1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
|
#include "idl_types.h"
/*
the base dcerpc packet definitions - not traditionally coded as IDL,
but given that pidl can handle it nicely it simplifies things a lot
to do it this way
See [C706 - DCE 1.1: Remote Procedure Call] for the OpenGroup
DCERPC specification:
http://pubs.opengroup.org/onlinepubs/9629399/toc.htm
See C706 - Chapter 12: RPC PDU Encodings for packet layouts:
http://www.opengroup.org/onlinepubs/9629399/chap12.htm
See also [MS-RPCE] for the Microsoft
"Remote Procedure Call Protocol Extensions".
http://msdn.microsoft.com/en-us/library/cc243560.aspx
*/
import "misc.idl";
cpp_quote("extern const uint8_t DCERPC_SEC_VT_MAGIC[8];")
[
helper("../librpc/ndr/ndr_dcerpc.h")
]
interface dcerpc
{
typedef struct {
uint16 context_id;
uint8 num_transfer_syntaxes;
ndr_syntax_id abstract_syntax;
ndr_syntax_id transfer_syntaxes[num_transfer_syntaxes];
} dcerpc_ctx_list;
typedef [public] struct {
uint16 max_xmit_frag;
uint16 max_recv_frag;
uint32 assoc_group_id;
uint8 num_contexts;
dcerpc_ctx_list ctx_list[num_contexts];
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_bind;
const uint8 DCERPC_REQUEST_LENGTH = 24;
typedef struct {
} dcerpc_empty;
typedef [nodiscriminant] union {
[case(LIBNDR_FLAG_OBJECT_PRESENT)] GUID object;
[default] dcerpc_empty empty;
} dcerpc_object;
typedef struct {
uint32 alloc_hint;
uint16 context_id;
uint16 opnum;
/*
* NDR_DCERPC_REQUEST_OBJECT_PRESENT
* is defined differently for ndr_dcerpc.c and py_dcerpc.c
*/
[switch_is(NDR_DCERPC_REQUEST_OBJECT_PRESENT)] dcerpc_object object;
[flag(NDR_REMAINING)] DATA_BLOB stub_and_verifier;
} dcerpc_request;
typedef [enum16bit] enum {
DCERPC_BIND_ACK_RESULT_ACCEPTANCE = 0,
DCERPC_BIND_ACK_RESULT_USER_REJECTION = 1,
DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION = 2,
DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK = 3
} dcerpc_bind_ack_result;
const int DCERPC_BIND_PROVIDER_REJECT =
DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION;
typedef [enum16bit] enum {
DCERPC_BIND_ACK_REASON_NOT_SPECIFIED = 0,
DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED = 1,
DCERPC_BIND_ACK_REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED = 2,
DCERPC_BIND_ACK_REASON_LOCAL_LIMIT_EXCEEDED = 3
} dcerpc_bind_ack_reason_values;
const int DCERPC_BIND_REASON_ASYNTAX =
DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED;
typedef [bitmap16bit] bitmap {
DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING = 0x0001,
DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN = 0x0002
} dcerpc_bind_time_features;
typedef [nodiscriminant] union {
[case(DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK)]
dcerpc_bind_time_features negotiate;
[default] dcerpc_bind_ack_reason_values value;
} dcerpc_bind_ack_reason;
typedef struct {
dcerpc_bind_ack_result result;
[switch_is(result)] dcerpc_bind_ack_reason reason;
ndr_syntax_id syntax;
} dcerpc_ack_ctx;
typedef struct {
uint16 max_xmit_frag;
uint16 max_recv_frag;
uint32 assoc_group_id;
[value(strlen_m_term_null(secondary_address))] uint16 secondary_address_size;
[charset(DOS)] uint8 secondary_address[secondary_address_size];
[flag(NDR_ALIGN4)] DATA_BLOB _pad1;
uint8 num_results;
dcerpc_ack_ctx ctx_list[num_results];
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_bind_ack;
typedef [public,enum16bit] enum {
DCERPC_BIND_NAK_REASON_NOT_SPECIFIED = 0,
DCERPC_BIND_NAK_REASON_TEMPORARY_CONGESTION = 1,
DCERPC_BIND_NAK_REASON_LOCAL_LIMIT_EXCEEDED = 2,
DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED = 4,
DCERPC_BIND_NAK_REASON_INVALID_AUTH_TYPE = 8,
DCERPC_BIND_NAK_REASON_INVALID_CHECKSUM = 9
} dcerpc_bind_nak_reason;
const int DECRPC_BIND_PROTOCOL_VERSION_NOT_SUPPORTED =
DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED;
const int DCERPC_BIND_REASON_INVALID_AUTH_TYPE =
DCERPC_BIND_NAK_REASON_INVALID_AUTH_TYPE;
typedef [public] struct {
uint8 rpc_vers; /* RPC version */
uint8 rpc_vers_minor; /* Minor version */
} dcerpc_bind_nak_version;
typedef [public,nopull] struct {
dcerpc_bind_nak_reason reject_reason;
uint8 num_versions;
dcerpc_bind_nak_version versions[num_versions];
[flag(NDR_REMAINING)] DATA_BLOB _pad;
} dcerpc_bind_nak;
const uint8 DCERPC_RESPONSE_LENGTH = 24;
typedef struct {
uint32 alloc_hint;
uint16 context_id;
uint8 cancel_count;
[value(0)] uint8 reserved;
[flag(NDR_REMAINING)] DATA_BLOB stub_and_verifier;
} dcerpc_response;
typedef [v1_enum] enum {
DCERPC_NCA_S_COMM_FAILURE = 0x1C010001,
DCERPC_NCA_S_OP_RNG_ERROR = 0x1C010002,
DCERPC_NCA_S_UNKNOWN_IF = 0x1C010003,
DCERPC_NCA_S_WRONG_BOOT_TIME = 0x1C010006,
DCERPC_NCA_S_YOU_CRASHED = 0x1C010009,
DCERPC_NCA_S_PROTO_ERROR = 0x1C01000B,
DCERPC_NCA_S_OUT_ARGS_TOO_BIG = 0x1C010013,
DCERPC_NCA_S_SERVER_TOO_BUSY = 0x1C010014,
DCERPC_NCA_S_FAULT_STRING_TOO_LARGE = 0x1C010015,
DCERPC_NCA_S_UNSUPPORTED_TYPE = 0x1C010017,
DCERPC_NCA_S_FAULT_INT_DIV_BY_ZERO = 0x1C000001,
DCERPC_NCA_S_FAULT_ADDR_ERROR = 0x1C000002,
DCERPC_NCA_S_FAULT_FP_DIV_BY_ZERO = 0x1C000003,
DCERPC_NCA_S_FAULT_FP_UNDERFLOW = 0x1C000004,
DCERPC_NCA_S_FAULT_FP_OVERRFLOW = 0x1C000005,
DCERPC_NCA_S_FAULT_INVALID_TAG = 0x1C000006,
DCERPC_NCA_S_FAULT_INVALID_BOUND = 0x1C000007,
DCERPC_NCA_S_FAULT_RPC_VERSION_MISMATCH = 0x1C000008,
DCERPC_NCA_S_FAULT_UNSPEC_REJECT = 0x1C000009,
DCERPC_NCA_S_FAULT_BAD_ACTID = 0x1C00000A,
DCERPC_NCA_S_FAULT_WHO_ARE_YOU_FAILED = 0x1C00000B,
DCERPC_NCA_S_FAULT_MANAGER_NOT_ENTERED = 0x1C00000C,
DCERPC_NCA_S_FAULT_CANCEL = 0x1C00000D,
DCERPC_NCA_S_FAULT_ILL_INST = 0x1C00000E,
DCERPC_NCA_S_FAULT_FP_ERROR = 0x1C00000F,
DCERPC_NCA_S_FAULT_INT_OVERFLOW = 0x1C000010,
DCERPC_NCA_S_UNUSED_1C000011 = 0x1C000011,
DCERPC_NCA_S_FAULT_UNSPEC = 0x1C000012,
DCERPC_NCA_S_FAULT_REMOTE_COMM_FAILURE = 0x1C000013,
DCERPC_NCA_S_FAULT_PIPE_EMPTY = 0x1C000014,
DCERPC_NCA_S_FAULT_PIPE_CLOSED = 0x1C000015,
DCERPC_NCA_S_FAULT_PIPE_ORDER = 0x1C000016,
DCERPC_NCA_S_FAULT_PIPE_DISCIPLINE = 0x1C000017,
DCERPC_NCA_S_FAULT_PIPE_COMM_ERROR = 0x1C000018,
DCERPC_NCA_S_FAULT_PIPE_MEMORY = 0x1C000019,
DCERPC_NCA_S_FAULT_CONTEXT_MISMATCH = 0x1C00001A,
DCERPC_NCA_S_FAULT_REMOTE_NO_MEMORY = 0x1C00001B,
DCERPC_NCA_S_INVALID_PRES_CONTEXT_ID = 0x1C00001C,
DCERPC_NCA_S_UNSUPPORTED_AUTHN_LEVEL = 0x1C00001D,
DCERPC_NCA_S_UNUSED_1C00001E = 0x1C00001E,
DCERPC_NCA_S_INVALID_CHECKSUM = 0x1C00001F,
DCERPC_NCA_S_INVALID_CRC = 0x1C000020,
DCERPC_NCA_S_FAULT_USER_DEFINED = 0x1C000021,
DCERPC_NCA_S_FAULT_TX_OPEN_FAILED = 0x1C000022,
DCERPC_NCA_S_FAULT_CODESET_CONV_ERROR = 0x1C000023,
DCERPC_NCA_S_FAULT_OBJECT_NOT_FOUND = 0x1C000024,
DCERPC_NCA_S_FAULT_NO_CLIENT_STUB = 0x1C000025,
DCERPC_FAULT_ACCESS_DENIED = 0x00000005,
DCERPC_FAULT_SERVER_UNAVAILABLE = 0x000006ba,
DCERPC_FAULT_NO_CALL_ACTIVE = 0x000006bd,
DCERPC_FAULT_CANT_PERFORM = 0x000006d8,
DCERPC_FAULT_OUT_OF_RESOURCES = 0x000006d9,
DCERPC_FAULT_BAD_STUB_DATA = 0x000006f7,
DCERPC_FAULT_SEC_PKG_ERROR = 0x00000721
} dcerpc_nca_status;
const int DCERPC_FAULT_OP_RNG_ERROR = DCERPC_NCA_S_OP_RNG_ERROR;
const int DCERPC_FAULT_NDR = DCERPC_FAULT_BAD_STUB_DATA;
const int DCERPC_FAULT_INVALID_TAG = DCERPC_NCA_S_FAULT_INVALID_TAG;
const int DCERPC_FAULT_CONTEXT_MISMATCH = DCERPC_NCA_S_FAULT_CONTEXT_MISMATCH;
const int DCERPC_FAULT_OTHER = 0x00000001;
/* we return this fault when we haven't yet run the test
to see what fault w2k3 returns in this case */
const int DCERPC_FAULT_TODO = 0x00000042;
typedef [bitmap8bit] bitmap {
DCERPC_FAULT_FLAG_EXTENDED_ERROR_INFORMATION = 0x01
} dcerpc_fault_flags;
typedef struct {
uint32 alloc_hint;
uint16 context_id;
uint8 cancel_count;
dcerpc_fault_flags flags;
dcerpc_nca_status status;
[value(0)] uint32 reserved;
[flag(NDR_REMAINING)] DATA_BLOB error_and_verifier;
} dcerpc_fault;
const uint8 DCERPC_FAULT_LENGTH = 32;
/* the auth types we know about */
typedef [enum8bit] enum {
DCERPC_AUTH_TYPE_NONE = 0,
/* this seems to be not krb5! */
DCERPC_AUTH_TYPE_KRB5_1 = 1,
DCERPC_AUTH_TYPE_SPNEGO = 9,
DCERPC_AUTH_TYPE_NTLMSSP = 10,
DCERPC_AUTH_TYPE_KRB5 = 16,
DCERPC_AUTH_TYPE_DPA = 17,
DCERPC_AUTH_TYPE_MSN = 18,
DCERPC_AUTH_TYPE_DIGEST = 21,
DCERPC_AUTH_TYPE_SCHANNEL = 68,
DCERPC_AUTH_TYPE_MSMQ = 100,
DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM = 200
} dcerpc_AuthType;
const char *AS_SYSTEM_MAGIC_PATH_TOKEN = "/root/ncalrpc_as_system";
typedef [enum8bit] enum {
DCERPC_AUTH_LEVEL_NONE = 1,
DCERPC_AUTH_LEVEL_CONNECT = 2,
DCERPC_AUTH_LEVEL_CALL = 3,
DCERPC_AUTH_LEVEL_PACKET = 4,
DCERPC_AUTH_LEVEL_INTEGRITY = 5,
DCERPC_AUTH_LEVEL_PRIVACY = 6
} dcerpc_AuthLevel;
typedef [public] struct {
dcerpc_AuthType auth_type;
dcerpc_AuthLevel auth_level;
uint8 auth_pad_length;
uint8 auth_reserved;
uint32 auth_context_id;
[flag(NDR_REMAINING)] DATA_BLOB credentials;
} dcerpc_auth;
const uint8 DCERPC_AUTH_TRAILER_LENGTH = 8;
const uint8 DCERPC_AUTH_PAD_ALIGNMENT = 16;
typedef [public] struct {
[value(0)] uint32 _pad;
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_auth3;
typedef [public] struct {
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_orphaned;
typedef [public] struct {
[flag(NDR_REMAINING)] DATA_BLOB auth_info;
} dcerpc_co_cancel;
typedef [public] struct {
uint32 version;
uint32 id;
} dcerpc_cl_cancel;
typedef [public] struct {
uint32 version;
uint32 id;
boolean32 server_is_accepting;
} dcerpc_cancel_ack;
typedef [public] struct {
uint32 version;
uint8 _pad1;
uint16 window_size;
uint32 max_tdsu;
uint32 max_frag_size;
uint16 serial_no;
uint16 selack_size;
uint32 selack[selack_size];
} dcerpc_fack;
typedef [public] struct {
} dcerpc_ack;
typedef [public] struct {
} dcerpc_ping;
typedef [public] struct {
} dcerpc_shutdown;
typedef [public] struct {
} dcerpc_working;
/* RTS data structures */
typedef [public] struct {
GUID Cookie;
} RTSCookie;
typedef [v1_enum,public] enum {
RTS_IPV4 = 0,
RTS_IPV6 = 1
} AddressType;
typedef [nodiscriminant] union {
[case(RTS_IPV4)] ipv4address ClientAddressIPV4;
[case(RTS_IPV6)] ipv6address ClientAddressIPV6;
} ClientAddressType;
typedef [public] struct {
AddressType AddressType;
[switch_is(AddressType)] ClientAddressType ClientAddress;
uint8 Padding[12];
} ClientAddress;
typedef [v1_enum, public] enum {
FDClient = 0,
FDInProxy = 1,
FDServer = 2,
FDOutProxy = 3
} ForwardDestination;
typedef [public] struct {
uint32 BytesReceived;
uint32 AvailableWindow;
RTSCookie ChannelCookie;
} FlowControlAcknowledgment;
/* RTS commands */
/* RTS command: 0x0 */
typedef [public] struct {
[range(0x2000,0x40000)] uint32 ReceiveWindowSize;
} dcerpc_rts_cmd_ReceiveWindowSize;
/* RTS command: 0x1 */
typedef [public] struct {
FlowControlAcknowledgment Ack;
} dcerpc_rts_cmd_FlowControlAck;
/* RTS command: 0x2 */
typedef [public] struct {
[range(0x1D4C0,0xDBBA00)] uint32 ConnectionTimeout;
} dcerpc_rts_cmd_ConnectionTimeout;
/* RTS command: 0x3 */
typedef [public] struct {
RTSCookie Cookie;
} dcerpc_rts_cmd_Cookie;
/* RTS command: 0x4 */
typedef [public] struct {
[range(0x20000,0x80000000)] uint32 ChannelLifetime;
} dcerpc_rts_cmd_ChannelLifetime;
/* RTS command: 0x5 */
typedef [public] struct {
uint32 ClientKeepalive;
} dcerpc_rts_cmd_ClientKeepalive;
/* RTS command: 0x6 */
typedef [public] struct {
uint32 Version;
} dcerpc_rts_cmd_Version;
/* RTS command: 0x7 */
typedef [public] struct {
} dcerpc_rts_cmd_Empty;
/* RTS command: 0x8 */
typedef [public] struct {
[range(0x0,0xFFFF)] uint32 ConformanceCount;
uint8 Padding[ConformanceCount];
} dcerpc_rts_cmd_Padding;
/* RTS command: 0x9 */
typedef [public] struct {
} dcerpc_rts_cmd_NegativeANCE;
/* RTS Command: 0xA */
typedef [public] struct {
} dcerpc_rts_cmd_ANCE;
/* RTS command: 0xB */
typedef [public] struct {
ClientAddress ClientAddress;
} dcerpc_rts_cmd_ClientAddress;
/* RTS command: 0xC */
typedef [public] struct {
RTSCookie AssociationGroupId;
} dcerpc_rts_cmd_AssociationGroupId;
/* RTS command: 0xD */
typedef [public] struct {
ForwardDestination ForwardDestination;
} dcerpc_rts_cmd_Destination;
/* RTS command: 0xE */
typedef [public] struct {
uint32 PingTrafficSent;
} dcerpc_rts_cmd_PingTrafficSentNotify;
typedef [nodiscriminant] union {
[case(0x0)] dcerpc_rts_cmd_ReceiveWindowSize ReceiveWindowSize;
[case(0x1)] dcerpc_rts_cmd_FlowControlAck FlowControlAck;
[case(0x2)] dcerpc_rts_cmd_ConnectionTimeout ConnectionTimeout;
[case(0x3)] dcerpc_rts_cmd_Cookie Cookie;
[case(0x4)] dcerpc_rts_cmd_ChannelLifetime ChannelLifetime;
[case(0x5)] dcerpc_rts_cmd_ClientKeepalive ClientKeepalive;
[case(0x6)] dcerpc_rts_cmd_Version Version;
[case(0x7)] dcerpc_rts_cmd_Empty Empty;
[case(0x8)] dcerpc_rts_cmd_Padding Padding;
[case(0x9)] dcerpc_rts_cmd_NegativeANCE NegativeANCE;
[case(0xA)] dcerpc_rts_cmd_ANCE ANCE;
[case(0xB)] dcerpc_rts_cmd_ClientAddress ClientAddress;
[case(0xC)] dcerpc_rts_cmd_AssociationGroupId AssociationGroupId;
[case(0xD)] dcerpc_rts_cmd_Destination Destination;
[case(0xE)] dcerpc_rts_cmd_PingTrafficSentNotify PingTrafficSentNotify;
} dcerpc_rts_cmds;
typedef [public] struct {
uint32 CommandType;
[switch_is(CommandType)] dcerpc_rts_cmds Command;
} dcerpc_rts_cmd;
/* The RTS flags */
typedef [public, bitmap16bit] bitmap {
RTS_FLAG_NONE = 0x0000,
RTS_FLAG_PING = 0x0001,
RTS_FLAG_OTHER_CMD = 0x0002,
RTS_FLAG_RECYCLE_CHANNEL = 0x0004,
RTS_FLAG_IN_CHANNEL = 0x0008,
RTS_FLAG_OUT_CHANNEL = 0x0010,
RTS_FLAG_EOF = 0x0020,
RTS_FLAG_ECHO = 0x0040
} dcerpc_rts_flags;
typedef [public] struct {
dcerpc_rts_flags Flags;
uint16 NumberOfCommands;
dcerpc_rts_cmd Commands[NumberOfCommands];
} dcerpc_rts;
typedef [public,enum8bit] enum {
DCERPC_PKT_REQUEST = 0, /* Ordinary request. */
DCERPC_PKT_PING = 1, /* Connectionless is server alive ? */
DCERPC_PKT_RESPONSE = 2, /* Ordinary reply. */
DCERPC_PKT_FAULT = 3, /* Fault in processing of call. */
DCERPC_PKT_WORKING = 4, /* Connectionless reply to a ping when server busy. */
DCERPC_PKT_NOCALL = 5, /* Connectionless reply to a ping when server has lost part of clients call. */
DCERPC_PKT_REJECT = 6, /* Refuse a request with a code. */
DCERPC_PKT_ACK = 7, /* Connectionless client to server code. */
DCERPC_PKT_CL_CANCEL = 8, /* Connectionless cancel. */
DCERPC_PKT_FACK = 9, /* Connectionless fragment ack. Both client and server send. */
DCERPC_PKT_CANCEL_ACK = 10, /* Server ACK to client cancel request. */
DCERPC_PKT_BIND = 11, /* Bind to interface. */
DCERPC_PKT_BIND_ACK = 12, /* Server ack of bind. */
DCERPC_PKT_BIND_NAK = 13, /* Server nack of bind. */
DCERPC_PKT_ALTER = 14, /* Alter auth. */
DCERPC_PKT_ALTER_RESP = 15, /* Reply to alter auth. */
DCERPC_PKT_AUTH3 = 16, /* not the real name! this is undocumented! */
DCERPC_PKT_SHUTDOWN = 17, /* Server to client request to shutdown. */
DCERPC_PKT_CO_CANCEL = 18, /* Connection-oriented cancel request. */
DCERPC_PKT_ORPHANED = 19, /* Client telling server it's aborting a partially sent request or telling server to stop sending replies. */
DCERPC_PKT_RTS = 20 /* RTS packets used in ncacn_http */
} dcerpc_pkt_type;
typedef [public,nodiscriminant] union {
[case(DCERPC_PKT_REQUEST)] dcerpc_request request;
[case(DCERPC_PKT_PING)] dcerpc_ping ping;
[case(DCERPC_PKT_RESPONSE)] dcerpc_response response;
[case(DCERPC_PKT_FAULT)] dcerpc_fault fault;
[case(DCERPC_PKT_WORKING)] dcerpc_working working;
[case(DCERPC_PKT_NOCALL)] dcerpc_fack nocall;
[case(DCERPC_PKT_REJECT)] dcerpc_fault reject;
[case(DCERPC_PKT_ACK)] dcerpc_ack ack;
[case(DCERPC_PKT_CL_CANCEL)] dcerpc_cl_cancel cl_cancel;
[case(DCERPC_PKT_FACK)] dcerpc_fack fack;
[case(DCERPC_PKT_CANCEL_ACK)] dcerpc_cancel_ack cancel_ack;
[case(DCERPC_PKT_BIND)] dcerpc_bind bind;
[case(DCERPC_PKT_BIND_ACK)] dcerpc_bind_ack bind_ack;
[case(DCERPC_PKT_BIND_NAK)] dcerpc_bind_nak bind_nak;
[case(DCERPC_PKT_ALTER)] dcerpc_bind alter;
[case(DCERPC_PKT_ALTER_RESP)] dcerpc_bind_ack alter_resp;
[case(DCERPC_PKT_SHUTDOWN)] dcerpc_shutdown shutdown;
[case(DCERPC_PKT_CO_CANCEL)] dcerpc_co_cancel co_cancel;
[case(DCERPC_PKT_ORPHANED)] dcerpc_orphaned orphaned;
[case(DCERPC_PKT_AUTH3)] dcerpc_auth3 auth3;
[case(DCERPC_PKT_RTS)] dcerpc_rts rts;
} dcerpc_payload;
/* pfc_flags values */
typedef [public,bitmap8bit] bitmap {
DCERPC_PFC_FLAG_FIRST = 0x01, /* First fragment */
DCERPC_PFC_FLAG_LAST = 0x02, /* Last fragment */
DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING = 0x04, /* depends on the pdu type */
DCERPC_PFC_FLAG_CONC_MPX = 0x10, /* supports concurrent multiplexing of a single connection. */
DCERPC_PFC_FLAG_DID_NOT_EXECUTE = 0x20, /* on a fault it means the server hasn't done anything */
DCERPC_PFC_FLAG_MAYBE = 0x40, /* `maybe' call semantics requested */
DCERPC_PFC_FLAG_OBJECT_UUID = 0x80 /* on valid guid is in the optional object field */
} dcerpc_pfc_flags;
/* Cancel was pending at sender */
const int DCERPC_PFC_FLAG_PENDING_CANCEL =
DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING;
const int DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN =
DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING;
/* these offsets are needed by the signing code */
const uint8 DCERPC_PFC_OFFSET = 3;
const uint8 DCERPC_DREP_OFFSET = 4;
const uint8 DCERPC_FRAG_LEN_OFFSET = 8;
const uint32 DCERPC_FRAG_MAX_SIZE = 5840;
const uint8 DCERPC_AUTH_LEN_OFFSET = 10;
const uint8 DCERPC_NCACN_PAYLOAD_OFFSET = 16;
/*
* See [MS-RPCE] 3.3.3.5.4 Maximum Server Input Data Size
* 4 MByte is the default limit of reassembled request payload
*/
const uint32 DCERPC_NCACN_REQUEST_DEFAULT_MAX_SIZE = 0x400000;
/*
* See [MS-RPCE] 3.3.2.5.2 Handling Responses
*
* Indicates that Windows accepts up to 0x7FFFFFFF ~2 GByte
*
* talloc has a limit of 256 MByte, so we need to use something smaller.
*
* For now we try our luck with 240 MByte.
*/
const uint32 DCERPC_NCACN_RESPONSE_DEFAULT_MAX_SIZE = 0xf000000; /* 240 MByte */
/* little-endian flag */
const uint8 DCERPC_DREP_LE = 0x10;
typedef [public,nopush,nopull,noprint] struct {
uint8 rpc_vers; /* RPC version */
uint8 rpc_vers_minor; /* Minor version */
dcerpc_pkt_type ptype; /* Packet type */
dcerpc_pfc_flags pfc_flags; /* Fragmentation flags */
uint8 drep[4]; /* NDR data representation */
uint16 frag_length; /* Total length of fragment */
uint16 auth_length; /* authenticator length */
uint32 call_id; /* Call identifier */
[switch_is(ptype)] dcerpc_payload u;
} ncacn_packet;
typedef [public] struct {
uint8 rpc_vers; /* RPC version (4) */
uint8 ptype;
uint8 pfc_flags;
uint8 ncadg_flags;
uint8 drep[3];
uint8 serial_high;
GUID object;
GUID iface;
GUID activity;
uint32 server_boot; /* Server boot time */
uint32 iface_version;
uint32 seq_num;
uint16 opnum;
uint16 ihint;
uint16 ahint;
uint16 len;
uint16 fragnum;
uint8 auth_proto;
uint8 serial_low;
[switch_is(ptype)] dcerpc_payload u;
} ncadg_packet;
typedef [bitmap16bit] bitmap {
DCERPC_SEC_VT_COMMAND_ENUM = 0x3FFF,
DCERPC_SEC_VT_COMMAND_END = 0x4000,
DCERPC_SEC_VT_MUST_PROCESS = 0x8000
} dcerpc_sec_vt_command;
typedef [enum16bit] enum {
DCERPC_SEC_VT_COMMAND_BITMASK1 = 0x0001,
DCERPC_SEC_VT_COMMAND_PCONTEXT = 0x0002,
DCERPC_SEC_VT_COMMAND_HEADER2 = 0x0003
} dcerpc_sec_vt_command_enum;
typedef [bitmap32bit] bitmap {
DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING = 0x00000001
} dcerpc_sec_vt_bitmask1;
typedef struct {
ndr_syntax_id abstract_syntax;
ndr_syntax_id transfer_syntax;
} dcerpc_sec_vt_pcontext;
typedef struct {
dcerpc_pkt_type ptype; /* Packet type */
[value(0)] uint8 reserved1;
[value(0)] uint16 reserved2;
uint8 drep[4]; /* NDR data representation */
uint32 call_id; /* Call identifier */
uint16 context_id;
uint16 opnum;
} dcerpc_sec_vt_header2;
typedef [switch_type(dcerpc_sec_vt_command_enum),nodiscriminant] union {
[case(DCERPC_SEC_VT_COMMAND_BITMASK1)] dcerpc_sec_vt_bitmask1 bitmask1;
[case(DCERPC_SEC_VT_COMMAND_PCONTEXT)] dcerpc_sec_vt_pcontext pcontext;
[case(DCERPC_SEC_VT_COMMAND_HEADER2)] dcerpc_sec_vt_header2 header2;
[default,flag(NDR_REMAINING)] DATA_BLOB _unknown;
} dcerpc_sec_vt_union;
typedef struct {
dcerpc_sec_vt_command command;
[switch_is(command & DCERPC_SEC_VT_COMMAND_ENUM)]
[subcontext(2),flag(NDR_SUBCONTEXT_NO_UNREAD_BYTES)]
dcerpc_sec_vt_union u;
} dcerpc_sec_vt;
typedef [public,nopush,nopull] struct {
uint16 count;
} dcerpc_sec_vt_count;
/*
* We assume that the whole verification trailer fits into
* the last 1024 bytes after the stub data.
*
* There're currently only 3 commands defined and each should
* only be used once.
*/
const uint16 DCERPC_SEC_VT_MAX_SIZE = 1024;
typedef [public,flag(NDR_PAHEX)] struct {
[flag(NDR_ALIGN4)] DATA_BLOB _pad;
[value(DCERPC_SEC_VT_MAGIC)] uint8 magic[8];
dcerpc_sec_vt_count count;
dcerpc_sec_vt commands[count.count];
} dcerpc_sec_verification_trailer;
}
|