### ms-lsad.idl
"""
RPC definitions for the following interfaces:
- lsarpc (v0.0): 12345778-1234-ABCD-EF00-0123456789AB
This file is auto-generated by midl-to-scapy, do not modify.
"""

from enum import IntEnum
import uuid

from scapy.fields import StrFixedLenField
from scapy.layers.dcerpc import (
    NDRPacket,
    DceRpcOp,
    NDRByteField,
    NDRConfFieldListField,
    NDRConfPacketListField,
    NDRConfStrLenField,
    NDRConfVarStrLenField,
    NDRConfVarStrLenFieldUtf16,
    NDRConfVarStrNullField,
    NDRConfVarStrNullFieldUtf16,
    NDRContextHandle,
    NDRFullPointerField,
    NDRInt3264EnumField,
    NDRIntField,
    NDRPacketField,
    NDRShortField,
    NDRSignedIntField,
    NDRSignedLongField,
    NDRSignedShortField,
    NDRUnionField,
    register_dcerpc_interface,
)


class LsarClose_Request(NDRPacket):
    fields_desc = [NDRPacketField("ObjectHandle", NDRContextHandle(), NDRContextHandle)]


class LsarClose_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("ObjectHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class RPC_UNICODE_STRING(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRShortField("Length", None, size_of="Buffer", adjust=lambda _, x: (x * 2)),
        NDRShortField(
            "MaximumLength", None, size_of="Buffer", adjust=lambda _, x: (x * 2)
        ),
        NDRFullPointerField(
            NDRConfVarStrLenFieldUtf16(
                "Buffer",
                "",
                size_is=lambda pkt: (pkt.MaximumLength // 2),
                length_is=lambda pkt: (pkt.Length // 2),
            ),
            deferred=True,
        ),
    ]


class LUID(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRIntField("LowPart", 0), NDRSignedIntField("HighPart", 0)]


class PLSAPR_POLICY_PRIVILEGE_DEF(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("LocalValue", LUID(), LUID),
    ]


class PLSAPR_PRIVILEGE_ENUM_BUFFER(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Entries", None, size_of="Privileges"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "Privileges",
                [PLSAPR_POLICY_PRIVILEGE_DEF()],
                PLSAPR_POLICY_PRIVILEGE_DEF,
                size_is=lambda pkt: pkt.Entries,
            ),
            deferred=True,
        ),
    ]


class LsarEnumeratePrivileges_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("EnumerationContext", 0),
        NDRIntField("PreferedMaximumLength", 0),
    ]


class LsarEnumeratePrivileges_Response(NDRPacket):
    fields_desc = [
        NDRIntField("EnumerationContext", 0),
        NDRPacketField(
            "EnumerationBuffer",
            PLSAPR_PRIVILEGE_ENUM_BUFFER(),
            PLSAPR_PRIVILEGE_ENUM_BUFFER,
        ),
        NDRIntField("status", 0),
    ]


class PLSAPR_SR_SECURITY_DESCRIPTOR(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Length", None, size_of="SecurityDescriptor"),
        NDRFullPointerField(
            NDRConfStrLenField(
                "SecurityDescriptor", "", size_is=lambda pkt: pkt.Length
            ),
            deferred=True,
        ),
    ]


class LsarQuerySecurityObject_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("ObjectHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("SecurityInformation", 0),
    ]


class LsarQuerySecurityObject_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField(
                "SecurityDescriptor",
                PLSAPR_SR_SECURITY_DESCRIPTOR(),
                PLSAPR_SR_SECURITY_DESCRIPTOR,
            )
        ),
        NDRIntField("status", 0),
    ]


class LsarSetSecurityObject_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("ObjectHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("SecurityInformation", 0),
        NDRPacketField(
            "SecurityDescriptor",
            PLSAPR_SR_SECURITY_DESCRIPTOR(),
            PLSAPR_SR_SECURITY_DESCRIPTOR,
        ),
    ]


class LsarSetSecurityObject_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class PSTRING(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRShortField("Length", None, size_of="Buffer"),
        NDRShortField("MaximumLength", None, size_of="Buffer"),
        NDRFullPointerField(
            NDRConfVarStrLenField(
                "Buffer",
                "",
                size_is=lambda pkt: pkt.MaximumLength,
                length_is=lambda pkt: pkt.Length,
            ),
            deferred=True,
        ),
    ]


class RPC_SID_IDENTIFIER_AUTHORITY(NDRPacket):
    fields_desc = [StrFixedLenField("Value", "", length=6)]


class PRPC_SID(NDRPacket):
    ALIGNMENT = (4, 8)
    DEPORTED_CONFORMANTS = ["SubAuthority"]
    fields_desc = [
        NDRByteField("Revision", 0),
        NDRByteField("SubAuthorityCount", None, size_of="SubAuthority"),
        NDRPacketField(
            "IdentifierAuthority",
            RPC_SID_IDENTIFIER_AUTHORITY(),
            RPC_SID_IDENTIFIER_AUTHORITY,
        ),
        NDRConfFieldListField(
            "SubAuthority",
            [],
            NDRIntField("", 0),
            size_is=lambda pkt: pkt.SubAuthorityCount,
            conformant_in_struct=True,
        ),
    ]


class PLSAPR_ACL(NDRPacket):
    ALIGNMENT = (2, 2)
    DEPORTED_CONFORMANTS = ["Dummy1"]
    fields_desc = [
        NDRByteField("AclRevision", 0),
        NDRByteField("Sbz1", 0),
        NDRShortField("AclSize", None, size_of="Dummy1", adjust=lambda _, x: (x + 4)),
        NDRConfStrLenField(
            "Dummy1",
            "",
            size_is=lambda pkt: (pkt.AclSize - 4),
            conformant_in_struct=True,
        ),
    ]


class PLSAPR_SECURITY_DESCRIPTOR(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRByteField("Revision", 0),
        NDRByteField("Sbz1", 0),
        NDRShortField("Control", 0),
        NDRFullPointerField(
            NDRPacketField("Owner", PRPC_SID(), PRPC_SID), deferred=True
        ),
        NDRFullPointerField(
            NDRPacketField("Group", PRPC_SID(), PRPC_SID), deferred=True
        ),
        NDRFullPointerField(
            NDRPacketField("Sacl", PLSAPR_ACL(), PLSAPR_ACL), deferred=True
        ),
        NDRFullPointerField(
            NDRPacketField("Dacl", PLSAPR_ACL(), PLSAPR_ACL), deferred=True
        ),
    ]


class SECURITY_IMPERSONATION_LEVEL(IntEnum):
    SecurityAnonymous = 0
    SecurityIdentification = 1
    SecurityImpersonation = 2
    SecurityDelegation = 3


class PSECURITY_QUALITY_OF_SERVICE(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [
        NDRIntField("Length", 0),
        NDRInt3264EnumField("ImpersonationLevel", 0, SECURITY_IMPERSONATION_LEVEL),
        NDRByteField("ContextTrackingMode", 0),
        NDRByteField("EffectiveOnly", 0),
    ]


class PLSAPR_OBJECT_ATTRIBUTES(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Length", 0),
        NDRFullPointerField(NDRByteField("RootDirectory", 0), deferred=True),
        NDRFullPointerField(
            NDRPacketField("ObjectName", PSTRING(), PSTRING), deferred=True
        ),
        NDRIntField("Attributes", 0),
        NDRFullPointerField(
            NDRPacketField(
                "SecurityDescriptor",
                PLSAPR_SECURITY_DESCRIPTOR(),
                PLSAPR_SECURITY_DESCRIPTOR,
            ),
            deferred=True,
        ),
        NDRFullPointerField(
            NDRPacketField(
                "SecurityQualityOfService",
                PSECURITY_QUALITY_OF_SERVICE(),
                PSECURITY_QUALITY_OF_SERVICE,
            ),
            deferred=True,
        ),
    ]


class LsarOpenPolicy_Request(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRShortField("SystemName", 0)),
        NDRPacketField(
            "ObjectAttributes", PLSAPR_OBJECT_ATTRIBUTES(), PLSAPR_OBJECT_ATTRIBUTES
        ),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarOpenPolicy_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class POLICY_INFORMATION_CLASS(IntEnum):
    PolicyAuditLogInformation = 1
    PolicyAuditEventsInformation = 2
    PolicyPrimaryDomainInformation = 3
    PolicyPdAccountInformation = 4
    PolicyAccountDomainInformation = 5
    PolicyLsaServerRoleInformation = 6
    PolicyReplicaSourceInformation = 7
    PolicyInformationNotUsedOnWire = 8
    PolicyModificationInformation = 9
    PolicyAuditFullSetInformation = 10
    PolicyAuditFullQueryInformation = 11
    PolicyDnsDomainInformation = 12
    PolicyDnsDomainInformationInt = 13
    PolicyLocalAccountDomainInformation = 14
    PolicyMachineAccountInformation = 15
    PolicyLastEntry = 16


class LARGE_INTEGER(NDRPacket):
    ALIGNMENT = (8, 8)
    fields_desc = [NDRSignedLongField("QuadPart", 0)]


class POLICY_AUDIT_LOG_INFO(NDRPacket):
    ALIGNMENT = (8, 8)
    fields_desc = [
        NDRIntField("AuditLogPercentFull", 0),
        NDRIntField("MaximumLogSize", 0),
        NDRPacketField("AuditRetentionPeriod", LARGE_INTEGER(), LARGE_INTEGER),
        NDRByteField("AuditLogFullShutdownInProgress", 0),
        NDRPacketField("TimeToShutdown", LARGE_INTEGER(), LARGE_INTEGER),
        NDRIntField("NextAuditRecordId", 0),
    ]


class LSAPR_POLICY_AUDIT_EVENTS_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRByteField("AuditingMode", 0),
        NDRFullPointerField(
            NDRConfFieldListField(
                "EventAuditingOptions",
                [],
                NDRIntField("EventAuditingOptions", 0),
                size_is=lambda pkt: pkt.MaximumAuditEventCount,
            ),
            deferred=True,
        ),
        NDRIntField("MaximumAuditEventCount", None, size_of="EventAuditingOptions"),
    ]


class LSAPR_POLICY_PRIMARY_DOM_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
    ]


class LSAPR_POLICY_ACCOUNT_DOM_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("DomainName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRFullPointerField(
            NDRPacketField("DomainSid", PRPC_SID(), PRPC_SID), deferred=True
        ),
    ]


class LSAPR_POLICY_PD_ACCOUNT_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING)]


class POLICY_LSA_SERVER_ROLE(IntEnum):
    PolicyServerRoleBackup = 2
    PolicyServerRolePrimary = 3


class POLICY_LSA_SERVER_ROLE_INFO(NDRPacket):
    ALIGNMENT = (2, 4)
    fields_desc = [NDRInt3264EnumField("LsaServerRole", 0, POLICY_LSA_SERVER_ROLE)]


class LSAPR_POLICY_REPLICA_SRCE_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("ReplicaSource", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("ReplicaAccountName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
    ]


class POLICY_MODIFICATION_INFO(NDRPacket):
    ALIGNMENT = (8, 8)
    fields_desc = [
        NDRPacketField("ModifiedId", LARGE_INTEGER(), LARGE_INTEGER),
        NDRPacketField("DatabaseCreationTime", LARGE_INTEGER(), LARGE_INTEGER),
    ]


class POLICY_AUDIT_FULL_SET_INFO(NDRPacket):
    fields_desc = [NDRByteField("ShutDownOnFull", 0)]


class POLICY_AUDIT_FULL_QUERY_INFO(NDRPacket):
    fields_desc = [NDRByteField("ShutDownOnFull", 0), NDRByteField("LogIsFull", 0)]


class GUID(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [
        NDRIntField("Data1", 0),
        NDRShortField("Data2", 0),
        NDRShortField("Data3", 0),
        StrFixedLenField("Data4", "", length=8),
    ]


class LSAPR_POLICY_DNS_DOMAIN_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("DnsDomainName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("DnsForestName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("DomainGuid", GUID(), GUID),
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
    ]


class LSAPR_POLICY_MACHINE_ACCT_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Rid", 0),
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
    ]


class LsarQueryInformationPolicy_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRInt3264EnumField("InformationClass", 0, POLICY_INFORMATION_CLASS),
    ]


class LsarQueryInformationPolicy_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRUnionField(
                [
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_AUDIT_LOG_INFO(),
                            POLICY_AUDIT_LOG_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_AUDIT_EVENTS_INFO(),
                            LSAPR_POLICY_AUDIT_EVENTS_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_PRIMARY_DOM_INFO(),
                            LSAPR_POLICY_PRIMARY_DOM_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_ACCOUNT_DOM_INFO(),
                            LSAPR_POLICY_ACCOUNT_DOM_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_PD_ACCOUNT_INFO(),
                            LSAPR_POLICY_PD_ACCOUNT_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_LSA_SERVER_ROLE_INFO(),
                            POLICY_LSA_SERVER_ROLE_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_REPLICA_SRCE_INFO(),
                            LSAPR_POLICY_REPLICA_SRCE_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_MODIFICATION_INFO(),
                            POLICY_MODIFICATION_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyModificationInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyModificationInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_AUDIT_FULL_SET_INFO(),
                            POLICY_AUDIT_FULL_SET_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAuditFullSetInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAuditFullSetInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_AUDIT_FULL_QUERY_INFO(),
                            POLICY_AUDIT_FULL_QUERY_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAuditFullQueryInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAuditFullQueryInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_DNS_DOMAIN_INFO(),
                            LSAPR_POLICY_DNS_DOMAIN_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_DNS_DOMAIN_INFO(),
                            LSAPR_POLICY_DNS_DOMAIN_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_ACCOUNT_DOM_INFO(),
                            LSAPR_POLICY_ACCOUNT_DOM_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_MACHINE_ACCT_INFO(),
                            LSAPR_POLICY_MACHINE_ACCT_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyMachineAccountInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyMachineAccountInformation
                            ),
                        ),
                    ),
                ],
                StrFixedLenField("PolicyInformation", "", length=0),
                align=(2, 8),
                switch_fmt=("H", "I"),
            )
        ),
        NDRIntField("status", 0),
    ]


class LsarSetInformationPolicy_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRInt3264EnumField("InformationClass", 0, POLICY_INFORMATION_CLASS),
        NDRUnionField(
            [
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_AUDIT_LOG_INFO(),
                        POLICY_AUDIT_LOG_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_AUDIT_EVENTS_INFO(),
                        LSAPR_POLICY_AUDIT_EVENTS_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_PRIMARY_DOM_INFO(),
                        LSAPR_POLICY_PRIMARY_DOM_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_ACCOUNT_DOM_INFO(),
                        LSAPR_POLICY_ACCOUNT_DOM_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_PD_ACCOUNT_INFO(),
                        LSAPR_POLICY_PD_ACCOUNT_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_LSA_SERVER_ROLE_INFO(),
                        POLICY_LSA_SERVER_ROLE_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_REPLICA_SRCE_INFO(),
                        LSAPR_POLICY_REPLICA_SRCE_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_MODIFICATION_INFO(),
                        POLICY_MODIFICATION_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyModificationInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyModificationInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_AUDIT_FULL_SET_INFO(),
                        POLICY_AUDIT_FULL_SET_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAuditFullSetInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAuditFullSetInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_AUDIT_FULL_QUERY_INFO(),
                        POLICY_AUDIT_FULL_QUERY_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAuditFullQueryInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAuditFullQueryInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_DNS_DOMAIN_INFO(),
                        LSAPR_POLICY_DNS_DOMAIN_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_DNS_DOMAIN_INFO(),
                        LSAPR_POLICY_DNS_DOMAIN_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_ACCOUNT_DOM_INFO(),
                        LSAPR_POLICY_ACCOUNT_DOM_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_MACHINE_ACCT_INFO(),
                        LSAPR_POLICY_MACHINE_ACCT_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyMachineAccountInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyMachineAccountInformation
                        ),
                    ),
                ),
            ],
            StrFixedLenField("PolicyInformation", "", length=0),
            align=(2, 8),
            switch_fmt=("H", "I"),
        ),
    ]


class LsarSetInformationPolicy_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarCreateAccount_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("AccountSid", PRPC_SID(), PRPC_SID),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarCreateAccount_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("AccountHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class PLSAPR_ACCOUNT_INFORMATION(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True)
    ]


class PLSAPR_ACCOUNT_ENUM_BUFFER(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("EntriesRead", None, size_of="Information"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "Information",
                [PLSAPR_ACCOUNT_INFORMATION()],
                PLSAPR_ACCOUNT_INFORMATION,
                size_is=lambda pkt: pkt.EntriesRead,
            ),
            deferred=True,
        ),
    ]


class LsarEnumerateAccounts_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("EnumerationContext", 0),
        NDRIntField("PreferedMaximumLength", 0),
    ]


class LsarEnumerateAccounts_Response(NDRPacket):
    fields_desc = [
        NDRIntField("EnumerationContext", 0),
        NDRPacketField(
            "EnumerationBuffer",
            PLSAPR_ACCOUNT_ENUM_BUFFER(),
            PLSAPR_ACCOUNT_ENUM_BUFFER,
        ),
        NDRIntField("status", 0),
    ]


class PLSAPR_TRUST_INFORMATION(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
    ]


class LsarCreateTrustedDomain_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField(
            "TrustedDomainInformation",
            PLSAPR_TRUST_INFORMATION(),
            PLSAPR_TRUST_INFORMATION,
        ),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarCreateTrustedDomain_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("TrustedDomainHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class PLSAPR_TRUSTED_ENUM_BUFFER(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("EntriesRead", None, size_of="Information"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "Information",
                [PLSAPR_TRUST_INFORMATION()],
                PLSAPR_TRUST_INFORMATION,
                size_is=lambda pkt: pkt.EntriesRead,
            ),
            deferred=True,
        ),
    ]


class LsarEnumerateTrustedDomains_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("EnumerationContext", 0),
        NDRIntField("PreferedMaximumLength", 0),
    ]


class LsarEnumerateTrustedDomains_Response(NDRPacket):
    fields_desc = [
        NDRIntField("EnumerationContext", 0),
        NDRPacketField(
            "EnumerationBuffer",
            PLSAPR_TRUSTED_ENUM_BUFFER(),
            PLSAPR_TRUSTED_ENUM_BUFFER,
        ),
        NDRIntField("status", 0),
    ]


class PRPC_UNICODE_STRING(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRShortField("Length", None, size_of="Buffer", adjust=lambda _, x: (x * 2)),
        NDRShortField(
            "MaximumLength", None, size_of="Buffer", adjust=lambda _, x: (x * 2)
        ),
        NDRFullPointerField(
            NDRConfVarStrLenFieldUtf16(
                "Buffer",
                "",
                size_is=lambda pkt: (pkt.MaximumLength // 2),
                length_is=lambda pkt: (pkt.Length // 2),
            ),
            deferred=True,
        ),
    ]


class LsarCreateSecret_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("SecretName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarCreateSecret_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("SecretHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class LsarOpenAccount_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("AccountSid", PRPC_SID(), PRPC_SID),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarOpenAccount_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("AccountHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class LSAPR_LUID_AND_ATTRIBUTES(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRPacketField("Luid", LUID(), LUID), NDRIntField("Attributes", 0)]


class PLSAPR_PRIVILEGE_SET(NDRPacket):
    ALIGNMENT = (4, 4)
    DEPORTED_CONFORMANTS = ["Privilege"]
    fields_desc = [
        NDRIntField("PrivilegeCount", None, size_of="Privilege"),
        NDRIntField("Control", 0),
        NDRConfPacketListField(
            "Privilege",
            [],
            LSAPR_LUID_AND_ATTRIBUTES,
            size_is=lambda pkt: pkt.PrivilegeCount,
            conformant_in_struct=True,
        ),
    ]


class LsarEnumeratePrivilegesAccount_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("AccountHandle", NDRContextHandle(), NDRContextHandle)
    ]


class LsarEnumeratePrivilegesAccount_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField("Privileges", PLSAPR_PRIVILEGE_SET(), PLSAPR_PRIVILEGE_SET)
        ),
        NDRIntField("status", 0),
    ]


class LsarAddPrivilegesToAccount_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("AccountHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("Privileges", PLSAPR_PRIVILEGE_SET(), PLSAPR_PRIVILEGE_SET),
    ]


class LsarAddPrivilegesToAccount_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarRemovePrivilegesFromAccount_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("AccountHandle", NDRContextHandle(), NDRContextHandle),
        NDRByteField("AllPrivileges", 0),
        NDRFullPointerField(
            NDRPacketField("Privileges", PLSAPR_PRIVILEGE_SET(), PLSAPR_PRIVILEGE_SET)
        ),
    ]


class LsarRemovePrivilegesFromAccount_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarGetSystemAccessAccount_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("AccountHandle", NDRContextHandle(), NDRContextHandle)
    ]


class LsarGetSystemAccessAccount_Response(NDRPacket):
    fields_desc = [NDRIntField("SystemAccess", 0), NDRIntField("status", 0)]


class LsarSetSystemAccessAccount_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("AccountHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("SystemAccess", 0),
    ]


class LsarSetSystemAccessAccount_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarOpenTrustedDomain_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainSid", PRPC_SID(), PRPC_SID),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarOpenTrustedDomain_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("TrustedDomainHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class TRUSTED_INFORMATION_CLASS(IntEnum):
    TrustedDomainNameInformation = 1
    TrustedControllersInformation = 2
    TrustedPosixOffsetInformation = 3
    TrustedPasswordInformation = 4
    TrustedDomainInformationBasic = 5
    TrustedDomainInformationEx = 6
    TrustedDomainAuthInformation = 7
    TrustedDomainFullInformation = 8
    TrustedDomainAuthInformationInternal = 9
    TrustedDomainFullInformationInternal = 10
    TrustedDomainInformationEx2Internal = 11
    TrustedDomainFullInformation2Internal = 12
    TrustedDomainSupportedEncryptionTypes = 13
    TrustedDomainAuthInformationInternalAes = 14
    TrustedDomainFullInformationInternalAes = 15


class LSAPR_TRUSTED_DOMAIN_NAME_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING)]


class LSAPR_TRUSTED_CONTROLLERS_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Entries", None, size_of="Names"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "Names",
                [PRPC_UNICODE_STRING()],
                PRPC_UNICODE_STRING,
                size_is=lambda pkt: pkt.Entries,
            ),
            deferred=True,
        ),
    ]


class TRUSTED_POSIX_OFFSET_INFO(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRIntField("Offset", 0)]


class PLSAPR_CR_CIPHER_VALUE(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Length", None, size_of="Buffer"),
        NDRIntField("MaximumLength", None, size_of="Buffer"),
        NDRFullPointerField(
            NDRConfVarStrLenField(
                "Buffer",
                "",
                size_is=lambda pkt: pkt.MaximumLength,
                length_is=lambda pkt: pkt.Length,
            ),
            deferred=True,
        ),
    ]


class LSAPR_TRUSTED_PASSWORD_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField(
                "Password", PLSAPR_CR_CIPHER_VALUE(), PLSAPR_CR_CIPHER_VALUE
            ),
            deferred=True,
        ),
        NDRFullPointerField(
            NDRPacketField(
                "OldPassword", PLSAPR_CR_CIPHER_VALUE(), PLSAPR_CR_CIPHER_VALUE
            ),
            deferred=True,
        ),
    ]


class LSAPR_TRUST_INFORMATION(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
    ]


class LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("FlatName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
        NDRIntField("TrustDirection", 0),
        NDRIntField("TrustType", 0),
        NDRIntField("TrustAttributes", 0),
    ]


class PLSAPR_AUTH_INFORMATION(NDRPacket):
    ALIGNMENT = (8, 8)
    fields_desc = [
        NDRPacketField("LastUpdateTime", LARGE_INTEGER(), LARGE_INTEGER),
        NDRIntField("AuthType", 0),
        NDRIntField("AuthInfoLength", None, size_of="AuthInfo"),
        NDRFullPointerField(
            NDRConfStrLenField("AuthInfo", "", size_is=lambda pkt: pkt.AuthInfoLength),
            deferred=True,
        ),
    ]


class LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("IncomingAuthInfos", 0),
        NDRFullPointerField(
            NDRPacketField(
                "IncomingAuthenticationInformation",
                PLSAPR_AUTH_INFORMATION(),
                PLSAPR_AUTH_INFORMATION,
            ),
            deferred=True,
        ),
        NDRFullPointerField(
            NDRPacketField(
                "IncomingPreviousAuthenticationInformation",
                PLSAPR_AUTH_INFORMATION(),
                PLSAPR_AUTH_INFORMATION,
            ),
            deferred=True,
        ),
        NDRIntField("OutgoingAuthInfos", 0),
        NDRFullPointerField(
            NDRPacketField(
                "OutgoingAuthenticationInformation",
                PLSAPR_AUTH_INFORMATION(),
                PLSAPR_AUTH_INFORMATION,
            ),
            deferred=True,
        ),
        NDRFullPointerField(
            NDRPacketField(
                "OutgoingPreviousAuthenticationInformation",
                PLSAPR_AUTH_INFORMATION(),
                PLSAPR_AUTH_INFORMATION,
            ),
            deferred=True,
        ),
    ]


class LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField(
            "Information",
            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
        ),
        NDRPacketField(
            "PosixOffset", TRUSTED_POSIX_OFFSET_INFO(), TRUSTED_POSIX_OFFSET_INFO
        ),
        NDRPacketField(
            "AuthInformation",
            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
        ),
    ]


class LSAPR_TRUSTED_DOMAIN_AUTH_BLOB(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("AuthSize", None, size_of="AuthBlob"),
        NDRFullPointerField(
            NDRConfStrLenField("AuthBlob", "", size_is=lambda pkt: pkt.AuthSize),
            deferred=True,
        ),
    ]


class LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField(
            "AuthBlob", LSAPR_TRUSTED_DOMAIN_AUTH_BLOB(), LSAPR_TRUSTED_DOMAIN_AUTH_BLOB
        )
    ]


class LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField(
            "Information",
            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
        ),
        NDRPacketField(
            "PosixOffset", TRUSTED_POSIX_OFFSET_INFO(), TRUSTED_POSIX_OFFSET_INFO
        ),
        NDRPacketField(
            "AuthInformation",
            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(),
            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL,
        ),
    ]


class LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("FlatName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
        NDRIntField("TrustDirection", 0),
        NDRIntField("TrustType", 0),
        NDRIntField("TrustAttributes", 0),
        NDRIntField("ForestTrustLength", None, size_of="ForestTrustInfo"),
        NDRFullPointerField(
            NDRConfStrLenField(
                "ForestTrustInfo", "", size_is=lambda pkt: pkt.ForestTrustLength
            ),
            deferred=True,
        ),
    ]


class LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField(
            "Information",
            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2(),
            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2,
        ),
        NDRPacketField(
            "PosixOffset", TRUSTED_POSIX_OFFSET_INFO(), TRUSTED_POSIX_OFFSET_INFO
        ),
        NDRPacketField(
            "AuthInformation",
            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
        ),
    ]


class TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRIntField("SupportedEncryptionTypes", 0)]


class LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        StrFixedLenField("AuthData", "", length=64),
        StrFixedLenField("Salt", "", length=16),
        NDRIntField("cbCipher", None, size_of="Cipher"),
        NDRFullPointerField(
            NDRConfStrLenField("Cipher", "", size_is=lambda pkt: pkt.cbCipher),
            deferred=True,
        ),
    ]


class LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField(
            "Information",
            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
        ),
        NDRPacketField(
            "PosixOffset", TRUSTED_POSIX_OFFSET_INFO(), TRUSTED_POSIX_OFFSET_INFO
        ),
        NDRPacketField(
            "AuthInformation",
            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(),
            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES,
        ),
    ]


class LsarQueryInfoTrustedDomain_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("TrustedDomainHandle", NDRContextHandle(), NDRContextHandle),
        NDRInt3264EnumField("InformationClass", 0, TRUSTED_INFORMATION_CLASS),
    ]


class LsarQueryInfoTrustedDomain_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRUnionField(
                [
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_NAME_INFO(),
                            LSAPR_TRUSTED_DOMAIN_NAME_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_CONTROLLERS_INFO(),
                            LSAPR_TRUSTED_CONTROLLERS_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            TRUSTED_POSIX_OFFSET_INFO(),
                            TRUSTED_POSIX_OFFSET_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_PASSWORD_INFO(),
                            LSAPR_TRUSTED_PASSWORD_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUST_INFORMATION(),
                            LSAPR_TRUST_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2(),
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES(),
                            TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                            ),
                        ),
                    ),
                ],
                StrFixedLenField("TrustedDomainInformation", "", length=0),
                align=(2, 8),
                switch_fmt=("H", "I"),
            )
        ),
        NDRIntField("status", 0),
    ]


class LsarSetInformationTrustedDomain_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("TrustedDomainHandle", NDRContextHandle(), NDRContextHandle),
        NDRInt3264EnumField("InformationClass", 0, TRUSTED_INFORMATION_CLASS),
        NDRUnionField(
            [
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_NAME_INFO(),
                        LSAPR_TRUSTED_DOMAIN_NAME_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_CONTROLLERS_INFO(),
                        LSAPR_TRUSTED_CONTROLLERS_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        TRUSTED_POSIX_OFFSET_INFO(),
                        TRUSTED_POSIX_OFFSET_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_PASSWORD_INFO(),
                        LSAPR_TRUSTED_PASSWORD_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUST_INFORMATION(),
                        LSAPR_TRUST_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2(),
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES(),
                        TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                        ),
                    ),
                ),
            ],
            StrFixedLenField("TrustedDomainInformation", "", length=0),
            align=(2, 8),
            switch_fmt=("H", "I"),
        ),
    ]


class LsarSetInformationTrustedDomain_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarOpenSecret_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("SecretName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarOpenSecret_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("SecretHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class LsarSetSecret_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("SecretHandle", NDRContextHandle(), NDRContextHandle),
        NDRFullPointerField(
            NDRPacketField(
                "EncryptedCurrentValue",
                PLSAPR_CR_CIPHER_VALUE(),
                PLSAPR_CR_CIPHER_VALUE,
            )
        ),
        NDRFullPointerField(
            NDRPacketField(
                "EncryptedOldValue", PLSAPR_CR_CIPHER_VALUE(), PLSAPR_CR_CIPHER_VALUE
            )
        ),
    ]


class LsarSetSecret_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class PLARGE_INTEGER(NDRPacket):
    ALIGNMENT = (8, 8)
    fields_desc = [NDRSignedLongField("QuadPart", 0)]


class LsarQuerySecret_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("SecretHandle", NDRContextHandle(), NDRContextHandle),
        NDRFullPointerField(
            NDRFullPointerField(
                NDRPacketField(
                    "EncryptedCurrentValue",
                    PLSAPR_CR_CIPHER_VALUE(),
                    PLSAPR_CR_CIPHER_VALUE,
                )
            )
        ),
        NDRFullPointerField(
            NDRPacketField("CurrentValueSetTime", PLARGE_INTEGER(), PLARGE_INTEGER)
        ),
        NDRFullPointerField(
            NDRFullPointerField(
                NDRPacketField(
                    "EncryptedOldValue",
                    PLSAPR_CR_CIPHER_VALUE(),
                    PLSAPR_CR_CIPHER_VALUE,
                )
            )
        ),
        NDRFullPointerField(
            NDRPacketField("OldValueSetTime", PLARGE_INTEGER(), PLARGE_INTEGER)
        ),
    ]


class LsarQuerySecret_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRFullPointerField(
                NDRPacketField(
                    "EncryptedCurrentValue",
                    PLSAPR_CR_CIPHER_VALUE(),
                    PLSAPR_CR_CIPHER_VALUE,
                )
            )
        ),
        NDRFullPointerField(
            NDRPacketField("CurrentValueSetTime", PLARGE_INTEGER(), PLARGE_INTEGER)
        ),
        NDRFullPointerField(
            NDRFullPointerField(
                NDRPacketField(
                    "EncryptedOldValue",
                    PLSAPR_CR_CIPHER_VALUE(),
                    PLSAPR_CR_CIPHER_VALUE,
                )
            )
        ),
        NDRFullPointerField(
            NDRPacketField("OldValueSetTime", PLARGE_INTEGER(), PLARGE_INTEGER)
        ),
        NDRIntField("status", 0),
    ]


class PLUID(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRIntField("LowPart", 0), NDRSignedIntField("HighPart", 0)]


class LsarLookupPrivilegeValue_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("Name", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
    ]


class LsarLookupPrivilegeValue_Response(NDRPacket):
    fields_desc = [NDRPacketField("Value", PLUID(), PLUID), NDRIntField("status", 0)]


class LsarLookupPrivilegeName_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("Value", PLUID(), PLUID),
    ]


class LsarLookupPrivilegeName_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField("Name", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING)
        ),
        NDRIntField("status", 0),
    ]


class LsarLookupPrivilegeDisplayName_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("Name", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRSignedShortField("ClientLanguage", 0),
        NDRSignedShortField("ClientSystemDefaultLanguage", 0),
    ]


class LsarLookupPrivilegeDisplayName_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField("DisplayName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING)
        ),
        NDRShortField("LanguageReturned", 0),
        NDRIntField("status", 0),
    ]


class LsarDeleteObject_Request(NDRPacket):
    fields_desc = [NDRPacketField("ObjectHandle", NDRContextHandle(), NDRContextHandle)]


class LsarDeleteObject_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("ObjectHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class LsarEnumerateAccountsWithUserRight_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRFullPointerField(
            NDRPacketField("UserRight", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING)
        ),
    ]


class LsarEnumerateAccountsWithUserRight_Response(NDRPacket):
    fields_desc = [
        NDRPacketField(
            "EnumerationBuffer",
            PLSAPR_ACCOUNT_ENUM_BUFFER(),
            PLSAPR_ACCOUNT_ENUM_BUFFER,
        ),
        NDRIntField("status", 0),
    ]


class PLSAPR_USER_RIGHT_SET(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Entries", None, size_of="UserRights"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "UserRights",
                [PRPC_UNICODE_STRING()],
                PRPC_UNICODE_STRING,
                size_is=lambda pkt: pkt.Entries,
            ),
            deferred=True,
        ),
    ]


class LsarEnumerateAccountRights_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("AccountSid", PRPC_SID(), PRPC_SID),
    ]


class LsarEnumerateAccountRights_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("UserRights", PLSAPR_USER_RIGHT_SET(), PLSAPR_USER_RIGHT_SET),
        NDRIntField("status", 0),
    ]


class LsarAddAccountRights_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("AccountSid", PRPC_SID(), PRPC_SID),
        NDRPacketField("UserRights", PLSAPR_USER_RIGHT_SET(), PLSAPR_USER_RIGHT_SET),
    ]


class LsarAddAccountRights_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarRemoveAccountRights_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("AccountSid", PRPC_SID(), PRPC_SID),
        NDRByteField("AllRights", 0),
        NDRPacketField("UserRights", PLSAPR_USER_RIGHT_SET(), PLSAPR_USER_RIGHT_SET),
    ]


class LsarRemoveAccountRights_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarQueryTrustedDomainInfo_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainSid", PRPC_SID(), PRPC_SID),
        NDRInt3264EnumField("InformationClass", 0, TRUSTED_INFORMATION_CLASS),
    ]


class LsarQueryTrustedDomainInfo_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRUnionField(
                [
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_NAME_INFO(),
                            LSAPR_TRUSTED_DOMAIN_NAME_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_CONTROLLERS_INFO(),
                            LSAPR_TRUSTED_CONTROLLERS_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            TRUSTED_POSIX_OFFSET_INFO(),
                            TRUSTED_POSIX_OFFSET_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_PASSWORD_INFO(),
                            LSAPR_TRUSTED_PASSWORD_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUST_INFORMATION(),
                            LSAPR_TRUST_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2(),
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES(),
                            TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                            ),
                        ),
                    ),
                ],
                StrFixedLenField("TrustedDomainInformation", "", length=0),
                align=(2, 8),
                switch_fmt=("H", "I"),
            )
        ),
        NDRIntField("status", 0),
    ]


class LsarSetTrustedDomainInfo_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainSid", PRPC_SID(), PRPC_SID),
        NDRInt3264EnumField("InformationClass", 0, TRUSTED_INFORMATION_CLASS),
        NDRUnionField(
            [
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_NAME_INFO(),
                        LSAPR_TRUSTED_DOMAIN_NAME_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_CONTROLLERS_INFO(),
                        LSAPR_TRUSTED_CONTROLLERS_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        TRUSTED_POSIX_OFFSET_INFO(),
                        TRUSTED_POSIX_OFFSET_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_PASSWORD_INFO(),
                        LSAPR_TRUSTED_PASSWORD_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUST_INFORMATION(),
                        LSAPR_TRUST_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2(),
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES(),
                        TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                        ),
                    ),
                ),
            ],
            StrFixedLenField("TrustedDomainInformation", "", length=0),
            align=(2, 8),
            switch_fmt=("H", "I"),
        ),
    ]


class LsarSetTrustedDomainInfo_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarDeleteTrustedDomain_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainSid", PRPC_SID(), PRPC_SID),
    ]


class LsarDeleteTrustedDomain_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarStorePrivateData_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("KeyName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRFullPointerField(
            NDRPacketField(
                "EncryptedData", PLSAPR_CR_CIPHER_VALUE(), PLSAPR_CR_CIPHER_VALUE
            )
        ),
    ]


class LsarStorePrivateData_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarRetrievePrivateData_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("KeyName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRFullPointerField(
            NDRPacketField(
                "EncryptedData", PLSAPR_CR_CIPHER_VALUE(), PLSAPR_CR_CIPHER_VALUE
            )
        ),
    ]


class LsarRetrievePrivateData_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField(
                "EncryptedData", PLSAPR_CR_CIPHER_VALUE(), PLSAPR_CR_CIPHER_VALUE
            )
        ),
        NDRIntField("status", 0),
    ]


class LsarOpenPolicy2_Request(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRConfVarStrNullFieldUtf16("SystemName", "")),
        NDRPacketField(
            "ObjectAttributes", PLSAPR_OBJECT_ATTRIBUTES(), PLSAPR_OBJECT_ATTRIBUTES
        ),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarOpenPolicy2_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class LsarQueryInformationPolicy2_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRInt3264EnumField("InformationClass", 0, POLICY_INFORMATION_CLASS),
    ]


class LsarQueryInformationPolicy2_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRUnionField(
                [
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_AUDIT_LOG_INFO(),
                            POLICY_AUDIT_LOG_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_AUDIT_EVENTS_INFO(),
                            LSAPR_POLICY_AUDIT_EVENTS_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_PRIMARY_DOM_INFO(),
                            LSAPR_POLICY_PRIMARY_DOM_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_ACCOUNT_DOM_INFO(),
                            LSAPR_POLICY_ACCOUNT_DOM_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_PD_ACCOUNT_INFO(),
                            LSAPR_POLICY_PD_ACCOUNT_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_LSA_SERVER_ROLE_INFO(),
                            POLICY_LSA_SERVER_ROLE_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_REPLICA_SRCE_INFO(),
                            LSAPR_POLICY_REPLICA_SRCE_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_MODIFICATION_INFO(),
                            POLICY_MODIFICATION_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyModificationInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyModificationInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_AUDIT_FULL_SET_INFO(),
                            POLICY_AUDIT_FULL_SET_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAuditFullSetInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAuditFullSetInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            POLICY_AUDIT_FULL_QUERY_INFO(),
                            POLICY_AUDIT_FULL_QUERY_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyAuditFullQueryInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyAuditFullQueryInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_DNS_DOMAIN_INFO(),
                            LSAPR_POLICY_DNS_DOMAIN_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_DNS_DOMAIN_INFO(),
                            LSAPR_POLICY_DNS_DOMAIN_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_ACCOUNT_DOM_INFO(),
                            LSAPR_POLICY_ACCOUNT_DOM_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyInformation",
                            LSAPR_POLICY_MACHINE_ACCT_INFO(),
                            LSAPR_POLICY_MACHINE_ACCT_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_INFORMATION_CLASS.PolicyMachineAccountInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_INFORMATION_CLASS.PolicyMachineAccountInformation
                            ),
                        ),
                    ),
                ],
                StrFixedLenField("PolicyInformation", "", length=0),
                align=(2, 8),
                switch_fmt=("H", "I"),
            )
        ),
        NDRIntField("status", 0),
    ]


class LsarSetInformationPolicy2_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRInt3264EnumField("InformationClass", 0, POLICY_INFORMATION_CLASS),
        NDRUnionField(
            [
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_AUDIT_LOG_INFO(),
                        POLICY_AUDIT_LOG_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAuditLogInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_AUDIT_EVENTS_INFO(),
                        LSAPR_POLICY_AUDIT_EVENTS_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAuditEventsInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_PRIMARY_DOM_INFO(),
                        LSAPR_POLICY_PRIMARY_DOM_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyPrimaryDomainInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_ACCOUNT_DOM_INFO(),
                        LSAPR_POLICY_ACCOUNT_DOM_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAccountDomainInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_PD_ACCOUNT_INFO(),
                        LSAPR_POLICY_PD_ACCOUNT_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyPdAccountInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_LSA_SERVER_ROLE_INFO(),
                        POLICY_LSA_SERVER_ROLE_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyLsaServerRoleInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_REPLICA_SRCE_INFO(),
                        LSAPR_POLICY_REPLICA_SRCE_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyReplicaSourceInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_MODIFICATION_INFO(),
                        POLICY_MODIFICATION_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyModificationInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyModificationInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_AUDIT_FULL_SET_INFO(),
                        POLICY_AUDIT_FULL_SET_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAuditFullSetInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAuditFullSetInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        POLICY_AUDIT_FULL_QUERY_INFO(),
                        POLICY_AUDIT_FULL_QUERY_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyAuditFullQueryInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyAuditFullQueryInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_DNS_DOMAIN_INFO(),
                        LSAPR_POLICY_DNS_DOMAIN_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_DNS_DOMAIN_INFO(),
                        LSAPR_POLICY_DNS_DOMAIN_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyDnsDomainInformationInt
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_ACCOUNT_DOM_INFO(),
                        LSAPR_POLICY_ACCOUNT_DOM_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyLocalAccountDomainInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "PolicyInformation",
                        LSAPR_POLICY_MACHINE_ACCT_INFO(),
                        LSAPR_POLICY_MACHINE_ACCT_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == POLICY_INFORMATION_CLASS.PolicyMachineAccountInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == POLICY_INFORMATION_CLASS.PolicyMachineAccountInformation
                        ),
                    ),
                ),
            ],
            StrFixedLenField("PolicyInformation", "", length=0),
            align=(2, 8),
            switch_fmt=("H", "I"),
        ),
    ]


class LsarSetInformationPolicy2_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarQueryTrustedDomainInfoByName_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRInt3264EnumField("InformationClass", 0, TRUSTED_INFORMATION_CLASS),
    ]


class LsarQueryTrustedDomainInfoByName_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRUnionField(
                [
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_NAME_INFO(),
                            LSAPR_TRUSTED_DOMAIN_NAME_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_CONTROLLERS_INFO(),
                            LSAPR_TRUSTED_CONTROLLERS_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            TRUSTED_POSIX_OFFSET_INFO(),
                            TRUSTED_POSIX_OFFSET_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_PASSWORD_INFO(),
                            LSAPR_TRUSTED_PASSWORD_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUST_INFORMATION(),
                            LSAPR_TRUST_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2(),
                            LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES(),
                            TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(),
                            LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "TrustedDomainInformation",
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES(),
                            LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                            ),
                            (
                                lambda _, val: val.tag
                                == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                            ),
                        ),
                    ),
                ],
                StrFixedLenField("TrustedDomainInformation", "", length=0),
                align=(2, 8),
                switch_fmt=("H", "I"),
            )
        ),
        NDRIntField("status", 0),
    ]


class LsarSetTrustedDomainInfoByName_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRInt3264EnumField("InformationClass", 0, TRUSTED_INFORMATION_CLASS),
        NDRUnionField(
            [
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_NAME_INFO(),
                        LSAPR_TRUSTED_DOMAIN_NAME_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainNameInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_CONTROLLERS_INFO(),
                        LSAPR_TRUSTED_CONTROLLERS_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedControllersInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        TRUSTED_POSIX_OFFSET_INFO(),
                        TRUSTED_POSIX_OFFSET_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedPosixOffsetInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_PASSWORD_INFO(),
                        LSAPR_TRUSTED_PASSWORD_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedPasswordInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUST_INFORMATION(),
                        LSAPR_TRUST_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationBasic
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2(),
                        LSAPR_TRUSTED_DOMAIN_INFORMATION_EX2,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainInformationEx2Internal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION2,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformation2Internal
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES(),
                        TRUSTED_DOMAIN_SUPPORTED_ENCRYPTION_TYPES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainSupportedEncryptionTypes
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(),
                        LSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainAuthInformationInternalAes
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "TrustedDomainInformation",
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES(),
                        LSAPR_TRUSTED_DOMAIN_FULL_INFORMATION_INTERNAL_AES,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "InformationClass", None)
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                        ),
                        (
                            lambda _, val: val.tag
                            == TRUSTED_INFORMATION_CLASS.TrustedDomainFullInformationInternalAes
                        ),
                    ),
                ),
            ],
            StrFixedLenField("TrustedDomainInformation", "", length=0),
            align=(2, 8),
            switch_fmt=("H", "I"),
        ),
    ]


class LsarSetTrustedDomainInfoByName_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("FlatName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
        NDRIntField("TrustDirection", 0),
        NDRIntField("TrustType", 0),
        NDRIntField("TrustAttributes", 0),
    ]


class PLSAPR_TRUSTED_ENUM_BUFFER_EX(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("EntriesRead", None, size_of="EnumerationBuffer"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "EnumerationBuffer",
                [PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX()],
                PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
                size_is=lambda pkt: pkt.EntriesRead,
            ),
            deferred=True,
        ),
    ]


class LsarEnumerateTrustedDomainsEx_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("EnumerationContext", 0),
        NDRIntField("PreferedMaximumLength", 0),
    ]


class LsarEnumerateTrustedDomainsEx_Response(NDRPacket):
    fields_desc = [
        NDRIntField("EnumerationContext", 0),
        NDRPacketField(
            "EnumerationBuffer",
            PLSAPR_TRUSTED_ENUM_BUFFER_EX(),
            PLSAPR_TRUSTED_ENUM_BUFFER_EX,
        ),
        NDRIntField("status", 0),
    ]


class PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("IncomingAuthInfos", 0),
        NDRFullPointerField(
            NDRPacketField(
                "IncomingAuthenticationInformation",
                PLSAPR_AUTH_INFORMATION(),
                PLSAPR_AUTH_INFORMATION,
            ),
            deferred=True,
        ),
        NDRFullPointerField(
            NDRPacketField(
                "IncomingPreviousAuthenticationInformation",
                PLSAPR_AUTH_INFORMATION(),
                PLSAPR_AUTH_INFORMATION,
            ),
            deferred=True,
        ),
        NDRIntField("OutgoingAuthInfos", 0),
        NDRFullPointerField(
            NDRPacketField(
                "OutgoingAuthenticationInformation",
                PLSAPR_AUTH_INFORMATION(),
                PLSAPR_AUTH_INFORMATION,
            ),
            deferred=True,
        ),
        NDRFullPointerField(
            NDRPacketField(
                "OutgoingPreviousAuthenticationInformation",
                PLSAPR_AUTH_INFORMATION(),
                PLSAPR_AUTH_INFORMATION,
            ),
            deferred=True,
        ),
    ]


class LsarCreateTrustedDomainEx_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField(
            "TrustedDomainInformation",
            PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
            PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
        ),
        NDRPacketField(
            "AuthenticationInformation",
            PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION(),
            PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION,
        ),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarCreateTrustedDomainEx_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("TrustedDomainHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class POLICY_DOMAIN_INFORMATION_CLASS(IntEnum):
    PolicyDomainQualityOfServiceInformation = 1
    PolicyDomainEfsInformation = 2
    PolicyDomainKerberosTicketInformation = 3


class POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRIntField("QualityOfService", 0)]


class LSAPR_POLICY_DOMAIN_EFS_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("InfoLength", None, size_of="EfsBlob"),
        NDRFullPointerField(
            NDRConfStrLenField("EfsBlob", "", size_is=lambda pkt: pkt.InfoLength),
            deferred=True,
        ),
    ]


class POLICY_DOMAIN_KERBEROS_TICKET_INFO(NDRPacket):
    ALIGNMENT = (8, 8)
    fields_desc = [
        NDRIntField("AuthenticationOptions", 0),
        NDRPacketField("MaxServiceTicketAge", LARGE_INTEGER(), LARGE_INTEGER),
        NDRPacketField("MaxTicketAge", LARGE_INTEGER(), LARGE_INTEGER),
        NDRPacketField("MaxRenewAge", LARGE_INTEGER(), LARGE_INTEGER),
        NDRPacketField("MaxClockSkew", LARGE_INTEGER(), LARGE_INTEGER),
        NDRPacketField("Reserved", LARGE_INTEGER(), LARGE_INTEGER),
    ]


class LsarQueryDomainInformationPolicy_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRInt3264EnumField("InformationClass", 0, POLICY_DOMAIN_INFORMATION_CLASS),
    ]


class LsarQueryDomainInformationPolicy_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRUnionField(
                [
                    (
                        NDRPacketField(
                            "PolicyDomainInformation",
                            POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO(),
                            POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainQualityOfServiceInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainQualityOfServiceInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyDomainInformation",
                            LSAPR_POLICY_DOMAIN_EFS_INFO(),
                            LSAPR_POLICY_DOMAIN_EFS_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainEfsInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainEfsInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyDomainInformation",
                            POLICY_DOMAIN_KERBEROS_TICKET_INFO(),
                            POLICY_DOMAIN_KERBEROS_TICKET_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainKerberosTicketInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainKerberosTicketInformation
                            ),
                        ),
                    ),
                ],
                StrFixedLenField("PolicyDomainInformation", "", length=0),
                align=(2, 8),
                switch_fmt=("H", "I"),
            )
        ),
        NDRIntField("status", 0),
    ]


class LsarSetDomainInformationPolicy_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRInt3264EnumField("InformationClass", 0, POLICY_DOMAIN_INFORMATION_CLASS),
        NDRFullPointerField(
            NDRUnionField(
                [
                    (
                        NDRPacketField(
                            "PolicyDomainInformation",
                            POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO(),
                            POLICY_DOMAIN_QUALITY_OF_SERVICE_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainQualityOfServiceInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainQualityOfServiceInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyDomainInformation",
                            LSAPR_POLICY_DOMAIN_EFS_INFO(),
                            LSAPR_POLICY_DOMAIN_EFS_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainEfsInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainEfsInformation
                            ),
                        ),
                    ),
                    (
                        NDRPacketField(
                            "PolicyDomainInformation",
                            POLICY_DOMAIN_KERBEROS_TICKET_INFO(),
                            POLICY_DOMAIN_KERBEROS_TICKET_INFO,
                        ),
                        (
                            (
                                lambda pkt: getattr(pkt, "InformationClass", None)
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainKerberosTicketInformation
                            ),
                            (
                                lambda _, val: val.tag
                                == POLICY_DOMAIN_INFORMATION_CLASS.PolicyDomainKerberosTicketInformation
                            ),
                        ),
                    ),
                ],
                StrFixedLenField("PolicyDomainInformation", "", length=0),
                align=(2, 8),
                switch_fmt=("H", "I"),
            )
        ),
    ]


class LsarSetDomainInformationPolicy_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class LsarOpenTrustedDomainByName_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainName", PRPC_UNICODE_STRING(), PRPC_UNICODE_STRING),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarOpenTrustedDomainByName_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("TrustedDomainHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRPacketField(
            "AuthBlob", LSAPR_TRUSTED_DOMAIN_AUTH_BLOB(), LSAPR_TRUSTED_DOMAIN_AUTH_BLOB
        )
    ]


class LsarCreateTrustedDomainEx2_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField(
            "TrustedDomainInformation",
            PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
            PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
        ),
        NDRPacketField(
            "AuthenticationInformation",
            PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL(),
            PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL,
        ),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarCreateTrustedDomainEx2_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("TrustedDomainHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class LSA_FOREST_TRUST_RECORD_TYPE(IntEnum):
    ForestTrustTopLevelName = 0
    ForestTrustTopLevelNameEx = 1
    ForestTrustDomainInfo = 2
    ForestTrustRecordTypeLast = ForestTrustDomainInfo


class LSA_FOREST_TRUST_DOMAIN_INFO(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRFullPointerField(NDRPacketField("Sid", PRPC_SID(), PRPC_SID), deferred=True),
        NDRPacketField("DnsName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRPacketField("NetbiosName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
    ]


class LSA_FOREST_TRUST_BINARY_DATA(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Length", None, size_of="Buffer"),
        NDRFullPointerField(
            NDRConfStrLenField("Buffer", "", size_is=lambda pkt: pkt.Length),
            deferred=True,
        ),
    ]


class PLSA_FOREST_TRUST_RECORD(NDRPacket):
    ALIGNMENT = (8, 8)
    fields_desc = [
        NDRIntField("Flags", 0),
        NDRInt3264EnumField("ForestTrustType", 0, LSA_FOREST_TRUST_RECORD_TYPE),
        NDRPacketField("Time", LARGE_INTEGER(), LARGE_INTEGER),
        NDRUnionField(
            [
                (
                    NDRPacketField(
                        "ForestTrustData", RPC_UNICODE_STRING(), RPC_UNICODE_STRING
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "ForestTrustType", None)
                            in [
                                LSA_FOREST_TRUST_RECORD_TYPE.ForestTrustTopLevelName,
                                LSA_FOREST_TRUST_RECORD_TYPE.ForestTrustTopLevelNameEx,
                            ]
                        ),
                        (
                            lambda _, val: val.tag
                            in [
                                LSA_FOREST_TRUST_RECORD_TYPE.ForestTrustTopLevelName,
                                LSA_FOREST_TRUST_RECORD_TYPE.ForestTrustTopLevelNameEx,
                            ]
                        ),
                    ),
                ),
                (
                    NDRPacketField(
                        "ForestTrustData",
                        LSA_FOREST_TRUST_DOMAIN_INFO(),
                        LSA_FOREST_TRUST_DOMAIN_INFO,
                    ),
                    (
                        (
                            lambda pkt: getattr(pkt, "ForestTrustType", None)
                            == LSA_FOREST_TRUST_RECORD_TYPE.ForestTrustDomainInfo
                        ),
                        (
                            lambda _, val: val.tag
                            == LSA_FOREST_TRUST_RECORD_TYPE.ForestTrustDomainInfo
                        ),
                    ),
                ),
            ],
            NDRPacketField(
                "ForestTrustData",
                LSA_FOREST_TRUST_BINARY_DATA(),
                LSA_FOREST_TRUST_BINARY_DATA,
            ),
            align=(2, 8),
            switch_fmt=("H", "I"),
        ),
    ]


class PLSA_FOREST_TRUST_INFORMATION(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("RecordCount", None, size_of="Entries"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "Entries",
                [],
                PLSA_FOREST_TRUST_RECORD,
                size_is=lambda pkt: pkt.RecordCount,
                ptr_pack=True,
            ),
            deferred=True,
        ),
    ]


class LsarQueryForestTrustInformation_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRInt3264EnumField("HighestRecordType", 0, LSA_FOREST_TRUST_RECORD_TYPE),
    ]


class LsarQueryForestTrustInformation_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField(
                "ForestTrustInfo",
                PLSA_FOREST_TRUST_INFORMATION(),
                PLSA_FOREST_TRUST_INFORMATION,
            )
        ),
        NDRIntField("status", 0),
    ]


class LSA_FOREST_TRUST_COLLISION_RECORD_TYPE(IntEnum):
    CollisionTdo = 0
    CollisionXref = 1
    CollisionOther = 2


class PLSA_FOREST_TRUST_COLLISION_RECORD(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("Index", 0),
        NDRInt3264EnumField("Type", 0, LSA_FOREST_TRUST_COLLISION_RECORD_TYPE),
        NDRIntField("Flags", 0),
        NDRPacketField("Name", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
    ]


class PLSA_FOREST_TRUST_COLLISION_INFORMATION(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("RecordCount", None, size_of="Entries"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "Entries",
                [],
                PLSA_FOREST_TRUST_COLLISION_RECORD,
                size_is=lambda pkt: pkt.RecordCount,
                ptr_pack=True,
            ),
            deferred=True,
        ),
    ]


class LsarSetForestTrustInformation_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField("TrustedDomainName", RPC_UNICODE_STRING(), RPC_UNICODE_STRING),
        NDRInt3264EnumField("HighestRecordType", 0, LSA_FOREST_TRUST_RECORD_TYPE),
        NDRPacketField(
            "ForestTrustInfo",
            PLSA_FOREST_TRUST_INFORMATION(),
            PLSA_FOREST_TRUST_INFORMATION,
        ),
        NDRByteField("CheckOnly", 0),
    ]


class LsarSetForestTrustInformation_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField(
                "CollisionInfo",
                PLSA_FOREST_TRUST_COLLISION_INFORMATION(),
                PLSA_FOREST_TRUST_COLLISION_INFORMATION,
            )
        ),
        NDRIntField("status", 0),
    ]


class PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        StrFixedLenField("AuthData", "", length=64),
        StrFixedLenField("Salt", "", length=16),
        NDRIntField("cbCipher", None, size_of="Cipher"),
        NDRFullPointerField(
            NDRConfStrLenField("Cipher", "", size_is=lambda pkt: pkt.cbCipher),
            deferred=True,
        ),
    ]


class LsarCreateTrustedDomainEx3_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRPacketField(
            "TrustedDomainInformation",
            PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX(),
            PLSAPR_TRUSTED_DOMAIN_INFORMATION_EX,
        ),
        NDRPacketField(
            "AuthenticationInformation",
            PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES(),
            PLSAPR_TRUSTED_DOMAIN_AUTH_INFORMATION_INTERNAL_AES,
        ),
        NDRIntField("DesiredAccess", 0),
    ]


class LsarCreateTrustedDomainEx3_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("TrustedDomainHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class LSAPR_REVISION_INFO_V1(NDRPacket):
    ALIGNMENT = (4, 4)
    fields_desc = [NDRIntField("Revision", 0), NDRIntField("SupportedFeatures", 0)]


class LsarOpenPolicy3_Request(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRConfVarStrNullFieldUtf16("SystemName", "")),
        NDRPacketField(
            "ObjectAttributes", PLSAPR_OBJECT_ATTRIBUTES(), PLSAPR_OBJECT_ATTRIBUTES
        ),
        NDRIntField("DesiredAccess", 0),
        NDRIntField("InVersion", 0),
        NDRUnionField(
            [
                (
                    NDRPacketField(
                        "OutRevisionInfo",
                        LSAPR_REVISION_INFO_V1(),
                        LSAPR_REVISION_INFO_V1,
                    ),
                    (
                        (lambda pkt: getattr(pkt, "InVersion", None) == 1),
                        (lambda _, val: val.tag == 1),
                    ),
                )
            ],
            StrFixedLenField("OutRevisionInfo", "", length=0),
            align=(4, 4),
            switch_fmt=("L", "L"),
        ),
    ]


class LsarOpenPolicy3_Response(NDRPacket):
    fields_desc = [
        NDRIntField("OutVersion", 0),
        NDRUnionField(
            [
                (
                    NDRPacketField(
                        "OutRevisionInfo",
                        LSAPR_REVISION_INFO_V1(),
                        LSAPR_REVISION_INFO_V1,
                    ),
                    (
                        (lambda pkt: getattr(pkt, "OutVersion", None) == 1),
                        (lambda _, val: val.tag == 1),
                    ),
                )
            ],
            StrFixedLenField("OutRevisionInfo", "", length=0),
            align=(4, 4),
            switch_fmt=("L", "L"),
        ),
        NDRPacketField("PolicyHandle", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


LSARPC_OPNUMS = {
    0: DceRpcOp(LsarClose_Request, LsarClose_Response),
    # 1: Opnum1NotUsedOnWire,
    2: DceRpcOp(LsarEnumeratePrivileges_Request, LsarEnumeratePrivileges_Response),
    3: DceRpcOp(LsarQuerySecurityObject_Request, LsarQuerySecurityObject_Response),
    4: DceRpcOp(LsarSetSecurityObject_Request, LsarSetSecurityObject_Response),
    # 5: Opnum5NotUsedOnWire,
    6: DceRpcOp(LsarOpenPolicy_Request, LsarOpenPolicy_Response),
    7: DceRpcOp(
        LsarQueryInformationPolicy_Request, LsarQueryInformationPolicy_Response
    ),
    8: DceRpcOp(LsarSetInformationPolicy_Request, LsarSetInformationPolicy_Response),
    # 9: Opnum9NotUsedOnWire,
    10: DceRpcOp(LsarCreateAccount_Request, LsarCreateAccount_Response),
    11: DceRpcOp(LsarEnumerateAccounts_Request, LsarEnumerateAccounts_Response),
    12: DceRpcOp(LsarCreateTrustedDomain_Request, LsarCreateTrustedDomain_Response),
    13: DceRpcOp(
        LsarEnumerateTrustedDomains_Request, LsarEnumerateTrustedDomains_Response
    ),
    # 14: Lsar_LSA_TM_14,
    # 15: Lsar_LSA_TM_15,
    16: DceRpcOp(LsarCreateSecret_Request, LsarCreateSecret_Response),
    17: DceRpcOp(LsarOpenAccount_Request, LsarOpenAccount_Response),
    18: DceRpcOp(
        LsarEnumeratePrivilegesAccount_Request, LsarEnumeratePrivilegesAccount_Response
    ),
    19: DceRpcOp(
        LsarAddPrivilegesToAccount_Request, LsarAddPrivilegesToAccount_Response
    ),
    20: DceRpcOp(
        LsarRemovePrivilegesFromAccount_Request,
        LsarRemovePrivilegesFromAccount_Response,
    ),
    # 21: Opnum21NotUsedOnWire,
    # 22: Opnum22NotUsedOnWire,
    23: DceRpcOp(
        LsarGetSystemAccessAccount_Request, LsarGetSystemAccessAccount_Response
    ),
    24: DceRpcOp(
        LsarSetSystemAccessAccount_Request, LsarSetSystemAccessAccount_Response
    ),
    25: DceRpcOp(LsarOpenTrustedDomain_Request, LsarOpenTrustedDomain_Response),
    26: DceRpcOp(
        LsarQueryInfoTrustedDomain_Request, LsarQueryInfoTrustedDomain_Response
    ),
    27: DceRpcOp(
        LsarSetInformationTrustedDomain_Request,
        LsarSetInformationTrustedDomain_Response,
    ),
    28: DceRpcOp(LsarOpenSecret_Request, LsarOpenSecret_Response),
    29: DceRpcOp(LsarSetSecret_Request, LsarSetSecret_Response),
    30: DceRpcOp(LsarQuerySecret_Request, LsarQuerySecret_Response),
    31: DceRpcOp(LsarLookupPrivilegeValue_Request, LsarLookupPrivilegeValue_Response),
    32: DceRpcOp(LsarLookupPrivilegeName_Request, LsarLookupPrivilegeName_Response),
    33: DceRpcOp(
        LsarLookupPrivilegeDisplayName_Request, LsarLookupPrivilegeDisplayName_Response
    ),
    34: DceRpcOp(LsarDeleteObject_Request, LsarDeleteObject_Response),
    35: DceRpcOp(
        LsarEnumerateAccountsWithUserRight_Request,
        LsarEnumerateAccountsWithUserRight_Response,
    ),
    36: DceRpcOp(
        LsarEnumerateAccountRights_Request, LsarEnumerateAccountRights_Response
    ),
    37: DceRpcOp(LsarAddAccountRights_Request, LsarAddAccountRights_Response),
    38: DceRpcOp(LsarRemoveAccountRights_Request, LsarRemoveAccountRights_Response),
    39: DceRpcOp(
        LsarQueryTrustedDomainInfo_Request, LsarQueryTrustedDomainInfo_Response
    ),
    40: DceRpcOp(LsarSetTrustedDomainInfo_Request, LsarSetTrustedDomainInfo_Response),
    41: DceRpcOp(LsarDeleteTrustedDomain_Request, LsarDeleteTrustedDomain_Response),
    42: DceRpcOp(LsarStorePrivateData_Request, LsarStorePrivateData_Response),
    43: DceRpcOp(LsarRetrievePrivateData_Request, LsarRetrievePrivateData_Response),
    44: DceRpcOp(LsarOpenPolicy2_Request, LsarOpenPolicy2_Response),
    # 45: Lsar_LSA_TM_45,
    46: DceRpcOp(
        LsarQueryInformationPolicy2_Request, LsarQueryInformationPolicy2_Response
    ),
    47: DceRpcOp(LsarSetInformationPolicy2_Request, LsarSetInformationPolicy2_Response),
    48: DceRpcOp(
        LsarQueryTrustedDomainInfoByName_Request,
        LsarQueryTrustedDomainInfoByName_Response,
    ),
    49: DceRpcOp(
        LsarSetTrustedDomainInfoByName_Request, LsarSetTrustedDomainInfoByName_Response
    ),
    50: DceRpcOp(
        LsarEnumerateTrustedDomainsEx_Request, LsarEnumerateTrustedDomainsEx_Response
    ),
    51: DceRpcOp(LsarCreateTrustedDomainEx_Request, LsarCreateTrustedDomainEx_Response),
    # 52: Opnum52NotUsedOnWire,
    53: DceRpcOp(
        LsarQueryDomainInformationPolicy_Request,
        LsarQueryDomainInformationPolicy_Response,
    ),
    54: DceRpcOp(
        LsarSetDomainInformationPolicy_Request, LsarSetDomainInformationPolicy_Response
    ),
    55: DceRpcOp(
        LsarOpenTrustedDomainByName_Request, LsarOpenTrustedDomainByName_Response
    ),
    # 56: Opnum56NotUsedOnWire,
    # 57: Lsar_LSA_TM_57,
    # 58: Lsar_LSA_TM_58,
    59: DceRpcOp(
        LsarCreateTrustedDomainEx2_Request, LsarCreateTrustedDomainEx2_Response
    ),
    # 60: Opnum60NotUsedOnWire,
    # 61: Opnum61NotUsedOnWire,
    # 62: Opnum62NotUsedOnWire,
    # 63: Opnum63NotUsedOnWire,
    # 64: Opnum64NotUsedOnWire,
    # 65: Opnum65NotUsedOnWire,
    # 66: Opnum66NotUsedOnWire,
    # 67: Opnum67NotUsedOnWire,
    # 68: Lsar_LSA_TM_68,
    # 69: Opnum69NotUsedOnWire,
    # 70: Opnum70NotUsedOnWire,
    # 71: Opnum71NotUsedOnWire,
    # 72: Opnum72NotUsedOnWire,
    73: DceRpcOp(
        LsarQueryForestTrustInformation_Request,
        LsarQueryForestTrustInformation_Response,
    ),
    74: DceRpcOp(
        LsarSetForestTrustInformation_Request, LsarSetForestTrustInformation_Response
    ),
    # 75: Opnum75NotUsedOnWire,
    # 76: Opnum76NotUsedOnWire,
    # 77: Opnum77NotUsedOnWire,
    # 78: Opnum78NotUsedOnWire,
    # 79: Opnum79NotUsedOnWire,
    # 80: Opnum80NotUsedOnWire,
    # 81: Opnum81NotUsedOnWire,
    # 82: Opnum82NotUsedOnWire,
    # 83: Opnum83NotUsedOnWire,
    # 84: Opnum84NotUsedOnWire,
    # 85: Opnum85NotUsedOnWire,
    # 86: Opnum86NotUsedOnWire,
    # 87: Opnum87NotUsedOnWire,
    # 88: Opnum88NotUsedOnWire,
    # 89: Opnum89NotUsedOnWire,
    # 90: Opnum90NotUsedOnWire,
    # 91: Opnum91NotUsedOnWire,
    # 92: Opnum92NotUsedOnWire,
    # 93: Opnum93NotUsedOnWire,
    # 94: Opnum94NotUsedOnWire,
    # 95: Opnum95NotUsedOnWire,
    # 96: Opnum96NotUsedOnWire,
    # 97: Opnum97NotUsedOnWire,
    # 98: Opnum98NotUsedOnWire,
    # 99: Opnum99NotUsedOnWire,
    # 100: Opnum100NotUsedOnWire,
    # 101: Opnum101NotUsedOnWire,
    # 102: Opnum102NotUsedOnWire,
    # 103: Opnum103NotUsedOnWire,
    # 104: Opnum104NotUsedOnWire,
    # 105: Opnum105NotUsedOnWire,
    # 106: Opnum106NotUsedOnWire,
    # 107: Opnum107NotUsedOnWire,
    # 108: Opnum108NotUsedOnWire,
    # 109: Opnum109NotUsedOnWire,
    # 110: Opnum110NotUsedOnWire,
    # 111: Opnum111NotUsedOnWire,
    # 112: Opnum112NotUsedOnWire,
    # 113: Opnum113NotUsedOnWire,
    # 114: Opnum114NotUsedOnWire,
    # 115: Opnum115NotUsedOnWire,
    # 116: Opnum116NotUsedOnWire,
    # 117: Opnum117NotUsedOnWire,
    # 118: Opnum118NotUsedOnWire,
    # 119: Opnum119NotUsedOnWire,
    # 120: Opnum120NotUsedOnWire,
    # 121: Opnum121NotUsedOnWire,
    # 122: Opnum122NotUsedOnWire,
    # 123: Opnum123NotUsedOnWire,
    # 124: Opnum124NotUsedOnWire,
    # 125: Opnum125NotUsedOnWire,
    # 126: Opnum126NotUsedOnWire,
    # 127: Opnum127NotUsedOnWire,
    # 128: Opnum128NotUsedOnWire,
    129: DceRpcOp(
        LsarCreateTrustedDomainEx3_Request, LsarCreateTrustedDomainEx3_Response
    ),
    130: DceRpcOp(LsarOpenPolicy3_Request, LsarOpenPolicy3_Response),
}
register_dcerpc_interface(
    name="lsarpc",
    uuid=uuid.UUID("12345778-1234-ABCD-EF00-0123456789AB"),
    version="0.0",
    opnums=LSARPC_OPNUMS,
)
