epm
import "github.com/TheManticoreProject/Manticore/network/dcerpc/v4/epm"
Package epm implements the RPC endpoint mapper (ept) over the connectionless (v4) transport: it resolves an interface UUID to its bound transport endpoints by calling ept_map on the endpoint mapper at UDP port 135.
Two encodings are involved. The protocol tower (this file) is the floor-based description of an interface-over-transport binding, defined in [C706] Appendix L with the floor protocol identifiers in [C706] Appendix I. The ept_map operation (epm.go) wraps a map tower in NDR and invokes the ept interface via the v4 client.
References:
- [C706] Appendix L (protocol tower encoding): https://pubs.opengroup.org/onlinepubs/9629399/apdxl.htm
- [C706] Appendix I (protocol identifiers): https://pubs.opengroup.org/onlinepubs/9629399/apdxi.htm
Index
Constants
const (
// InterfaceMajorVersion is the ept interface major version (3.0).
InterfaceMajorVersion = 3
// InterfaceMinorVersion is the ept interface minor version.
InterfaceMinorVersion = 0
// OpnumEptMap is the operation number of ept_map (the 4th ept operation).
OpnumEptMap = 3
// DefaultMaxTowers is the default number of towers ept_map is asked to return.
DefaultMaxTowers = 4
)
Floor protocol identifier bytes, the first octet of a floor’s LHS ([C706] Appendix I).
const (
// FloorProtoUUID marks a floor whose LHS is a UUID plus a 16-bit major version
// (the interface-identifier and transfer-syntax floors). The RHS holds the 16-bit
// minor version.
FloorProtoUUID = 0x0D
// FloorProtoNCACN identifies the connection-oriented RPC protocol (major v5).
FloorProtoNCACN = 0x0B
// FloorProtoNCADG identifies the connectionless RPC protocol (major v4).
FloorProtoNCADG = 0x0A
// FloorProtoUDP identifies the DOD UDP floor; its RHS is a 16-bit port in
// big-endian order.
FloorProtoUDP = 0x08
// FloorProtoIP identifies the DOD IP floor; its RHS is a 4-octet IPv4 address in
// big-endian order.
FloorProtoIP = 0x09
)
Variables
Endpoint mapper (ept) interface identity ([C706] Appendix O).
var (
// Interface is the ept interface UUID, e1af8308-5d1f-11c9-91a4-08002b14a0fa.
Interface = guid.GUID{A: 0xe1af8308, B: 0x5d1f, C: 0x11c9, D: 0x91a4, E: 0x08002b14a0fa}
)
type Client
Client resolves interface endpoints through the endpoint mapper using a connectionless RPC client.
type Client struct {
// contains filtered or unexported fields
}
func New
func New(rpc *client.Client) *Client
New returns an endpoint-mapper client over the given connectionless RPC client. The rpc client should be bound to the endpoint mapper’s UDP endpoint (port 135).
func (*Client) Map
func (c *Client) Map(iface guid.GUID, ifMajor, ifMinor uint16) ([]Endpoint, error)
Map resolves the transport endpoints bound to the given interface UUID and version by calling ept_map with an ncadg_ip_udp map tower, and returns the endpoints extracted from the towers the endpoint mapper returns.
func (*Client) SetMaxTowers
func (c *Client) SetMaxTowers(n uint32)
SetMaxTowers overrides how many towers ept_map is asked to return.
type Endpoint
Endpoint is a resolved transport endpoint extracted from a tower.
type Endpoint struct {
IP net.IP
Port uint16
}
func (Endpoint) String
func (e Endpoint) String() string
String renders the endpoint as host:port.
type Floor
Floor is one floor of a protocol tower: a length-prefixed left-hand side (protocol identifier and associated data) and a length-prefixed right-hand side (addressing or version data).
type Floor struct {
LHS []byte
RHS []byte
}
func IPFloor
func IPFloor(ip net.IP) Floor
IPFloor builds the DOD IP floor; the RHS is the 4-octet IPv4 address in big-endian (network) order.
func InterfaceFloor
func InterfaceFloor(iface guid.GUID, major, minor uint16) Floor
InterfaceFloor builds the interface-identifier floor (floor 1).
func TransferSyntaxFloor
func TransferSyntaxFloor() Floor
TransferSyntaxFloor builds the NDR transfer-syntax floor (floor 2).
func UDPFloor
func UDPFloor(port uint16) Floor
UDPFloor builds the DOD UDP floor; the RHS is the 16-bit port in big-endian order.
func (Floor) Marshal
func (f Floor) Marshal() []byte
Marshal serializes the floor: uint16 LHS length, LHS, uint16 RHS length, RHS (all lengths little-endian).
func (Floor) Protocol
func (f Floor) Protocol() byte
Protocol returns the floor’s protocol identifier byte (the first LHS octet), or 0 if the LHS is empty.
type Tower
Tower is an ordered list of floors describing an interface-over-transport binding.
type Tower struct {
Floors []Floor
}
func BuildMapTower
func BuildMapTower(iface guid.GUID, ifMajor, ifMinor uint16) Tower
BuildMapTower builds the 5-floor ncadg_ip_udp tower used as the ept_map input: the interface and NDR transfer-syntax floors describe what is wanted, and the connectionless/UDP/IP floors with a zero port and address request that the endpoint mapper fill in the bound endpoint.
func UnmarshalTower
func UnmarshalTower(data []byte) (Tower, error)
UnmarshalTower parses a tower octet string.
func (Tower) Endpoint
func (t Tower) Endpoint() (ep Endpoint, ok bool)
Endpoint extracts the UDP port and IPv4 address from the tower’s transport floors. ok is false unless both a UDP floor and an IP floor are present.
func (Tower) Marshal
func (t Tower) Marshal() []byte
Marshal serializes the tower: a little-endian uint16 floor count followed by each floor.