/* Packet-rdp.c
 * Routines for Remote Desktop Protocol (RDP) packet dissection
 * Copyright 2010, Graeme Lunt
 *
 * Wireshark - Network traffic analyzer
 * By Gerald Combs <gerald@wireshark.org>
 * Copyright 1998 Gerald Combs
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

/*
 * See: "[MS-RDPBCGR] Remote Desktop Protocol: Basic Connectivity and Graphics Remoting"
 */

#include "config.h"

#include <epan/packet.h>
#include <epan/prefs.h>
#include <epan/conversation.h>
#include <epan/asn1.h>
#include <epan/expert.h>
#include <epan/strutil.h>
#include "packet-tls.h"
#include "packet-t124.h"

#define PNAME  "Remote Desktop Protocol"
#define PSNAME "RDP"
#define PFNAME "rdp"

void proto_register_rdp(void);
void proto_reg_handoff_rdp(void);

static int proto_rdp = -1;

static int ett_rdp = -1;

static int ett_negReq_flags = -1;
static int ett_requestedProtocols = -1;

static int ett_negRsp_flags = -1;
static int ett_selectedProtocol = -1;

static int ett_rdp_SendData = -1;

static int ett_rdp_ClientData = -1;
static int ett_rdp_clientCoreData = -1;
static int ett_rdp_clientSecurityData = -1;
static int ett_rdp_clientNetworkData = -1;
static int ett_rdp_clientClusterData = -1;
static int ett_rdp_clientMonitorData = -1;
static int ett_rdp_clientMonitorDefData = -1;
static int ett_rdp_clientMsgChannelData = -1;
static int ett_rdp_clientMonitorExData = -1;
static int ett_rdp_clientMultiTransportData = -1;
static int ett_rdp_clientUnknownData = -1;
static int ett_rdp_ServerData = -1;
static int ett_rdp_serverCoreData = -1;
static int ett_rdp_serverSecurityData = -1;
static int ett_rdp_serverNetworkData = -1;
static int ett_rdp_serverMsgChannelData = -1;
static int ett_rdp_serverMultiTransportData = -1;
static int ett_rdp_serverUnknownData = -1;
static int ett_rdp_channelIdArray = -1;
static int ett_rdp_securityExchangePDU = -1;
static int ett_rdp_clientInfoPDU = -1;
static int ett_rdp_validClientLicenseData = -1;
static int ett_rdp_shareControlHeader = -1;
static int ett_rdp_pduType = -1;
static int ett_rdp_flags = -1;
static int ett_rdp_compressedType = -1;
static int ett_rdp_mapFlags = -1;
static int ett_rdp_options = -1;
static int ett_rdp_channelDefArray = -1;
static int ett_rdp_channelDef = -1;
static int ett_rdp_channelPDUHeader = -1;
static int ett_rdp_channelFlags = -1;
static int ett_rdp_capabilitySet = -1;

static int ett_rdp_StandardDate = -1;
static int ett_rdp_DaylightDate = -1;
static int ett_rdp_clientTimeZone = -1;

static expert_field ei_rdp_neg_len_invalid = EI_INIT;
static expert_field ei_rdp_not_correlation_info = EI_INIT;

static int hf_rdp_rt_cookie = -1;
static int hf_rdp_neg_type = -1;
static int hf_rdp_negReq_flags = -1;
static int hf_rdp_negReq_flag_restricted_admin_mode_req = -1;
static int hf_rdp_negReq_flag_correlation_info_present = -1;
static int hf_rdp_neg_length = -1;
static int hf_rdp_requestedProtocols = -1;
static int hf_rdp_requestedProtocols_flag_ssl = -1;
static int hf_rdp_requestedProtocols_flag_hybrid = -1;
static int hf_rdp_requestedProtocols_flag_hybrid_ex = -1;
static int hf_rdp_correlationInfo_flags;
static int hf_rdp_correlationId = -1;
static int hf_rdp_correlationInfo_reserved = -1;
static int hf_rdp_negRsp_flags = -1;
static int hf_rdp_negRsp_flag_extended_client_data_supported = -1;
static int hf_rdp_negRsp_flag_dynvc_gfx_protocol_supported = -1;
static int hf_rdp_negRsp_flag_restricted_admin_mode_supported = -1;
static int hf_rdp_selectedProtocol = -1;
static int hf_rdp_selectedProtocol_flag_ssl = -1;
static int hf_rdp_selectedProtocol_flag_hybrid = -1;
static int hf_rdp_selectedProtocol_flag_hybrid_ex = -1;
static int hf_rdp_negFailure_failureCode = -1;

static int hf_rdp_ClientData = -1;
static int hf_rdp_SendData = -1;
static int hf_rdp_clientCoreData = -1;
static int hf_rdp_clientSecurityData = -1;
static int hf_rdp_clientNetworkData = -1;
static int hf_rdp_clientClusterData = -1;
static int hf_rdp_clientMonitorData = -1;
static int hf_rdp_clientMonitorDefData = -1;
static int hf_rdp_clientMsgChannelData = -1;
static int hf_rdp_clientMonitorExData = -1;
static int hf_rdp_clientMultiTransportData = -1;
static int hf_rdp_clientUnknownData = -1;
static int hf_rdp_ServerData = -1;
static int hf_rdp_serverCoreData = -1;
static int hf_rdp_serverSecurityData = -1;
static int hf_rdp_serverNetworkData = -1;
static int hf_rdp_serverMsgChannelData = -1;
static int hf_rdp_serverMultiTransportData = -1;
static int hf_rdp_serverUnknownData = -1;

static int hf_rdp_securityExchangePDU = -1;
static int hf_rdp_clientInfoPDU = -1;
static int hf_rdp_validClientLicenseData = -1;

static int hf_rdp_headerType = -1;
static int hf_rdp_headerLength = -1;
static int hf_rdp_versionMajor = -1;
static int hf_rdp_versionMinor = -1;
static int hf_rdp_desktopWidth = -1;
static int hf_rdp_desktopHeight = -1;
static int hf_rdp_colorDepth = -1;
static int hf_rdp_SASSequence = -1;
static int hf_rdp_keyboardLayout = -1;
static int hf_rdp_clientBuild = -1;
static int hf_rdp_clientName = -1;
static int hf_rdp_keyboardType = -1;
static int hf_rdp_keyboardSubType = -1;
static int hf_rdp_keyboardFunctionKey = -1;
static int hf_rdp_imeFileName = -1;
static int hf_rdp_postBeta2ColorDepth = -1;
static int hf_rdp_clientProductId = -1;
static int hf_rdp_serialNumber = -1;
static int hf_rdp_highColorDepth = -1;
static int hf_rdp_supportedColorDepths = -1;
static int hf_rdp_earlyCapabilityFlags = -1;
static int hf_rdp_clientDigProductId = -1;
static int hf_rdp_connectionType = -1;
static int hf_rdp_pad1octet = -1;
static int hf_rdp_serverSelectedProtocol = -1;

static int hf_rdp_encryptionMethods = -1;
static int hf_rdp_extEncryptionMethods = -1;
static int hf_rdp_cluster_flags = -1;
static int hf_rdp_redirectedSessionId = -1;
static int hf_rdp_msgChannelFlags = -1;
static int hf_rdp_msgChannelId = -1;
static int hf_rdp_monitorFlags = -1;
static int hf_rdp_monitorExFlags = -1;
static int hf_rdp_monitorAttributeSize = -1;
static int hf_rdp_monitorCount = -1;
static int hf_rdp_multiTransportFlags = -1;

static int hf_rdp_monitorDefLeft = -1;
static int hf_rdp_monitorDefTop = -1;
static int hf_rdp_monitorDefRight = -1;
static int hf_rdp_monitorDefBottom = -1;
static int hf_rdp_monitorDefFlags = -1;


static int hf_rdp_encryptionMethod = -1;
static int hf_rdp_encryptionLevel  = -1;
static int hf_rdp_serverRandomLen  = -1;
static int hf_rdp_serverCertLen  = -1;
static int hf_rdp_serverRandom = -1;
static int hf_rdp_serverCertificate = -1;
static int hf_rdp_clientRequestedProtocols = -1;
static int hf_rdp_MCSChannelId = -1;
static int hf_rdp_channelCount = -1;
static int hf_rdp_channelIdArray = -1;
static int hf_rdp_Pad = -1;
static int hf_rdp_length = -1;
static int hf_rdp_encryptedClientRandom = -1;
static int hf_rdp_dataSignature = -1;
static int hf_rdp_fipsLength = -1;
static int hf_rdp_fipsVersion = -1;
static int hf_rdp_padlen = -1;
static int hf_rdp_flags = -1;
static int hf_rdp_flagsPkt = -1;
static int hf_rdp_flagsEncrypt = -1;
static int hf_rdp_flagsResetSeqno = -1;
static int hf_rdp_flagsIgnoreSeqno = -1;
static int hf_rdp_flagsLicenseEncrypt = -1;
static int hf_rdp_flagsSecureChecksum = -1;
static int hf_rdp_flagsFlagsHiValid = -1;
static int hf_rdp_flagsHi = -1;
static int hf_rdp_codePage = -1;
static int hf_rdp_optionFlags = -1;
static int hf_rdp_cbDomain = -1;
static int hf_rdp_cbUserName = -1;
static int hf_rdp_cbPassword = -1;
static int hf_rdp_cbAlternateShell = -1;
static int hf_rdp_cbWorkingDir = -1;
static int hf_rdp_cbClientAddress = -1;
static int hf_rdp_cbClientDir = -1;
static int hf_rdp_cbAutoReconnectLen = -1;
static int hf_rdp_domain = -1;
static int hf_rdp_userName = -1;
static int hf_rdp_password = -1;
static int hf_rdp_alternateShell = -1;
static int hf_rdp_workingDir = -1;
static int hf_rdp_clientAddressFamily = -1;
static int hf_rdp_clientAddress = -1;
static int hf_rdp_clientDir = -1;
static int hf_rdp_clientTimeZone = -1;
static int hf_rdp_clientSessionId = -1;
static int hf_rdp_performanceFlags = -1;
static int hf_rdp_autoReconnectCookie = -1;
static int hf_rdp_reserved1 = -1;
static int hf_rdp_reserved2 = -1;
static int hf_rdp_bMsgType = -1;
static int hf_rdp_bVersion = -1;
static int hf_rdp_wMsgSize = -1;
static int hf_rdp_wBlobType = -1;
static int hf_rdp_wBlobLen = -1;
static int hf_rdp_blobData = -1;
static int hf_rdp_shareControlHeader = -1;
static int hf_rdp_totalLength = -1;
static int hf_rdp_pduType = -1;
static int hf_rdp_pduTypeType = -1;
static int hf_rdp_pduTypeVersionLow = -1;
static int hf_rdp_pduTypeVersionHigh = -1;
static int hf_rdp_pduSource = -1;

static int hf_rdp_shareId = -1;
static int hf_rdp_pad1 = -1;
static int hf_rdp_streamId = -1;
static int hf_rdp_uncompressedLength = -1;
static int hf_rdp_pduType2 = -1;
static int hf_rdp_compressedType = -1;
static int hf_rdp_compressedTypeType = -1;
static int hf_rdp_compressedTypeCompressed = -1;
static int hf_rdp_compressedTypeAtFront = -1;
static int hf_rdp_compressedTypeFlushed = -1;
static int hf_rdp_compressedLength = -1;
static int hf_rdp_wErrorCode = -1;
static int hf_rdp_wStateTransition = -1;
static int hf_rdp_numberEntries = -1;
static int hf_rdp_totalNumberEntries = -1;
static int hf_rdp_mapFlags = -1;
static int hf_rdp_fontMapFirst = -1;
static int hf_rdp_fontMapLast = -1;

/* Control */
static int hf_rdp_action = -1;
static int hf_rdp_grantId = -1;
static int hf_rdp_controlId = -1;

/* Synchronize */
static int hf_rdp_messageType = -1;
static int hf_rdp_targetUser = -1;

/* BitmapCache Persistent List */
static int hf_rdp_numEntriesCache0 = -1;
static int hf_rdp_numEntriesCache1 = -1;
static int hf_rdp_numEntriesCache2 = -1;
static int hf_rdp_numEntriesCache3 = -1;
static int hf_rdp_numEntriesCache4 = -1;
static int hf_rdp_totalEntriesCache0 = -1;
static int hf_rdp_totalEntriesCache1 = -1;
static int hf_rdp_totalEntriesCache2 = -1;
static int hf_rdp_totalEntriesCache3 = -1;
static int hf_rdp_totalEntriesCache4 = -1;
static int hf_rdp_bBitMask = -1;
static int hf_rdp_Pad2 = -1;
static int hf_rdp_Pad3 = -1;

/* BitmapCache Persistent List Entry */
/* static int hf_rdp_Key1 = -1; */
/* static int hf_rdp_Key2 = -1; */

/* FontList */
#if 0
static int hf_rdp_numberFonts = -1;
static int hf_rdp_totalNumFonts = -1;
static int hf_rdp_listFlags = -1;
#endif
static int hf_rdp_entrySize = -1;

/* Confirm Active PDU */
static int hf_rdp_originatorId = -1;
static int hf_rdp_lengthSourceDescriptor = -1;
static int hf_rdp_lengthCombinedCapabilities = -1;
static int hf_rdp_sourceDescriptor = -1;
static int hf_rdp_numberCapabilities = -1;
static int hf_rdp_pad2Octets = -1;
static int hf_rdp_capabilitySet = -1;
static int hf_rdp_capabilitySetType = -1;
static int hf_rdp_lengthCapability = -1;
static int hf_rdp_capabilityData = -1;
static int hf_rdp_sessionId = -1;

/* static int hf_rdp_unknownData = -1; */
static int hf_rdp_notYetImplemented = -1;
static int hf_rdp_encrypted = -1;
/* static int hf_rdp_compressed = -1; */

static int hf_rdp_channelDefArray = -1;
static int hf_rdp_channelDef = -1;
static int hf_rdp_name = -1;
static int hf_rdp_options = -1;
static int hf_rdp_optionsInitialized = -1;
static int hf_rdp_optionsEncryptRDP = -1;
static int hf_rdp_optionsEncryptSC = -1;
static int hf_rdp_optionsEncryptCS = -1;
static int hf_rdp_optionsPriHigh = -1;
static int hf_rdp_optionsPriMed = -1;
static int hf_rdp_optionsPriLow = -1;
static int hf_rdp_optionsCompressRDP = -1;
static int hf_rdp_optionsCompress = -1;
static int hf_rdp_optionsShowProtocol= -1;
static int hf_rdp_optionsRemoteControlPersistent = -1;

static int hf_rdp_channelPDUHeader = -1;
static int hf_rdp_channelFlags = -1;
static int hf_rdp_channelFlagFirst = -1;
static int hf_rdp_channelFlagLast = -1;
static int hf_rdp_channelFlagShowProtocol = -1;
static int hf_rdp_channelFlagSuspend = -1;
static int hf_rdp_channelFlagResume = -1;
static int hf_rdp_channelPacketCompressed = -1;
static int hf_rdp_channelPacketAtFront = -1;
static int hf_rdp_channelPacketFlushed = -1;
static int hf_rdp_channelPacketCompressionType = -1;
static int hf_rdp_virtualChannelData = -1;

static int hf_rdp_wYear = -1;
static int hf_rdp_wMonth = -1;
static int hf_rdp_wDayOfWeek = -1;
static int hf_rdp_wDay = -1;
static int hf_rdp_wHour = -1;
static int hf_rdp_wMinute = -1;
static int hf_rdp_wSecond = -1;
static int hf_rdp_wMilliseconds = -1;

static int hf_rdp_Bias = -1;
static int hf_rdp_StandardName = -1;
static int hf_rdp_StandardDate = -1;
static int hf_rdp_StandardBias = -1;
static int hf_rdp_DaylightName = -1;
static int hf_rdp_DaylightDate = -1;
static int hf_rdp_DaylightBias = -1;

#define TYPE_RDP_NEG_REQ          0x01
#define TYPE_RDP_NEG_RSP          0x02
#define TYPE_RDP_NEG_FAILURE      0x03
#define TYPE_RDP_CORRELATION_INFO 0x06

static const value_string neg_type_vals[] = {
  { TYPE_RDP_NEG_REQ,          "RDP Negotiation Request" },
  { TYPE_RDP_NEG_RSP,          "RDP Negotiation Response" },
  { TYPE_RDP_NEG_FAILURE,      "RDP Negotiation Failure" },
  { TYPE_RDP_CORRELATION_INFO, "RDP Correlation Info" },
  { 0, NULL }
};

#define RESTRICTED_ADMIN_MODE_REQUIRED 0x01
#define CORRELATION_INFO_PRESENT       0x08

static const value_string failure_code_vals[] = {
  { 0x00000001, "TLS required by server" },
  { 0x00000002, "TLS not allowed by server" },
  { 0x00000003, "TLS certificate not on server" },
  { 0x00000004, "Inconsistent flags" },
  { 0x00000005, "Server requires Enhanced RDP Security with CredSSP" },
  { 0x00000006, "Server requires Enhanced RDP Security with TLS and certificate-based client authentication" },
  { 0, NULL }
};

#define CS_CORE                0xC001
#define CS_SECURITY            0xC002
#define CS_NET                 0xC003
#define CS_CLUSTER             0xC004
#define CS_MONITOR             0xC005
#define CS_MCS_MSGCHANNEL      0xC006
#define CS_MONITOR_EX          0xC008
#define CS_MULTITRANSPORT      0xC00A

#define SC_CORE                0x0C01
#define SC_SECURITY            0x0C02
#define SC_NET                 0x0C03
#define SC_MCS_MSGCHANNEL      0x0C04
#define SC_MULTITRANSPORT      0x0C08

#define SEC_EXCHANGE_PKT       0x0001
#define SEC_ENCRYPT            0x0008
#define SEC_RESET_SEQNO        0x0010
#define SEC_IGNORE_SEQNO       0x0020
#define SEC_INFO_PKT           0x0040
#define SEC_LICENSE_PKT        0x0080
#define SEC_LICENSE_ENCRYPT_CS 0x0200
#define SEC_LICENSE_ENCRYPT_SC 0x0200
#define SEC_REDIRECTION_PKT    0x0400
#define SEC_SECURE_CHECKSUM    0x0800
#define SEC_FLAGSHI_VALID      0x8000

#define SEC_PKT_MASK           0x04c1

#define ENCRYPTION_METHOD_NONE    0x00000000
#define ENCRYPTION_METHOD_40BIT   0x00000001
#define ENCRYPTION_METHOD_128BIT  0x00000002
#define ENCRYPTION_METHOD_56BIT   0x00000008
#define ENCRYPTION_METHOD_FIPS    0x00000010

#define ENCRYPTION_LEVEL_NONE               0x00000000
#define ENCRYPTION_LEVEL_LOW                0x00000001
#define ENCRYPTION_LEVEL_CLIENT_COMPATIBLE  0x00000002
#define ENCRYPTION_LEVEL_HIGH               0x00000003
#define ENCRYPTION_LEVEL_FIPS               0x00000004

/* sent by server */
#define LICENSE_REQUEST             0x01
#define PLATFORM_CHALLENGE          0x02
#define NEW_LICENSE                 0x03
#define UPGRADE_LICENSE             0x04
/* sent by client */
#define LICENSE_INFO                0x12
#define NEW_LICENSE_REQUEST         0x13
#define PLATFORM_CHALLENGE_RESPONSE 0x15
/* sent by either */
#define ERROR_ALERT                 0xff

#define ERR_INVALID_SERVER_CERTIFICIATE 0x00000001
#define ERR_NO_LICENSE                  0x00000002
#define ERR_INVALID_MAC                 0x00000003
#define ERR_INVALID_SCOPE               0x00000004
#define ERR_NO_LICENSE_SERVER           0x00000006
#define STATUS_VALID_CLIENT             0x00000007
#define ERR_INVALID_CLIENT              0x00000008
#define ERR_INVALID_PRODUCTID           0x0000000B
#define ERR_INVALID_MESSAGE_LEN         0x0000000C

#define ST_TOTAL_ABORT                  0x00000001
#define ST_NO_TRANSITION                0x00000002
#define ST_RESET_PHASE_TO_START         0x00000003
#define ST_RESEND_LAST_MESSAGE          0x00000004

#define BB_DATA_BLOB                0x0001
#define BB_RANDOM_BLOB              0x0002
#define BB_CERTIFICATE_BLOB         0x0003
#define BB_ERROR_BLOB               0x0004
#define BB_ENCRYPTED_DATA_BLOB      0x0009
#define BB_KEY_EXCHG_ALG_BLOB       0x000D
#define BB_SCOPE_BLOB               0x000E
#define BB_CLIENT_USER_NAME_BLOB    0x000F
#define BB_CLIENT_MACHINE_NAME_BLOB 0x0010

#define PDUTYPE_TYPE_MASK           0x000F
#define PDUTYPE_VERSIONLOW_MASK     0x00F0
#define PDUTYPE_VERSIONHIGH_MASK    0xFF00

#define PDUTYPE_DEMANDACTIVEPDU     0x1
#define PDUTYPE_CONFIRMACTIVEPDU    0x3
#define PDUTYPE_DEACTIVATEALLPDU    0x6
#define PDUTYPE_DATAPDU             0x7
#define PDUTYPE_SERVER_REDIR_PKT    0xA

#define TS_PROTOCOL_VERSION         0x1

#define PDUTYPE2_UPDATE                      0x02
#define PDUTYPE2_CONTROL                     0x14
#define PDUTYPE2_POINTER                     0x1B
#define PDUTYPE2_INPUT                       0x1C
#define PDUTYPE2_SYNCHRONIZE                 0x1F
#define PDUTYPE2_REFRESH_RECT                0x21
#define PDUTYPE2_PLAY_SOUND                  0x22
#define PDUTYPE2_SUPPRESS_OUTPUT             0x23
#define PDUTYPE2_SHUTDOWN_REQUEST            0x24
#define PDUTYPE2_SHUTDOWN_DENIED             0x25
#define PDUTYPE2_SAVE_SESSION_INFO           0x26
#define PDUTYPE2_FONTLIST                    0x27
#define PDUTYPE2_FONTMAP                     0x28
#define PDUTYPE2_SET_KEYBOARD_INDICATORS     0x29
#define PDUTYPE2_BITMAPCACHE_PERSISTENT_LIST 0x2B
#define PDUTYPE2_BITMAPCACHE_ERROR_PDU       0x2C
#define PDUTYPE2_SET_KEYBOARD_IME_STATUS     0x2D
#define PDUTYPE2_OFFSCRCACHE_ERROR_PDU       0x2E
#define PDUTYPE2_SET_ERROR_INFO_PDU          0x2F
#define PDUTYPE2_DRAWNINEGRID_ERROR_PDU      0x30
#define PDUTYPE2_DRAWGDIPLUS_ERROR_PDU       0x31
#define PDUTYPE2_ARC_STATUS_PDU              0x32
#define PDUTYPE2_STATUS_INFO_PDU             0x36
#define PDUTYPE2_MONITOR_LAYOUT_PDU          0x37

#define PACKET_COMPRESSED                    0x20
#define PACKET_AT_FRONT                      0x40
#define PACKET_FLUSHED                       0x80

#define PacketCompressionTypeMask            0x0f
#define PACKET_COMPR_TYPE_8K                 0x0
#define PACKET_COMPR_TYPE_64K                0x1
#define PACKET_COMPR_TYPE_RDP6               0x2
#define PACKET_COMPR_TYPE_RDP61              0x3


#define CHANNEL_FLAG_FIRST                   0x00000001
#define CHANNEL_FLAG_LAST                    0x00000002
#define CHANNEL_FLAG_SHOW_PROTOCOL           0x00000010
#define CHANNEL_FLAG_SUSPEND                 0x00000020
#define CHANNEL_FLAG_RESUME                  0x00000040
#define CHANNEL_PACKET_COMPRESSED            0x00200000
#define CHANNEL_PACKET_AT_FRONT              0x00400000
#define CHANNEL_PACKET_FLUSHED               0x00800000

#define ChannelCompressionTypeMask           0x000f0000
#define CHANNEL_COMPR_TYPE_8K                0x00000000
#define CHANNEL_COMPR_TYPE_64K               0x00010000
#define CHANNEL_COMPR_TYPE_RDP6              0x00020000
#define CHANNEL_COMPR_TYPE_RDP61             0x00030000

#define MapFlagsMask                         0xffff
#define FONTMAP_FIRST                        0x0001
#define FONTMAP_LAST                         0x0002
/* There may well be others */

#define CTRLACTION_REQUEST_CONTROL           0x0001
#define CTRLACTION_GRANTED_CONTROL           0x0002
#define CTRLACTION_DETACH                    0x0003
#define CTRLACTION_COOPERATE                 0x0004

#define CAPSTYPE_GENERAL                     0x0001
#define CAPSTYPE_BITMAP                      0x0002
#define CAPSTYPE_ORDER                       0x0003
#define CAPSTYPE_BITMAPCACHE                 0x0004
#define CAPSTYPE_CONTROL                     0x0005
#define CAPSTYPE_ACTIVATION                  0x0007
#define CAPSTYPE_POINTER                     0x0008
#define CAPSTYPE_SHARE                       0x0009
#define CAPSTYPE_COLORCACHE                  0x000A
#define CAPSTYPE_SOUND                       0x000C
#define CAPSTYPE_INPUT                       0x000D
#define CAPSTYPE_FONT                        0x000E
#define CAPSTYPE_BRUSH                       0x000F
#define CAPSTYPE_GLYPHCACHE                  0x0010
#define CAPSTYPE_OFFSCREENCACHE              0x0011
#define CAPSTYPE_BITMAPCACHE_HOSTSUPPORT     0x0012
#define CAPSTYPE_BITMAPCACHE_REV2            0x0013
#define CAPSTYPE_BITMAPCACHE_VIRTUALCHANNEL  0x0014
#define CAPSTYPE_DRAWNINEGRIDCACHE           0x0015
#define CAPSTYPE_DRAWGDIPLUS                 0x0016
#define CAPSTYPE_RAIL                        0x0017
#define CAPSTYPE_WINDOW                      0x0018
#define CAPSTYPE_COMPDESK                    0x0019
#define CAPSTYPE_MULTIFRAGMENTUPDATE         0x001A
#define CAPSTYPE_LARGE_POINTER               0x001B
#define CAPSTYPE_SURFACE_COMMANDS            0x001C
#define CAPSTYPE_BITMAP_CODECS               0x001D


#define CHANNEL_OPTION_INITIALIZED               0x80000000
#define CHANNEL_OPTION_ENCRYPT_RDP               0x40000000
#define CHANNEL_OPTION_ENCRYPT_SC                0x20000000
#define CHANNEL_OPTION_ENCRYPT_CS                0x10000000
#define CHANNEL_OPTION_PRI_HIGH                  0x08000000
#define CHANNEL_OPTION_PRI_MED                   0x04000000
#define CHANNEL_OPTION_PRI_LOW                   0x02000000
#define CHANNEL_OPTION_COMPRESS_RDP              0x00800000
#define CHANNEL_OPTION_COMPRESS                  0x00400000
#define CHANNEL_OPTION_SHOW_PROTOCOL             0x00200000
#define CHANNEL_OPTION_REMOTE_CONTROL_PERSISTENT 0x00100000

#define MAX_CHANNELS                         31

typedef struct rdp_conv_info_t {
  guint32 staticChannelId;
  guint32 encryptionMethod;
  guint32 encryptionLevel;
  guint32 licenseAgreed;
  guint8  maxChannels;
  value_string channels[MAX_CHANNELS+1]; /* we may need to hold more information later */
} rdp_conv_info_t;

#define RDP_FI_NONE          0x00
#define RDP_FI_OPTIONAL      0x01
#define RDP_FI_STRING        0x02
#define RDP_FI_UNICODE       0x04 /* field is always Unicode (UTF-16) */
#define RDP_FI_ANSI          0x08 /* field is always ANSI (code page) */
#define RDP_FI_NOINCOFFSET   0x10 /* do not increase the offset */
#define RDP_FI_SUBTREE       0x20
#define RDP_FI_INFO_FLAGS    0x40

typedef struct rdp_field_info_t {
  const int *pfield;
  gint32   fixedLength;
  guint32 *variableLength;
  int      offsetOrTree;
  guint32  flags;
  const struct rdp_field_info_t *subfields;
} rdp_field_info_t;

#define FI_FIXEDLEN(_hf_, _len_) { _hf_, _len_, NULL, 0, 0, NULL }
#define FI_FIXEDLEN_ANSI_STRING(_hf_, _len_) { _hf_, _len_, NULL, 0, RDP_FI_STRING|RDP_FI_ANSI, NULL }
#define FI_VALUE(_hf_, _len_, _value_) { _hf_, _len_, &_value_, 0, 0, NULL }
#define FI_VARLEN(_hf, _length_) { _hf_, 0, &_length_, 0, 0, NULL }
#define FI_SUBTREE(_hf_, _len_, _ett_, _sf_) { _hf_, _len_, NULL, _ett_, RDP_FI_SUBTREE, _sf_ }
#define FI_TERMINATOR {NULL, 0, NULL, 0, 0, NULL}

static const value_string rdp_headerType_vals[] = {
  { CS_CORE,           "clientCoreData" },
  { CS_SECURITY,       "clientSecurityData" },
  { CS_NET,            "clientNetworkData" },
  { CS_CLUSTER,        "clientClusterData" },
  { CS_MONITOR,        "clientMonitorData" },
  { CS_MCS_MSGCHANNEL, "clientMsgChannelData" },
  { CS_MONITOR_EX,     "clientMonitorExData" },
  { CS_MULTITRANSPORT, "clientMultiTransportData" },
  { SC_CORE,           "serverCoreData" },
  { SC_SECURITY,       "serverSecurityData" },
  { SC_NET,            "serverNetworkData" },
  { SC_MCS_MSGCHANNEL, "serverMsgChannelData" },
  { SC_MULTITRANSPORT, "serverMultiTransportData" },
  { 0, NULL }
};

static const value_string rdp_colorDepth_vals[] = {
  { 0xCA00, "4 bits-per-pixel (bpp)"},
  { 0xCA01, "8 bits-per-pixel (bpp)"},
  { 0xCA02, "15-bit 555 RGB mask"},
  { 0xCA03, "16-bit 565 RGB mask"},
  { 0xCA04, "24-bit RGB mask"},
  { 0, NULL }
};

static const value_string rdp_highColorDepth_vals[] = {
  { 0x0004, "4 bits-per-pixel (bpp)"},
  { 0x0008, "8 bits-per-pixel (bpp)"},
  { 0x000F, "15-bit 555 RGB mask"},
  { 0x0010, "16-bit 565 RGB mask"},
  { 0x0018, "24-bit RGB mask"},
  { 0, NULL }
};


static const value_string rdp_keyboardType_vals[] = {
  {   1, "IBM PC/XT or compatible (83-key) keyboard" },
  {   2, "Olivetti \"ICO\" (102-key) keyboard" },
  {   3, "IBM PC/AT (84-key) and similar keyboards" },
  {   4, "IBM enhanced (101-key or 102-key) keyboard" },
  {   5, "Noki 1050 and similar keyboards" },
  {   6, "Nokia 9140 and similar keyboards" },
  {   7, "Japanese keyboard" },
  {   0, NULL }
};

static const value_string rdp_connectionType_vals[] = {
  {   1, "Modem (56 Kbps)" },
  {   2, "Low-speed broadband (256 Kbps - 2Mbps)" },
  {   3, "Satellite (2 Mbps - 16Mbps with high latency)" },
  {   4, "High-speed broadband (2 Mbps - 10Mbps)" },
  {   5, "WAN (10 Mbps or higher with high latency)" },
  {   6, "LAN (10 Mbps or higher)" },
  {   7, "Auto Detect" },
  {   0, NULL},
};

static const value_string rdp_requestedProtocols_vals[] = {
  {   0, "Standard RDP Security" },
  {   1, "TLS 1.0" },
  {   2, "Credential Security Support Provider protocol (CredSSP)" },
  {   3, "Credential Security Support Provider protocol (CredSSP)" },
  {   0, NULL},
};

static const value_string rdp_flagsPkt_vals[] = {
  {0,                   "(None)" },
  {SEC_EXCHANGE_PKT,    "Security Exchange PDU" },
  {SEC_INFO_PKT,        "Client Info PDU" },
  {SEC_LICENSE_PKT,     "Licensing PDU" },
  {SEC_REDIRECTION_PKT, "Standard Security Server Redirection PDU"},
  {0, NULL},
};

static const value_string rdp_encryptionMethod_vals[] = {
  { ENCRYPTION_METHOD_NONE,   "None" },
  { ENCRYPTION_METHOD_40BIT,  "40-bit RC4" },
  { ENCRYPTION_METHOD_128BIT, "128-bit RC4" },
  { ENCRYPTION_METHOD_56BIT,  "56-bit RC4" },
  { ENCRYPTION_METHOD_FIPS,   "FIPS140-1 3DES" },
  { 0, NULL},
};

static const value_string rdp_encryptionLevel_vals[] = {
  { ENCRYPTION_LEVEL_NONE,              "None" },
  { ENCRYPTION_LEVEL_LOW,               "Low" },
  { ENCRYPTION_LEVEL_CLIENT_COMPATIBLE, "Client Compatible" },
  { ENCRYPTION_LEVEL_HIGH,              "High" },
  { ENCRYPTION_LEVEL_FIPS,              "FIPS140-1" },
  { 0, NULL},
};

static const value_string rdp_bMsgType_vals[] = {
  { LICENSE_REQUEST,             "License Request" },
  { PLATFORM_CHALLENGE,          "Platform Challenge" },
  { NEW_LICENSE,                 "New License" },
  { UPGRADE_LICENSE,             "Upgrade License" },
  { LICENSE_INFO,                "License Info" },
  { NEW_LICENSE_REQUEST,         "New License Request" },
  { PLATFORM_CHALLENGE_RESPONSE, "Platform Challenge Response" },
  { ERROR_ALERT,                 "Error Alert" },
  { 0, NULL},
};

static const value_string rdp_wErrorCode_vals[] = {
  { ERR_INVALID_SERVER_CERTIFICIATE, "Invalid Server Certificate" },
  { ERR_NO_LICENSE,                  "No License" },
  { ERR_INVALID_MAC,                 "Invalid MAC" },
  { ERR_INVALID_SCOPE,               "Invalid Scope" },
  { ERR_NO_LICENSE_SERVER,           "No License Server" },
  { STATUS_VALID_CLIENT,             "Valid Client" },
  { ERR_INVALID_CLIENT,              "Invalid Client" },
  { ERR_INVALID_PRODUCTID,           "Invalid Product Id" },
  { ERR_INVALID_MESSAGE_LEN,         "Invalid Message Length" },
  { 0, NULL},
};

static const value_string rdp_wStateTransition_vals[] = {
  { ST_TOTAL_ABORT,              "Total Abort" },
  { ST_NO_TRANSITION,            "No Transition" },
  { ST_RESET_PHASE_TO_START,     "Reset Phase to Start" },
  { ST_RESEND_LAST_MESSAGE,      "Resend Last Message" },
  { 0, NULL},
};

static const value_string rdp_wBlobType_vals[] = {
  { BB_DATA_BLOB,                "Data" },
  { BB_RANDOM_BLOB,              "Random" },
  { BB_CERTIFICATE_BLOB,         "Certificate" },
  { BB_ERROR_BLOB,               "Error" },
  { BB_ENCRYPTED_DATA_BLOB,      "Encrypted Data" },
  { BB_KEY_EXCHG_ALG_BLOB,       "Key Exchange Algorithm" },
  { BB_SCOPE_BLOB,               "Scope" },
  { BB_CLIENT_USER_NAME_BLOB,    "Client User Name" },
  { BB_CLIENT_MACHINE_NAME_BLOB, "Client Machine Name" },
  { 0, NULL},
};

static const value_string rdp_pduTypeType_vals[] = {
  { PDUTYPE_DEMANDACTIVEPDU,  "Demand Active PDU" },
  { PDUTYPE_CONFIRMACTIVEPDU, "Confirm Active PDU" },
  { PDUTYPE_DEACTIVATEALLPDU, "Deactivate All PDU" },
  { PDUTYPE_DATAPDU,          "Data PDU" },
  { PDUTYPE_SERVER_REDIR_PKT, "Server Redirection PDU" },
  { 0, NULL},
};

static const value_string rdp_pduType2_vals[] = {
  { PDUTYPE2_UPDATE,                      "Update"},
  { PDUTYPE2_CONTROL,                     "Control"},
  { PDUTYPE2_POINTER,                     "Pointer"},
  { PDUTYPE2_INPUT,                       "Input"},
  { PDUTYPE2_SYNCHRONIZE,                 "Synchronize"},
  { PDUTYPE2_REFRESH_RECT,                "Refresh Rect"},
  { PDUTYPE2_PLAY_SOUND,                  "Play Sound"},
  { PDUTYPE2_SUPPRESS_OUTPUT,             "Suppress Output"},
  { PDUTYPE2_SHUTDOWN_REQUEST,            "Shutdown Request" },
  { PDUTYPE2_SHUTDOWN_DENIED,             "Shutdown Denied" },
  { PDUTYPE2_SAVE_SESSION_INFO,           "Save Session Info" },
  { PDUTYPE2_FONTLIST,                    "FontList" },
  { PDUTYPE2_FONTMAP,                     "FontMap" },
  { PDUTYPE2_SET_KEYBOARD_INDICATORS,     "Set Keyboard Indicators" },
  { PDUTYPE2_BITMAPCACHE_PERSISTENT_LIST, "BitmapCache Persistent List" },
  { PDUTYPE2_BITMAPCACHE_ERROR_PDU,       "BitmapCache Error" },
  { PDUTYPE2_SET_KEYBOARD_IME_STATUS,     "Set Keyboard IME Status" },
  { PDUTYPE2_OFFSCRCACHE_ERROR_PDU,       "OffScrCache Error" },
  { PDUTYPE2_SET_ERROR_INFO_PDU,          "Set Error Info" },
  { PDUTYPE2_DRAWNINEGRID_ERROR_PDU,      "DrawNineGrid Error" },
  { PDUTYPE2_DRAWGDIPLUS_ERROR_PDU,       "DrawGDIPlus Error" },
  { PDUTYPE2_ARC_STATUS_PDU,              "Arc Status" },
  { PDUTYPE2_STATUS_INFO_PDU,             "Status Info" },
  { PDUTYPE2_MONITOR_LAYOUT_PDU,          "Monitor Layout" },
  { 0, NULL},
};

static const value_string rdp_compressionType_vals[] = {
  { PACKET_COMPR_TYPE_8K,     "RDP 4.0 bulk compression" },
  { PACKET_COMPR_TYPE_64K,    "RDP 5.0 bulk compression" },
  { PACKET_COMPR_TYPE_RDP6,   "RDP 6.0 bulk compression" },
  { PACKET_COMPR_TYPE_RDP61,  "RDP 6.1 bulk compression" },
  { 0, NULL},
};

static const value_string rdp_channelCompressionType_vals[] = {
  { CHANNEL_COMPR_TYPE_8K,     "RDP 4.0 bulk compression" },
  { CHANNEL_COMPR_TYPE_64K,    "RDP 5.0 bulk compression" },
  { CHANNEL_COMPR_TYPE_RDP6,   "RDP 6.0 bulk compression" },
  { CHANNEL_COMPR_TYPE_RDP61,  "RDP 6.1 bulk compression" },
  { 0, NULL},
};

static const value_string rdp_action_vals[] = {
  { CTRLACTION_REQUEST_CONTROL, "Request control" },
  { CTRLACTION_GRANTED_CONTROL, "Granted control" },
  { CTRLACTION_DETACH,          "Detach" },
  { CTRLACTION_COOPERATE,       "Cooperate" },
  {0, NULL },
};

static const value_string rdp_capabilityType_vals[] = {
  { CAPSTYPE_GENERAL,                    "General" },
  { CAPSTYPE_BITMAP,                     "Bitmap" },
  { CAPSTYPE_ORDER,                      "Order" },
  { CAPSTYPE_BITMAPCACHE,                "Bitmap Cache" },
  { CAPSTYPE_CONTROL,                    "Control" },
  { CAPSTYPE_ACTIVATION,                 "Activation" },
  { CAPSTYPE_POINTER,                    "Pointer" },
  { CAPSTYPE_SHARE,                      "Share" },
  { CAPSTYPE_COLORCACHE,                 "Color Cache" },
  { CAPSTYPE_SOUND,                      "Sound" },
  { CAPSTYPE_INPUT,                      "Input" },
  { CAPSTYPE_FONT,                       "Font" },
  { CAPSTYPE_BRUSH,                      "Brush" },
  { CAPSTYPE_GLYPHCACHE,                 "Glyph Cache" },
  { CAPSTYPE_OFFSCREENCACHE,             "Off-screen Cache" },
  { CAPSTYPE_BITMAPCACHE_HOSTSUPPORT,    "Bitmap Cache Host Support" },
  { CAPSTYPE_BITMAPCACHE_REV2,           "Bitmap Cache Rev 2" },
  { CAPSTYPE_BITMAPCACHE_VIRTUALCHANNEL, "Virtual Channel"},
  { CAPSTYPE_DRAWNINEGRIDCACHE,          "Draw Nine Grid Cache" },
  { CAPSTYPE_DRAWGDIPLUS,                "Draw GDI Plus" },
  { CAPSTYPE_RAIL,                       "Rail" },
  { CAPSTYPE_WINDOW,                     "Window" },
  { CAPSTYPE_COMPDESK,                   "Comp Desk" },
  { CAPSTYPE_MULTIFRAGMENTUPDATE,        "Multi-Fragment Update" },
  { CAPSTYPE_LARGE_POINTER,              "Large Pointer" },
  { CAPSTYPE_SURFACE_COMMANDS,           "Surface Commands" },
  { CAPSTYPE_BITMAP_CODECS,              "Bitmap Codecs" },
  {0, NULL },
};

static const value_string rdp_monitorDefFlags_vals[] = {
  { 0, "None" },
  { 1, "Primary" },
  {0, NULL },
};

static const value_string rdp_wDayOfWeek_vals[] = {
  { 0, "Sunday" },
  { 1, "Monday" },
  { 2, "Tuesday" },
  { 3, "Wednesday" },
  { 4, "Thursday" },
  { 5, "Friday" },
  { 6, "Saturday" },
  {0, NULL },
};

static const value_string rdp_wDay_vals[] = {
  { 1, "First occurrence" },
  { 2, "Second occurrence" },
  { 3, "Third occurrence" },
  { 4, "Fourth occurrence" },
  { 5, "Last occurrence" },
  {0, NULL },
};

static const value_string rdp_wMonth_vals[] = {
  {  1, "January" },
  {  2, "February" },
  {  3, "March" },
  {  4, "April" },
  {  5, "May" },
  {  6, "June" },
  {  7, "July" },
  {  8, "August" },
  {  9, "September" },
  { 10, "October" },
  { 11, "November" },
  { 12, "December" },
  {0, NULL },
};

/*
 * Flags in the flags field of a TS_INFO_PACKET.
 * XXX - define more, and show them underneath that field.
 */
#define INFO_UNICODE  0x00000010

static rdp_conv_info_t *
rdp_get_conversation_data(packet_info *pinfo)
{
  conversation_t  *conversation;
  rdp_conv_info_t *rdp_info;

  conversation = find_or_create_conversation(pinfo);

  rdp_info = (rdp_conv_info_t *)conversation_get_proto_data(conversation, proto_rdp);

  if (rdp_info == NULL) {
    rdp_info = wmem_new0(wmem_file_scope(), rdp_conv_info_t);
    rdp_info->staticChannelId  = -1;
    rdp_info->encryptionMethod = 0;
    rdp_info->encryptionLevel  = 0;
    rdp_info->licenseAgreed    = 0;
    rdp_info->maxChannels      = 0;

    conversation_add_proto_data(conversation, proto_rdp, rdp_info);
  }

  return rdp_info;
}


static int
dissect_rdp_fields(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, const rdp_field_info_t *fields, int totlen)
{
  const rdp_field_info_t *c;
  gint              len;
  int               base_offset = offset;
  guint32           info_flags = 0;
  guint             encoding;

  while (((c = fields++)->pfield) != NULL) {
    if ((c->fixedLength == 0) && (c->variableLength)) {
      len = *(c->variableLength);
    } else {
      len = c->fixedLength;

      if ((c->variableLength) && (c->fixedLength <= 4)) {
        switch (c->fixedLength) {
        case 1:
          *(c->variableLength) = tvb_get_guint8(tvb, offset);
          break;
        case 2:
          *(c->variableLength) = tvb_get_letohs(tvb, offset);
          break;
        case 4:
          *(c->variableLength) = tvb_get_letohl(tvb, offset);
          break;
        default:
          REPORT_DISSECTOR_BUG("Invalid length");
        }

        *(c->variableLength) += c->offsetOrTree; /* XXX: ??? */
      }
    }

    if (len) {
      proto_item *pi;
      if (c->flags & RDP_FI_STRING) {
        /* If this is always Unicode, or if the INFO_UNICODE flag is set,
           treat this as UTF-16; otherwise, treat it as "ANSI". */
        if (c->flags & RDP_FI_UNICODE)
          encoding = ENC_UTF_16|ENC_LITTLE_ENDIAN;
        else if (c->flags & RDP_FI_ANSI)
          encoding = ENC_ASCII|ENC_NA;  /* XXX - code page */
        else {
          /* Could be Unicode, could be ANSI, based on INFO_UNICODE flag */
          encoding = (info_flags & INFO_UNICODE) ? ENC_UTF_16|ENC_LITTLE_ENDIAN : ENC_ASCII|ENC_NA;  /* XXX - code page */
        }
      } else
        encoding = ENC_LITTLE_ENDIAN;

      pi = proto_tree_add_item(tree, *c->pfield, tvb, offset, len, encoding);

      if (c->flags & RDP_FI_INFO_FLAGS) {
        /* TS_INFO_PACKET flags field; save it for later use */
        DISSECTOR_ASSERT(len == 4);
        info_flags = tvb_get_letohl(tvb, offset);
      }

      if (c->flags & RDP_FI_SUBTREE) {
        proto_tree *next_tree;
        if (c->offsetOrTree != -1)
          next_tree = proto_item_add_subtree(pi, c->offsetOrTree);
        else
          REPORT_DISSECTOR_BUG("Tree Error!!");

        if (c->subfields)
          dissect_rdp_fields(tvb, offset, pinfo, next_tree, c->subfields, 0);
      }

      if (!(c->flags & RDP_FI_NOINCOFFSET))
        offset += len;
    }

    if ((totlen > 0) && ((offset-base_offset) >= totlen))
      break;  /* we're done: skip optional fields */
              /* XXX: err if > totlen ??          */
  }

  return offset;
}

static int
dissect_rdp_nyi(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, const char *info)
{
  rdp_field_info_t nyi_fields[] = {
    {&hf_rdp_notYetImplemented,      -1, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  offset = dissect_rdp_fields(tvb, offset, pinfo, tree, nyi_fields, 0);

  if ((tree != NULL) && (info != NULL))
    proto_item_append_text(tree->last_child, " (%s)", info);

  return offset;
}

static int
dissect_rdp_encrypted(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, const char *info)
{
  rdp_field_info_t enc_fields[] = {
    {&hf_rdp_encrypted,      -1, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  offset = dissect_rdp_fields(tvb, offset,pinfo, tree, enc_fields, 0);

  if ((tree != NULL) && (info != NULL))
    proto_item_append_text(tree->last_child, " (%s)", info);

  col_append_sep_str(pinfo->cinfo, COL_INFO, ", ", "[Encrypted]");

  return offset;
}


static int
dissect_rdp_clientNetworkData(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, guint length, rdp_conv_info_t *rdp_info)
{
  proto_tree *next_tree;
  proto_item *pi;
  guint32     channelCount = 0;

  rdp_field_info_t net_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    FI_VALUE(&hf_rdp_channelCount, 4, channelCount),
    FI_TERMINATOR
  };
  rdp_field_info_t option_fields[] = {
    {&hf_rdp_optionsInitialized,  4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsEncryptRDP,   4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsEncryptSC,    4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsEncryptCS,    4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsPriHigh,      4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsPriMed,       4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsPriLow,       4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsCompressRDP,  4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsCompress,     4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsShowProtocol, 4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_optionsRemoteControlPersistent, 4, NULL, 0, 0, NULL },
    FI_TERMINATOR,
  };
  rdp_field_info_t channel_fields[] = {
    FI_FIXEDLEN_ANSI_STRING(&hf_rdp_name, 8),
    FI_SUBTREE(&hf_rdp_options, 4, ett_rdp_options, option_fields),
    FI_TERMINATOR
  };
  rdp_field_info_t def_fields[] = {
    FI_SUBTREE(&hf_rdp_channelDef, 12, ett_rdp_channelDef, channel_fields),
    FI_TERMINATOR
  };

  pi        = proto_tree_add_item(tree, hf_rdp_clientNetworkData, tvb, offset, length, ENC_NA);
  next_tree = proto_item_add_subtree(pi, ett_rdp_clientNetworkData);

  offset = dissect_rdp_fields(tvb, offset, pinfo, next_tree, net_fields, 0);

  if (channelCount > 0) {
    guint i;
    pi        = proto_tree_add_item(next_tree, hf_rdp_channelDefArray, tvb, offset, channelCount * 12, ENC_NA);
    next_tree = proto_item_add_subtree(pi, ett_rdp_channelDefArray);

    if (rdp_info)
      rdp_info->maxChannels = MIN(channelCount, MAX_CHANNELS);

    for (i = 0; i < MIN(channelCount, MAX_CHANNELS); i++) {
      if (rdp_info) {
        rdp_info->channels[i].value = -1; /* unset */
        rdp_info->channels[i].strptr = tvb_get_string_enc(wmem_packet_scope(), tvb, offset, 8, ENC_ASCII);
      }
      offset = dissect_rdp_fields(tvb, offset, pinfo, next_tree, def_fields, 0);
    }

    if (rdp_info) {
      /* value_strings are normally terminated with a {0, NULL} entry */
      rdp_info->channels[i].value  = 0;
      rdp_info->channels[i].strptr = NULL;
    }
  }

  return offset;
}

static int
dissect_rdp_basicSecurityHeader(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, guint32 *flags_ptr) {

  guint32 flags = 0;

  rdp_field_info_t secFlags_fields[] = {
    {&hf_rdp_flagsPkt,           2, &flags, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsEncrypt,       2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsResetSeqno,    2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsIgnoreSeqno,   2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsLicenseEncrypt,2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsSecureChecksum,2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsFlagsHiValid,  2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    FI_TERMINATOR
  };

  rdp_field_info_t flags_fields[] = {
    FI_SUBTREE(&hf_rdp_flags, 2, ett_rdp_flags, secFlags_fields),
    FI_FIXEDLEN(&hf_rdp_flagsHi, 2),
    FI_TERMINATOR
  };

  offset = dissect_rdp_fields(tvb, offset, pinfo, tree, flags_fields, 0);

  if (flags_ptr)
    *flags_ptr = flags;

  return offset;
}


static int
dissect_rdp_securityHeader(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, rdp_conv_info_t *rdp_info, gboolean alwaysBasic, guint32 *flags_ptr) {

  rdp_field_info_t fips_fields[] = {
    {&hf_rdp_fipsLength,        2, NULL, 0, 0, NULL },
    {&hf_rdp_fipsVersion,       1, NULL, 0, 0, NULL },
    {&hf_rdp_padlen,            1, NULL, 0, 0, NULL },
    {&hf_rdp_dataSignature,     8, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t enc_fields[] = {
    {&hf_rdp_dataSignature,     8, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  const rdp_field_info_t *fields = NULL;

  if (rdp_info) {

    if (alwaysBasic || (rdp_info->encryptionLevel != ENCRYPTION_LEVEL_NONE))
      offset = dissect_rdp_basicSecurityHeader(tvb, offset, pinfo, tree, flags_ptr);

    if (rdp_info->encryptionMethod &
       (ENCRYPTION_METHOD_40BIT  |
        ENCRYPTION_METHOD_128BIT |
        ENCRYPTION_METHOD_56BIT)) {
      fields = enc_fields;
    } else if (rdp_info->encryptionMethod == ENCRYPTION_METHOD_FIPS) {
      fields = fips_fields;
    }

    if (fields)
      offset = dissect_rdp_fields(tvb, offset, pinfo, tree, fields, 0);
  }
  return offset;
}
static int
dissect_rdp_channelPDU(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {

  guint32 length = 0;

  rdp_field_info_t flag_fields[] = {
    {&hf_rdp_channelFlagFirst,        4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_channelFlagLast,         4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_channelFlagShowProtocol, 4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_channelFlagSuspend,      4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_channelFlagResume,       4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_channelPacketCompressed, 4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_channelPacketAtFront,    4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_channelPacketFlushed,    4, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_channelPacketCompressionType,  4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  rdp_field_info_t channel_fields[] =   {
    FI_VALUE(&hf_rdp_length, 4, length),
    FI_SUBTREE(&hf_rdp_channelFlags, 4, ett_rdp_channelFlags, flag_fields),
    FI_TERMINATOR
  };

  rdp_field_info_t channelPDU_fields[] =   {
    FI_SUBTREE(&hf_rdp_channelPDUHeader, 8, ett_rdp_channelPDUHeader, channel_fields),
    FI_FIXEDLEN(&hf_rdp_virtualChannelData, -1),
    FI_TERMINATOR
  };

  /* length is the uncompressed length, and the PDU may be compressed */
  offset = dissect_rdp_fields(tvb, offset, pinfo, tree, channelPDU_fields, 0);

  return offset;
}

static int
dissect_rdp_shareDataHeader(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {
  guint32 pduType2 = 0;
  guint32 compressedType;
  guint32 action = 0;

  rdp_field_info_t compressed_fields[] =   {
    {&hf_rdp_compressedTypeType, 1, &compressedType, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_compressedTypeCompressed, 1, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_compressedTypeAtFront,    1, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_compressedTypeFlushed,    1, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t share_fields[] =   {
    {&hf_rdp_shareId,            4, NULL, 0, 0, NULL },
    {&hf_rdp_pad1,               1, NULL, 0, 0, NULL },
    {&hf_rdp_streamId,           1, NULL, 0, 0, NULL },
    {&hf_rdp_uncompressedLength, 2, NULL, 0, 0, NULL },
    {&hf_rdp_pduType2,           1, &pduType2, 0, 0, NULL },
    FI_SUBTREE(&hf_rdp_compressedType, 1, ett_rdp_compressedType, compressed_fields),
    {&hf_rdp_compressedLength,   2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t control_fields[] = {
    {&hf_rdp_action,             2, &action, 0, 0, NULL },
    {&hf_rdp_grantId,            2, NULL, 0, 0, NULL },
    {&hf_rdp_controlId,          4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t sync_fields[] = {
    {&hf_rdp_messageType,        2, NULL, 0, 0, NULL },
    {&hf_rdp_targetUser,         2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t mapflags_fields[] = {
    {&hf_rdp_fontMapFirst, 2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_fontMapLast, 2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t fontmap_fields[] = {
    {&hf_rdp_numberEntries,      2, NULL, 0, 0, NULL },
    {&hf_rdp_totalNumberEntries, 2, NULL, 0, 0, NULL },
    FI_SUBTREE(&hf_rdp_mapFlags, 2, ett_rdp_mapFlags, mapflags_fields),
    {&hf_rdp_entrySize,          2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t persistent_fields[] = {
    {&hf_rdp_numEntriesCache0,   2, NULL, 0, 0, NULL },
    {&hf_rdp_numEntriesCache1,   2, NULL, 0, 0, NULL },
    {&hf_rdp_numEntriesCache2,   2, NULL, 0, 0, NULL },
    {&hf_rdp_numEntriesCache3,   2, NULL, 0, 0, NULL },
    {&hf_rdp_numEntriesCache4,   2, NULL, 0, 0, NULL },
    {&hf_rdp_totalEntriesCache0, 2, NULL, 0, 0, NULL },
    {&hf_rdp_totalEntriesCache1, 2, NULL, 0, 0, NULL },
    {&hf_rdp_totalEntriesCache2, 2, NULL, 0, 0, NULL },
    {&hf_rdp_totalEntriesCache3, 2, NULL, 0, 0, NULL },
    {&hf_rdp_totalEntriesCache4, 2, NULL, 0, 0, NULL },
    {&hf_rdp_bBitMask,           1, NULL, 0, 0, NULL },
    {&hf_rdp_Pad2,               1, NULL, 0, 0, NULL },
    {&hf_rdp_Pad3,               2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  const rdp_field_info_t *fields;

  offset = dissect_rdp_fields(tvb, offset, pinfo, tree, share_fields, 0);

  col_append_str(pinfo->cinfo, COL_INFO, "RDP PDU Type: ");
  col_append_sep_str(pinfo->cinfo, COL_INFO, "", val_to_str_const(pduType2, rdp_pduType2_vals, "Unknown"));

  fields = NULL;
  switch(pduType2) {
  case PDUTYPE2_UPDATE:
    break;
  case PDUTYPE2_CONTROL:
    fields = control_fields;
    break;
  case PDUTYPE2_POINTER:
    break;
  case PDUTYPE2_INPUT:
    break;
  case PDUTYPE2_SYNCHRONIZE:
    fields = sync_fields;
    break;
  case PDUTYPE2_REFRESH_RECT:
    break;
  case PDUTYPE2_PLAY_SOUND:
    break;
  case PDUTYPE2_SUPPRESS_OUTPUT:
    break;
  case PDUTYPE2_SHUTDOWN_REQUEST:
    break;
  case PDUTYPE2_SHUTDOWN_DENIED:
    break;
  case PDUTYPE2_SAVE_SESSION_INFO:
    break;
  case PDUTYPE2_FONTLIST:
    break;
  case PDUTYPE2_FONTMAP:
    fields = fontmap_fields;
    break;
  case PDUTYPE2_SET_KEYBOARD_INDICATORS:
    break;
  case PDUTYPE2_BITMAPCACHE_PERSISTENT_LIST:
    fields = persistent_fields;
    break;
  case PDUTYPE2_BITMAPCACHE_ERROR_PDU:
    break;
  case PDUTYPE2_SET_KEYBOARD_IME_STATUS:
    break;
  case PDUTYPE2_OFFSCRCACHE_ERROR_PDU:
    break;
  case PDUTYPE2_SET_ERROR_INFO_PDU:
    break;
  case PDUTYPE2_DRAWNINEGRID_ERROR_PDU:
    break;
  case PDUTYPE2_DRAWGDIPLUS_ERROR_PDU:
    break;
  case PDUTYPE2_ARC_STATUS_PDU:
    break;
  case PDUTYPE2_STATUS_INFO_PDU:
    break;
  case PDUTYPE2_MONITOR_LAYOUT_PDU:
    break;
  default:
    break;
  }

  if (fields) {
    offset = dissect_rdp_fields(tvb, offset, pinfo, tree, fields, 0);
  }

  if (pduType2 == PDUTYPE2_CONTROL) {
    col_append_sep_str(pinfo->cinfo, COL_INFO, ", ", "Action: ");
    col_append_sep_str(pinfo->cinfo, COL_INFO, "", val_to_str_const(action, rdp_action_vals, "Unknown"));
  }

  return offset;
}

static int
dissect_rdp_capabilitySets(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree, guint32 numberCapabilities) {
  guint   i;
  guint32 lengthCapability;

  rdp_field_info_t cs_fields[] = {
    {&hf_rdp_capabilitySetType, 2, NULL, 0, 0, NULL },
    {&hf_rdp_lengthCapability, 2, &lengthCapability, -4, 0, NULL },
    {&hf_rdp_capabilityData, 0, &lengthCapability, 0, 0, NULL },
    FI_TERMINATOR
  };

  rdp_field_info_t set_fields[] = {
    FI_SUBTREE(&hf_rdp_capabilitySet, 0, ett_rdp_capabilitySet, cs_fields),
    FI_TERMINATOR
  };

  for (i = 0; i < numberCapabilities; i++) {
    offset = dissect_rdp_fields(tvb, offset, pinfo, tree, set_fields, 0);
  }

  return offset;
}

static int
dissect_rdp_demandActivePDU(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {

  guint32 lengthSourceDescriptor;
  guint32 numberCapabilities = 0;

  rdp_field_info_t fields[] = {
    {&hf_rdp_shareId,                    4, NULL, 0, 0, NULL },
    {&hf_rdp_lengthSourceDescriptor,     2, &lengthSourceDescriptor, 0, 0, NULL },
    {&hf_rdp_lengthCombinedCapabilities, 2, NULL, 0, 0, NULL },
    {&hf_rdp_sourceDescriptor,           0, &lengthSourceDescriptor, 0, RDP_FI_STRING|RDP_FI_ANSI, NULL }, /* XXX - T.128 says this is T.50, which is ISO 646, which is only ASCII in its US form */
    {&hf_rdp_numberCapabilities,         2, &numberCapabilities, 0, 0, NULL },
    {&hf_rdp_pad2Octets,                 2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t final_fields[] = {
    {&hf_rdp_sessionId,                    4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  offset = dissect_rdp_fields(tvb, offset, pinfo, tree, fields, 0);

  offset = dissect_rdp_capabilitySets(tvb, offset, pinfo, tree, numberCapabilities);

  offset = dissect_rdp_fields(tvb, offset, pinfo, tree, final_fields, 0);

  return offset;
}

static int
dissect_rdp_confirmActivePDU(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {

  guint32 lengthSourceDescriptor;
  guint32 numberCapabilities = 0;

  rdp_field_info_t fields[] = {
    {&hf_rdp_shareId,                    4, NULL, 0, 0, NULL },
    {&hf_rdp_originatorId,               2, NULL, 0, 0, NULL },
    {&hf_rdp_lengthSourceDescriptor,     2, &lengthSourceDescriptor, 0, 0, NULL },
    {&hf_rdp_lengthCombinedCapabilities, 2, NULL, 0, 0, NULL },
    {&hf_rdp_sourceDescriptor,           0, &lengthSourceDescriptor, 0, 0, NULL },
    {&hf_rdp_numberCapabilities,         2, &numberCapabilities, 0, 0, NULL },
    {&hf_rdp_pad2Octets,                 2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  offset = dissect_rdp_fields(tvb, offset, pinfo, tree, fields, 0);

  offset = dissect_rdp_capabilitySets(tvb, offset, pinfo, tree, numberCapabilities);

  return offset;
}


static proto_tree *
dissect_rdp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree)
{
  proto_item *item;
  proto_tree *tree;

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "RDP");
  col_clear(pinfo->cinfo, COL_INFO);

  item = proto_tree_add_item(parent_tree, proto_rdp, tvb, 0, -1, ENC_NA);
  tree = proto_item_add_subtree(item, ett_rdp);

  return tree;
}

static int
dissect_rdp_SendData(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
  proto_item      *pi;
  int              offset       = 0;
  guint32          flags        = 0;
  guint32          cbDomain, cbUserName, cbPassword, cbAlternateShell, cbWorkingDir,
                   cbClientAddress, cbClientDir, cbAutoReconnectLen, wBlobLen, pduType = 0;
  guint32          bMsgType = 0xffffffff;
  guint32          encryptedLen = 0;
  conversation_t  *conversation;
  rdp_conv_info_t *rdp_info;

  rdp_field_info_t secFlags_fields[] = {
    {&hf_rdp_flagsPkt,           2, &flags, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsEncrypt,       2, NULL  , 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsResetSeqno,    2, NULL  , 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsIgnoreSeqno,   2, NULL  , 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsLicenseEncrypt,2, NULL  , 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsSecureChecksum,2, NULL  , 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_flagsFlagsHiValid,  2, NULL  , 0, RDP_FI_NOINCOFFSET, NULL },
    FI_TERMINATOR
  };

  rdp_field_info_t se_fields[] = {
    FI_SUBTREE(&hf_rdp_flags, 2, ett_rdp_flags, secFlags_fields),
    FI_FIXEDLEN(&hf_rdp_flagsHi, 2),
    {&hf_rdp_length,                4, &encryptedLen, 0, 0, NULL },
    {&hf_rdp_encryptedClientRandom, 0, &encryptedLen, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t systime_fields [] = {
    FI_FIXEDLEN(&hf_rdp_wYear        , 2),
    FI_FIXEDLEN(&hf_rdp_wMonth       , 2),
    FI_FIXEDLEN(&hf_rdp_wDayOfWeek   , 2),
    FI_FIXEDLEN(&hf_rdp_wDay         , 2),
    FI_FIXEDLEN(&hf_rdp_wHour        , 2),
    FI_FIXEDLEN(&hf_rdp_wMinute      , 2),
    FI_FIXEDLEN(&hf_rdp_wSecond      , 2),
    FI_FIXEDLEN(&hf_rdp_wMilliseconds, 2),
    FI_TERMINATOR,
  };
  rdp_field_info_t tz_info_fields [] = {
    FI_FIXEDLEN(&hf_rdp_Bias, 4),
    {&hf_rdp_StandardName,           64, NULL, 0, RDP_FI_STRING|RDP_FI_UNICODE, NULL },
    FI_SUBTREE(&hf_rdp_StandardDate, 16, ett_rdp_StandardDate, systime_fields),
    FI_FIXEDLEN(&hf_rdp_StandardBias, 4),
    {&hf_rdp_DaylightName,           64, NULL, 0, RDP_FI_STRING|RDP_FI_UNICODE, NULL },
    FI_SUBTREE(&hf_rdp_DaylightDate, 16, ett_rdp_DaylightDate, systime_fields),
    FI_FIXEDLEN(&hf_rdp_DaylightBias, 4),
    FI_TERMINATOR,
  };

  rdp_field_info_t ue_fields[] = {
    {&hf_rdp_codePage,           4, NULL, 0, 0, NULL },
    {&hf_rdp_optionFlags,        4, NULL, 0, RDP_FI_INFO_FLAGS, NULL },
    {&hf_rdp_cbDomain,           2, &cbDomain, 2, 0, NULL },
    {&hf_rdp_cbUserName,         2, &cbUserName, 2, 0, NULL },
    {&hf_rdp_cbPassword,         2, &cbPassword, 2, 0, NULL },
    {&hf_rdp_cbAlternateShell,   2, &cbAlternateShell, 2, 0, NULL },
    {&hf_rdp_cbWorkingDir,       2, &cbWorkingDir, 2, 0, NULL },
    {&hf_rdp_domain,             0, &cbDomain, 0, RDP_FI_STRING, NULL },
    {&hf_rdp_userName,           0, &cbUserName, 0, RDP_FI_STRING, NULL },
    {&hf_rdp_password,           0, &cbPassword, 0, RDP_FI_STRING, NULL },
    {&hf_rdp_alternateShell,     0, &cbAlternateShell, 0, RDP_FI_STRING, NULL },
    {&hf_rdp_workingDir,         0, &cbWorkingDir, 0, RDP_FI_STRING, NULL },
    {&hf_rdp_clientAddressFamily,2, NULL, 0, 0, NULL },
    {&hf_rdp_cbClientAddress,    2, &cbClientAddress, 0, 0, NULL },
    {&hf_rdp_clientAddress,      0, &cbClientAddress, 0, RDP_FI_STRING, NULL },
    {&hf_rdp_cbClientDir,        2, &cbClientDir, 0, 0, NULL },
    {&hf_rdp_clientDir,          0, &cbClientDir, 0, RDP_FI_STRING, NULL },
    FI_SUBTREE(&hf_rdp_clientTimeZone, 172, ett_rdp_clientTimeZone, tz_info_fields),
    {&hf_rdp_clientSessionId,    4, NULL, 0, 0, NULL },
    {&hf_rdp_performanceFlags,   4, NULL, 0, 0, NULL },
    {&hf_rdp_cbAutoReconnectLen, 2, &cbAutoReconnectLen, 0, 0, NULL },
    {&hf_rdp_autoReconnectCookie,0, &cbAutoReconnectLen, 0, 0, NULL },
    {&hf_rdp_reserved1,          2, NULL, 0, 0, NULL },
    {&hf_rdp_reserved2,          2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t msg_fields[] = {
    {&hf_rdp_bMsgType,           1, &bMsgType, 0, 0, NULL },
    {&hf_rdp_bVersion,           1, NULL, 0, 0, NULL },
    {&hf_rdp_wMsgSize,           2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t error_fields[] = {
    {&hf_rdp_wErrorCode,         4, NULL, 0, 0, NULL },
    {&hf_rdp_wStateTransition,   4, NULL, 0, 0, NULL },
    {&hf_rdp_wBlobType,          2, NULL, 0, 0, NULL },
    {&hf_rdp_wBlobLen,           2, &wBlobLen, 0, 0, NULL },
    {&hf_rdp_blobData,           0, &wBlobLen, 0, 0, NULL },
    FI_TERMINATOR
  };

  rdp_field_info_t pdu_fields[] = {
    {&hf_rdp_pduTypeType,        2, &pduType, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_pduTypeVersionLow,  2, NULL, 0, RDP_FI_NOINCOFFSET, NULL },
    {&hf_rdp_pduTypeVersionHigh, 2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t ctrl_fields[] = {
    {&hf_rdp_totalLength,        2, NULL, 0, 0, NULL },
    {&hf_rdp_pduType,            2, NULL, ett_rdp_pduType, RDP_FI_SUBTREE,
     pdu_fields },
    {&hf_rdp_pduSource,          2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  tree = dissect_rdp(tvb, pinfo, tree);

  pi   = proto_tree_add_item(tree, hf_rdp_SendData, tvb, offset, -1, ENC_NA);
  tree = proto_item_add_subtree(pi, ett_rdp_SendData);

  conversation = find_or_create_conversation(pinfo);
  rdp_info = (rdp_conv_info_t *)conversation_get_proto_data(conversation, proto_rdp);

  if (rdp_info &&
      ((rdp_info->licenseAgreed == 0) ||
       (pinfo->num <= rdp_info->licenseAgreed))) {
    /* licensing stage hasn't been completed */
    proto_tree *next_tree;

    flags = tvb_get_letohs(tvb, offset);

    switch(flags & SEC_PKT_MASK) {
    case SEC_EXCHANGE_PKT:
      pi        = proto_tree_add_item(tree, hf_rdp_securityExchangePDU, tvb, offset, -1, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_securityExchangePDU);

      col_append_sep_str(pinfo->cinfo, COL_INFO, " ", "SecurityExchange");

      /*offset=*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, se_fields, 0);

      break;

    case SEC_INFO_PKT:
      pi        = proto_tree_add_item(tree, hf_rdp_clientInfoPDU, tvb, offset, -1, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_clientInfoPDU);

      col_append_sep_str(pinfo->cinfo, COL_INFO, " ", "ClientInfo");

      offset = dissect_rdp_securityHeader(tvb, offset, pinfo, next_tree, rdp_info, TRUE, NULL);

      if (!(flags & SEC_ENCRYPT)) {

        /*offset =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, ue_fields, 0);
      } else {

        /*offset =*/ dissect_rdp_encrypted(tvb, offset, pinfo, next_tree, NULL);
      }
      break;

    case SEC_LICENSE_PKT:
      pi        = proto_tree_add_item(tree, hf_rdp_validClientLicenseData, tvb, offset, -1, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_validClientLicenseData);

      offset = dissect_rdp_securityHeader(tvb, offset, pinfo, next_tree, rdp_info, TRUE, NULL);
      if (!(flags & SEC_ENCRYPT)) {

        offset = dissect_rdp_fields(tvb, offset, pinfo, next_tree, msg_fields, 0);

        col_append_sep_str(pinfo->cinfo, COL_INFO, ", ", val_to_str_const(bMsgType, rdp_bMsgType_vals, "Unknown"));

        switch(bMsgType) {
        case LICENSE_REQUEST:
        case PLATFORM_CHALLENGE:
        case NEW_LICENSE:
        case UPGRADE_LICENSE:
        case LICENSE_INFO:
        case NEW_LICENSE_REQUEST:
        case PLATFORM_CHALLENGE_RESPONSE:
          /* RDPELE Not supported */
          /*offset =*/ dissect_rdp_nyi(tvb, offset, pinfo, next_tree, "RDPELE not implemented");
          break;
        case ERROR_ALERT:
          /*offset =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, error_fields, 0);
          rdp_info->licenseAgreed = pinfo->num;
          break;
        default:
          /* Unknown msgType */
          break;
        }
      } else {
        /*offset =*/ dissect_rdp_encrypted(tvb, offset, pinfo, next_tree, NULL);

        /* XXX: we assume the license is agreed in this exchange */
        rdp_info->licenseAgreed = pinfo->num;
      }
      break;

    case SEC_REDIRECTION_PKT:
      /* NotYetImplemented */
      break;

    default:
      break;
    }

    return tvb_captured_length(tvb);
  } /* licensing stage */

  if (rdp_info && (t124_get_last_channelId() == rdp_info->staticChannelId)) {

    offset = dissect_rdp_securityHeader(tvb, offset, pinfo, tree, rdp_info, FALSE, &flags);

    if (!(flags & SEC_ENCRYPT)) {
      proto_tree *next_tree;
      pi        = proto_tree_add_item(tree, hf_rdp_shareControlHeader, tvb, offset, -1, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_shareControlHeader);

      offset = dissect_rdp_fields(tvb, offset, pinfo, next_tree, ctrl_fields, 0);

      pduType &= PDUTYPE_TYPE_MASK; /* mask out just the type */

      if (pduType != PDUTYPE_DATAPDU)
        col_append_sep_str(pinfo->cinfo, COL_INFO, ", ", val_to_str_const(pduType, rdp_pduTypeType_vals, "Unknown"));

      switch(pduType) {
      case PDUTYPE_DEMANDACTIVEPDU:
        /*offset =*/ dissect_rdp_demandActivePDU(tvb, offset, pinfo, next_tree);
        break;
      case PDUTYPE_CONFIRMACTIVEPDU:
        /*offset =*/ dissect_rdp_confirmActivePDU(tvb, offset, pinfo, next_tree);
        break;
      case PDUTYPE_DEACTIVATEALLPDU:
        break;
      case PDUTYPE_DATAPDU:
        /*offset =*/ dissect_rdp_shareDataHeader(tvb, offset, pinfo, next_tree);
        break;
      case PDUTYPE_SERVER_REDIR_PKT:
        break;
      default:
        break;
      }
    } else {

      /*offset =*/ dissect_rdp_encrypted(tvb, offset, pinfo, tree, NULL);
    }

    /* we may get multiple control headers in a single frame */
    col_set_fence(pinfo->cinfo, COL_INFO);

    return tvb_captured_length(tvb);
  } /* (rdp_info && (t124_get_last_channelId() == rdp_info->staticChannelId)) */

  /* Virtual Channel */
  col_append_sep_str(pinfo->cinfo, COL_INFO, " ", "Virtual Channel PDU");

  offset = dissect_rdp_securityHeader(tvb, offset, pinfo, tree, rdp_info, FALSE, &flags);

  if (!(flags & SEC_ENCRYPT))
    /*offset =*/ dissect_rdp_channelPDU(tvb, offset, pinfo, tree);
  else
    /*offset =*/ dissect_rdp_encrypted(tvb, offset, pinfo, tree, "Channel PDU");

  return tvb_captured_length(tvb);
}

static int
dissect_rdp_monitor(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {

  guint32 monitorCount, i;
  proto_item *monitorDef_item;
  proto_tree *monitorDef_tree;

  rdp_field_info_t monitor_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    {&hf_rdp_monitorFlags,           4, NULL, 0, 0, NULL },
    {&hf_rdp_monitorCount,           4, &monitorCount, 0, 0, NULL },
    FI_TERMINATOR
  };

  rdp_field_info_t monitorDef_fields[] = {
    {&hf_rdp_monitorDefLeft,         4, NULL, 0, 0, NULL },
    {&hf_rdp_monitorDefTop,          4, NULL, 0, 0, NULL },
    {&hf_rdp_monitorDefRight,        4, NULL, 0, 0, NULL },
    {&hf_rdp_monitorDefBottom,       4, NULL, 0, 0, NULL },
    {&hf_rdp_monitorDefFlags,        4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  offset = dissect_rdp_fields(tvb, offset, pinfo, tree, monitor_fields, 0);
  for (i = 0; i < monitorCount; i++) {
    monitorDef_item = proto_tree_add_item(tree, hf_rdp_clientMonitorDefData, tvb, offset, 20, ENC_NA);
    monitorDef_tree = proto_item_add_subtree(monitorDef_item, ett_rdp_clientMonitorDefData);

    offset = dissect_rdp_fields(tvb, offset, pinfo, monitorDef_tree, monitorDef_fields, 0);
  }

  return offset;
}

static int
dissect_rdp_ClientData(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
  int              offset    = 0;
  proto_item      *pi;
  proto_tree      *next_tree;
  guint16          type;
  guint            length;
  rdp_conv_info_t *rdp_info;

  rdp_field_info_t header_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t core_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    {&hf_rdp_versionMajor,           2, NULL, 0, 0, NULL },
    {&hf_rdp_versionMinor,           2, NULL, 0, 0, NULL },
    {&hf_rdp_desktopWidth,           2, NULL, 0, 0, NULL },
    {&hf_rdp_desktopHeight,          2, NULL, 0, 0, NULL },
    {&hf_rdp_colorDepth,             2, NULL, 0, 0, NULL },
    {&hf_rdp_SASSequence,            2, NULL, 0, 0, NULL },
    {&hf_rdp_keyboardLayout,         4, NULL, 0, 0, NULL },
    {&hf_rdp_clientBuild,            4, NULL, 0, 0, NULL },
    {&hf_rdp_clientName,            32, NULL, 0, RDP_FI_STRING|RDP_FI_UNICODE, NULL },
    {&hf_rdp_keyboardType,           4, NULL, 0, 0, NULL },
    {&hf_rdp_keyboardSubType,        4, NULL, 0, 0, NULL },
    {&hf_rdp_keyboardFunctionKey,    4, NULL, 0, 0, NULL },
    {&hf_rdp_imeFileName,           64, NULL, 0, 0, NULL },
    /* The following fields are *optional*.                   */
    /*  I.E., a sequence of one or more of the trailing       */
    /*  fields at the end of the Data Block need not be       */
    /*  present. The length from the header field determines  */
    /*  the actual number of fields which are present.        */
    {&hf_rdp_postBeta2ColorDepth,    2, NULL, 0, 0, NULL },
    {&hf_rdp_clientProductId,        2, NULL, 0, 0, NULL },
    {&hf_rdp_serialNumber,           4, NULL, 0, 0, NULL },
    {&hf_rdp_highColorDepth,         2, NULL, 0, 0, NULL },
    {&hf_rdp_supportedColorDepths,   2, NULL, 0, 0, NULL },
    {&hf_rdp_earlyCapabilityFlags,   2, NULL, 0, 0, NULL },
    {&hf_rdp_clientDigProductId,    64, NULL, 0, RDP_FI_STRING|RDP_FI_UNICODE, NULL }, /* XXX - is this always a string?  MS-RDPBCGR doesn't say so */
    {&hf_rdp_connectionType,         1, NULL, 0, 0, NULL },
    {&hf_rdp_pad1octet,              1, NULL, 0, 0, NULL },
    {&hf_rdp_serverSelectedProtocol, 4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t security_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    {&hf_rdp_encryptionMethods,      4, NULL, 0, 0, NULL },
    {&hf_rdp_extEncryptionMethods,   4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t cluster_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    {&hf_rdp_cluster_flags,          4, NULL, 0, 0, NULL },
    {&hf_rdp_redirectedSessionId,    4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t msgchannel_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    {&hf_rdp_msgChannelFlags,        4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t monitorex_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    {&hf_rdp_monitorExFlags,         4, NULL, 0, 0, NULL },
    {&hf_rdp_monitorAttributeSize,   4, NULL, 0, 0, NULL },
    {&hf_rdp_monitorCount,           4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t multitransport_fields[] = {
    {&hf_rdp_headerType,             2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,           2, NULL, 0, 0, NULL },
    {&hf_rdp_multiTransportFlags,    4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  tree = dissect_rdp(tvb, pinfo, tree);

  rdp_info = rdp_get_conversation_data(pinfo);

  col_append_sep_str(pinfo->cinfo, COL_INFO, " ", "ClientData");

  pi   = proto_tree_add_item(tree, hf_rdp_ClientData, tvb, offset, -1, ENC_NA);
  tree = proto_item_add_subtree(pi, ett_rdp_ClientData);

  /* Advance through the data blocks using the length from the header for each block.
   *  ToDo: Expert if actual amount dissected (based upon field array) is not equal to length ??
   *  Note: If length is less than the header size (4 bytes) offset is advanced by 4 bytes
   *        to ensure that dissection eventually terminates.
   */

  while (tvb_reported_length_remaining(tvb, offset) > 0) {

    type   = tvb_get_letohs(tvb, offset);
    length = tvb_get_letohs(tvb, offset+2);

#if 0
    printf("offset=%d, type=%x, length=%d, remaining=%d\n",
           offset, type, length, tvb_captured_length_remaining(tvb, offset));
#endif

    switch(type) {
    case CS_CORE:
      pi        = proto_tree_add_item(tree, hf_rdp_clientCoreData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_clientCoreData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, core_fields, length);
      break;

    case CS_SECURITY:
      pi        = proto_tree_add_item(tree, hf_rdp_clientSecurityData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_clientSecurityData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, security_fields, 0);
      break;

    case CS_NET:
      /*offset    =*/ dissect_rdp_clientNetworkData(tvb, offset, pinfo, tree, length, rdp_info);
      break;

    case CS_CLUSTER:
      pi        = proto_tree_add_item(tree, hf_rdp_clientClusterData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_clientClusterData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, cluster_fields, 0);

      break;

    case CS_MONITOR:
      pi        = proto_tree_add_item(tree, hf_rdp_clientMonitorData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_clientMonitorData);
      /*offset    =*/ dissect_rdp_monitor(tvb, offset, pinfo, next_tree);
      break;

    case CS_MONITOR_EX:
      pi        = proto_tree_add_item(tree, hf_rdp_clientMonitorExData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_clientMonitorExData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, monitorex_fields, 0);
      break;

    case CS_MCS_MSGCHANNEL:
      pi        = proto_tree_add_item(tree, hf_rdp_clientMsgChannelData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_clientMsgChannelData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, msgchannel_fields, 0);
      break;

    case CS_MULTITRANSPORT:
      pi        = proto_tree_add_item(tree, hf_rdp_clientMultiTransportData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_clientMultiTransportData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, multitransport_fields, 0);
      break;

    default: /* unknown */
        pi        = proto_tree_add_item(tree, hf_rdp_clientUnknownData, tvb, offset, length, ENC_NA);
        next_tree = proto_item_add_subtree(pi, ett_rdp_clientUnknownData);
        /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, header_fields, 0);
        break;
    }
    offset += MAX(4, length);   /* Use length from header, but advance at least 4 bytes */
  }
  return tvb_captured_length(tvb);
}

static int
dissect_rdp_ServerData(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_) {
  int              offset           = 0;
  proto_item      *pi;
  proto_tree      *next_tree;
  guint16          type;
  guint            length;
  guint32          serverRandomLen  = 0;
  guint32          serverCertLen    = 0;
  guint32          encryptionMethod = 0;
  guint32          encryptionLevel  = 0;
  guint32          channelCount     = 0;
  guint32          channelId        = 0;
  guint            i;
  rdp_conv_info_t *rdp_info;

  rdp_field_info_t header_fields[] = {
    {&hf_rdp_headerType,               2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,             2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t sc_fields[] = {
    {&hf_rdp_headerType,               2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,             2, NULL, 0, 0, NULL },
    {&hf_rdp_versionMajor,             2, NULL, 0, 0, NULL },
    {&hf_rdp_versionMinor,             2, NULL, 0, 0, NULL },
    /* The following fields are *optional*.                   */
    /*  I.E., a sequence of one or more of the trailing       */
    /*  fields at the end of the Data Block need not be       */
    /*  present. The length from the header field determines  */
    /*  the actual number of fields which are present.        */
    {&hf_rdp_clientRequestedProtocols, 4, NULL, 0, 0, NULL },
    {&hf_rdp_earlyCapabilityFlags,     2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t ss_fields[] = {
    {&hf_rdp_headerType,               2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,             2, NULL, 0, 0, NULL },
    {&hf_rdp_encryptionMethod,         4, &encryptionMethod, 0, 0, NULL },
    {&hf_rdp_encryptionLevel,          4, &encryptionLevel,  0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t encryption_fields[] = {
    {&hf_rdp_serverRandomLen,          4, &serverRandomLen,  0, 0, NULL },
    {&hf_rdp_serverCertLen,            4, &serverCertLen,    0, 0, NULL },
    {&hf_rdp_serverRandom,             0, &serverRandomLen,  0, 0, NULL },
    {&hf_rdp_serverCertificate,        0, &serverCertLen,    0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t sn_fields[] = {
    {&hf_rdp_headerType,               2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,             2, NULL, 0, 0, NULL },
    {&hf_rdp_MCSChannelId,             2, &channelId, 0, 0, NULL },
    {&hf_rdp_channelCount,             2, &channelCount, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t array_fields[] = {
      {&hf_rdp_channelIdArray, 0 /*(channelCount * 2)*/, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t channel_fields[] = {
    {&hf_rdp_MCSChannelId, 2, &channelId, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t pad_fields[] = {
    {&hf_rdp_Pad, 2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t msgchannel_fields[] = {
    {&hf_rdp_headerType,               2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,             2, NULL, 0, 0, NULL },
    {&hf_rdp_msgChannelId,             2, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };
  rdp_field_info_t multitransport_fields[] = {
    {&hf_rdp_headerType,               2, NULL, 0, 0, NULL },
    {&hf_rdp_headerLength,             2, NULL, 0, 0, NULL },
    {&hf_rdp_multiTransportFlags,      4, NULL, 0, 0, NULL },
    FI_TERMINATOR
  };

  tree   = dissect_rdp(tvb, pinfo, tree);

  rdp_info = rdp_get_conversation_data(pinfo);

  col_append_sep_str(pinfo->cinfo, COL_INFO, " ", "ServerData");

  pi   = proto_tree_add_item(tree, hf_rdp_ServerData, tvb, offset, -1, ENC_NA);
  tree = proto_item_add_subtree(pi, ett_rdp_ServerData);

  /* Advance through the data blocks using the length from the header for each block.
   *  ToDo: Expert if actual amount dissected (based upon field array) is not equal to length ??
   *  Note: If length is less than the header size (4 bytes) offset is advanced by 4 bytes
   *        to ensure that dissection eventually terminates.
   */
  while (tvb_reported_length_remaining(tvb, offset) > 0) {

    type   = tvb_get_letohs(tvb, offset);
    length = tvb_get_letohs(tvb, offset+2);

    /*    printf("offset=%d, type=%x, length=%d, remaining=%d\n",
          offset, type, length, tvb_captured_length_remaining(tvb, offset)); */

    switch(type) {
    case SC_CORE:
      pi        = proto_tree_add_item(tree, hf_rdp_serverCoreData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_serverCoreData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, sc_fields, length);
      break;

    case SC_SECURITY: {
      gint lcl_offset;
      pi         = proto_tree_add_item(tree, hf_rdp_serverSecurityData, tvb, offset, length, ENC_NA);
      next_tree  = proto_item_add_subtree(pi, ett_rdp_serverSecurityData);

      lcl_offset = dissect_rdp_fields(tvb, offset, pinfo, next_tree, ss_fields, 0);

      col_append_sep_fstr(pinfo->cinfo, COL_INFO, " ", "Encryption: %s (%s)",
                          val_to_str_const(encryptionMethod, rdp_encryptionMethod_vals, "Unknown"),
                          val_to_str_const(encryptionLevel, rdp_encryptionLevel_vals, "Unknown"));

      if ((encryptionLevel != 0) || (encryptionMethod != 0)) {
        /*lcl_offset =*/ dissect_rdp_fields(tvb, lcl_offset, pinfo, next_tree, encryption_fields, 0);
      }

      rdp_info->encryptionMethod = encryptionMethod;
      rdp_info->encryptionLevel  = encryptionLevel;
      break;
    }

    case SC_NET: {
      gint lcl_offset;
      pi        = proto_tree_add_item(tree, hf_rdp_serverNetworkData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_serverNetworkData);

      lcl_offset = dissect_rdp_fields(tvb, offset, pinfo, next_tree, sn_fields, 0);

      rdp_info->staticChannelId = channelId;
      register_t124_sd_dissector(pinfo, channelId, dissect_rdp_SendData, proto_rdp);

      if (channelCount > 0) {
        array_fields[0].fixedLength = channelCount * 2;
        dissect_rdp_fields(tvb, lcl_offset, pinfo, next_tree, array_fields, 0);

        if (next_tree)
          next_tree = proto_item_add_subtree(next_tree->last_child, ett_rdp_channelIdArray);
        for (i = 0; i < channelCount; i++) {
          lcl_offset = dissect_rdp_fields(tvb, lcl_offset, pinfo, next_tree, channel_fields, 0);
          if (i < MAX_CHANNELS)
            rdp_info->channels[i].value = channelId;

          /* register SendData on this for now */
          register_t124_sd_dissector(pinfo, channelId, dissect_rdp_SendData, proto_rdp);
        }
        if (channelCount % 2)
          /*lcl_offset =*/ dissect_rdp_fields(tvb, lcl_offset, pinfo, next_tree, pad_fields, 0);
      }
      break;
    }

    case SC_MCS_MSGCHANNEL:
      pi        = proto_tree_add_item(tree, hf_rdp_serverMsgChannelData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_serverMsgChannelData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, msgchannel_fields, length);
      break;

    case SC_MULTITRANSPORT:
      pi        = proto_tree_add_item(tree, hf_rdp_serverMultiTransportData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_serverMultiTransportData);
      /*offset    =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, multitransport_fields, length);
      break;

    default:  /* unknown */
      pi        = proto_tree_add_item(tree, hf_rdp_serverUnknownData, tvb, offset, length, ENC_NA);
      next_tree = proto_item_add_subtree(pi, ett_rdp_serverUnknownData);

      /*offset =*/ dissect_rdp_fields(tvb, offset, pinfo, next_tree, header_fields, 0);
      break;
    }
    offset += MAX(4, length);   /* Use length from header, but advance at least 4 bytes */
  }
  return tvb_captured_length(tvb);
}

/* Dissect extra data in a CR PDU */
static int
dissect_rdpCorrelationInfo(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {
  guint32 type;
  guint32 length;
  proto_item *type_item, *length_item;

  type_item = proto_tree_add_item_ret_uint(tree, hf_rdp_neg_type, tvb, offset, 1, ENC_NA, &type);
  offset += 1;
  if (type != TYPE_RDP_CORRELATION_INFO) {
    expert_add_info(pinfo, type_item, &ei_rdp_not_correlation_info);
    return offset;
  }
  proto_tree_add_item(tree, hf_rdp_correlationInfo_flags, tvb, offset, 1, ENC_NA);
  offset += 1;
  length_item = proto_tree_add_item_ret_uint(tree, hf_rdp_neg_length, tvb, offset, 1, ENC_LITTLE_ENDIAN, &length);
  offset += 2;
  if (length != 36) {
    expert_add_info_format(pinfo, length_item, &ei_rdp_neg_len_invalid, "RDP Correlation Info length is %u, not 36", length);
    return offset;
  }
  proto_tree_add_item(tree, hf_rdp_correlationId, tvb, offset, 16, ENC_NA);
  offset += 16;
  proto_tree_add_item(tree, hf_rdp_correlationInfo_reserved, tvb, offset, 16, ENC_NA);
  offset += 16;
  return offset;
}

static int
dissect_rdpNegReq(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {
  guint64 flags;
  guint32 length;
  proto_item *length_item;
  static const int *flag_bits[] = {
    &hf_rdp_negReq_flag_restricted_admin_mode_req,
    &hf_rdp_negReq_flag_correlation_info_present,
    NULL
  };
  static const int *requestedProtocols_bits[] = {
    &hf_rdp_requestedProtocols_flag_ssl,
    &hf_rdp_requestedProtocols_flag_hybrid,
    &hf_rdp_requestedProtocols_flag_hybrid_ex,
    NULL
  };

  col_append_str(pinfo->cinfo, COL_INFO, "Negotiate Request");

  proto_tree_add_item(tree, hf_rdp_neg_type, tvb, offset, 1, ENC_NA);
  offset += 1;
  proto_tree_add_bitmask_ret_uint64(tree, tvb, offset, hf_rdp_negReq_flags,
                                    ett_negReq_flags, flag_bits,
                                    ENC_LITTLE_ENDIAN, &flags);
  offset += 1;
  length_item = proto_tree_add_item_ret_uint(tree, hf_rdp_neg_length, tvb, offset, 1, ENC_LITTLE_ENDIAN, &length);
  offset += 2;
  if (length != 8) {
    expert_add_info_format(pinfo, length_item, &ei_rdp_neg_len_invalid, "RDP Negotiate Request length is %u, not 8", length);
    return offset;
  }
  proto_tree_add_bitmask(tree, tvb, offset, hf_rdp_requestedProtocols,
                         ett_requestedProtocols, requestedProtocols_bits,
                         ENC_LITTLE_ENDIAN);
  offset += 4;
  if (flags & CORRELATION_INFO_PRESENT)
    offset = dissect_rdpCorrelationInfo(tvb, offset, pinfo, tree);
  return offset;
}

static int
dissect_rdp_cr(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data _U_)
{
  int offset = 0;
  gboolean have_cookie = FALSE;
  gboolean have_rdpNegRequest = FALSE;
  proto_item *item;
  proto_tree *tree;
  gint linelen, next_offset;
  const guint8 *stringval;
  const char *sep = "";

  /*
   * routingToken or cookie?  Both begin with "Cookie: ".
   */
  if (tvb_memeql(tvb, offset, "Cookie: ", 8) == 0) {
    /* Looks like a routing token or cookie */
    have_cookie = TRUE;
  } else if (tvb_bytes_exist(tvb, offset, 4) &&
             tvb_get_guint8(tvb, offset) == TYPE_RDP_NEG_REQ &&
             tvb_get_letohs(tvb, offset + 2) == 8) {
    /* Looks like a Negotiate Request (TYPE_RDP_NEG_REQ, length 8) */
    have_rdpNegRequest = TRUE;
  }
  if (!have_cookie && !have_rdpNegRequest) {
    /* Doesn't look like our data */
    return 0;
  }

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "RDP");
  col_clear(pinfo->cinfo, COL_INFO);

  item = proto_tree_add_item(parent_tree, proto_rdp, tvb, 0, -1, ENC_NA);
  tree = proto_item_add_subtree(item, ett_rdp);

  if (have_cookie) {
    /* XXX - distinguish between routing token and cookie? */
    linelen = tvb_find_line_end(tvb, offset, -1, &next_offset, TRUE);
    proto_tree_add_item_ret_string(tree, hf_rdp_rt_cookie, tvb, offset,
                                   linelen, ENC_ASCII|ENC_NA,
                                   wmem_packet_scope(), &stringval);
    offset = (linelen == -1) ? (gint)tvb_captured_length(tvb) : next_offset;
    col_append_str(pinfo->cinfo, COL_INFO, format_text(wmem_packet_scope(), stringval, strlen(stringval)));
    sep = ", ";
  }
  /*
   * rdpNegRequest?
   */
  if (tvb_reported_length_remaining(tvb, offset) > 0) {
    col_append_str(pinfo->cinfo, COL_INFO, sep);
    offset = dissect_rdpNegReq(tvb, offset, pinfo, tree);
  }
  return offset; /* returns 0 if nothing was dissected, which is what we want */
}

/* Dissect extra data in a CC PDU */
static int
dissect_rdpNegRsp(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {
  guint32 length;
  proto_item *length_item;
  static const int *flag_bits[] = {
    &hf_rdp_negRsp_flag_extended_client_data_supported,
    &hf_rdp_negRsp_flag_dynvc_gfx_protocol_supported,
    &hf_rdp_negRsp_flag_restricted_admin_mode_supported,
    NULL
  };
  static const int *selectedProtocol_bits[] = {
    &hf_rdp_selectedProtocol_flag_ssl,
    &hf_rdp_selectedProtocol_flag_hybrid,
    &hf_rdp_selectedProtocol_flag_hybrid_ex,
    NULL
  };

  col_append_str(pinfo->cinfo, COL_INFO, "Negotiate Response");

  proto_tree_add_item(tree, hf_rdp_neg_type, tvb, offset, 1, ENC_NA);
  offset += 1;
  proto_tree_add_bitmask(tree, tvb, offset, hf_rdp_negRsp_flags,
                         ett_negRsp_flags, flag_bits,
                         ENC_LITTLE_ENDIAN);
  offset += 1;
  length_item = proto_tree_add_item_ret_uint(tree, hf_rdp_neg_length, tvb, offset, 1, ENC_LITTLE_ENDIAN, &length);
  offset += 2;
  if (length != 8) {
    expert_add_info_format(pinfo, length_item, &ei_rdp_neg_len_invalid, "RDP Negotiate Response length is %u, not 8", length);
    return offset;
  }
  proto_tree_add_bitmask(tree, tvb, offset, hf_rdp_selectedProtocol,
                         ett_selectedProtocol, selectedProtocol_bits,
                         ENC_LITTLE_ENDIAN);
  offset += 4;
  return offset;
}

static int
dissect_rdpNegFailure(tvbuff_t *tvb, int offset, packet_info *pinfo, proto_tree *tree) {
  guint32 length;
  proto_item *length_item;
  guint32 failureCode;

  col_append_str(pinfo->cinfo, COL_INFO, "Negotiate Failure");

  proto_tree_add_item(tree, hf_rdp_neg_type, tvb, offset, 1, ENC_NA);
  offset += 1;
  proto_tree_add_item(tree, hf_rdp_negReq_flags, tvb, offset, 1, ENC_LITTLE_ENDIAN);
  offset += 1;
  length_item = proto_tree_add_item_ret_uint(tree, hf_rdp_neg_length, tvb, offset, 1, ENC_LITTLE_ENDIAN, &length);
  offset += 2;
  if (length != 8) {
    expert_add_info_format(pinfo, length_item, &ei_rdp_neg_len_invalid, "RDP Negotiate Failure length is %u, not 8", length);
    return offset;
  }
  proto_tree_add_item_ret_uint(tree, hf_rdp_negFailure_failureCode, tvb, offset, 4, ENC_LITTLE_ENDIAN, &failureCode);
  offset += 4;
  col_append_fstr(pinfo->cinfo, COL_INFO, ", failureCode %s",
                  val_to_str(failureCode, failure_code_vals, "Unknown (0x%08x)"));
  return offset;
}

static int
dissect_rdp_cc(tvbuff_t *tvb, packet_info *pinfo, proto_tree *parent_tree, void* data _U_)
{
  int offset = 0;
  guint8 type;
  guint16 length;
  gboolean ours = FALSE;
  proto_item *item;
  proto_tree *tree;

  if (tvb_bytes_exist(tvb, offset, 4)) {
    type = tvb_get_guint8(tvb, offset);
    length = tvb_get_letohs(tvb, offset + 2);
    if ((type == TYPE_RDP_NEG_RSP || type == TYPE_RDP_NEG_FAILURE) &&
        length == 8) {
      /* Looks like a Negotiate Response (TYPE_RDP_NEG_RSP, length 8)
         or a Negotaiate Failure (TYPE_RDP_NEG_FAILURE, length 8) */
      ours = TRUE;
    }
  }
  if (!ours) {
    /* Doesn't look like our data */
    return 0;
  }

  col_set_str(pinfo->cinfo, COL_PROTOCOL, "RDP");
  col_clear(pinfo->cinfo, COL_INFO);

  item = proto_tree_add_item(parent_tree, proto_rdp, tvb, 0, -1, ENC_NA);
  tree = proto_item_add_subtree(item, ett_rdp);

  switch (type) {

  case TYPE_RDP_NEG_RSP:
    offset = dissect_rdpNegRsp(tvb, offset, pinfo, tree);
    break;

  case TYPE_RDP_NEG_FAILURE:
    offset = dissect_rdpNegFailure(tvb, offset, pinfo, tree);
    break;
  }
  return offset;
}

/*--- proto_register_rdp -------------------------------------------*/
void
proto_register_rdp(void) {

  /* List of fields */
  static hf_register_info hf[] = {
    { &hf_rdp_rt_cookie,
      { "Routing Token/Cookie", "rdp.rt_cookie",
        FT_STRING, BASE_NONE, NULL, 0,
	NULL, HFILL }},
    { &hf_rdp_neg_type,
      { "Type", "rdp.neg_type",
        FT_UINT8, BASE_HEX, VALS(neg_type_vals), 0,
	NULL, HFILL }},
    { &hf_rdp_negReq_flags,
      { "Flags", "rdp.negReq.flags",
        FT_UINT8, BASE_HEX, NULL, 0,
	NULL, HFILL }},
    { &hf_rdp_negReq_flag_restricted_admin_mode_req,
      { "Restricted admin mode required", "rdp.negReq.flags.restricted_admin_mode_req",
        FT_BOOLEAN, 8, NULL, RESTRICTED_ADMIN_MODE_REQUIRED,
	NULL, HFILL }},
    { &hf_rdp_negReq_flag_correlation_info_present,
      { "Correlation info present", "rdp.negReq.flags.correlation_info_present",
        FT_BOOLEAN, 8, NULL, CORRELATION_INFO_PRESENT,
	NULL, HFILL }},
    { &hf_rdp_neg_length,
      { "Length", "rdp.neg_length",
        FT_UINT16, BASE_DEC, NULL, 0,
	NULL, HFILL }},
    { &hf_rdp_requestedProtocols,
      { "requestedProtocols", "rdp.negReq.requestedProtocols",
        FT_UINT32, BASE_HEX, NULL, 0,
	NULL, HFILL }},
    { &hf_rdp_requestedProtocols_flag_ssl,
      { "TLS security supported", "rdp.negReq.requestedProtocols.ssl",
        FT_BOOLEAN, 32, NULL, 0x00000001,
	NULL, HFILL }},
    { &hf_rdp_requestedProtocols_flag_hybrid,
      { "CredSSP supported", "rdp.negReq.requestedProtocols.hybrid",
        FT_BOOLEAN, 32, NULL, 0x00000002,
	NULL, HFILL }},
    { &hf_rdp_requestedProtocols_flag_hybrid_ex,
      { "Early User Authorization Result PDU supported", "rdp.negReq.requestedProtocols.hybrid_ex",
        FT_BOOLEAN, 32, NULL, 0x00000008,
	NULL, HFILL }},
    { &hf_rdp_correlationInfo_flags,
      { "Flags", "rdp.correlationInfo.flags",
        FT_UINT8, BASE_HEX, NULL, 0,
	NULL, HFILL }},
    { &hf_rdp_correlationId,
      { "correlationId", "rdp.correlationInfo.correlationId",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_correlationInfo_reserved,
      { "Reserved", "rdp.correlationInfo.reserved",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_negRsp_flags,
      { "Flags", "rdp.negRsp.flags",
        FT_UINT8, BASE_HEX, NULL, 0,
	NULL, HFILL }},
    { &hf_rdp_negRsp_flag_extended_client_data_supported,
      { "Extended Client Data Blocks supported", "rdp.negRsp.flags.extended_client_data_supported",
        FT_BOOLEAN, 8, NULL, 0x01,
	NULL, HFILL }},
    { &hf_rdp_negRsp_flag_dynvc_gfx_protocol_supported,
      { "Graphics Pipeline Extension Protocol supported", "rdp.negRsp.flags.dynvc_gfx_protocol_supported",
        FT_BOOLEAN, 8, NULL, 0x02,
	NULL, HFILL }},
    { &hf_rdp_negRsp_flag_restricted_admin_mode_supported,
      { "Restricted admin mode supported", "rdp.negRsp.flags.restricted_admin_mode_supported",
        FT_BOOLEAN, 8, NULL, 0x08,
	NULL, HFILL }},
    { &hf_rdp_selectedProtocol,
      { "selectedProtocol", "rdp.negReq.selectedProtocol",
        FT_UINT32, BASE_HEX, NULL, 0,
	NULL, HFILL }},
    { &hf_rdp_selectedProtocol_flag_ssl,
      { "TLS security selected", "rdp.negReq.selectedProtocol.ssl",
        FT_BOOLEAN, 32, NULL, 0x00000001,
	NULL, HFILL }},
    { &hf_rdp_selectedProtocol_flag_hybrid,
      { "CredSSP selected", "rdp.negReq.selectedProtocol.hybrid",
        FT_BOOLEAN, 32, NULL, 0x00000002,
	NULL, HFILL }},
    { &hf_rdp_selectedProtocol_flag_hybrid_ex,
      { "Early User Authorization Result PDU selected", "rdp.negReq.selectedProtocol.hybrid_ex",
        FT_BOOLEAN, 32, NULL, 0x00000008,
	NULL, HFILL }},
    { &hf_rdp_negFailure_failureCode,
      { "failureCode", "rdp.negFailure.failureCode",
        FT_UINT32, BASE_HEX, VALS(failure_code_vals), 0,
	NULL, HFILL }},
    { &hf_rdp_ClientData,
      { "ClientData", "rdp.clientData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_SendData,
      { "SendData", "rdp.sendData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientCoreData,
      { "clientCoreData", "rdp.client.coreData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientSecurityData,
      { "clientSecurityData", "rdp.client.securityData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientNetworkData,
      { "clientNetworkData", "rdp.client.networkData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientClusterData,
      { "clientClusterData", "rdp.client.clusterData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientMonitorData,
      { "clientMonitorData", "rdp.client.monitorData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientMonitorDefData,
      { "clientMonitorDefData", "rdp.client.monitorDefData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientMsgChannelData,
      { "clientMsgChannelData", "rdp.client.msgChannelData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientMonitorExData,
      { "clientMonitorExData", "rdp.client.monitorExData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientMultiTransportData,
      { "clientMultiTransportData", "rdp.client.multiTransportData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientUnknownData,
      { "clientUnknownData", "rdp.unknownData.client",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_ServerData,
      { "ServerData", "rdp.serverData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverCoreData,
      { "serverCoreData", "rdp.server.coreData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverSecurityData,
      { "serverSecurityData", "rdp.server.securityData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverNetworkData,
      { "serverNetworkData", "rdp.server.networkData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverMsgChannelData,
      { "serverMsgChannelData", "rdp.server.msgChannelData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverMultiTransportData,
      { "serverMultiTransportData", "rdp.server.multiTransportData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverUnknownData,
      { "serverUnknownData", "rdp.unknownData.server",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_securityExchangePDU,
      { "securityExchangePDU", "rdp.securityExchangePDU",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientInfoPDU,
      { "clientInfoPDU", "rdp.clientInfoPDU",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_validClientLicenseData,
      { "validClientLicenseData", "rdp.validClientLicenseData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_headerType,
      { "headerType", "rdp.header.type",
        FT_UINT16, BASE_HEX, VALS(rdp_headerType_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_headerLength,
      { "headerLength", "rdp.header.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_versionMajor,
      { "versionMajor", "rdp.version.major",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_versionMinor,
      { "versionMinor", "rdp.version.minor",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_desktopWidth,
      { "desktopWidth", "rdp.desktop.width",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_desktopHeight,
      { "desktopHeight", "rdp.desktop.height",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_colorDepth,
      { "colorDepth", "rdp.colorDepth",
        FT_UINT16, BASE_HEX, VALS(rdp_colorDepth_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_SASSequence,
      { "SASSequence", "rdp.SASSequence",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_keyboardLayout,
      { "keyboardLayout", "rdp.keyboardLayout",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientBuild,
      { "clientBuild", "rdp.client.build",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientName,
      { "clientName", "rdp.client.name",
        FT_STRINGZ, BASE_NONE, NULL, 0, /* supposed to be null-terminated */
        NULL, HFILL }},
    { &hf_rdp_keyboardType,
      { "keyboardType", "rdp.keyboard.type",
        FT_UINT32, BASE_DEC, VALS(rdp_keyboardType_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_keyboardSubType,
      { "keyboardSubType", "rdp.keyboard.subtype",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_keyboardFunctionKey,
      { "keyboardFunctionKey", "rdp.keyboard.functionkey",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_imeFileName,
      { "imeFileName", "rdp.imeFileName",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_postBeta2ColorDepth,
      { "postBeta2ColorDepth", "rdp.postBeta2ColorDepth",
        FT_UINT16, BASE_HEX, VALS(rdp_colorDepth_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_clientProductId,
      { "clientProductId", "rdp.client.productId",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serialNumber,
      { "serialNumber", "rdp.serialNumber",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_highColorDepth,
      { "highColorDepth", "rdp.highColorDepth",
        FT_UINT16, BASE_HEX, VALS(rdp_highColorDepth_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_supportedColorDepths,
      { "supportedColorDepths", "rdp.supportedColorDepths",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_earlyCapabilityFlags,
      { "earlyCapabilityFlags", "rdp.earlyCapabilityFlags",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientDigProductId,
      { "clientDigProductId", "rdp.client.digProductId",
        FT_STRINGZ, BASE_NONE, NULL, 0, /* XXX - is this always a string?  MS-RDPBCGR doesn't say so */
        NULL, HFILL }},
    { &hf_rdp_connectionType,
      { "connectionType", "rdp.connectionType",
        FT_UINT8, BASE_DEC, VALS(rdp_connectionType_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_pad1octet,
      { "pad1octet", "rdp.pad1octet",
        FT_UINT8, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverSelectedProtocol,
      { "serverSelectedProtocol", "rdp.serverSelectedProtocol",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_encryptionMethods,
      { "encryptionMethods", "rdp.encryptionMethods",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_extEncryptionMethods,
      { "extEncryptionMethods", "rdp.extEncryptionMethods",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cluster_flags,    /* ToDo: Display flags in detail */
      { "clusterFlags", "rdp.clusterFlags",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_redirectedSessionId,
      { "redirectedSessionId", "rdp.redirectedSessionId",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_msgChannelFlags,
      { "msgChannelFlags", "rdp.msgChannelFlags",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_msgChannelId,
      { "msgChannelId", "rdp.msgChannelId",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorFlags,
      { "monitorFlags", "rdp.monitorFlags",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorExFlags,
      { "monitorExFlags", "rdp.monitorExFlags",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorAttributeSize,
      { "monitorAttributeSize", "rdp.monitorAttributeSize",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorCount,
      { "monitorCount", "rdp.monitorCount",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorDefLeft,
      { "left", "rdp.monitorDef.left",
        FT_INT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorDefTop,
      { "top", "rdp.monitorDef.top",
        FT_INT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorDefRight,
      { "right", "rdp.monitorDef.right",
        FT_INT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorDefBottom,
      { "bottom", "rdp.monitorDef.bottom",
        FT_INT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_monitorDefFlags,
      { "flags", "rdp.monitorDef.flags",
        FT_UINT32, BASE_DEC, VALS(rdp_monitorDefFlags_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_multiTransportFlags,
      { "multiTransportFlags", "rdp.multiTransportFlags",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_encryptionMethod,
      { "encryptionMethod", "rdp.encryptionMethod",
        FT_UINT32, BASE_HEX, VALS(rdp_encryptionMethod_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_encryptionLevel,
      { "encryptionLevel", "rdp.encryptionLevel",
        FT_UINT32, BASE_HEX, VALS(rdp_encryptionLevel_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_serverRandomLen,
      { "serverRandomLen", "rdp.serverRandomLen",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverCertLen,
      { "serverCertLen", "rdp.serverCertLen",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverRandom,
      { "serverRandom", "rdp.serverRandom",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_serverCertificate,
      { "serverCertificate", "rdp.serverCertificate",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientRequestedProtocols,
      { "clientRequestedProtocols", "rdp.client.requestedProtocols",
        FT_UINT32, BASE_HEX, VALS(rdp_requestedProtocols_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_MCSChannelId,
      { "MCSChannelId", "rdp.MCSChannelId",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_channelCount,
      { "channelCount", "rdp.channelCount",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_channelIdArray,
      { "channelIdArray", "rdp.channelIdArray",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_Pad,
      { "Pad", "rdp.Pad",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_flags,
      { "flags", "rdp.flags",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_channelFlags,
      { "channelFlags", "rdp.channelFlags",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_flagsPkt,
      { "flagsPkt", "rdp.flags.pkt",
        FT_UINT16, BASE_HEX, VALS(rdp_flagsPkt_vals), SEC_PKT_MASK,
        NULL, HFILL }},
    { &hf_rdp_flagsEncrypt,
      { "flagsEncrypt", "rdp.flags.encrypt",
        FT_UINT16, BASE_HEX, NULL, SEC_ENCRYPT,
        NULL, HFILL }},
    { &hf_rdp_flagsResetSeqno,
      { "flagsResetSeqno", "rdp.flags.resetseqno",
        FT_UINT16, BASE_HEX, NULL, SEC_RESET_SEQNO,
        NULL, HFILL }},
    { &hf_rdp_flagsIgnoreSeqno,
      { "flagsIgnoreSeqno", "rdp.flags.ignoreseqno",
        FT_UINT16, BASE_HEX, NULL, SEC_IGNORE_SEQNO,
        NULL, HFILL }},
    { &hf_rdp_flagsLicenseEncrypt,
      { "flagsLicenseEncrypt", "rdp.flags.licenseencrypt",
        FT_UINT16, BASE_HEX, NULL, SEC_LICENSE_ENCRYPT_CS,
        NULL, HFILL }},
    { &hf_rdp_flagsSecureChecksum,
      { "flagsSecureChecksum", "rdp.flags.securechecksum",
        FT_UINT16, BASE_HEX, NULL, SEC_SECURE_CHECKSUM,
        NULL, HFILL }},
    { &hf_rdp_flagsFlagsHiValid,
      { "flagsHiValid", "rdp.flags.flagshivalid",
        FT_UINT16, BASE_HEX, NULL, SEC_FLAGSHI_VALID,
        NULL, HFILL }},
    { &hf_rdp_flagsHi,
      { "flagsHi", "rdp.flagsHi",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_length,
      { "length", "rdp.length",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_encryptedClientRandom,
      { "encryptedClientRandom", "rdp.encryptedClientRandom",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_dataSignature,
      { "dataSignature", "rdp.dataSignature",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_fipsLength,
      { "fipsLength", "rdp.fipsLength",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_fipsVersion,
      { "fipsVersion", "rdp.fipsVersion",
        FT_UINT8, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_padlen,
      { "padlen", "rdp.padlen",
        FT_UINT8, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_codePage,
      { "codePage", "rdp.codePage",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_optionFlags,
      { "optionFlags", "rdp.optionFlags",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cbDomain,
      { "cbDomain", "rdp.domain.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cbUserName,
      { "cbUserName", "rdp.userName.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cbPassword,
      { "cbPassword", "rdp.password.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cbAlternateShell,
      { "cbAlternateShell", "rdp.alternateShell.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cbWorkingDir,
      { "cbWorkingDir", "rdp.workingDir.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cbClientAddress,
      { "cbClientAddress", "rdp.client.address.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cbClientDir,
      { "cbClientDir", "rdp.client.dir.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_cbAutoReconnectLen,
      { "cbAutoReconnectLen", "rdp.autoReconnectCookie.length",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_domain,
      { "domain", "rdp.domain",
        FT_STRINGZ, BASE_NONE, NULL, 0,  /* null-terminated, count includes terminator */
        NULL, HFILL }},
    { &hf_rdp_userName,
      { "userName", "rdp.userName",
        FT_STRINGZ, BASE_NONE, NULL, 0,  /* null-terminated, count includes terminator */
        NULL, HFILL }},
    { &hf_rdp_password,
      { "password", "rdp.password",
        FT_STRINGZ, BASE_NONE, NULL, 0,  /* null-terminated, count includes terminator */
        NULL, HFILL }},
    { &hf_rdp_alternateShell,
      { "alternateShell", "rdp.alternateShell",
        FT_STRINGZ, BASE_NONE, NULL, 0,  /* null-terminated, count includes terminator */
        NULL, HFILL }},
    { &hf_rdp_workingDir,
      { "workingDir", "rdp.workingDir",
        FT_STRINGZ, BASE_NONE, NULL, 0,  /* null-terminated, count includes terminator */
        NULL, HFILL }},
    { &hf_rdp_clientAddressFamily,
      { "clientAddressFamily", "rdp.client.addressFamily",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientAddress,
      { "clientAddress", "rdp.client.address",
        FT_STRINGZ, BASE_NONE, NULL, 0,  /* null-terminated, count includes terminator */
        NULL, HFILL }},
    { &hf_rdp_clientDir,
      { "clientDir", "rdp.client.dir",
        FT_STRINGZ, BASE_NONE, NULL, 0,  /* null-terminated, count includes terminator */
        NULL, HFILL }},
    { &hf_rdp_clientTimeZone,
      { "clientTimeZone", "rdp.client.timeZone",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_clientSessionId,
      { "clientSessionId", "rdp.client.sessionId",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_performanceFlags,
      { "performanceFlags", "rdp.performanceFlags",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_autoReconnectCookie,
      { "autoReconnectCookie", "rdp.autoReconnectCookie",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_reserved1,
      { "reserved1", "rdp.reserved1",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_reserved2,
      { "reserved2", "rdp.reserved2",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_bMsgType,
      { "bMsgType", "rdp.bMsgType",
        FT_UINT8, BASE_HEX, VALS(rdp_bMsgType_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_bVersion,
      { "bVersion", "rdp.bVersion",
        FT_UINT8, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_wMsgSize,
      { "wMsgSize", "rdp.wMsgSize",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_wBlobType,
      { "wBlobType", "rdp.wBlobType",
        FT_UINT16, BASE_DEC, VALS(rdp_wBlobType_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_wBlobLen,
      { "wBlobLen", "rdp.wBlobLen",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_blobData,
      { "blobData", "rdp.blobData",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_shareControlHeader,
      { "shareControlHeader", "rdp.shareControlHeader",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_channelPDUHeader,
      { "channelPDUHeader", "rdp.channelPDUHeader",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_virtualChannelData,
      { "virtualChannelData", "rdp.virtualChannelData",
        FT_BYTES, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_totalLength,
      { "totalLength", "rdp.totalLength",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_pduType,
      { "pduType", "rdp.pduType",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_pduTypeType,
      { "pduTypeType", "rdp.pduType.type",
        FT_UINT16, BASE_HEX, VALS(rdp_pduTypeType_vals), PDUTYPE_TYPE_MASK,
        NULL, HFILL }},
    { &hf_rdp_pduTypeVersionLow,
      { "pduTypeVersionLow", "rdp.pduType.versionLow",
        FT_UINT16, BASE_DEC, NULL, PDUTYPE_VERSIONLOW_MASK,
        NULL, HFILL }},
    { &hf_rdp_pduTypeVersionHigh,
      { "pduTypeVersionHigh", "rdp.pduType.versionHigh",
        FT_UINT16, BASE_DEC, NULL, PDUTYPE_VERSIONHIGH_MASK,
        NULL, HFILL }},
    { &hf_rdp_pduSource,
      { "pduSource", "rdp.pduSource",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_shareId,
      { "shareId", "rdp.shareId",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_pad1,
      { "pad1", "rdp.pad1",
        FT_UINT8, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_streamId,
      { "streamId", "rdp.streamId",
        FT_UINT8, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_uncompressedLength,
      { "uncompressedLength", "rdp.uncompressedLength",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_pduType2,
      { "pduType2", "rdp.pduType2",
        FT_UINT8, BASE_DEC, VALS(rdp_pduType2_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_compressedType,
      { "compressedType", "rdp.compressedType",
        FT_UINT8, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_compressedTypeType,
      { "compressedTypeType", "rdp.compressedType.type",
        FT_UINT8, BASE_HEX, VALS(rdp_compressionType_vals),
        PacketCompressionTypeMask,
        NULL, HFILL }},
    { &hf_rdp_compressedTypeCompressed,
      { "compressedTypeCompressed", "rdp.compressedType.compressed",
        FT_UINT8, BASE_HEX, NULL, PACKET_COMPRESSED,
        NULL, HFILL }},
    { &hf_rdp_compressedTypeAtFront,
      { "compressedTypeAtFront", "rdp.compressedType.atFront",
        FT_UINT8, BASE_HEX, NULL, PACKET_AT_FRONT,
        NULL, HFILL }},
    { &hf_rdp_compressedTypeFlushed,
      { "compressedTypeFlushed", "rdp.compressedType.flushed",
        FT_UINT8, BASE_HEX, NULL, PACKET_FLUSHED,
        NULL, HFILL }},
    { &hf_rdp_compressedLength,
      { "compressedLength", "rdp.compressedLength",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_wErrorCode,
      { "errorCode", "rdp.errorCode",
        FT_UINT32, BASE_DEC, VALS(rdp_wErrorCode_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_wStateTransition,
      { "stateTransition", "rdp.stateTransition",
        FT_UINT32, BASE_DEC, VALS(rdp_wStateTransition_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_numberEntries,
      { "numberEntries", "rdp.numberEntries",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_totalNumberEntries,
      { "totalNumberEntries", "rdp.totalNumberEntries",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_mapFlags,
      { "mapFlags", "rdp.mapFlags",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_fontMapFirst,
      { "fontMapFirst", "rdp.mapFlags.fontMapFirst",
        FT_UINT16, BASE_HEX, NULL, FONTMAP_FIRST,
        NULL, HFILL }},
    { &hf_rdp_fontMapLast,
      { "fontMapLast", "rdp.mapFlags.fontMapLast",
        FT_UINT16, BASE_HEX, NULL, FONTMAP_LAST,
        NULL, HFILL }},
    { &hf_rdp_entrySize,
      { "entrySize", "rdp.entrySize",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_action,
      { "action", "rdp.action",
        FT_UINT16, BASE_HEX, VALS(rdp_action_vals),
        0,
        NULL, HFILL }},
    { &hf_rdp_grantId,
      { "grantId", "rdp.grantId",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_controlId,
      { "controlId", "rdp.controlId",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_messageType,
      { "messageType", "rdp.messageType",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_targetUser,
      { "targetUser", "rdp.targetUser",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_numEntriesCache0,
      { "numEntriesCache0", "rdp.numEntriesCache0",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_numEntriesCache1,
      { "numEntriesCache1", "rdp.numEntriesCache1",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_numEntriesCache2,
      { "numEntriesCache2", "rdp.numEntriesCache2",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_numEntriesCache3,
      { "numEntriesCache3", "rdp.numEntriesCache3",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_numEntriesCache4,
      { "numEntriesCache4", "rdp.numEntriesCache4",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_totalEntriesCache0,
      { "totalEntriesCache0", "rdp.totalEntriesCache0",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_totalEntriesCache1,
      { "totalEntriesCache1", "rdp.totalEntriesCache1",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_totalEntriesCache2,
      { "totalEntriesCache2", "rdp.totalEntriesCache2",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_totalEntriesCache3,
      { "totalEntriesCache3", "rdp.totalEntriesCache3",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_totalEntriesCache4,
      { "totalEntriesCache4", "rdp.totalEntriesCache4",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_bBitMask,
      { "bBitMask", "rdp.bBitMask",
        FT_UINT8, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_Pad2,
      { "Pad2", "rdp.Pad2",
        FT_UINT8, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_Pad3,
      { "Pad3", "rdp.Pad3",
        FT_UINT16, BASE_HEX, NULL, 0,
        NULL, HFILL }},
#if 0
    { &hf_rdp_Key1,
      { "Key1", "rdp.Key1",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
#endif
#if 0
    { &hf_rdp_Key2,
      { "Key2", "rdp.Key2",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
#endif
    { &hf_rdp_originatorId,
      { "originatorId", "rdp.OriginatorId",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_lengthSourceDescriptor,
      { "lengthSourceDescriptor", "rdp.lengthSourceDescriptor",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_lengthCombinedCapabilities,
      { "lengthCombinedCapabilities", "rdp.lengthCombinedCapabilities",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_sourceDescriptor,
      { "sourceDescriptor", "rdp.sourceDescriptor",
        FT_STRING, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_numberCapabilities,
      { "numberCapabilities", "rdp.numberCapabilities",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_pad2Octets,
      { "pad2Octets", "rdp.pad2Octets",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_capabilitySetType,
      { "capabilitySetType", "rdp.capabilitySetType",
        FT_UINT16, BASE_HEX, VALS(rdp_capabilityType_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_capabilitySet,
      { "capabilitySet", "rdp.capabilitySet",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_lengthCapability,
      { "lengthCapability", "rdp.lengthCapability",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_capabilityData,
      { "capabilityData", "rdp.capabilityData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
#if 0
    { &hf_rdp_unknownData,
      { "unknownData", "rdp.unknownData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
#endif
    { &hf_rdp_notYetImplemented,
      { "notYetImplemented", "rdp.notYetImplemented",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_encrypted,
      { "encryptedData", "rdp.encryptedData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
#if 0
    { &hf_rdp_compressed,
      { "compressedData", "rdp.compressedData",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
#endif
    { &hf_rdp_sessionId,
      { "sessionId", "rdp.sessionId",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_channelDefArray,
      { "channelDefArray", "rdp.channelDefArray",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_channelDef,
      { "channelDef", "rdp.channelDef",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_name,
      { "name", "rdp.name",
        FT_STRING, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_options,
      { "options", "rdp.options",
        FT_UINT32, BASE_HEX, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_optionsInitialized,
      { "optionsInitialized", "rdp.options.initialized",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_INITIALIZED,
        NULL, HFILL }},
    { &hf_rdp_optionsEncryptRDP,
      { "encryptRDP", "rdp.options.encrypt.rdp",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_ENCRYPT_RDP,
        NULL, HFILL }},
    { &hf_rdp_optionsEncryptSC,
      { "encryptSC", "rdp.options.encrypt.sc",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_ENCRYPT_SC,
        NULL, HFILL }},
    { &hf_rdp_optionsEncryptCS,
      { "encryptCS", "rdp.options.encrypt.cs",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_ENCRYPT_CS,
        NULL, HFILL }},
    { &hf_rdp_optionsPriHigh,
      { "priorityHigh", "rdp.options.priority.high",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_PRI_HIGH,
        NULL, HFILL }},
    { &hf_rdp_optionsPriMed,
      { "priorityMed", "rdp.options.priority.med",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_PRI_MED,
        NULL, HFILL }},
    { &hf_rdp_optionsPriLow,
      { "priorityLow", "rdp.options.priority.low",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_PRI_LOW,
        NULL, HFILL }},
    { &hf_rdp_optionsCompressRDP,
      { "compressRDP", "rdp.options.compress.rdp",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_COMPRESS_RDP,
        NULL, HFILL }},
    { &hf_rdp_optionsCompress,
      { "compress", "rdp.options.compress",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_COMPRESS,
        NULL, HFILL }},
    { &hf_rdp_optionsShowProtocol,
      { "showProtocol", "rdp.options.showprotocol",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_SHOW_PROTOCOL,
        NULL, HFILL }},
    { &hf_rdp_optionsRemoteControlPersistent,
      { "remoteControlPersistent", "rdp.options.remotecontrolpersistent",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_OPTION_REMOTE_CONTROL_PERSISTENT,
        NULL, HFILL }},
    { &hf_rdp_channelFlagFirst,
      { "channelFlagFirst", "rdp.channelFlag.first",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_FLAG_FIRST,
        NULL, HFILL }},
    { &hf_rdp_channelFlagLast,
      { "channelFlagLast", "rdp.channelFlag.last",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_FLAG_LAST,
        NULL, HFILL }},
    { &hf_rdp_channelFlagShowProtocol,
      { "channelFlagShowProtocol", "rdp.channelFlag.showProtocol",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_FLAG_SHOW_PROTOCOL,
        NULL, HFILL }},
    { &hf_rdp_channelFlagSuspend,
      { "channelFlagSuspend", "rdp.channelFlag.suspend",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_FLAG_SUSPEND,
        NULL, HFILL }},
    { &hf_rdp_channelFlagResume,
      { "channelFlagResume", "rdp.channelFlag.resume",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_FLAG_RESUME,
        NULL, HFILL }},
    { &hf_rdp_channelPacketCompressed,
      { "channelPacketCompressed", "rdp.channelPacket.compressed",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_PACKET_COMPRESSED,
        NULL, HFILL }},
    { &hf_rdp_channelPacketAtFront,
      { "channelPacketAtFront", "rdp.channelPacket.atFront",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_PACKET_AT_FRONT,
        NULL, HFILL }},
    { &hf_rdp_channelPacketFlushed,
      { "channelPacketFlushed", "rdp.channelPacket.flushed",
        FT_UINT32, BASE_HEX, NULL, CHANNEL_PACKET_FLUSHED,
        NULL, HFILL }},
    { &hf_rdp_channelPacketCompressionType,
      { "channelPacketCompresssionType", "rdp.channelPacket.compressionType",
        FT_UINT32, BASE_HEX, VALS(rdp_channelCompressionType_vals), ChannelCompressionTypeMask,
        NULL, HFILL }},
    { &hf_rdp_wYear,
      { "wYear", "rdp.wYear",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_wMonth,
      { "wMonth", "rdp.wMonth",
        FT_UINT16, BASE_DEC, VALS(rdp_wMonth_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_wDayOfWeek,
      { "wDayOfWeek", "rdp.wDayOfWeek",
        FT_UINT16, BASE_DEC, VALS(rdp_wDayOfWeek_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_wDay,
      { "wDay", "rdp.wDay",
        FT_UINT16, BASE_DEC, VALS(rdp_wDay_vals), 0,
        NULL, HFILL }},
    { &hf_rdp_wHour,
      { "wHour", "rdp.wHour",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_wMinute,
      { "wMinute", "rdp.wMinute",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_wSecond,
      { "wSecond", "rdp.wSecond",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_wMilliseconds,
      { "wMilliseconds", "rdp.wMilliseconds",
        FT_UINT16, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_Bias,
      { "Bias", "rdp.Bias",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_StandardBias,
      { "StandardBias", "rdp.Bias.standard",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_DaylightBias,
      { "DaylightBias", "rdp.Bias.daylight",
        FT_UINT32, BASE_DEC, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_StandardName,
      { "StandardName", "rdp.Name.Standard",
        FT_STRINGZ, BASE_NONE, NULL, 0,      /* zero-padded, not null-terminated */
        NULL, HFILL }},
    { &hf_rdp_StandardDate,
      { "StandardDate", "rdp.Date.Standard",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
    { &hf_rdp_DaylightName,
      { "DaylightName", "rdp.Name.Daylight",
        FT_STRINGZ, BASE_NONE, NULL, 0,      /* zero-padded, not null-terminated */
        NULL, HFILL }},
    { &hf_rdp_DaylightDate,
      { "DaylightDate", "rdp.Date.Daylight",
        FT_NONE, BASE_NONE, NULL, 0,
        NULL, HFILL }},
  };

  /* List of subtrees */
  static gint *ett[] = {
    &ett_rdp,
    &ett_negReq_flags,
    &ett_requestedProtocols,
    &ett_negRsp_flags,
    &ett_selectedProtocol,
    &ett_rdp_ClientData,
    &ett_rdp_ServerData,
    &ett_rdp_SendData,
    &ett_rdp_capabilitySet,
    &ett_rdp_channelDef,
    &ett_rdp_channelDefArray,
    &ett_rdp_channelFlags,
    &ett_rdp_channelIdArray,
    &ett_rdp_channelPDUHeader,
    &ett_rdp_clientClusterData,
    &ett_rdp_clientCoreData,
    &ett_rdp_clientInfoPDU,
    &ett_rdp_clientMonitorData,
    &ett_rdp_clientMonitorDefData,
    &ett_rdp_clientMonitorExData,
    &ett_rdp_clientMsgChannelData,
    &ett_rdp_clientMultiTransportData,
    &ett_rdp_clientNetworkData,
    &ett_rdp_clientSecurityData,
    &ett_rdp_clientUnknownData,
    &ett_rdp_compressedType,
    &ett_rdp_flags,
    &ett_rdp_mapFlags,
    &ett_rdp_options,
    &ett_rdp_pduType,
    &ett_rdp_securityExchangePDU,
    &ett_rdp_serverCoreData,
    &ett_rdp_serverMsgChannelData,
    &ett_rdp_serverMultiTransportData,
    &ett_rdp_serverNetworkData,
    &ett_rdp_serverSecurityData,
    &ett_rdp_serverUnknownData,
    &ett_rdp_shareControlHeader,
    &ett_rdp_validClientLicenseData,
    &ett_rdp_StandardDate,
    &ett_rdp_DaylightDate,
    &ett_rdp_clientTimeZone,
  };
  static ei_register_info ei[] = {
     { &ei_rdp_neg_len_invalid, { "rdp.neg_len.invalid", PI_PROTOCOL, PI_ERROR, "Invalid length", EXPFILL }},
     { &ei_rdp_not_correlation_info, { "rdp.not_correlation_info", PI_PROTOCOL, PI_ERROR, "What follows RDP Negotiation Request is not an RDP Correlation Info", EXPFILL }},
  };
  module_t *rdp_module;
  expert_module_t* expert_rdp;

  /* Register protocol */
  proto_rdp = proto_register_protocol(PNAME, PSNAME, PFNAME);
  /* Register fields and subtrees */
  proto_register_field_array(proto_rdp, hf, array_length(hf));
  proto_register_subtree_array(ett, array_length(ett));
  expert_rdp = expert_register_protocol(proto_rdp);
  expert_register_field_array(expert_rdp, ei, array_length(ei));

  /*   register_dissector("rdp", dissect_rdp, proto_rdp); */

  /* Register our configuration options for RDP, particularly our port */

  rdp_module = prefs_register_protocol(proto_rdp, NULL);

  prefs_register_obsolete_preference(rdp_module, "tcp.port");

  prefs_register_static_text_preference(rdp_module, "tcp_port_info",
            "The TCP ports used by the RDP protocol should be added to the TPKT preference \"TPKT TCP ports\", or by selecting \"TPKT\" as the \"Transport\" protocol in the \"Decode As\" dialog.",
            "RDP TCP Port preference moved information");
}

void
proto_reg_handoff_rdp(void)
{
  heur_dissector_add("cotp_cr", dissect_rdp_cr, "RDP", "rdp_cr", proto_rdp, HEURISTIC_ENABLE);
  heur_dissector_add("cotp_cc", dissect_rdp_cc, "RDP", "rdp_cc", proto_rdp, HEURISTIC_ENABLE);

  register_t124_ns_dissector("Duca", dissect_rdp_ClientData, proto_rdp);
  register_t124_ns_dissector("McDn", dissect_rdp_ServerData, proto_rdp);
}

/*
 * Editor modelines  -  http://www.wireshark.org/tools/modelines.html
 *
 * Local Variables:
 * c-basic-offset: 2
 * tab-width: 8
 * indent-tabs-mode: nil
 * End:
 *
 * ex: set shiftwidth=2 tabstop=8 expandtab:
 * :indentSize=2:tabSize=8:noTabs=true:
 */
