//*****************************************************************************
//
// Name:        msrpc.h
//
// Description: MSRPC protocol parser.
//
// History:
//  08/1/93  t-glennc  Created.
//
//*****************************************************************************

//*****************************************************************************
//
// Copyright (c) 1993 by Microsoft Corp.  All rights reserved.
//
//*****************************************************************************

// MSRPC protocol property database identifiers

#define MSRPC_SUMMARY                0x00
#define MSRPC_VERSION                0x01
#define MSRPC_VERSION_MINOR          0x02
#define MSRPC_PTYPE                  0x03
#define MSRPC_PFC_FLAGS1             0x04
#define MSRPC_PFC_FLAGS1_BITS        0x05
#define MSRPC_PACKED_DREP            0x06
#define MSRPC_FRAG_LENGTH            0x07
#define MSRPC_AUTH_LENGTH            0x08
#define MSRPC_CALL_ID                0x09
#define MSRPC_MAX_XMIT_FRAG          0x0A
#define MSRPC_MAX_RECV_FRAG          0x0B
#define MSRPC_ASSOC_GROUP_ID         0x0C
#define MSRPC_P_CONTEXT_SUM          0x0D
#define MSRPC_AUTH_VERIFIER          0x0E
#define MSRPC_SEC_ADDR               0x0F
#define MSRPC_PAD                    0x10
#define MSRPC_P_RESULT_LIST          0x11
#define MSRPC_PROVIDER_REJECT_REASON 0x12
#define MSRPC_VERSIONS_SUPPORTED     0x13
#define MSRPC_ALLOC_HINT             0x14
#define MSRPC_PRES_CONTEXT_ID        0x15
#define MSRPC_CANCEL_COUNT           0x16
#define MSRPC_RESERVED               0x17
#define MSRPC_STATUS                 0x18
#define MSRPC_RESERVED_2             0x19
#define MSRPC_STUB_DATA              0x1A
#define MSRPC_OPNUM                  0x1B
#define MSRPC_OBJECT                 0x1C
#define MSRPC_PFC_FLAGS2             0x1D
#define MSRPC_PFC_FLAGS2_BITS        0x1E
#define MSRPC_SERIAL_HI              0x1F
#define MSRPC_OBJECT_ID              0x20
#define MSRPC_INTERFACE_ID           0x21
#define MSRPC_ACTIVITY_ID            0x22
#define MSRPC_SERVER_BOOT_TIME       0x23
#define MSRPC_INTERFACE_VER          0x24
#define MSRPC_SEQ_NUM                0x25
#define MSRPC_INTERFACE_HINT         0x26
#define MSRPC_ACTIVITY_HINT          0x27
#define MSRPC_LEN_OF_PACKET_BODY     0x28
#define MSRPC_FRAG_NUM               0x29
#define MSRPC_AUTH_PROTO_ID          0x2A
#define MSRPC_SERIAL_LO              0x2B
#define MSRPC_CANCEL_ID              0x2C
#define MSRPC_SERVER_IS_ACCEPTING    0x2D
#define MSRPC_STATUS_CODE            0x2E
#define MSRPC_WINDOW_SIZE            0x2F
#define MSRPC_MAX_TPDU               0x30
#define MSRPC_MAX_PATH_TPDU          0x31
#define MSRPC_SERIAL_NUM             0x32
#define MSRPC_SELACK_LEN             0x33
#define MSRPC_SELACK                 0x34
#define MSRPC_CANCEL_REQUEST_FMT_VER 0x35
#define MSRPC_SEQ_NUMBER             0x36
#define MSRPC_SEC_ADDR_LENGTH        0x37
#define MSRPC_SEC_ADDR_PORT          0x38
#define MSRPC_N_RESULTS              0x39
#define MSRPC_P_RESULTS              0x3A
#define MSRPC_P_CONT_DEF_RESULT      0x3B
#define MSRPC_P_PROVIDER_REASON      0x3C
#define MSRPC_P_TRANSFER_SYNTAX      0x3D
#define MSRPC_IF_UUID                0x3E
#define MSRPC_IF_VERSION             0x3F

#define MSRPC_P_CONTEXT_ELEM         0x40
#define MSRPC_NUM_TRANSFER_SYNTAX	 0x41
#define MSRPC_ABSTRACT_IF_UUID		 0x42
#define MSRPC_ABSTRACT_IF_VERSION	 0x43
#define MSRPC_TRANSFER_IF_UUID		 0x44
#define MSRPC_TRANSFER_IF_VERSION    0x45
#define MSRPC_BIND_FRAME_NUMBER      0x46




// MSRPC PDU TYPES

#define MSRPC_PDU_REQUEST            0
#define MSRPC_PDU_PING               1
#define MSRPC_PDU_RESPONSE           2
#define MSRPC_PDU_FAULT              3
#define MSRPC_PDU_WORKING            4
#define MSRPC_PDU_NOCALL             5
#define MSRPC_PDU_REJECT             6
#define MSRPC_PDU_ACK                7
#define MSRPC_PDU_CL_CANCEL          8
#define MSRPC_PDU_FACK               9
#define MSRPC_PDU_CANCEL_ACK         10
#define MSRPC_PDU_BIND               11
#define MSRPC_PDU_BIND_ACK           12
#define MSRPC_PDU_BIND_NAK           13
#define MSRPC_PDU_ALTER_CONTEXT      14
#define MSRPC_PDU_ALTER_CONTEXT_RESP 15
#define MSRPC_PDU_SHUTDOWN           17
#define MSRPC_PDU_CO_CANCEL          18
#define MSRPC_PDU_ORPHANED           19


// MSRPC PDU FLAGS - 1st Set

#define MSRPC_PDU_FLAG_1_RESERVED_01 0x01
#define MSRPC_PDU_FLAG_1_LASTFRAG    0x02
#define MSRPC_PDU_FLAG_1_FRAG        0x04
#define MSRPC_PDU_FLAG_1_NOFACK      0x08
#define MSRPC_PDU_FLAG_1_MAYBE       0x10
#define MSRPC_PDU_FLAG_1_IDEMPOTENT  0x20
#define MSRPC_PDU_FLAG_1_BROADCAST   0x40
#define MSRPC_PDU_FLAG_1_RESERVED_80 0x80


// MSRPC PDU FLAGS - 2nd Set

#define MSRPC_PDU_FLAG_2_RESERVED_01 0x01
#define MSRPC_PDU_FLAG_2_CANCEL_PEND 0x02
#define MSRPC_PDU_FLAG_2_RESERVED_04 0x04
#define MSRPC_PDU_FLAG_2_RESERVED_08 0x08
#define MSRPC_PDU_FLAG_2_RESERVED_10 0x10
#define MSRPC_PDU_FLAG_2_RESERVED_20 0x20
#define MSRPC_PDU_FLAG_2_RESERVED_40 0x40
#define MSRPC_PDU_FLAG_2_RESERVED_80 0x80


// Data Structures of a MSRPC protocol frame

typedef struct _ALTER_CONTEXT
{
    WORD  MaxXmitFrag;
    WORD  MaxRecvFrag;
    DWORD AssocGroupId;
    BYTE  PContextElem[];
} ALTER_CONTEXT;

typedef struct _ALTER_CONTEXT_RESP
{
    WORD  MaxXmitFrag;
    WORD  MaxRecvFrag;
    DWORD AssocGroupId;
    BYTE  SecAddr[];
} ALTER_CONTEXT_RESP;

typedef struct _BIND
{
    WORD  MaxXmitFrag;
    WORD  MaxRecvFrag;
    DWORD AssocGroupId;
    BYTE  PContextElem[];
} BIND;

typedef struct _BIND_ACK
{
    WORD  MaxXmitFrag;
    WORD  MaxRecvFrag;
    DWORD AssocGroupId;
    BYTE  SecAddr[];
} BIND_ACK;

typedef struct _BIND_NAK
{
    WORD  RejectReason;
    BYTE  Versions[];
} BIND_NAK;

typedef struct _CO_CANCEL
{
    BYTE  AuthTrailer[];
} CO_CANCEL;

typedef struct _FAULT
{
    union
    {
        DWORD AllocHint;
        DWORD StatusCode;
    };
    WORD  PContId;
    BYTE  CancelCount;
    BYTE  Reserved;
    DWORD Status;
    BYTE  Reserved2[4];
    BYTE  Data[];
} FAULT;

typedef struct _ORPHANED
{
    BYTE  AuthTrailer[];
} ORPHANED;

typedef struct _REQUEST
{
    DWORD AllocHint;
    WORD  PContId;
    WORD  OpNum;
    BYTE  Object[16];
    BYTE  Data[];
} REQUEST;

typedef struct _RESPONSE
{
    DWORD AllocHint;
    WORD  PContId;
    BYTE  CancelCount;
    BYTE  Reserved;
    BYTE  Data[];
} RESPONSE;

typedef struct _SHUTDOWN
{
    BYTE  Data[];
} SHUTDOWN;

typedef struct _MSRPCCO
{
    BYTE  Version;
    BYTE  VersionMinor;
    BYTE  PType;
    BYTE  PFCFlags;
    BYTE  PackedDrep[4];
    WORD  FragLength;
    WORD  AuthLength;
    DWORD CallID;
    union
    {
      ALTER_CONTEXT      AlterContext;
      ALTER_CONTEXT_RESP AlterContextResp;
      BIND               Bind;
      BIND_ACK           BindAck;
      BIND_NAK           BindNak;
      CO_CANCEL          COCancel;
      FAULT              Fault;
      ORPHANED           Orphaned;
      REQUEST            Request;
      RESPONSE           Response;
      SHUTDOWN           Shutdown;
    };
} MSRPCCO;

typedef MSRPCCO UNALIGNED * LPMSRPCCO;


typedef struct _CL_REQUEST
{
    BYTE  Data[];
} CL_REQUEST;

typedef struct _PING
{
    BYTE  Data[];
} PING;

typedef struct _CL_RESPONSE
{
    BYTE  Data[];
} CL_RESPONSE;

typedef struct _WORKING
{
    BYTE  Data[];
} WORKING;

typedef struct _NOCALL
{
    BYTE  Vers;
    BYTE  Pad1;
    WORD  WindowSize;
    DWORD MaxTPDU;
    DWORD MaxPathTPDU;
    WORD  SerialNumber;
    WORD  SelAckLen;
    DWORD SelAck[];
} NOCALL;

typedef struct _REJECT
{
    DWORD  StatusCode;
} REJECT;

typedef struct _ACK
{
    BYTE  Data[];
} ACK;

typedef struct _CL_CANCEL
{
    DWORD  Vers;
    DWORD  CancelId;
} CL_CANCEL;

typedef struct _FACK
{
    BYTE  Vers;
    BYTE  Pad1;
    WORD  WindowSize;
    DWORD MaxTPDU;
    DWORD MaxPathTPDU;
    WORD  SerialNumber;
    WORD  SelAckLen;
    DWORD SelAck[];
} FACK;

typedef struct _CANCEL_ACK
{
    DWORD  Vers;
    DWORD  CancelId;
    DWORD  ServerIsAccepting;
} CANCEL_ACK;


typedef struct _MSRPCCL
{
    BYTE  Version;
    BYTE  PType;
    BYTE  PFCFlags1;
    BYTE  PFCFlags2;
    BYTE  PackedDrep[3];
    BYTE  SerialNumHi;
    BYTE  ObjectId[16];
    BYTE  InterfaceId[16];
    BYTE  ActivityId[16];
    DWORD ServerBootTime;
    DWORD InterfaceVersion;
    DWORD SeqNum;
    WORD  OpNum;
    WORD  InterfaceHint;
    WORD  ActivityHint;
    WORD  Length;
    WORD  FragNum;
    BYTE  AuthProtoId;
    BYTE  SerialNumLo;
    union
    {
      CL_REQUEST         Request;
      PING               Ping;
      CL_RESPONSE        Response;
      FAULT              Fault;
      WORKING            Working;
      NOCALL             NoCall;
      REJECT             Reject;
      ACK                Ack;
      CL_CANCEL          CLCancel;
      FACK               Fack;
      CANCEL_ACK         CancelAck;
    };
} MSRPCCL;

typedef MSRPCCL UNALIGNED * LPMSRPCCL;


typedef unsigned short p_context_id_t;

typedef struct
{
    GUID if_uuid;
    unsigned long if_version;
} p_syntax_id_t;

typedef struct
{
    p_context_id_t p_cont_id;
    unsigned char n_transfer_syn;
    unsigned char reserved;
    p_syntax_id_t abstract_syntax;
    p_syntax_id_t transfer_syntaxes[1];
} p_cont_elem_t;



// Table for tracking IIDs

typedef struct _IID_HANDOFF
{
	union
	{
		BYTE	ByteRep[16];
		DWORD	DwordRep[4];
	};
	HPROTOCOL	hNext;
}  IID_HANDOFF;



// We are going to store the BIND frames in a database so that at attach time, we 
//  can point to who is the BIND frame on requests and responses.  CCHeapAlloc routines
//  will be used to store the data.


enum BINDTABLESTATE
{
    UNINITED,
    NORMAL,
    FULL
};

typedef struct _BINDENTRY
{
    DWORD   nFrame;
    HFRAME  hBindFrame;
} BINDENTRY;

typedef BINDENTRY * LPBINDENTRY;


typedef struct _BINDTABLE
{
    DWORD   nEntries;
    DWORD   nAllocated;
    DWORD   State;
    BOOL    fCurrentlyLookingBack;
    BINDENTRY BindEntry[1];

} BINDTABLE;

typedef BINDTABLE * LPBINDTABLE;

#define BINDTABLEHEADERSIZE (sizeof(BINDTABLE)-sizeof(BINDENTRY))



// Defintions for MSRPC protocol parser entry point functions

VOID WINAPI   MSRPC_Register( HPROTOCOL hMSRPC );

VOID WINAPI   MSRPC_Deregister( HPROTOCOL hMSRPC );

LPBYTE WINAPI MSRPC_RecognizeFrame( HFRAME      hFrame,
                                    LPBYTE      lpStartFrame,
                                    LPBYTE      lpStartMSRPC,
                                    DWORD       MacType,
                                    DWORD       BytesLeft,
                                    HPROTOCOL   hPreviousProtocol,       
                                    DWORD       nPreviousProtocolOffset, 
                                    LPDWORD     ProtocolStatusCode,      
                                    LPHPROTOCOL hNextProtocol,
                                    LPDWORD     lpInstData );

LPBYTE WINAPI MSRPC_AttachProperties( HFRAME    hFrame,
                                      LPBYTE    lpStartFrame,
                                      LPBYTE    lpStartMSRPC,
                                      DWORD     MacType,
                                      DWORD     BytesLeft,
                                      HPROTOCOL hPreviousProtocol,
                                      DWORD     nPreviousProtocolOffset,
                                      DWORD     InstData );

DWORD WINAPI  MSRPC_FormatProperties( HFRAME         hFrame,
                                      LPBYTE         MacFrame,
                                      LPBYTE         ProtocolFrame,
                                      DWORD          nPropertyInsts,
                                      LPPROPERTYINST p );

VOID WINAPIV   MSRPC_FmtSummary( LPPROPERTYINST lpPropertyInst );