/*

 * packet-winsrepl.c

 *

 * Routines for WINS Replication packet dissection

 *

 * Copyright 2005 Stefan Metzmacher <metze@samba.org>

 *

 * Wireshark - Network traffic analyzer

 * By Gerald Combs <gerald@wireshark.org>

 * Copyright 1998 Gerald Combs

 *

 * SPDX-License-Identifier: GPL-2.0-or-later

 */

#include "config.h"

#include <epan/packet.h>

#include <epan/expert.h>

#include <epan/exceptions.h>

#include <epan/prefs.h>

#include <epan/to_str.h>

#include "packet-netbios.h"

#include "packet-tcp.h"

void proto_register_winsrepl(void);

void proto_reg_handoff_winsrepl(void);

static dissector_handle_t winsrepl_handle;

static bool winsrepl_reassemble = true;

static int proto_winsrepl;

static int hf_winsrepl_size;

static int hf_winsrepl_opcode;

static int hf_winsrepl_assoc_ctx;

static int hf_winsrepl_mess_type;

static int hf_winsrepl_start_minor_version;

static int hf_winsrepl_start_major_version;

static int hf_winsrepl_stop_reason;

static int hf_winsrepl_replication_command;

static int hf_winsrepl_owner_address;

static int hf_winsrepl_owner_max_version;

static int hf_winsrepl_owner_min_version;

static int hf_winsrepl_owner_type;

static int hf_winsrepl_table_partner_count;

static int hf_winsrepl_table_initiator;

static int hf_winsrepl_ip_owner;

static int hf_winsrepl_ip_ip;

static int hf_winsrepl_addr_list_num_ips;

static int hf_winsrepl_name_len;

static int hf_winsrepl_name_flags;

static int hf_winsrepl_name_flags_rectype;

static int hf_winsrepl_name_flags_recstate;

static int hf_winsrepl_name_flags_local;

static int hf_winsrepl_name_flags_hosttype;

static int hf_winsrepl_name_flags_static;

static int hf_winsrepl_name_group_flag;

static int hf_winsrepl_name_version_id;

static int hf_winsrepl_name_unknown;

static int hf_winsrepl_reply_num_names;

static int ett_winsrepl;

static int ett_winsrepl_start;

static int ett_winsrepl_stop;

static int ett_winsrepl_replication;

static int ett_winsrepl_owner;

static int ett_winsrepl_table_reply;

static int ett_winsrepl_ip;

static int ett_winsrepl_addr_list;

static int ett_winsrepl_name;

static int ett_winsrepl_send_reply;

static int ett_winsrepl_flags;

static expert_field ei_winsrepl_name_len;

#define WINS_REPLICATION_PORT ( 42 )

#define WREPL_OPCODE_BITS ( 0x7800 )

enum wrepl_replication_cmd {

  WREPL_REPL_TABLE_QUERY=0,

  WREPL_REPL_TABLE_REPLY=1,

  WREPL_REPL_SEND_REQUEST=2,

  WREPL_REPL_SEND_REPLY=3,

  WREPL_REPL_UPDATE=4,

  WREPL_REPL_UPDATE2=5,

  WREPL_REPL_INFORM=8,

  WREPL_REPL_INFORM2=9

};

enum wrepl_mess_type {

  WREPL_START_ASSOCIATION=0,

  WREPL_START_ASSOCIATION_REPLY=1,

  WREPL_STOP_ASSOCIATION=2,

  WREPL_REPLICATION=3

};

static const value_string replication_cmd_vals[] = {

  {WREPL_REPL_TABLE_QUERY,  "WREPL_REPL_TABLE_QUERY"},

  {WREPL_REPL_TABLE_REPLY,  "WREPL_REPL_TABLE_REPLY"},

  {WREPL_REPL_SEND_REQUEST, "WREPL_REPL_SEND_REQUEST"},

  {WREPL_REPL_SEND_REPLY,   "WREPL_REPL_SEND_REPLY"},

  {WREPL_REPL_UPDATE,   "WREPL_REPL_UPDATE"},

  {WREPL_REPL_UPDATE2,    "WREPL_REPL_UPDATE2"},

  {WREPL_REPL_INFORM,   "WREPL_REPL_INFORM"},

  {WREPL_REPL_INFORM2,    "WREPL_REPL_INFORM2"},

  {0, NULL}

};

static const value_string message_type_vals[] = {

  {WREPL_START_ASSOCIATION, "WREPL_START_ASSOCIATION"},

  {WREPL_START_ASSOCIATION_REPLY, "WREPL_START_ASSOCIATION_REPLY"},

  {WREPL_STOP_ASSOCIATION,  "WREPL_STOP_ASSOCIATION"},

  {WREPL_REPLICATION,   "WREPL_REPLICATION"},

  {0, NULL}

};

#define WREPL_NAME_TYPE_MASK    0x03

#define WREPL_NAME_TYPE_UNIQUE    0x00

#define WREPL_NAME_TYPE_NORMAL_GROUP  0x01

#define WREPL_NAME_TYPE_SPECIAL_GROUP 0x02

#define WREPL_NAME_TYPE_MULTIHOMED  0x03

static const value_string rectype_vals[] = {

  {WREPL_NAME_TYPE_UNIQUE,  "Unique"},

  {WREPL_NAME_TYPE_NORMAL_GROUP,  "Normal group"},

  {WREPL_NAME_TYPE_SPECIAL_GROUP, "Special group"},

  {WREPL_NAME_TYPE_MULTIHOMED,  "Multihomed"},

  {0, NULL}

};

static const value_string recstate_vals[] = {

  {0x00,  "Active"},

  {0x01,  "Released"},

  {0x02,  "Tombstoned"},

  {0x03,  "Deleted"},

  {0, NULL}

};

static const value_string hosttype_vals[] = {

  {0x00,  "B-node"},

  {0x01,  "P-node"},

  {0x02,  "M-node"},

  {0x03,  "H-node"},

  {0, NULL}

};

static int

dissect_winsrepl_start(tvbuff_t *winsrepl_tvb, _U_ packet_info *pinfo,

           int winsrepl_offset, proto_tree *winsrepl_tree)

{

  proto_tree *start_tree;

  start_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, -1,

                  ett_winsrepl_start, NULL, "WREPL_START_ASSOCIATION");

  /* ASSOC_CTX */

  proto_tree_add_item(start_tree, hf_winsrepl_assoc_ctx, winsrepl_tvb, winsrepl_offset, 4, ENC_BIG_ENDIAN);

  winsrepl_offset += 4;

  /* MINOR VERSION */

  proto_tree_add_item(start_tree, hf_winsrepl_start_minor_version, winsrepl_tvb, winsrepl_offset, 2, ENC_BIG_ENDIAN);

  winsrepl_offset += 2;

  /* MAJOR VERSION */

  proto_tree_add_item(start_tree, hf_winsrepl_start_major_version, winsrepl_tvb, winsrepl_offset, 2, ENC_BIG_ENDIAN);

  winsrepl_offset += 2;

  return winsrepl_offset;

}

static int

dissect_winsrepl_stop(tvbuff_t *winsrepl_tvb, _U_ packet_info *pinfo,

          int winsrepl_offset, proto_tree *winsrepl_tree)

{

  uint32_t reason;

  proto_item *stop_item;

  proto_tree *stop_tree;

  stop_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, -1,

              ett_winsrepl_stop, &stop_item, "WREPL_STOP_ASSOCIATION");

  /* REASON */

  reason = tvb_get_ntohl(winsrepl_tvb, winsrepl_offset);

  proto_tree_add_uint(stop_tree, hf_winsrepl_stop_reason, winsrepl_tvb, winsrepl_offset, 4, reason);

  winsrepl_offset += 4;

  proto_item_append_text(stop_item, ", Reason: 0x%08X", reason);

  return winsrepl_offset;

}

static int

dissect_winsrepl_table_query(tvbuff_t *winsrepl_tvb _U_, packet_info *pinfo _U_,

           int winsrepl_offset, proto_tree *winsrepl_tree _U_)

{

  /* Nothing to do here */

  return winsrepl_offset;

}

static int

dissect_winsrepl_wins_owner(tvbuff_t *winsrepl_tvb, _U_ packet_info *pinfo,

          int winsrepl_offset, proto_tree *winsrepl_tree,

          proto_tree *sub_tree, uint32_t idx)

{

  proto_tree *owner_tree = NULL;

  if (sub_tree) {

    owner_tree = proto_tree_add_subtree_format(sub_tree, winsrepl_tvb, winsrepl_offset, 24,

                        ett_winsrepl_owner, NULL, "WINS Owner [%u]", idx);

  } else if (winsrepl_tree) {

    owner_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, 24,

                        ett_winsrepl_owner, NULL, "WINS Owner");

  }

  /* ADDRESS */

  proto_tree_add_item(owner_tree, hf_winsrepl_owner_address, winsrepl_tvb, winsrepl_offset, 4, ENC_BIG_ENDIAN);

  winsrepl_offset += 4;

  /* MAX_VERSION */

  proto_tree_add_item(owner_tree, hf_winsrepl_owner_max_version, winsrepl_tvb, winsrepl_offset, 8, ENC_BIG_ENDIAN);

  winsrepl_offset += 8;

  /* MIN_VERSION */

  proto_tree_add_item(owner_tree, hf_winsrepl_owner_min_version, winsrepl_tvb, winsrepl_offset, 8, ENC_BIG_ENDIAN);

  winsrepl_offset += 8;

  /* TYPE */

  proto_tree_add_item(owner_tree, hf_winsrepl_owner_type, winsrepl_tvb, winsrepl_offset, 4, ENC_BIG_ENDIAN);

  winsrepl_offset += 4;

  return winsrepl_offset;

}

static int

dissect_winsrepl_table_reply(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

           int winsrepl_offset, proto_tree *winsrepl_tree)

{

  proto_tree *table_tree;

  uint32_t partner_count;

  uint32_t i;

  table_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, -1,

                  ett_winsrepl_table_reply, NULL, "WREPL_REPL_TABLE_REPLY");

  /* PARTNER COUNT */

  partner_count = tvb_get_ntohl(winsrepl_tvb, winsrepl_offset);

  proto_tree_add_uint(table_tree, hf_winsrepl_table_partner_count, winsrepl_tvb, winsrepl_offset, 4, partner_count);

  winsrepl_offset += 4;

  for (i=0; i < partner_count; i++) {

    winsrepl_offset = dissect_winsrepl_wins_owner(winsrepl_tvb, pinfo,

                    winsrepl_offset, table_tree,

                    table_tree, i);

  }

  /* INITIATOR */

  proto_tree_add_item(table_tree, hf_winsrepl_table_initiator, winsrepl_tvb, winsrepl_offset, 4, ENC_BIG_ENDIAN);

  winsrepl_offset += 4;

  return winsrepl_offset;

}

static int

dissect_winsrepl_send_request(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

           int winsrepl_offset, proto_tree *winsrepl_tree)

{

  winsrepl_offset = dissect_winsrepl_wins_owner(winsrepl_tvb, pinfo,

                  winsrepl_offset, winsrepl_tree,

                  NULL, 0);

  return winsrepl_offset;

}

static int

dissect_winsrepl_wins_ip(tvbuff_t *winsrepl_tvb, _U_ packet_info *pinfo,

       int winsrepl_offset, proto_tree *winsrepl_tree,

       uint32_t *addr, proto_tree *sub_tree, uint32_t idx)

{

  proto_item *ip_item = NULL;

  proto_tree *ip_tree = NULL;

  if (sub_tree) {

    ip_tree = proto_tree_add_subtree_format(sub_tree, winsrepl_tvb, winsrepl_offset, 8,

        ett_winsrepl_ip, &ip_item, "WINS IP [%u]", idx);

  } else if (winsrepl_tree) {

    ip_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, 8,

        ett_winsrepl_ip, &ip_item, "WINS IP");

  }

  /* OWNER */

  proto_tree_add_item(ip_tree, hf_winsrepl_ip_owner, winsrepl_tvb, winsrepl_offset, 4, ENC_BIG_ENDIAN);

  winsrepl_offset += 4;

  /* IP */

  *addr = tvb_get_ipv4(winsrepl_tvb, winsrepl_offset);

  proto_tree_add_ipv4(ip_tree, hf_winsrepl_ip_ip, winsrepl_tvb, winsrepl_offset, 4, *addr);

  proto_item_append_text(ip_item, ": %s", tvb_ip_to_str(pinfo->pool, winsrepl_tvb, winsrepl_offset));

  winsrepl_offset += 4;

  return winsrepl_offset;

}

static int

dissect_winsrepl_wins_address_list(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

           int winsrepl_offset, proto_tree *winsrepl_tree,

           proto_item *parent_item)

{

  proto_item *addr_list_item;

  proto_tree *addr_list_tree;

  int old_offset = winsrepl_offset;

  uint32_t num_ips;

  uint32_t ip;

  uint32_t i;

  address addr;

  char* addr_str;

  addr_list_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, -1,

              ett_winsrepl_addr_list, &addr_list_item, "WINS Address List");

  /* NUM_IPS */

  num_ips = tvb_get_letohl(winsrepl_tvb, winsrepl_offset);

  proto_tree_add_uint(addr_list_tree, hf_winsrepl_addr_list_num_ips, winsrepl_tvb, winsrepl_offset, 4, num_ips);

  winsrepl_offset += 4;

  for (i=0; i < num_ips; i++) {

    winsrepl_offset = dissect_winsrepl_wins_ip(winsrepl_tvb, pinfo,

                 winsrepl_offset, addr_list_tree,

                 &ip, addr_list_tree, i);

    set_address(&addr, AT_IPv4, 4, &ip);

    addr_str = address_to_str(pinfo->pool, &addr);

    if (i == 0) {

      proto_item_append_text(parent_item, ": %s", addr_str);

      proto_item_append_text(addr_list_item, ": %s", addr_str);

    } else {

      proto_item_append_text(parent_item, ", %s", addr_str);

      proto_item_append_text(addr_list_item, ", %s", addr_str);

    }

  }

  proto_item_set_len(addr_list_item, winsrepl_offset - old_offset);

  return winsrepl_offset;

}

static int

dissect_winsrepl_wins_name(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

         int winsrepl_offset, proto_tree *winsrepl_tree,

         proto_tree *sub_tree, uint32_t idx)

{

  proto_item *name_item = NULL, *ti;

  proto_tree *name_tree = NULL;

  int old_offset = winsrepl_offset;

  tvbuff_t *name_tvb = NULL;

  uint32_t name_len;

  char  name_str[(NETBIOS_NAME_LEN - 1)*4 + 1];

  int   name_type;

  uint32_t flags;

  static int * const name_flags[] = {

    &hf_winsrepl_name_flags_rectype,

    &hf_winsrepl_name_flags_recstate,

    &hf_winsrepl_name_flags_local,

    &hf_winsrepl_name_flags_hosttype,

    &hf_winsrepl_name_flags_static,

    NULL

  };

  if (sub_tree) {

    name_tree = proto_tree_add_subtree_format(sub_tree, winsrepl_tvb, winsrepl_offset, -1,

                    ett_winsrepl_name, &name_item, "WINS Name [%u]", idx);

  } else if (winsrepl_tree) {

    name_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, -1,

                        ett_winsrepl_name, &name_item, "WINS Name");

  }

  /* NAME_LEN */

  name_len = tvb_get_ntohl(winsrepl_tvb, winsrepl_offset);

  ti = proto_tree_add_uint(name_tree, hf_winsrepl_name_len, winsrepl_tvb, winsrepl_offset, 4, name_len);

  winsrepl_offset += 4;

  if (name_len == 0) {

    expert_add_info(pinfo, ti, &ei_winsrepl_name_len);

    return winsrepl_offset;

  }

  /* NAME: TODO! */

  /*

   * XXX - apparently, according to the Samba code for handling

   * WINS replication, there's a bug in a lot of versions of Windows,

   * including W2K SP2, wherein the first and last bytes of the

   * name (the last byte being the name type) are swapped if

   * the type is 0x1b.  I think I've seen this in at least

   * one capture.

   */

  name_tvb = tvb_new_subset_length(winsrepl_tvb, winsrepl_offset, name_len);

  netbios_add_name("Name", name_tvb, 0, name_tree);

  name_type = get_netbios_name(name_tvb, 0, name_str, (NETBIOS_NAME_LEN - 1)*4 + 1);

  proto_item_append_text(name_item, ": %s<%02x>", name_str, name_type);

  winsrepl_offset += name_len;

  /* ALIGN to 4 Byte */

  /* winsrepl_offset += ((winsrepl_offset & (4-1)) == 0 ? 0 : (4 - (winsrepl_offset & (4-1)))); */

  /* Windows including w2k8 add 4 padding bytes, when it's already 4 byte

   * aligned... This happens when the name has a "scope" part

   */

  winsrepl_offset += 4 - (winsrepl_offset & (4-1));

  /* FLAGS */

  /*

   * XXX - there appear to be more flag bits, but I didn't see

   * anything in the Samba code about them.

   */

  flags = tvb_get_ntohl(winsrepl_tvb, winsrepl_offset);

  proto_tree_add_bitmask(name_tree, winsrepl_tvb, winsrepl_offset, hf_winsrepl_name_flags, ett_winsrepl_flags, name_flags, ENC_BIG_ENDIAN);

  winsrepl_offset += 4;

  /* GROUP_FLAG */

  /* XXX - is this just a Boolean? */

  proto_tree_add_item(name_tree, hf_winsrepl_name_group_flag, winsrepl_tvb, winsrepl_offset, 4, ENC_LITTLE_ENDIAN);

  winsrepl_offset += 4;

  /* Version ID */

  proto_tree_add_item(name_tree, hf_winsrepl_name_version_id, winsrepl_tvb, winsrepl_offset, 8, ENC_BIG_ENDIAN);

  winsrepl_offset += 8;

  switch (flags & WREPL_NAME_TYPE_MASK) {

  case WREPL_NAME_TYPE_UNIQUE:

  case WREPL_NAME_TYPE_NORMAL_GROUP:

    /* Single address */

    proto_tree_add_item(name_tree, hf_winsrepl_ip_ip, winsrepl_tvb, winsrepl_offset, 4, ENC_BIG_ENDIAN);

    proto_item_append_text(name_item, ": %s", tvb_ip_to_str(pinfo->pool, winsrepl_tvb, winsrepl_offset));

    winsrepl_offset += 4;

    break;

  case WREPL_NAME_TYPE_SPECIAL_GROUP:

  case WREPL_NAME_TYPE_MULTIHOMED:

    /* Address list */

    winsrepl_offset = dissect_winsrepl_wins_address_list(winsrepl_tvb, pinfo,

                     winsrepl_offset, name_tree,

                     name_item);

    break;

  }

  /* UNKNOWN, little or big endian??? */

  proto_tree_add_item(name_tree, hf_winsrepl_name_unknown, winsrepl_tvb, winsrepl_offset, 4, ENC_BIG_ENDIAN);

  winsrepl_offset += 4;

  proto_item_set_len(name_item, winsrepl_offset - old_offset);

  return winsrepl_offset;

}

static int

dissect_winsrepl_send_reply(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

          int winsrepl_offset, proto_tree *winsrepl_tree)

{

  proto_tree *rep_tree;

  uint32_t num_names;

  uint32_t i;

  rep_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, -1,

                ett_winsrepl_send_reply, NULL, "WREPL_REPL_SEND_REPLY");

  /* NUM NAMES */

  num_names = tvb_get_ntohl(winsrepl_tvb, winsrepl_offset);

  proto_tree_add_uint(rep_tree, hf_winsrepl_reply_num_names, winsrepl_tvb, winsrepl_offset, 4, num_names);

  winsrepl_offset += 4;

  for (i=0; i < num_names; i++) {

    winsrepl_offset = dissect_winsrepl_wins_name(winsrepl_tvb, pinfo,

                   winsrepl_offset, rep_tree,

                   rep_tree, i);

  }

  return winsrepl_offset;

}

static int

dissect_winsrepl_update(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

      int winsrepl_offset, proto_tree *winsrepl_tree)

{

  winsrepl_offset = dissect_winsrepl_table_reply(winsrepl_tvb, pinfo,

                   winsrepl_offset, winsrepl_tree);

  return winsrepl_offset;

}

static int

dissect_winsrepl_update2(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

       int winsrepl_offset, proto_tree *winsrepl_tree)

{

  winsrepl_offset = dissect_winsrepl_table_reply(winsrepl_tvb, pinfo,

                   winsrepl_offset, winsrepl_tree);

  return winsrepl_offset;

}

static int

dissect_winsrepl_inform(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

      int winsrepl_offset, proto_tree *winsrepl_tree)

{

  winsrepl_offset = dissect_winsrepl_table_reply(winsrepl_tvb, pinfo,

                   winsrepl_offset, winsrepl_tree);

  return winsrepl_offset;

}

static int

dissect_winsrepl_inform2(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

       int winsrepl_offset, proto_tree *winsrepl_tree)

{

  winsrepl_offset = dissect_winsrepl_table_reply(winsrepl_tvb, pinfo,

                   winsrepl_offset, winsrepl_tree);

  return winsrepl_offset;

}

static int

dissect_winsrepl_replication(tvbuff_t *winsrepl_tvb, packet_info *pinfo,

           int winsrepl_offset, proto_item *winsrepl_item, proto_tree *winsrepl_tree)

{

  proto_item *repl_item;

  proto_tree *repl_tree;

  enum wrepl_replication_cmd command;

  repl_tree = proto_tree_add_subtree(winsrepl_tree, winsrepl_tvb, winsrepl_offset, -1,

              ett_winsrepl_replication, &repl_item, "WREPL_REPLICATION");

  /* REPLICATION_CMD */

  command = (enum wrepl_replication_cmd)tvb_get_ntohl(winsrepl_tvb, winsrepl_offset);

  proto_tree_add_uint(repl_tree, hf_winsrepl_replication_command, winsrepl_tvb, winsrepl_offset, 4, command);

  winsrepl_offset += 4;

  switch (command) {

    case WREPL_REPL_TABLE_QUERY:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_REPL_TABLE_QUERY");

      proto_item_append_text(winsrepl_item, ", WREPL_REPL_TABLE_QUERY");

      proto_item_append_text(repl_item, ", WREPL_REPL_TABLE_QUERY");

      winsrepl_offset = dissect_winsrepl_table_query(winsrepl_tvb, pinfo,

                       winsrepl_offset, repl_tree);

      break;

    case WREPL_REPL_TABLE_REPLY:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_REPL_TABLE_REPLY");

      proto_item_append_text(winsrepl_item, ", WREPL_REPL_TABLE_REPLY");

      proto_item_append_text(repl_item, ", WREPL_REPL_TABLE_REPLY");

      winsrepl_offset = dissect_winsrepl_table_reply(winsrepl_tvb, pinfo,

                       winsrepl_offset, repl_tree);

      break;

    case WREPL_REPL_SEND_REQUEST:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_REPL_SEND_REQUEST");

      proto_item_append_text(winsrepl_item, ", WREPL_REPL_SEND_REQUEST");

      proto_item_append_text(repl_item, ", WREPL_REPL_SEND_REQUEST");

      winsrepl_offset = dissect_winsrepl_send_request(winsrepl_tvb, pinfo,

                  winsrepl_offset, repl_tree);

      break;

    case WREPL_REPL_SEND_REPLY:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_REPL_SEND_REPLY");

      proto_item_append_text(winsrepl_item, ", WREPL_REPL_SEND_REPLY");

      proto_item_append_text(repl_item, ", WREPL_REPL_SEND_REPLY");

      winsrepl_offset = dissect_winsrepl_send_reply(winsrepl_tvb, pinfo,

                      winsrepl_offset, repl_tree);

      break;

    case WREPL_REPL_UPDATE:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_REPL_UPDATE");

      proto_item_append_text(winsrepl_item, ", WREPL_REPL_UPDATE");

      proto_item_append_text(repl_item, ", WREPL_REPL_UPDATE");

      winsrepl_offset = dissect_winsrepl_update(winsrepl_tvb, pinfo,

                  winsrepl_offset, repl_tree);

      break;

    case WREPL_REPL_UPDATE2:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_REPL_UPDATE2");

      proto_item_append_text(winsrepl_item, ",WREPL_REPL_UPDATE2");

      proto_item_append_text(repl_item, ",WREPL_REPL_UPDATE2");

      winsrepl_offset = dissect_winsrepl_update2(winsrepl_tvb, pinfo,

                   winsrepl_offset, repl_tree);

      break;

    case WREPL_REPL_INFORM:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_REPL_INFORM");

      proto_item_append_text(winsrepl_item, ", WREPL_REPL_INFORM");

      proto_item_append_text(repl_item, ", WREPL_REPL_INFORM");

      winsrepl_offset = dissect_winsrepl_inform(winsrepl_tvb, pinfo,

                  winsrepl_offset, repl_tree);

      break;

    case WREPL_REPL_INFORM2:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_REPL_INFORM2");

      proto_item_append_text(winsrepl_item, ", WREPL_REPL_INFORM2");

      proto_item_append_text(repl_item, ", WREPL_REPL_INFORM2");

      winsrepl_offset = dissect_winsrepl_inform2(winsrepl_tvb, pinfo,

                   winsrepl_offset, repl_tree);

      break;

  }

  return winsrepl_offset;

}

static int

dissect_winsrepl_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data _U_)

{

  int offset = 0;

  proto_item *winsrepl_item;

  proto_tree *winsrepl_tree;

  enum wrepl_mess_type mess_type;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "WINS-Replication");

  col_clear(pinfo->cinfo, COL_INFO);

  winsrepl_item = proto_tree_add_item(parent_tree, proto_winsrepl, tvb, offset, -1, ENC_NA);

  winsrepl_tree = proto_item_add_subtree(winsrepl_item, ett_winsrepl);

  /* SIZE */

  proto_tree_add_item(winsrepl_tree, hf_winsrepl_size, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  /* OPCODE */

  proto_tree_add_item(winsrepl_tree, hf_winsrepl_opcode, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  /* ASSOC_CTX */

  proto_tree_add_item(winsrepl_tree, hf_winsrepl_assoc_ctx, tvb, offset, 4, ENC_BIG_ENDIAN);

  offset += 4;

  /* MESSAGE_TYPE */

  mess_type = (enum wrepl_mess_type)tvb_get_ntohl(tvb, offset);

  proto_tree_add_uint(winsrepl_tree, hf_winsrepl_mess_type, tvb, offset, 4, mess_type);

  offset += 4;

  switch (mess_type) {

    case WREPL_START_ASSOCIATION:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_START_ASSOCIATION");

      proto_item_append_text(winsrepl_item, ", WREPL_START_ASSOCIATION");

      dissect_winsrepl_start(tvb, pinfo,

              offset, winsrepl_tree);

      break;

    case WREPL_START_ASSOCIATION_REPLY:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_START_ASSOCIATION_REPLY");

      proto_item_append_text(winsrepl_item, ", WREPL_START_ASSOCIATION_REPLY");

      dissect_winsrepl_start(tvb, pinfo,

              offset, winsrepl_tree);

      break;

    case WREPL_STOP_ASSOCIATION:

      col_set_str(pinfo->cinfo, COL_INFO, "WREPL_STOP_ASSOCIATION");

      proto_item_append_text(winsrepl_item, ", WREPL_STOP_ASSOCIATION");

      dissect_winsrepl_stop(tvb, pinfo,

                   offset, winsrepl_tree);

      break;

    case WREPL_REPLICATION:

      dissect_winsrepl_replication(tvb, pinfo,

                    offset, winsrepl_item, winsrepl_tree);

      break;

  }

  return tvb_captured_length(tvb);

}

static unsigned

get_winsrepl_pdu_len(packet_info *pinfo _U_, tvbuff_t *tvb,

                     int offset, void *data _U_)

{

  unsigned pdu_len;

  pdu_len=tvb_get_ntohl(tvb, offset);

  return pdu_len+4;

}

static int

dissect_winsrepl(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data)

{

  tcp_dissect_pdus(tvb, pinfo, parent_tree, winsrepl_reassemble, 4, get_winsrepl_pdu_len, dissect_winsrepl_pdu, data);

  return tvb_captured_length(tvb);

}

void

proto_register_winsrepl(void)

{

  static hf_register_info hf[] = {

    { &hf_winsrepl_size, {

      "Packet Size", "winsrepl.size",

      FT_UINT32, BASE_DEC, NULL, 0x0,

      "WINS Replication Packet Size", HFILL }},

    { &hf_winsrepl_opcode, {

      "Opcode", "winsrepl.opcode",

      FT_UINT32, BASE_HEX, NULL, 0x0,

      "WINS Replication Opcode", HFILL }},

    { &hf_winsrepl_assoc_ctx, {

      "Assoc_Ctx", "winsrepl.assoc_ctx",

      FT_UINT32, BASE_HEX, NULL, 0x0,

      "WINS Replication Assoc_Ctx", HFILL }},

    { &hf_winsrepl_mess_type, {

      "Message_Type", "winsrepl.message_type",

      FT_UINT32, BASE_DEC, VALS(message_type_vals), 0x0,

      "WINS Replication Message_Type", HFILL }},

    { &hf_winsrepl_start_minor_version, {

      "Minor Version", "winsrepl.minor_version",

      FT_UINT16, BASE_DEC, NULL, 0x0,

      "WINS Replication Minor Version", HFILL }},

    { &hf_winsrepl_start_major_version, {

      "Major Version", "winsrepl.major_version",

      FT_UINT16, BASE_DEC, NULL, 0x0,

      "WINS Replication Major Version", HFILL }},

    { &hf_winsrepl_stop_reason, {

      "Reason", "winsrepl.reason",

      FT_UINT32, BASE_HEX, NULL, 0x0,

      "WINS Replication Reason", HFILL }},

    { &hf_winsrepl_replication_command, {

      "Replication Command", "winsrepl.repl_cmd",

      FT_UINT32, BASE_HEX, VALS(replication_cmd_vals), 0x0,

      "WINS Replication Command", HFILL }},

    { &hf_winsrepl_owner_address, {

      "Owner Address", "winsrepl.owner_address",

      FT_IPv4, BASE_NONE, NULL, 0x0,

      "WINS Replication Owner Address", HFILL }},

    { &hf_winsrepl_owner_max_version, {

      "Max Version", "winsrepl.max_version",

      FT_UINT64, BASE_DEC, NULL, 0x0,

      "WINS Replication Max Version", HFILL }},

    { &hf_winsrepl_owner_min_version, {

      "Min Version", "winsrepl.min_version",

      FT_UINT64, BASE_DEC, NULL, 0x0,

      "WINS Replication Min Version", HFILL }},

    { &hf_winsrepl_owner_type, {

      "Owner Type", "winsrepl.owner_type",

      FT_UINT32, BASE_DEC, NULL, 0x0,

      "WINS Replication Owner Type", HFILL }},

    { &hf_winsrepl_table_partner_count, {

      "Partner Count", "winsrepl.partner_count",

      FT_UINT32, BASE_DEC, NULL, 0x0,

      "WINS Replication Partner Count", HFILL }},

    { &hf_winsrepl_table_initiator, {

      "Initiator", "winsrepl.initiator",

      FT_IPv4, BASE_NONE, NULL, 0x0,

      "WINS Replication Initiator", HFILL }},

    { &hf_winsrepl_ip_owner, {

      "IP Owner", "winsrepl.ip_owner",

      FT_IPv4, BASE_NONE, NULL, 0x0,

      "WINS Replication IP Owner", HFILL }},

    { &hf_winsrepl_ip_ip, {

      "IP Address", "winsrepl.ip_address",

      FT_IPv4, BASE_NONE, NULL, 0x0,

      "WINS Replication IP Address", HFILL }},

    { &hf_winsrepl_addr_list_num_ips, {

      "Num IPs", "winsrepl.num_ips",

      FT_UINT32, BASE_DEC, NULL, 0x0,

      "WINS Replication Num IPs", HFILL }},

    { &hf_winsrepl_name_len, {

      "Name Len", "winsrepl.name_len",

      FT_UINT32, BASE_DEC, NULL, 0x0,

      "WINS Replication Name Len", HFILL }},

    { &hf_winsrepl_name_flags, {

      "Name Flags", "winsrepl.name_flags",

      FT_UINT32, BASE_HEX, NULL, 0x0,

      "WINS Replication Name Flags", HFILL }},

    { &hf_winsrepl_name_flags_rectype, {

      "Record Type", "winsrepl.name_flags.rectype",

      FT_UINT32, BASE_HEX, VALS(rectype_vals), 0x00000003,

      "WINS Replication Name Flags Record Type", HFILL }},

    { &hf_winsrepl_name_flags_recstate, {

      "Record State", "winsrepl.name_flags.recstate",

      FT_UINT32, BASE_HEX, VALS(recstate_vals), 0x0000000C,

      "WINS Replication Name Flags Record State", HFILL }},

    { &hf_winsrepl_name_flags_local, {

      "Local", "winsrepl.name_flags.local",

      FT_BOOLEAN, 32, NULL, 0x00000010,

      "WINS Replication Name Flags Local Flag", HFILL }},

    { &hf_winsrepl_name_flags_hosttype, {

      "Host Type", "winsrepl.name_flags.hosttype",

      FT_UINT32, BASE_HEX, VALS(hosttype_vals), 0x00000060,

      "WINS Replication Name Flags Host Type", HFILL }},

    { &hf_winsrepl_name_flags_static, {

      "Static", "winsrepl.name_flags.static",

      FT_BOOLEAN, 32, NULL, 0x00000080,

      "WINS Replication Name Flags Static Flag", HFILL }},

    { &hf_winsrepl_name_group_flag, {

      "Name Group Flag", "winsrepl.name_group_flag",

      FT_UINT32, BASE_HEX, NULL, 0x0,

      "WINS Replication Name Group Flag", HFILL }},

    { &hf_winsrepl_name_version_id, {

      "Name Version Id", "winsrepl.name_version_id",

      FT_UINT64, BASE_DEC, NULL, 0x0,

      "WINS Replication Name Version Id", HFILL }},

    { &hf_winsrepl_name_unknown, {

      "Unknown IP", "winsrepl.unknown",

      FT_IPv4, BASE_NONE, NULL, 0x0,

      "WINS Replication Unknown IP", HFILL }},

    { &hf_winsrepl_reply_num_names, {

      "Num Names", "winsrepl.num_names",

      FT_UINT32, BASE_DEC, NULL, 0x0,

      "WINS Replication Num Names", HFILL }},

  };

  static int *ett[] = {

    &ett_winsrepl,

    &ett_winsrepl_start,

    &ett_winsrepl_stop,

    &ett_winsrepl_replication,

    &ett_winsrepl_owner,

    &ett_winsrepl_table_reply,

    &ett_winsrepl_ip,

    &ett_winsrepl_addr_list,

    &ett_winsrepl_name,

    &ett_winsrepl_send_reply,

    &ett_winsrepl_flags,

  };

  static ei_register_info ei[] = {

    { &ei_winsrepl_name_len, { "winsrepl.name_len.invalid", PI_MALFORMED, PI_ERROR, "Bad name length", EXPFILL }},

  };

  module_t *winsrepl_module;

  expert_module_t* expert_winsrepl;

  proto_winsrepl = proto_register_protocol("WINS (Windows Internet Name Service) Replication",

             "WINS-Replication", "winsrepl");

  proto_register_subtree_array(ett, array_length(ett));

  proto_register_field_array(proto_winsrepl, hf, array_length(hf));

  expert_winsrepl = expert_register_protocol(proto_winsrepl);

  expert_register_field_array(expert_winsrepl, ei, array_length(ei));

  winsrepl_handle = register_dissector("winsrepl", dissect_winsrepl, proto_winsrepl);

  winsrepl_module = prefs_register_protocol(proto_winsrepl, NULL);

  prefs_register_bool_preference(winsrepl_module, "reassemble",

    "Reassemble WINS-Replication messages spanning multiple TCP segments",

    "Whether the WINS-Replication dissector should reassemble messages spanning multiple TCP segments."

    " To use this option, you must also enable \"Allow subdissectors to reassemble TCP streams\" in the TCP protocol settings.",

    &winsrepl_reassemble);

}

void

proto_reg_handoff_winsrepl(void)

{

  dissector_add_uint_with_preference("tcp.port", WINS_REPLICATION_PORT, winsrepl_handle);

}

/*

 * Editor modelines  -  https://www.wireshark.org/tools/modelines.html

 *

 * Local variables:

 * c-basic-offset: 8

 * tab-width: 8

 * indent-tabs-mode: t

 * End:

 *

 * vi: set shiftwidth=8 tabstop=8 noexpandtab:

 * :indentSize=8:tabSize=8:noTabs=false:

 */