What is SRV in MS RPC and what should I know about it?

Question

This MSDN article about interface registration flags when describing the RPC_IF_ALLOW_LOCAL_ONLY flag talks about some entity called SRV:

...When this interface flag is registered, the RPC runtime rejects calls made by remote clients. ... RPC allows ncacn_NP calls only if the call does not come from SRV...

I've looked through the RFC 2782 and still don't get it. What is SRV in the first place and how can I judge if calls come from it or some other way?

Answer 1

SRV.SYS is the SMB server driver. What the article is saying is that named pipe requests are allowed unless they come from that driver (i.e., unless they originate from somewhere other than the local machine).

That makes sense since you're registering your server to accept local connections only. You don't want named pipe connections sneaking in over the network.

This page details the use of named pipes over SMB.