The Manticore Project
GitHub Discord Get Started
Generated from Manticore v1.1.6 • 388 packages. View on pkg.go.dev

msraa

import "github.com/TheManticoreProject/Manticore/windows/protocols/ms-raa"

Index

Constants

AuthzrHandleSize is the wire size of an RPC context handle: a 4-octet attributes field plus a 16-octet UUID ([C706] 4.2.16.6, [MS-RPCE] 2.3.2.2).

const AuthzrHandleSize = 20

type AUTHZR\_ACCESS\_REPLY

AUTHZR_ACCESS_REPLY ([MS-RAA]). Generated by tools/idlgen; verify pointer/array tags.

type AUTHZR_ACCESS_REPLY struct {
    ResultListLength  ndr.DWORD
    GrantedAccessMask []ndr.DWORD `ndr:"unique,size_is=ResultListLength"`
    Error             []ndr.DWORD `ndr:"unique,size_is=ResultListLength"`
}

type AUTHZR\_ACCESS\_REQUEST

AUTHZR_ACCESS_REQUEST ([MS-RAA]). Generated by tools/idlgen; verify pointer/array tags.

type AUTHZR_ACCESS_REQUEST struct {
    DesiredAccess        ndr.DWORD
    PrincipalSelfSid     *msdtyp.RPC_SID `ndr:"unique"`
    ObjectTypeListLength ndr.DWORD
    ObjectTypeList       []OBJECT_TYPE_LIST `ndr:"unique,size_is=ObjectTypeListLength"`
}

type AUTHZR\_CONTEXT\_INFORMATION

AUTHZR_CONTEXT_INFORMATION carries one piece of client-context information returned by AuthzGetInformationFromContext ([MS-RAA] 2.2.3.7). ValueType selects the arm of ContextInfoUnion via switch_is(ValueType); being a non-encapsulated union, the discriminant is transmitted twice — once as this ValueType field and once inline at the head of the union ([C706] 14.3.8).

type AUTHZR_CONTEXT_INFORMATION struct {
    ValueType        uint16
    ContextInfoUnion AUTHZR_CONTEXT_INFORMATION_UNION
}

type AUTHZR\_CONTEXT\_INFORMATION\_UNION

AUTHZR_CONTEXT_INFORMATION_UNION is the switch_is(ValueType) union of AUTHZR_CONTEXT_INFORMATION ([MS-RAA] 2.2.3.7). The discriminant is the enclosing USHORT ValueType, so Tag is a 16-bit scalar transmitted inline ahead of the selected arm ([C706] 14.3.8). Every arm is a unique pointer. The IDL maps several AUTHZ_CONTEXT_INFORMATION_CLASS values to one arm — token groups for 0x2 (GroupsSids), 0x3 (RestrictedSids), and 0xC (DeviceSids); token claims for 0xD (UserClaims) and 0xE (DeviceClaims) — and the declarative union takes one case value per field, so those arms are repeated per case value.

type AUTHZR_CONTEXT_INFORMATION_UNION struct {
    Tag                 uint16                                  `ndr:"switch"`
    PTokenUser          *AUTHZR_TOKEN_USER                      `ndr:"case=1,unique"`
    PTokenGroups        *AUTHZR_TOKEN_GROUPS                    `ndr:"case=2,unique"`
    PTokenRestrictedSid *AUTHZR_TOKEN_GROUPS                    `ndr:"case=3,unique"`
    PTokenDeviceGroups  *AUTHZR_TOKEN_GROUPS                    `ndr:"case=12,unique"`
    PTokenUserClaims    *AUTHZR_SECURITY_ATTRIBUTES_INFORMATION `ndr:"case=13,unique"`
    PTokenDeviceClaims  *AUTHZR_SECURITY_ATTRIBUTES_INFORMATION `ndr:"case=14,unique"`
}

type AUTHZR\_HANDLE

AUTHZR_HANDLE is the authzr RPC context handle (the IDL’s [context_handle] PVOID, [MS-RAA] 2.2.1.1). It is transmitted inline as its 20 octets — not as an NDR pointer referent — and aligned to 4 octets because it begins with the 4-octet attributes word. It is a Marshaler so the codec applies that alignment regardless of what precedes it; the zero value is the null handle. AuthzrInitializeContextFromSid returns it and every subsequent authzr call passes it back.

type AUTHZR_HANDLE [AuthzrHandleSize]byte

func (*AUTHZR_HANDLE) AlignmentNDR

func (*AUTHZR_HANDLE) AlignmentNDR() int

AlignmentNDR reports the 4-octet alignment of a context handle.

func (AUTHZR_HANDLE) IsNull

func (h AUTHZR_HANDLE) IsNull() bool

IsNull reports whether the handle is the null context handle, i.e. its 16-octet UUID (the octets after the 4-octet attributes word) is all zero.

func (*AUTHZR_HANDLE) MarshalNDR

func (h *AUTHZR_HANDLE) MarshalNDR(e *ndr.Encoder) error

MarshalNDR writes the 20 octets of the context handle.

func (*AUTHZR_HANDLE) UnmarshalNDR

func (h *AUTHZR_HANDLE) UnmarshalNDR(d *ndr.Decoder) error

UnmarshalNDR reads the 20 octets of the context handle.

type AUTHZR\_SECURITY\_ATTRIBUTES\_INFORMATION

AUTHZR_SECURITY_ATTRIBUTES_INFORMATION ([MS-RAA]). Generated by tools/idlgen; verify pointer/array tags.

type AUTHZR_SECURITY_ATTRIBUTES_INFORMATION struct {
    Version        uint16
    Reserved       uint16
    AttributeCount ndr.DWORD
    Attributes     []AUTHZR_SECURITY_ATTRIBUTE_V1 `ndr:"unique,size_is=AttributeCount"`
}

type AUTHZR\_SECURITY\_ATTRIBUTE\_STRING\_VALUE

AUTHZR_SECURITY_ATTRIBUTE_STRING_VALUE is the string arm of a claim attribute value ([MS-RAA] 2.2.3.4). Value is the IDL’s [string][size_is(Length)] WCHAR* — a unique pointer to a conformant-varying UTF-16 array whose maximum_count is Length; it carries its own offset/actual_count words, so the field is tagged varying. Length is derived from the element count on marshal.

type AUTHZR_SECURITY_ATTRIBUTE_STRING_VALUE struct {
    Length ndr.DWORD
    Value  []uint16 `ndr:"unique,varying,size_is=Length"`
}

type AUTHZR\_SECURITY\_ATTRIBUTE\_UNION

AUTHZR_SECURITY_ATTRIBUTE_UNION is the switch_is(ValueType) union of AUTHZR_SECURITY_ATTRIBUTE_V1_VALUE ([MS-RAA] 2.2.3.5). The discriminant is the enclosing USHORT ValueType, so Tag is a 16-bit scalar, transmitted inline ahead of the selected arm ([C706] 14.3.8). Uint64 covers ValueType 0x2 (UINT64) and 0x6 (BOOLEAN, encoded as a UINT64); the IDL maps both case labels to one arm, so each gets its own field per the declarative-union rule (one case value per field).

type AUTHZR_SECURITY_ATTRIBUTE_UNION struct {
    Tag        uint16                                 `ndr:"switch"`
    Int64      int64                                  `ndr:"case=1"`
    Uint64     uint64                                 `ndr:"case=2"`
    Uint64Bool uint64                                 `ndr:"case=6"`
    String     AUTHZR_SECURITY_ATTRIBUTE_STRING_VALUE `ndr:"case=3"`
}

type AUTHZR\_SECURITY\_ATTRIBUTE\_V1

AUTHZR_SECURITY_ATTRIBUTE_V1 is a single claim security attribute ([MS-RAA] 2.2.3.6). Value is the IDL’s [string][size_is(Length)] WCHAR* attribute name — a unique pointer to a conformant-varying UTF-16 array (see AUTHZR_SECURITY_ATTRIBUTE_STRING_VALUE); Values is the unique pointer to the size_is(ValueCount) array of typed values. Length and ValueCount are derived from the element counts on marshal.

type AUTHZR_SECURITY_ATTRIBUTE_V1 struct {
    Length     ndr.DWORD
    Value      []uint16 `ndr:"unique,varying,size_is=Length"`
    ValueType  uint16
    Reserved   uint16
    Flags      ndr.DWORD
    ValueCount ndr.DWORD
    Values     []AUTHZR_SECURITY_ATTRIBUTE_V1_VALUE `ndr:"unique,size_is=ValueCount"`
}

type AUTHZR\_SECURITY\_ATTRIBUTE\_V1\_VALUE

AUTHZR_SECURITY_ATTRIBUTE_V1_VALUE models a single typed value of a claim security attribute ([MS-RAA] 2.2.3.5). ValueType selects the arm of AttributeUnion via the switch_is(ValueType) discriminant; because it is a non-encapsulated union the discriminant is transmitted twice — once as this ValueType field and once inline at the head of the union ([C706] 14.3.8).

type AUTHZR_SECURITY_ATTRIBUTE_V1_VALUE struct {
    ValueType      uint16
    AttributeUnion AUTHZR_SECURITY_ATTRIBUTE_UNION
}

type AUTHZR\_SID\_AND\_ATTRIBUTES

AUTHZR_SID_AND_ATTRIBUTES ([MS-RAA]). Generated by tools/idlgen; verify pointer/array tags.

type AUTHZR_SID_AND_ATTRIBUTES struct {
    Sid        *msdtyp.RPC_SID `ndr:"unique"`
    Attributes ndr.DWORD
}

type AUTHZR\_TOKEN\_GROUPS

AUTHZR_TOKEN_GROUPS is the array of group SIDs and attributes of a client context ([MS-RAA] 2.2.3.9). Groups is the IDL’s trailing conformant array member (AUTHZR_SID_AND_ATTRIBUTES Groups[]) — NOT a pointer — so it is tagged conformant, not unique: NDR hoists its maximum_count to the front of the structure and writes the elements in place with no referent id ([C706] 14.3.10, [MS-RPCE] 2.2.4). GroupCount is derived from the element count on marshal.

type AUTHZR_TOKEN_GROUPS struct {
    GroupCount ndr.DWORD
    Groups     []AUTHZR_SID_AND_ATTRIBUTES `ndr:"conformant,size_is=GroupCount"`
}

type AUTHZR\_TOKEN\_USER

AUTHZR_TOKEN_USER ([MS-RAA]). Generated by tools/idlgen; verify pointer/array tags.

type AUTHZR_TOKEN_USER struct {
    User AUTHZR_SID_AND_ATTRIBUTES
}

type AUTHZ\_CONTEXT\_INFORMATION\_CLASS

AUTHZ_CONTEXT_INFORMATION_CLASS is an NDR enum, transmitted as a 16-bit value ([C706] 14.3.6, [MS-RAA]).

type AUTHZ_CONTEXT_INFORMATION_CLASS uint16

const (
    AuthzContextInfoUserSid        AUTHZ_CONTEXT_INFORMATION_CLASS = 1
    AuthzContextInfoGroupsSids     AUTHZ_CONTEXT_INFORMATION_CLASS = 2
    AuthzContextInfoRestrictedSids AUTHZ_CONTEXT_INFORMATION_CLASS = 3
    ReservedEnumValue4             AUTHZ_CONTEXT_INFORMATION_CLASS = 4
    ReservedEnumValue5             AUTHZ_CONTEXT_INFORMATION_CLASS = 5
    ReservedEnumValue6             AUTHZ_CONTEXT_INFORMATION_CLASS = 6
    ReservedEnumValue7             AUTHZ_CONTEXT_INFORMATION_CLASS = 7
    ReservedEnumValue8             AUTHZ_CONTEXT_INFORMATION_CLASS = 8
    ReservedEnumValue9             AUTHZ_CONTEXT_INFORMATION_CLASS = 9
    ReservedEnumValue10            AUTHZ_CONTEXT_INFORMATION_CLASS = 10
    ReservedEnumValue11            AUTHZ_CONTEXT_INFORMATION_CLASS = 11
    AuthzContextInfoDeviceSids     AUTHZ_CONTEXT_INFORMATION_CLASS = 12
    AuthzContextInfoUserClaims     AUTHZ_CONTEXT_INFORMATION_CLASS = 13
    AuthzContextInfoDeviceClaims   AUTHZ_CONTEXT_INFORMATION_CLASS = 14
    ReservedEnumValue15            AUTHZ_CONTEXT_INFORMATION_CLASS = 15
    ReservedEnumValue16            AUTHZ_CONTEXT_INFORMATION_CLASS = 16
)

type AUTHZ\_SECURITY\_ATTRIBUTE\_OPERATION

AUTHZ_SECURITY_ATTRIBUTE_OPERATION is an NDR enum, transmitted as a 16-bit value ([C706] 14.3.6, [MS-RAA]).

type AUTHZ_SECURITY_ATTRIBUTE_OPERATION uint16

const (
    AUTHZ_SECURITY_ATTRIBUTE_OPERATION_NONE        AUTHZ_SECURITY_ATTRIBUTE_OPERATION = 0
    AUTHZ_SECURITY_ATTRIBUTE_OPERATION_REPLACE_ALL AUTHZ_SECURITY_ATTRIBUTE_OPERATION = 1
    AUTHZ_SECURITY_ATTRIBUTE_OPERATION_ADD         AUTHZ_SECURITY_ATTRIBUTE_OPERATION = 2
    AUTHZ_SECURITY_ATTRIBUTE_OPERATION_DELETE      AUTHZ_SECURITY_ATTRIBUTE_OPERATION = 3
    AUTHZ_SECURITY_ATTRIBUTE_OPERATION_REPLACE     AUTHZ_SECURITY_ATTRIBUTE_OPERATION = 4
)

type AUTHZ\_SID\_OPERATION

AUTHZ_SID_OPERATION is an NDR enum, transmitted as a 16-bit value ([C706] 14.3.6, [MS-RAA]).

type AUTHZ_SID_OPERATION uint16

const (
    AUTHZ_SID_OPERATION_NONE        AUTHZ_SID_OPERATION = 0
    AUTHZ_SID_OPERATION_REPLACE_ALL AUTHZ_SID_OPERATION = 1
    AUTHZ_SID_OPERATION_ADD         AUTHZ_SID_OPERATION = 2
    AUTHZ_SID_OPERATION_DELETE      AUTHZ_SID_OPERATION = 3
    AUTHZ_SID_OPERATION_REPLACE     AUTHZ_SID_OPERATION = 4
)

type OBJECT\_TYPE\_LIST

OBJECT_TYPE_LIST identifies an object-type element in a hierarchy of object types ([MS-DTYP] 2.4.x / 2.5.3): the authzr access-check request carries an array of these to describe an object and its sub-objects (property sets and properties). It is referenced by the authzr IDL but defined in [MS-DTYP], so it is modeled here in the protocol package rather than pulled from the IDL.

Wire layout ([C706] 14): Level is a 2-octet WORD, Remaining a 4-octet ACCESS_MASK (4-aligned, so 2 octets of padding follow Level), and ObjectType a unique pointer to a GUID (referent id inline, GUID body deferred). The pointer is unique because [MS-DTYP]’s IDL declares pointer_default(unique).

type OBJECT_TYPE_LIST struct {
    Level      uint16
    Remaining  ndr.DWORD
    ObjectType *msdtyp.GUID `ndr:"unique"`
}

type SR\_SD

SR_SD ([MS-RAA]). Generated by tools/idlgen; verify pointer/array tags.

type SR_SD struct {
    DwLength ndr.DWORD
    PSrSd    []uint8 `ndr:"unique,size_is=DwLength"`
}