decode the field of type 11

(it could theoretically also be a union with arm:1 selected instead of a conformant array)



git-svn-id: http://anonsvn.wireshark.org/wireshark/trunk@18858 f5534014-38df-0310-8fa8-9805f1628bb7

1 files changed, 38 insertions, 0 deletions

diff --git a/epan/dissectors/packet-dcerpc-netlogon.c b/epan/dissectors/packet-dcerpc-netlogon.c
index 667304bf9e..abbe759d1f 100644
--- a/epan/dissectors/packet-dcerpc-netlogon.c
+++ b/epan/dissectors/packet-dcerpc-netlogon.c
@@ -1519,7 +1519,45 @@ netlogon_dissect_PAC_LOGON_INFO(tvbuff_t *tvb, int offset,
 	return offset;
 }
 
+static int
+netlogon_dissect_CONSTRAINED_DELEGATION_name(tvbuff_t *tvb, int offset,
+			packet_info *pinfo, proto_tree *tree,
+			guint8 *drep)
+{
+	offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+		hf_netlogon_unknown_string, 0);
+
+	return offset;
+}
+
+static int
+netlogon_dissect_CONSTRAINED_DELEGATION_array(tvbuff_t *tvb, int offset,
+			packet_info *pinfo, proto_tree *tree,
+			guint8 *drep)
+{
+	offset = dissect_ndr_ucarray(tvb, offset, pinfo, tree, drep,
+			netlogon_dissect_CONSTRAINED_DELEGATION_name);
+
+	return offset;
+}
+
+int
+netlogon_dissect_PAC_CONSTRAINED_DELEGATION(tvbuff_t *tvb, int offset,
+			packet_info *pinfo, proto_tree *tree,
+			guint8 *drep)
+{
+	offset = dissect_ndr_counted_string(tvb, offset, pinfo, tree, drep,
+		hf_netlogon_unknown_string, 0);
+
+	offset = dissect_ndr_uint32(tvb, offset, pinfo, tree, drep,
+		hf_netlogon_unknown_long, NULL);
 
+        offset = dissect_ndr_pointer(tvb, offset, pinfo, tree, drep,
+		netlogon_dissect_CONSTRAINED_DELEGATION_array, NDR_POINTER_UNIQUE,
+		"names:", -1);
+
+	return offset;
+}
 
 static int
 netlogon_dissect_PAC(tvbuff_t *tvb, int offset,