1RPC(3)                              rpc 1.5                             RPC(3)
2
3
4

NAME

6       packet.application.rpc - RPC module
7

DESCRIPTION

9       Decode RPC layer.
10

CLASSES

12   class Header(baseobj.BaseObj)
13       Header object
14
15
16       Methods defined here:
17       ---------------------
18
19       __init__(self, size, last_fragment)
20       Constructor which takes the size and last fragment as inputs
21
22   class Prog(baseobj.BaseObj)
23       Prog object
24
25
26       Methods defined here:
27       ---------------------
28
29       __init__(self, unpack)
30       Constructor which takes the Unpack object as input
31
32   class RPC(packet.application.gss.GSS)
33       RPC object
34
35       Usage:
36           from packet.application.rpc import RPC
37
38           # Decode the RPC header
39           x = RPC(pktt_obj, proto=6)
40
41           # Decode NFS layer
42           nfs = x.decode_payload()
43
44       Object definition:
45
46       RPC(
47           [
48               # If TCP
49               fragment_hdr = Header(
50                   last_fragment = int,
51                   size          = int,
52               ),
53           ]
54           xid  = int,
55           type = int,
56
57           [
58               # If type == 0 (RPC call)
59               rpc_version = int,
60               program     = int,
61               version     = int,
62               procedure   = int,
63               credential  = Credential(
64                   data   = string,
65                   flavor = int,
66                   size   = int,
67               ),
68               verifier = Credential(
69                   data   = string,
70                   flavor = int,
71                   size   = int,
72               ),
73           ] | [
74               # If type == 1 (RPC reply)
75               reply_status = int,
76               [
77                   # If reply_status == 0
78                   verifier = Credential(
79                       data   = string,
80                       flavor = int,
81                       size   = int,
82                   ),
83                   accepted_status = int,
84                   [
85                       # If accepted_status == 2
86                       prog_mismatch = Prog(
87                           low  = int,
88                           high = int,
89                       )
90                   ]
91               ] | [
92                   # If reply_status != 0
93                   rejected_status = int,
94                   [
95                       # If rejected_status == 0
96                       prog_mismatch = Prog(
97                           low  = int,
98                           high = int,
99                       )
100                   ] | [
101                       # If rejected_status != 0
102                       auth_status = int,
103                   ]
104               ]
105           ]
106           psize = int,    # payload data size
107           [data = string] # raw data of payload if unable to decode
108       )
109
110
111       Methods defined here:
112       ---------------------
113
114       __bool__(self)
115       Truth value testing for the built-in operation bool()
116
117       __init__(self, pktt, proto=17, state=True)
118       Constructor
119
120       Initialize object's private data.
121
122
123              pktt:  Packet trace object (packet.pktt.Pktt) so this layer has
124                     access to the parent layers.
125
126              proto: Transport layer protocol.
127
128              state: Save call state. [default: True]
129
130       __str__(self)
131       String representation of object
132
133       The representation depends on the verbose level set by debug_repr().
134       If set to 0 the generic object representation is returned.
135       If set to 1 the representation of the object is:
136           'RPC call   program: 100003, version: 4, procedure: 0, xid: 0xe37d3d5 '
137
138       If set to 2 the representation of the object is as follows:
139           'CALL(0), program: 100003, version: 4, procedure: 0, xid: 0xe37d3d5'
140
141       decode_payload(self)
142       Decode RPC load
143
144       For RPC calls it is easy to decide if the RPC payload is an NFS packet
145       since the RPC program is in the RPC header, which for NFS the
146       program number is 100003. On the other hand, for RPC replies the RPC
147       header does not have any information on what the payload is, so the
148       transaction ID (xid) is used to map the replies to their calls and
149       thus deciding if RPC payload is an NFS packet or not.
150       This is further complicated when trying to decode callbacks, since
151       the program number for callbacks could be any number in the transient
152       program range [0x40000000, 0x5FFFFFFF]. Therefore, any program number
153       in the transient range is considered a callback and if the decoding
154       succeeds then this is an NFS callback, otherwise it is not.
155
156       Since the RPC replies do not contain any information about what type
157       of payload, when they are decoded correctly as NFS replies this
158       information is inserted in the RPC (pkt.rpc) object.
159       This information includes program number, RPC version, procedure
160       number as well as the call_index which is the packet index of its
161       corresponding call for each reply.
162
163       x.pkt.nfs = <NFSobject>
164
165       where <NFSobject> is an object of type COMPOUND4args or COMPOUND4res
166
167       class COMPOUND4args(
168           tag          = string,
169           minorversion = int,
170           argarray     = [],
171       )
172
173       The argarray is a list of nfs_argop4 objects:
174
175       class nfs_argop4(
176           argop = int,
177           [<opobject> = <opargobject>,]
178       )
179
180       where opobject could be opsequence, opgetattr, etc., and opargobject
181       is the object which has the arguments for the given opobject, e.g.,
182       SEQUENCE4args, GETATTR4args, etc.
183
184       class COMPOUND4res(
185           tag      = string,
186           status   = int,
187           resarray = [],
188       )
189
190       The resarray is a list of nfs_resop4 objects:
191
192       class nfs_resop4(
193           resop = int,
194           [<opobject> = <opresobject>,]
195       )
196
197       where opobject could be opsequence, opgetattr, etc., and opresobject
198       is the object which has the results for the given opobject, e.g.,
199       SEQUENCE4res, GETATTR4res, etc.
200
201   class accept_stat_enum(packet.utils.Enum)
202       enum accept_stat
203
204
205   class auth_stat_enum(packet.utils.Enum)
206       enum auth_stat
207
208
209   class reject_stat_enum(packet.utils.Enum)
210       enum reject_stat
211
212

SEE ALSO

214       baseobj(3), packet.application.gss(3), packet.application.rpc_const(3),
215       packet.application.rpc_creds(3),                  packet.nfs.mount3(3),
216       packet.nfs.nfs(3),      packet.nfs.nlm4(3),     packet.nfs.portmap2(3),
217       packet.utils(3)
218
219

BUGS

221       No known bugs.
222

AUTHOR

224       Jorge Mora (mora@netapp.com)
225
226
227
228NFStest 3.2                      21 March 2023                          RPC(3)
Impressum