Download as PDF, PPTX
More Related Content
Similar to DCERPC and Endpoint Mapper
![Devfest Harare 2025 Slides [GDG Harare] - Combined Slide Deck](https://cdn.slidesharecdn.com/ss_thumbnails/ilovepdfmerged12-251029161756-3b829161-thumbnail.jpg?width=640&height=640&fit=bounds)
DCERPC and Endpoint Mapper
- 1. DCERPC Endpoint Mapper Samba3 RPC Server Why? DCERPC and Endpoint Mapper Andreas Schneider <[email protected]> Red Hat May 11th, 2011 Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 2. DCERPC Endpoint Mapper Samba3 RPC Server Why? DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 3. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 4. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? Abbreviations DCE: Distributed (Disturbed) Computing Environment RPC: Remote Procedure Call NDR: Network Data Representation IDL: Interface description language Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 5. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? The RPC process Server Application Application Client Stub Server Stub RPC Library RPC Library Transport Transport Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 6. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? Application spoolss: Printing application displaying a list of printers regedit: Display all values of a key Server Application Application Client Stub Server Stub RPC Library RPC Library Transport Transport Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 7. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? Client Stubs spoolss: Your application calling dcerpc spoolss EnumPrinters regedit: Your application calling dcerpc winreg EnumValues Server Application Application Client Stub Server Stub RPC Library RPC Library Transport Transport Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 8. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? Run-time Library RPC client implementation creating a RPC bind Establishes the connection Authenticates the user Server Application Application Client Stub Server Stub RPC Library RPC Library Transport Transport Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 9. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? Transports ncacn np: SMB Named Pipes transport ncacn ip tcp: DCE/RPC over TCP/IP ncalrpc: Local interprocess communication ncacn http: DCE/RPC over HTTP ncadg ip udp, ncacn at dsp, ncacn nb ipx, ncacn dnet nsp, ... Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 10. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? Run-time Library The RPC Server accepting a connection over a transport and creating the RPC bind After successfull authentication it calls the Server Stub Server Application Application Client Stub Server Stub RPC Library RPC Library Transport Transport Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 11. DCERPC Endpoint Mapper Samba3 RPC Server Why? How does RPC work? Server Stubs This unmarshals the packet and calls the application implementation spoolss: spoolss EnumPrinters regedit: winreg EnumValues Server Application Application Client Stub Server Stub RPC Library RPC Library Transport Transport Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 12. DCERPC Endpoint Mapper Samba3 RPC Server Why? Concept DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 13. DCERPC Endpoint Mapper Samba3 RPC Server Why? Concept Abbreviations EPM: Endpoint Mapper UUID: Universally Unique Identifier (man uuidgen) NDR: Network Data Representation Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 14. DCERPC Endpoint Mapper Samba3 RPC Server Why? Concept Terminology Endpoint: An endpoint could be a port or a pipe and provide several interfaces Interface: An interface is a RPC service provided by an endpoint The named pipe PIPEnetlogon can be used for netlogon and lsarpc connections. Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 15. DCERPC Endpoint Mapper Samba3 RPC Server Why? Concept Remember: The RPC process Server Application Application Client Stub Server Stub RPC Library RPC Library Transport Transport Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 16. DCERPC Endpoint Mapper Samba3 RPC Server Why? Concept Endpoint operations Each RPC service allocates one or more endpoints dynamically on server startup Endpoint mapper maintains information about those endpoints The Endpoint Mapper listens on port 135 TCP/IP or on PIPEepmapper Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 17. DCERPC Endpoint Mapper Samba3 RPC Server Why? Functions and Details DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 18. DCERPC Endpoint Mapper Samba3 RPC Server Why? Functions and Details Function overview The most important function of the endpoint mapper. epm Insert Add specified entries to an endpoint map. epm Delete Delete specified entries from an endpoint map. epm Lookup Lookup entries in an endpoint map. epm Map Apply some algorithm to an endpoint map to produce a list of protocol towers. (Provide an uuid and get an endpoint) epm LookupHandleFree Free an epm Lookup or epm Map entry handle. Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 19. DCERPC Endpoint Mapper Samba3 RPC Server Why? Functions and Details Example Wireshark trace ... Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 20. DCERPC Endpoint Mapper Samba3 RPC Server Why? Functions and Details An endpoint tower A tower has up to 6 floors, 4 at least 1 Floor1: Provides the RPC interface identifier (netlogon uuid). 2 Floor2: Transfer syntax (NDR endcoded) 3 Floor3: RPC protocol identifier (ncacn tcp ip, ncacn np, ...) 4 Floor4: Port address (e.g. TCP Port: 49156, PIPE) 5 Floor5: Transport (e.g. IP:192.168.51.10, NB:krikkit) 6 Floor6: Routing Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 21. DCERPC Endpoint Mapper Samba3 RPC Server Why? Overview DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 22. DCERPC Endpoint Mapper Samba3 RPC Server Why? Overview RPC Endpoints Added support for TCP/IP and NCALRPC Other processes can register at EPM (OpenChange) over NCALRPC Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 23. DCERPC Endpoint Mapper Samba3 RPC Server Why? Robustness DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 24. DCERPC Endpoint Mapper Samba3 RPC Server Why? Robustness Robustness Client RPC service tries to register serveral times After successful registration we do connection monitoring Server We monitor the client connection If it goes away, delete the endpoints Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 25. DCERPC Endpoint Mapper Samba3 RPC Server Why? Scalability DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 26. DCERPC Endpoint Mapper Samba3 RPC Server Why? Scalability Pre-fork We started to implement a mutex locking based pre-fork model. Parent binds all sockets and then forks a number of children Childs have a lock around the accept(3) call Prototype working for our spoolss daemon Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 27. DCERPC Endpoint Mapper Samba3 RPC Server Why? Franky DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 28. DCERPC Endpoint Mapper Samba3 RPC Server Why? Franky Franky A lot of infrastructure has been created for Franky EPM allows us to have multiple daemons Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 29. DCERPC Endpoint Mapper Samba3 RPC Server Why? FreeIPA DCERPC and Endpoint Mapper 1 DCERPC How does RPC work? 2 Endpoint Mapper Concept Functions and Details 3 Samba3 RPC Server Overview Robustness Scalability 4 Why? Franky FreeIPA Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 30. DCERPC Endpoint Mapper Samba3 RPC Server Why? FreeIPA FreeIPA FreeIPA is something like Active Directory but for Linux only. We want to be able to do forest trusts with Active Directory For this we need LSA and Netlogon (SAMR) pdb ipa and ’net rpc trust’ Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper
- 31. DCERPC Endpoint Mapper Samba3 RPC Server Why? FreeIPA Questions & Answers Slides http://www.samba.org/~asn/ Andreas Schneider <[email protected]> Red Hat DCERPC and Endpoint Mapper