissectors, hf_opnum);
8634 }