structures
import "github.com/TheManticoreProject/Manticore/network/dcerpc/interfaces/e1af8308-5d1f-11c9-91a4-08002b14a0fa/3.0/structures"
Index
- Constants
- type Annotation
- type Binding
- type BindingKind
- type ContextHandle
- type Endpoint
- type EptEntry
- type EptUUID
- type Floor
- func HTTPFloor(port uint16) Floor
- func IPFloor(ip net.IP) Floor
- func InterfaceFloor(iface guid.GUID, major, minor uint16) Floor
- func NamedPipeFloor(name string) Floor
- func NetBIOSFloor(host string) Floor
- func TCPFloor(port uint16) Floor
- func TransferSyntaxFloor() Floor
- func (f Floor) Marshal() []byte
- func (f Floor) Protocol() byte
- type RpcIfID
- type Tower
- type Twr
Constants
Floor protocol identifier bytes, the first octet of a floor’s LHS ([C706] Appendix I).
const (
// FloorProtoUUID marks a floor whose LHS is a UUID plus a 16-bit major version (the
// interface-identifier and transfer-syntax floors). The RHS holds the 16-bit minor
// version.
FloorProtoUUID = 0x0D
// FloorProtoNCACN identifies the connection-oriented RPC protocol (major v5).
FloorProtoNCACN = 0x0B
// FloorProtoNCADG identifies the connectionless RPC protocol (major v4).
FloorProtoNCADG = 0x0A
// FloorProtoTCP identifies the DOD TCP floor; its RHS is a 16-bit port in big-endian
// order. This is the transport floor of an ncacn_ip_tcp tower.
FloorProtoTCP = 0x07
// FloorProtoUDP identifies the DOD UDP floor; its RHS is a 16-bit port in big-endian
// order.
FloorProtoUDP = 0x08
// FloorProtoIP identifies the DOD IP floor; its RHS is a 4-octet IPv4 address in
// big-endian order.
FloorProtoIP = 0x09
// FloorProtoNamedPipe identifies the named-pipe floor of an ncacn_np tower; its RHS
// is the NUL-terminated pipe name (e.g. "\PIPE\srvsvc").
FloorProtoNamedPipe = 0x0F
// FloorProtoNetBIOS identifies the NetBIOS host-name floor (the address floor of an
// ncacn_np tower); its RHS is the NUL-terminated host name.
FloorProtoNetBIOS = 0x11
// FloorProtoLRPC identifies the local-RPC (ncalrpc) endpoint floor; its RHS is the
// NUL-terminated local port name (e.g. "WindowsShutdown"). It is the transport/endpoint
// floor of an ncalrpc tower, accompanied by the 0x0C protocol-identifier floor
// (FloorProtoLRPCAssoc). This is the most common transport in a real Windows endpoint
// map ([C706] Appendix I; [MS-RPCE] 2.2.1.2 protocol identifiers).
FloorProtoLRPC = 0x10
// FloorProtoLRPCAssoc is the protocol-identifier floor that accompanies an ncalrpc
// endpoint floor (its RHS is empty). The endpoint name lives on the 0x10 floor.
FloorProtoLRPCAssoc = 0x0C
// FloorProtoHTTP identifies the RPC-over-HTTP floor of an ncacn_http tower; its RHS is
// a 16-bit port in big-endian order.
FloorProtoHTTP = 0x1F
)
AnnotationMaxSize is ept_max_annotation_size, the fixed bound of the annotation array.
const AnnotationMaxSize = 64
ContextHandleSize is the wire size of an ept_lookup_handle_t / ndr_context_handle: a 4-octet attributes field plus a 16-octet UUID ([C706] section 4.2.16.6).
const ContextHandleSize = 20
type Annotation
Annotation is the [string] char annotation[ept_max_annotation_size] field of an ept_entry_t ([C706] Appendix O, ept_max_annotation_size = 64): a human-readable label the endpoint mapper stores with each registration (e.g. “Messenger Service”).
A fixed-bound [string] array is encoded in NDR as a *varying* array — an offset and an actual_count (number of characters, including the NUL terminator) followed by that many octets, with no maximum_count. That two-count framing differs from the codec’s general conformant-varying string handling, so Annotation marshals itself.
type Annotation string
func (*Annotation) AlignmentNDR
func (*Annotation) AlignmentNDR() int
AlignmentNDR reports the 4-octet alignment of the leading offset/actual_count words.
func (*Annotation) MarshalNDR
func (a *Annotation) MarshalNDR(e *ndr.Encoder) error
MarshalNDR writes the annotation as a varying char array: offset 0, actual_count (string length plus the NUL terminator), then the bytes and the terminator.
func (*Annotation) UnmarshalNDR
func (a *Annotation) UnmarshalNDR(d *ndr.Decoder) error
UnmarshalNDR reads a varying char array (offset, actual_count, octets) and stores it with the trailing NUL removed.
type Binding
Binding is a tower decoded into the components of a DCE string binding (protseq:network_address[endpoint]).
type Binding struct {
Kind BindingKind
// ProtSeq is the protocol sequence, e.g. "ncacn_ip_tcp" or "ncacn_np".
ProtSeq string
// NetworkAddress is the host: an IPv4 address (ncacn_ip_tcp/http, ncadg_ip_udp) or a
// NetBIOS host name (ncacn_np). It may be empty if the tower carries no address floor.
NetworkAddress string
// Endpoint is the per-transport endpoint: a decimal port (TCP/UDP/HTTP) or a pipe name
// (named pipe).
Endpoint string
}
func (Binding) String
func (b Binding) String() string
String renders the canonical DCE string binding, protseq:network_address[endpoint] (e.g. “ncacn_ip_tcp:10.0.0.1[49664]”, “ncacn_np:HOST[\\PIPE\\srvsvc]”).
type BindingKind
BindingKind identifies the transport (protocol sequence) a tower describes.
type BindingKind uint8
const (
// BindingUnknown marks a tower with no recognized transport/endpoint floor.
BindingUnknown BindingKind = iota
// BindingTCP is ncacn_ip_tcp (RPC over TCP).
BindingTCP
// BindingUDP is ncadg_ip_udp (connectionless RPC over UDP).
BindingUDP
// BindingNamedPipe is ncacn_np (RPC over an SMB named pipe).
BindingNamedPipe
// BindingHTTP is ncacn_http (RPC over HTTP / RPC proxy).
BindingHTTP
// BindingLRPC is ncalrpc (local RPC over an ALPC port). Its endpoint is the local port
// name and it has no network address.
BindingLRPC
)
type ContextHandle
ContextHandle models the ept_lookup_handle_t context handle. A context handle is transmitted inline as its 20 octets (not as an NDR pointer referent) and aligned to 4 octets; it is a Marshaler so the codec applies that alignment ahead of the handle regardless of how the preceding tower octet string padded out. The zero value is the null handle used on the first ept_map call.
type ContextHandle [ContextHandleSize]byte
func (*ContextHandle) AlignmentNDR
func (*ContextHandle) AlignmentNDR() int
AlignmentNDR reports the 4-octet alignment of a context handle (its first field is the 4-octet attributes word).
func (ContextHandle) IsNull
func (h ContextHandle) IsNull() bool
IsNull reports whether the handle is the null context handle, i.e. its 16-octet UUID (the octets after the 4-octet attributes word) is all zero. ept_lookup signals the end of a paged enumeration by returning a null entry handle.
func (*ContextHandle) MarshalNDR
func (h *ContextHandle) MarshalNDR(e *ndr.Encoder) error
MarshalNDR writes the 20 octets of the context handle.
func (*ContextHandle) UnmarshalNDR
func (h *ContextHandle) UnmarshalNDR(d *ndr.Decoder) error
UnmarshalNDR reads the 20 octets of the context handle.
type Endpoint
Endpoint is a resolved transport endpoint extracted from a tower.
type Endpoint struct {
IP net.IP
Port uint16
}
func (Endpoint) String
func (e Endpoint) String() string
String renders the endpoint as host:port.
type EptEntry
EptEntry models ept_entry_t ([C706] Appendix O):
typedef struct {
uuid_t object;
twr_p_t tower;
[string] char annotation[ept_max_annotation_size];
} ept_entry_t;
Object is the object UUID (often nil/zero), Tower is a unique/full pointer to the twr_t describing the binding, and Annotation is the registration’s label. It is the element type of ept_lookup’s [out] entries array; use DecodeTower to obtain the decoded protocol Tower (and Tower.Binding for a string binding).
type EptEntry struct {
Object EptUUID
Tower *Twr `ndr:"ptr"`
Annotation Annotation
}
func (EptEntry) DecodeTower
func (e EptEntry) DecodeTower() (Tower, error)
DecodeTower decodes the entry’s twr_t into a protocol Tower. It errors if the entry has no tower (a null pointer on the wire).
type EptUUID
EptUUID models the uuid_t referent of ept_map’s optional [in] object pointer (uuid_p_t). Octets holds the 16-octet UUID exactly as it appears on the wire (Data1/2/3 little-endian, Data4 big-endian), which the codec emits verbatim as the referent body of the full pointer. It is a fixed-octet struct rather than an ndr.Marshaler so the codec applies its normal pointer handling (a NULL referent id when the field is nil); a Marshaler is intercepted before that and would be dereferenced even when nil. guid.GUID is not used directly because its Go layout (a trailing uint64) does not map to 16 contiguous octets under reflection.
type EptUUID struct {
Octets [16]byte
}
func NewEptUUID
func NewEptUUID(g guid.GUID) EptUUID
NewEptUUID converts a GUID to its uuid_t octet form.
func (EptUUID) GUID
func (u EptUUID) GUID() guid.GUID
GUID converts the octets back to a guid.GUID.
type Floor
Floor is one floor of a protocol tower: a length-prefixed left-hand side (protocol identifier and associated data) and a length-prefixed right-hand side (addressing or version data).
type Floor struct {
LHS []byte
RHS []byte
}
func HTTPFloor
func HTTPFloor(port uint16) Floor
HTTPFloor builds the RPC-over-HTTP floor; the RHS is the 16-bit port in big-endian order.
func IPFloor
func IPFloor(ip net.IP) Floor
IPFloor builds the DOD IP floor; the RHS is the 4-octet IPv4 address in big-endian (network) order.
func InterfaceFloor
func InterfaceFloor(iface guid.GUID, major, minor uint16) Floor
InterfaceFloor builds the interface-identifier floor (floor 1).
func NamedPipeFloor
func NamedPipeFloor(name string) Floor
NamedPipeFloor builds the named-pipe floor of an ncacn_np tower; the RHS is the NUL-terminated pipe name (e.g. “\PIPE\srvsvc”).
func NetBIOSFloor
func NetBIOSFloor(host string) Floor
NetBIOSFloor builds the NetBIOS host-name floor; the RHS is the NUL-terminated host name.
func TCPFloor
func TCPFloor(port uint16) Floor
TCPFloor builds the DOD TCP floor; the RHS is the 16-bit port in big-endian order.
func TransferSyntaxFloor
func TransferSyntaxFloor() Floor
TransferSyntaxFloor builds the NDR transfer-syntax floor (floor 2).
func (Floor) Marshal
func (f Floor) Marshal() []byte
Marshal serializes the floor: uint16 LHS length, LHS, uint16 RHS length, RHS (all lengths little-endian).
func (Floor) Protocol
func (f Floor) Protocol() byte
Protocol returns the floor’s protocol identifier byte (the first LHS octet), or 0 if the LHS is empty.
type RpcIfID
RpcIfID models RPC_IF_ID ([C706] Appendix O / [MS-RPCE] 2.2.1.2.4): an interface identifier (UUID + 16-bit major/minor version). It is the referent of ept_lookup’s optional [in, ptr] Ifid parameter, used to filter the endpoint map by interface.
UUID is the EptUUID octet form (the same fixed-octet UUID used by ept_map’s object pointer) so the codec emits it verbatim as part of the referent body.
type RpcIfID struct {
UUID EptUUID
VersMajor uint16
VersMinor uint16
}
func NewRpcIfID
func NewRpcIfID(iface guid.GUID, major, minor uint16) RpcIfID
NewRpcIfID builds an RpcIfID from a GUID and an interface major/minor version.
type Tower
Tower is an ordered list of floors describing an interface-over-transport binding.
type Tower struct {
Floors []Floor
}
func BuildMapTowerTCP
func BuildMapTowerTCP(iface guid.GUID, ifMajor, ifMinor uint16) Tower
BuildMapTowerTCP builds the 5-floor ncacn_ip_tcp tower used as the ept_map input: the interface and NDR transfer-syntax floors describe what is wanted, and the connection-oriented/TCP/IP floors with a zero port and address request that the endpoint mapper fill in the bound endpoint.
func UnmarshalTower
func UnmarshalTower(data []byte) (Tower, error)
UnmarshalTower parses a tower octet string.
func (Tower) Binding
func (t Tower) Binding() (Binding, error)
Binding decodes the tower’s transport and address floors into a Binding. It supports ncacn_ip_tcp, ncadg_ip_udp, ncacn_np, ncacn_http, and ncalrpc. ok-style failure is reported as an error when no recognized transport (endpoint) floor is present.
func (Tower) Endpoint
func (t Tower) Endpoint() (ep Endpoint, ok bool)
Endpoint extracts the TCP port and IPv4 address from the tower’s transport floors. ok is false unless a TCP floor is present; the IP is left zero if the tower carries no IP floor. It is the ncacn_ip_tcp fast path used by ept_map’s Map; for any other transport use Binding.
func (Tower) Marshal
func (t Tower) Marshal() []byte
Marshal serializes the tower: a little-endian uint16 floor count followed by each floor.
type Twr
Twr models twr_t ([C706] Appendix O):
typedef struct {
unsigned32 tower_length;
[size_is(tower_length)] byte tower_octet_string[];
} twr_t;
It is a conformant structure: the NDR codec hoists the array’s maximum_count to the front of the structure and derives TowerLength from the octet-string length, so callers set only TowerOctetString. The octet string itself is a protocol tower (see Tower); use NewTwr / DecodeTower to convert between the two.
type Twr struct {
TowerLength uint32
TowerOctetString []byte `ndr:"conformant,size_is=TowerLength"`
}
func NewTwr
func NewTwr(tower Tower) Twr
NewTwr wraps a protocol tower’s octet-string encoding in a twr_t.
func (Twr) DecodeTower
func (t Twr) DecodeTower() (Tower, error)
DecodeTower parses the twr_t’s octet string back into a protocol tower.