### ms-efsr.idl
"""
RPC definitions for the following interfaces:
- efsrpc (v1.0): c681d488-d850-11d0-8c52-00c04fd90f7e
This file is auto-generated by midl-to-scapy, do not modify.
"""

import uuid

from scapy.fields import StrFixedLenField
from scapy.layers.dcerpc import (
    NDRPacket,
    DceRpcOp,
    NDRByteField,
    NDRConfFieldListField,
    NDRConfPacketListField,
    NDRConfStrLenField,
    NDRConfVarStrNullField,
    NDRConfVarStrNullFieldUtf16,
    NDRContextHandle,
    NDRFullPointerField,
    NDRIntField,
    NDRPacketField,
    NDRSignedIntField,
    register_dcerpc_interface,
)


class EfsRpcOpenFileRaw_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRSignedIntField("Flags", 0),
    ]


class EfsRpcOpenFileRaw_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("hContext", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class EfsRpcReadFileRaw_Request(NDRPacket):
    fields_desc = [NDRPacketField("hContext", NDRContextHandle(), NDRContextHandle)]


class EfsRpcReadFileRaw_Response(NDRPacket):
    fields_desc = [NDRByteField("EfsOutPipe", 0), NDRIntField("status", 0)]


class EfsRpcWriteFileRaw_Request(NDRPacket):
    fields_desc = [
        NDRPacketField("hContext", NDRContextHandle(), NDRContextHandle),
        NDRByteField("EfsInPipe", 0),
    ]


class EfsRpcWriteFileRaw_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EfsRpcCloseRaw_Request(NDRPacket):
    fields_desc = [NDRPacketField("hContext", NDRContextHandle(), NDRContextHandle)]


class EfsRpcCloseRaw_Response(NDRPacket):
    fields_desc = [
        NDRPacketField("hContext", NDRContextHandle(), NDRContextHandle),
        NDRIntField("status", 0),
    ]


class EfsRpcEncryptFileSrv_Request(NDRPacket):
    fields_desc = [NDRConfVarStrNullFieldUtf16("FileName", "")]


class EfsRpcEncryptFileSrv_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EfsRpcDecryptFileSrv_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRIntField("OpenFlag", 0),
    ]


class EfsRpcDecryptFileSrv_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class RPC_SID_IDENTIFIER_AUTHORITY(NDRPacket):
    fields_desc = [StrFixedLenField("Value", "", length=6)]


class RPC_SID(NDRPacket):
    ALIGNMENT = (4, 8)
    DEPORTED_CONFORMANTS = ["SubAuthority"]
    fields_desc = [
        NDRByteField("Revision", 0),
        NDRByteField("SubAuthorityCount", None, size_of="SubAuthority"),
        NDRPacketField(
            "IdentifierAuthority",
            RPC_SID_IDENTIFIER_AUTHORITY(),
            RPC_SID_IDENTIFIER_AUTHORITY,
        ),
        NDRConfFieldListField(
            "SubAuthority",
            [],
            NDRIntField("", 0),
            size_is=lambda pkt: pkt.SubAuthorityCount,
            conformant_in_struct=True,
        ),
    ]


class EFS_HASH_BLOB(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("cbData", None, size_of="bData"),
        NDRFullPointerField(
            NDRConfStrLenField("bData", "", size_is=lambda pkt: pkt.cbData),
            deferred=True,
        ),
    ]


class ENCRYPTION_CERTIFICATE_HASH(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("cbTotalLength", 0),
        NDRFullPointerField(
            NDRPacketField("UserSid", RPC_SID(), RPC_SID), deferred=True
        ),
        NDRFullPointerField(
            NDRPacketField("Hash", EFS_HASH_BLOB(), EFS_HASH_BLOB), deferred=True
        ),
        NDRFullPointerField(
            NDRConfVarStrNullFieldUtf16("lpDisplayInformation", ""), deferred=True
        ),
    ]


class ENCRYPTION_CERTIFICATE_HASH_LIST(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("nCert_Hash", None, size_of="Users"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "Users",
                [],
                ENCRYPTION_CERTIFICATE_HASH,
                size_is=lambda pkt: pkt.nCert_Hash,
                ptr_pack=True,
            ),
            deferred=True,
        ),
    ]


class EfsRpcQueryUsersOnFile_Request(NDRPacket):
    fields_desc = [NDRConfVarStrNullFieldUtf16("FileName", "")]


class EfsRpcQueryUsersOnFile_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField(
                "Users",
                ENCRYPTION_CERTIFICATE_HASH_LIST(),
                ENCRYPTION_CERTIFICATE_HASH_LIST,
            )
        ),
        NDRIntField("status", 0),
    ]


class EfsRpcQueryRecoveryAgents_Request(NDRPacket):
    fields_desc = [NDRConfVarStrNullFieldUtf16("FileName", "")]


class EfsRpcQueryRecoveryAgents_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField(
                "RecoveryAgents",
                ENCRYPTION_CERTIFICATE_HASH_LIST(),
                ENCRYPTION_CERTIFICATE_HASH_LIST,
            )
        ),
        NDRIntField("status", 0),
    ]


class EfsRpcRemoveUsersFromFile_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRPacketField(
            "Users",
            ENCRYPTION_CERTIFICATE_HASH_LIST(),
            ENCRYPTION_CERTIFICATE_HASH_LIST,
        ),
    ]


class EfsRpcRemoveUsersFromFile_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EFS_CERTIFICATE_BLOB(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("dwCertEncodingType", 0),
        NDRIntField("cbData", None, size_of="bData"),
        NDRFullPointerField(
            NDRConfStrLenField("bData", "", size_is=lambda pkt: pkt.cbData),
            deferred=True,
        ),
    ]


class ENCRYPTION_CERTIFICATE(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("cbTotalLength", 0),
        NDRFullPointerField(
            NDRPacketField("UserSid", RPC_SID(), RPC_SID), deferred=True
        ),
        NDRFullPointerField(
            NDRPacketField("CertBlob", EFS_CERTIFICATE_BLOB(), EFS_CERTIFICATE_BLOB),
            deferred=True,
        ),
    ]


class ENCRYPTION_CERTIFICATE_LIST(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("nUsers", None, size_of="Users"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "Users",
                [],
                ENCRYPTION_CERTIFICATE,
                size_is=lambda pkt: pkt.nUsers,
                ptr_pack=True,
            ),
            deferred=True,
        ),
    ]


class EfsRpcAddUsersToFile_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRPacketField(
            "EncryptionCertificates",
            ENCRYPTION_CERTIFICATE_LIST(),
            ENCRYPTION_CERTIFICATE_LIST,
        ),
    ]


class EfsRpcAddUsersToFile_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EFS_RPC_BLOB(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("cbData", None, size_of="bData"),
        NDRFullPointerField(
            NDRConfStrLenField("bData", "", size_is=lambda pkt: pkt.cbData),
            deferred=True,
        ),
    ]


class EfsRpcNotSupported_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("Reserved1", ""),
        NDRConfVarStrNullFieldUtf16("Reserved2", ""),
        NDRIntField("dwReserved1", 0),
        NDRIntField("dwReserved2", 0),
        NDRFullPointerField(NDRPacketField("Reserved", EFS_RPC_BLOB(), EFS_RPC_BLOB)),
        NDRSignedIntField("bReserved", 0),
    ]


class EfsRpcNotSupported_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EfsRpcFileKeyInfo_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRIntField("InfoClass", 0),
    ]


class EfsRpcFileKeyInfo_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRPacketField("KeyInfo", EFS_RPC_BLOB(), EFS_RPC_BLOB)),
        NDRIntField("status", 0),
    ]


class EfsRpcDuplicateEncryptionInfoFile_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("SrcFileName", ""),
        NDRConfVarStrNullFieldUtf16("DestFileName", ""),
        NDRIntField("dwCreationDisposition", 0),
        NDRIntField("dwAttributes", 0),
        NDRFullPointerField(NDRPacketField("RelativeSD", EFS_RPC_BLOB(), EFS_RPC_BLOB)),
        NDRSignedIntField("bInheritHandle", 0),
    ]


class EfsRpcDuplicateEncryptionInfoFile_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EfsRpcAddUsersToFileEx_Request(NDRPacket):
    fields_desc = [
        NDRIntField("dwFlags", 0),
        NDRFullPointerField(NDRPacketField("Reserved", EFS_RPC_BLOB(), EFS_RPC_BLOB)),
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRPacketField(
            "EncryptionCertificates",
            ENCRYPTION_CERTIFICATE_LIST(),
            ENCRYPTION_CERTIFICATE_LIST,
        ),
    ]


class EfsRpcAddUsersToFileEx_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EfsRpcFileKeyInfoEx_Request(NDRPacket):
    fields_desc = [
        NDRIntField("dwFileKeyInfoFlags", 0),
        NDRFullPointerField(NDRPacketField("Reserved", EFS_RPC_BLOB(), EFS_RPC_BLOB)),
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRIntField("InfoClass", 0),
    ]


class EfsRpcFileKeyInfoEx_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(NDRPacketField("KeyInfo", EFS_RPC_BLOB(), EFS_RPC_BLOB)),
        NDRIntField("status", 0),
    ]


class EfsRpcGetEncryptedFileMetadata_Request(NDRPacket):
    fields_desc = [NDRConfVarStrNullFieldUtf16("FileName", "")]


class EfsRpcGetEncryptedFileMetadata_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField("EfsStreamBlob", EFS_RPC_BLOB(), EFS_RPC_BLOB)
        ),
        NDRIntField("status", 0),
    ]


class ENCRYPTED_FILE_METADATA_SIGNATURE(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("dwEfsAccessType", 0),
        NDRFullPointerField(
            NDRPacketField(
                "CertificatesAdded",
                ENCRYPTION_CERTIFICATE_HASH_LIST(),
                ENCRYPTION_CERTIFICATE_HASH_LIST,
            ),
            deferred=True,
        ),
        NDRFullPointerField(
            NDRPacketField(
                "EncryptionCertificate",
                ENCRYPTION_CERTIFICATE(),
                ENCRYPTION_CERTIFICATE,
            ),
            deferred=True,
        ),
        NDRFullPointerField(
            NDRPacketField("EfsStreamSignature", EFS_RPC_BLOB(), EFS_RPC_BLOB),
            deferred=True,
        ),
    ]


class EfsRpcSetEncryptedFileMetadata_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRFullPointerField(
            NDRPacketField("OldEfsStreamBlob", EFS_RPC_BLOB(), EFS_RPC_BLOB)
        ),
        NDRPacketField("NewEfsStreamBlob", EFS_RPC_BLOB(), EFS_RPC_BLOB),
        NDRFullPointerField(
            NDRPacketField(
                "NewEfsSignature",
                ENCRYPTED_FILE_METADATA_SIGNATURE(),
                ENCRYPTED_FILE_METADATA_SIGNATURE,
            )
        ),
    ]


class EfsRpcSetEncryptedFileMetadata_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EfsRpcFlushEfsCache_Request(NDRPacket):
    fields_desc = []


class EfsRpcFlushEfsCache_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class EfsRpcEncryptFileExSrv_Request(NDRPacket):
    fields_desc = [
        NDRConfVarStrNullFieldUtf16("FileName", ""),
        NDRFullPointerField(NDRConfVarStrNullFieldUtf16("ProtectorDescriptor", "")),
        NDRIntField("Flags", 0),
    ]


class EfsRpcEncryptFileExSrv_Response(NDRPacket):
    fields_desc = [NDRIntField("status", 0)]


class PENCRYPTION_PROTECTOR(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("cbTotalLength", 0),
        NDRFullPointerField(
            NDRPacketField("UserSid", RPC_SID(), RPC_SID), deferred=True
        ),
        NDRFullPointerField(
            NDRConfVarStrNullFieldUtf16("lpProtectorDescriptor", ""), deferred=True
        ),
    ]


class PENCRYPTION_PROTECTOR_LIST(NDRPacket):
    ALIGNMENT = (4, 8)
    fields_desc = [
        NDRIntField("nProtectors", None, size_of="pProtectors"),
        NDRFullPointerField(
            NDRConfPacketListField(
                "pProtectors",
                [],
                PENCRYPTION_PROTECTOR,
                size_is=lambda pkt: pkt.nProtectors,
                ptr_pack=True,
            ),
            deferred=True,
        ),
    ]


class EfsRpcQueryProtectors_Request(NDRPacket):
    fields_desc = [NDRConfVarStrNullFieldUtf16("FileName", "")]


class EfsRpcQueryProtectors_Response(NDRPacket):
    fields_desc = [
        NDRFullPointerField(
            NDRPacketField(
                "ppProtectorList",
                PENCRYPTION_PROTECTOR_LIST(),
                PENCRYPTION_PROTECTOR_LIST,
            )
        ),
        NDRIntField("status", 0),
    ]


EFSRPC_OPNUMS = {
    0: DceRpcOp(EfsRpcOpenFileRaw_Request, EfsRpcOpenFileRaw_Response),
    1: DceRpcOp(EfsRpcReadFileRaw_Request, EfsRpcReadFileRaw_Response),
    2: DceRpcOp(EfsRpcWriteFileRaw_Request, EfsRpcWriteFileRaw_Response),
    3: DceRpcOp(EfsRpcCloseRaw_Request, EfsRpcCloseRaw_Response),
    4: DceRpcOp(EfsRpcEncryptFileSrv_Request, EfsRpcEncryptFileSrv_Response),
    5: DceRpcOp(EfsRpcDecryptFileSrv_Request, EfsRpcDecryptFileSrv_Response),
    6: DceRpcOp(EfsRpcQueryUsersOnFile_Request, EfsRpcQueryUsersOnFile_Response),
    7: DceRpcOp(EfsRpcQueryRecoveryAgents_Request, EfsRpcQueryRecoveryAgents_Response),
    8: DceRpcOp(EfsRpcRemoveUsersFromFile_Request, EfsRpcRemoveUsersFromFile_Response),
    9: DceRpcOp(EfsRpcAddUsersToFile_Request, EfsRpcAddUsersToFile_Response),
    # 10: Opnum10NotUsedOnWire,
    11: DceRpcOp(EfsRpcNotSupported_Request, EfsRpcNotSupported_Response),
    12: DceRpcOp(EfsRpcFileKeyInfo_Request, EfsRpcFileKeyInfo_Response),
    13: DceRpcOp(
        EfsRpcDuplicateEncryptionInfoFile_Request,
        EfsRpcDuplicateEncryptionInfoFile_Response,
    ),
    # 14: Opnum14NotUsedOnWire,
    15: DceRpcOp(EfsRpcAddUsersToFileEx_Request, EfsRpcAddUsersToFileEx_Response),
    16: DceRpcOp(EfsRpcFileKeyInfoEx_Request, EfsRpcFileKeyInfoEx_Response),
    # 17: Opnum17NotUsedOnWire,
    18: DceRpcOp(
        EfsRpcGetEncryptedFileMetadata_Request, EfsRpcGetEncryptedFileMetadata_Response
    ),
    19: DceRpcOp(
        EfsRpcSetEncryptedFileMetadata_Request, EfsRpcSetEncryptedFileMetadata_Response
    ),
    20: DceRpcOp(EfsRpcFlushEfsCache_Request, EfsRpcFlushEfsCache_Response),
    21: DceRpcOp(EfsRpcEncryptFileExSrv_Request, EfsRpcEncryptFileExSrv_Response),
    22: DceRpcOp(EfsRpcQueryProtectors_Request, EfsRpcQueryProtectors_Response),
    # 23: Opnum23NotUsedOnWire,
    # 24: Opnum24NotUsedOnWire,
    # 25: Opnum25NotUsedOnWire,
    # 26: Opnum26NotUsedOnWire,
    # 27: Opnum27NotUsedOnWire,
    # 28: Opnum28NotUsedOnWire,
    # 29: Opnum29NotUsedOnWire,
    # 30: Opnum30NotUsedOnWire,
    # 31: Opnum31NotUsedOnWire,
    # 32: Opnum32NotUsedOnWire,
    # 33: Opnum33NotUsedOnWire,
    # 34: Opnum34NotUsedOnWire,
    # 35: Opnum35NotUsedOnWire,
    # 36: Opnum36NotUsedOnWire,
    # 37: Opnum37NotUsedOnWire,
    # 38: Opnum38NotUsedOnWire,
    # 39: Opnum39NotUsedOnWire,
    # 40: Opnum40NotUsedOnWire,
    # 41: Opnum41NotUsedOnWire,
    # 42: Opnum42NotUsedOnWire,
    # 43: Opnum43NotUsedOnWire,
    # 44: Opnum44NotUsedOnWire
}
register_dcerpc_interface(
    name="efsrpc",
    uuid=uuid.UUID("c681d488-d850-11d0-8c52-00c04fd90f7e"),
    version="1.0",
    opnums=EFSRPC_OPNUMS,
)
