lib/util: remove extra safe_string.h file
[samba.git] / source4 / ntvfs / ipc / vfs_ipc.c
index bde87684e13af7139bd5449b2db1070bec35eb26..967c80d299591f9b4837947725c3956f5d413ac4 100644 (file)
@@ -4,11 +4,10 @@
 
    Copyright (C) Andrew Tridgell 2003
    Copyright (C) Stefan (metze) Metzmacher 2004-2005
-   Copyright (C) Jelmer Vernooij 2005
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
@@ -17,8 +16,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 /*
   this implements the IPC$ backend, called by the NTVFS subsystem to
 
 
 #include "includes.h"
-#include "dlinklist.h"
-#include "smb_server/smb_server.h"
-#include "ntvfs/ipc/ipc.h"
+#include "../lib/util/dlinklist.h"
 #include "ntvfs/ntvfs.h"
-#include "rpc_server/dcerpc_server.h"
-#include "smb_build.h"
-
-#define IPC_BASE_FNUM 0x400
+#include "../librpc/gen_ndr/rap.h"
+#include "ntvfs/ipc/proto.h"
+#include "../libcli/smb/smb_constants.h"
+#include "param/param.h"
+#include "../lib/tsocket/tsocket.h"
+#include "../libcli/named_pipe_auth/npa_tstream.h"
+#include "auth/auth.h"
+#include "auth/auth_sam_reply.h"
+#include "lib/socket/socket.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
+#include "system/kerberos.h"
+#include "system/gssapi.h"
+#include "system/locale.h"
+#include "system/filesys.h"
+
+#undef strncasecmp
 
 /* this is the private structure used to keep the state of an open
    ipc$ connection. It needs to keep information about all open
    pipes */
 struct ipc_private {
-       struct idr_context *idtree_fnum;
-
-       struct dcesrv_context *dcesrv;
+       struct ntvfs_module_context *ntvfs;
 
        /* a list of open pipes */
        struct pipe_state {
                struct pipe_state *next, *prev;
-               struct ipc_private *private;
+               struct ipc_private *ipriv;
                const char *pipe_name;
-               const struct named_pipe_ops *ops;
-               void *private_data;
-               uint16_t fnum;
-               uint16_t ipc_state;
-               /* we need to remember the session it was opened on,
-                  as it is illegal to operate on someone elses fnum */
-               struct smbsrv_session *session;
-
-               /* we need to remember the client pid that 
-                  opened the file so SMBexit works */
-               uint16_t smbpid;
+               struct ntvfs_handle *handle;
+               struct tstream_context *npipe;
+               uint16_t file_type;
+               uint16_t device_state;
+               uint64_t allocation_size;
+               struct tevent_queue *write_queue;
+               struct tevent_queue *read_queue;
        } *pipe_list;
-
 };
 
 
 /*
-  find a open pipe give a file descriptor
+  find a open pipe give a file handle
+*/
+static struct pipe_state *pipe_state_find(struct ipc_private *ipriv, struct ntvfs_handle *handle)
+{
+       struct pipe_state *s;
+       void *p;
+
+       p = ntvfs_handle_get_backend_data(handle, ipriv->ntvfs);
+       if (!p) return NULL;
+
+       s = talloc_get_type(p, struct pipe_state);
+       if (!s) return NULL;
+
+       return s;
+}
+
+/*
+  find a open pipe give a wire fnum
 */
-static struct pipe_state *pipe_state_find(struct ipc_private *private, uint16_t fnum)
+static struct pipe_state *pipe_state_find_key(struct ipc_private *ipriv, struct ntvfs_request *req, const DATA_BLOB *key)
 {
-       return idr_find(private->idtree_fnum, fnum);
+       struct ntvfs_handle *h;
+
+       h = ntvfs_handle_search_by_wire_key(ipriv->ntvfs, req, key);
+       if (!h) return NULL;
+
+       return pipe_state_find(ipriv, h);
 }
 
 
@@ -78,27 +102,52 @@ static struct pipe_state *pipe_state_find(struct ipc_private *private, uint16_t
   connect to a share - always works 
 */
 static NTSTATUS ipc_connect(struct ntvfs_module_context *ntvfs,
-                           struct smbsrv_request *req, const char *sharename)
+                           struct ntvfs_request *req,
+                           union smb_tcon* tcon)
 {
-       struct smbsrv_tcon *tcon = req->tcon;
-       struct ipc_private *private;
+       struct ipc_private *ipriv;
+       const char *sharename;
+
+       switch (tcon->generic.level) {
+       case RAW_TCON_TCON:
+               sharename = tcon->tcon.in.service;
+               break;
+       case RAW_TCON_TCONX:
+               sharename = tcon->tconx.in.path;
+               break;
+       case RAW_TCON_SMB2:
+               sharename = tcon->smb2.in.path;
+               break;
+       default:
+               return NT_STATUS_INVALID_LEVEL;
+       }
 
-       tcon->fs_type = talloc_strdup(tcon, "IPC");
-       NT_STATUS_HAVE_NO_MEMORY(tcon->fs_type);
+       if (strncmp(sharename, "\\\\", 2) == 0) {
+               char *p = strchr(sharename+2, '\\');
+               if (p) {
+                       sharename = p + 1;
+               }
+       }
 
-       tcon->dev_type = talloc_strdup(tcon, "IPC");
-       NT_STATUS_HAVE_NO_MEMORY(tcon->dev_type);
+       ntvfs->ctx->fs_type = talloc_strdup(ntvfs->ctx, "IPC");
+       NT_STATUS_HAVE_NO_MEMORY(ntvfs->ctx->fs_type);
 
-       /* prepare the private state for this connection */
-       private = talloc(ntvfs, struct ipc_private);
-       NT_STATUS_HAVE_NO_MEMORY(private);
+       ntvfs->ctx->dev_type = talloc_strdup(ntvfs->ctx, "IPC");
+       NT_STATUS_HAVE_NO_MEMORY(ntvfs->ctx->dev_type);
 
-       ntvfs->private_data = private;
+       if (tcon->generic.level == RAW_TCON_TCONX) {
+               tcon->tconx.out.fs_type = ntvfs->ctx->fs_type;
+               tcon->tconx.out.dev_type = ntvfs->ctx->dev_type;
+       }
 
-       private->pipe_list = NULL;
+       /* prepare the private state for this connection */
+       ipriv = talloc(ntvfs, struct ipc_private);
+       NT_STATUS_HAVE_NO_MEMORY(ipriv);
+
+       ntvfs->private_data = ipriv;
 
-       private->idtree_fnum = idr_init(private);
-       NT_STATUS_HAVE_NO_MEMORY(private->idtree_fnum);
+       ipriv->ntvfs = ntvfs;
+       ipriv->pipe_list = NULL;
 
        return NT_STATUS_OK;
 }
@@ -106,8 +155,7 @@ static NTSTATUS ipc_connect(struct ntvfs_module_context *ntvfs,
 /*
   disconnect from a share
 */
-static NTSTATUS ipc_disconnect(struct ntvfs_module_context *ntvfs,
-                              struct smbsrv_tcon *tcon)
+static NTSTATUS ipc_disconnect(struct ntvfs_module_context *ntvfs)
 {
        return NT_STATUS_OK;
 }
@@ -116,17 +164,8 @@ static NTSTATUS ipc_disconnect(struct ntvfs_module_context *ntvfs,
   delete a file
 */
 static NTSTATUS ipc_unlink(struct ntvfs_module_context *ntvfs,
-                          struct smbsrv_request *req, struct smb_unlink *unl)
-{
-       return NT_STATUS_ACCESS_DENIED;
-}
-
-
-/*
-  ioctl interface - we don't do any
-*/
-static NTSTATUS ipc_ioctl(struct ntvfs_module_context *ntvfs,
-                         struct smbsrv_request *req, union smb_ioctl *io)
+                          struct ntvfs_request *req,
+                          union smb_unlink *unl)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -135,7 +174,8 @@ static NTSTATUS ipc_ioctl(struct ntvfs_module_context *ntvfs,
   check if a directory exists
 */
 static NTSTATUS ipc_chkpath(struct ntvfs_module_context *ntvfs,
-                           struct smbsrv_request *req, struct smb_chkpath *cp)
+                           struct ntvfs_request *req,
+                           union smb_chkpath *cp)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -144,16 +184,23 @@ static NTSTATUS ipc_chkpath(struct ntvfs_module_context *ntvfs,
   return info on a pathname
 */
 static NTSTATUS ipc_qpathinfo(struct ntvfs_module_context *ntvfs,
-                             struct smbsrv_request *req, union smb_fileinfo *info)
+                             struct ntvfs_request *req, union smb_fileinfo *info)
 {
-       return NT_STATUS_ACCESS_DENIED;
+       switch (info->generic.level) {
+       case  RAW_FILEINFO_GENERIC:
+               return NT_STATUS_INVALID_DEVICE_REQUEST;
+       case RAW_FILEINFO_GETATTR:
+               return NT_STATUS_ACCESS_DENIED;
+       default:
+               return ntvfs_map_qpathinfo(ntvfs, req, info);
+       }
 }
 
 /*
   set info on a pathname
 */
 static NTSTATUS ipc_setpathinfo(struct ntvfs_module_context *ntvfs,
-                               struct smbsrv_request *req, union smb_setfileinfo *st)
+                               struct ntvfs_request *req, union smb_setfileinfo *st)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -162,198 +209,229 @@ static NTSTATUS ipc_setpathinfo(struct ntvfs_module_context *ntvfs,
 /*
   destroy a open pipe structure
 */
-static int ipc_fd_destructor(void *ptr)
+static int ipc_fd_destructor(struct pipe_state *p)
 {
-       struct pipe_state *p = ptr;
-       idr_remove(p->private->idtree_fnum, p->fnum);
-       DLIST_REMOVE(p->private->pipe_list, p);
+       DLIST_REMOVE(p->ipriv->pipe_list, p);
+       ntvfs_handle_remove_backend_data(p->handle, p->ipriv->ntvfs);
        return 0;
 }
 
-static struct named_pipe {
-       struct named_pipe *prev, *next;
-       const char *name;
-       const struct named_pipe_ops *ops;
-       void *context_data;
-} *named_pipes = NULL;
+struct ipc_open_state {
+       struct ipc_private *ipriv;
+       struct pipe_state *p;
+       struct ntvfs_request *req;
+       union smb_open *oi;
+       struct auth_session_info_transport *session_info_transport;
+};
 
-static NTSTATUS find_pipe_ops(const char *fname, const struct named_pipe_ops **ops, void **context_data)
-{
-       struct named_pipe *np;
+static void ipc_open_done(struct tevent_req *subreq);
 
-       for (np = named_pipes; np; np = np->next) {
-               if (strcasecmp_m(np->name, fname) == 0) {
-                       if (ops) *ops = np->ops;
-                       if (context_data) *context_data = np->context_data;
-                       return NT_STATUS_OK;
+/*
+  check the pipename is valid
+ */
+static NTSTATUS validate_pipename(const char *name)
+{
+       while (*name) {
+               if (!isalnum(*name) && *name != '_') {
+                       return NT_STATUS_INVALID_PARAMETER;
                }
+               name++;
        }
-
-       return NT_STATUS_OBJECT_NAME_NOT_FOUND;
+       return NT_STATUS_OK;
 }
 
-NTSTATUS named_pipe_listen(const char *name, const struct named_pipe_ops *ops, void *context_data)
+/*
+  open a file - used for MSRPC pipes
+*/
+static NTSTATUS ipc_open(struct ntvfs_module_context *ntvfs,
+                        struct ntvfs_request *req, union smb_open *oi)
 {
        NTSTATUS status;
-       struct named_pipe *np;
-       DEBUG(3, ("Registering named pipe `%s'\n", name));
-
-       status = find_pipe_ops(name, NULL, NULL);
-       if (NT_STATUS_IS_OK(status)) {
-               return NT_STATUS_OBJECT_NAME_COLLISION;
-       }
+       struct pipe_state *p;
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
+       struct ntvfs_handle *h;
+       struct ipc_open_state *state;
+       struct tevent_req *subreq;
+       const char *fname;
+       const char *directory;
+       const struct tsocket_address *remote_client_addr;
+       const struct tsocket_address *local_server_addr;
 
-       if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
-               return status;
+       switch (oi->generic.level) {
+       case RAW_OPEN_NTCREATEX:
+       case RAW_OPEN_NTTRANS_CREATE:
+               fname = oi->ntcreatex.in.fname;
+               while (fname[0] == '\\') fname++;
+               break;
+       case RAW_OPEN_OPENX:
+               fname = oi->openx.in.fname;
+               while (fname[0] == '\\') fname++;
+               if (strncasecmp(fname, "PIPE\\", 5) != 0) {
+                       return NT_STATUS_OBJECT_PATH_SYNTAX_BAD;
+               }
+               while (fname[0] == '\\') fname++;
+               break;
+       case RAW_OPEN_SMB2:
+               fname = oi->smb2.in.fname;
+               break;
+       default:
+               return NT_STATUS_NOT_SUPPORTED;
        }
 
-       np = talloc(talloc_autofree_context(), struct named_pipe);
-       np->name = talloc_strdup(np, name);
-       np->ops = ops;
-       np->context_data = context_data;
-       np->prev = np->next = NULL;
-
-       DLIST_ADD(named_pipes, np);
+       directory = talloc_asprintf(req, "%s/np",
+                                   lpcfg_ncalrpc_dir(ipriv->ntvfs->ctx->lp_ctx));
+       NT_STATUS_HAVE_NO_MEMORY(directory);
 
-       return NT_STATUS_OK;
-}
+       state = talloc(req, struct ipc_open_state);
+       NT_STATUS_HAVE_NO_MEMORY(state);
 
+       status = ntvfs_handle_new(ntvfs, req, &h);
+       NT_STATUS_NOT_OK_RETURN(status);
 
+       p = talloc(h, struct pipe_state);
+       NT_STATUS_HAVE_NO_MEMORY(p);
 
-/*
-  open a file backend - used for MSRPC pipes
-*/
-static NTSTATUS ipc_open_generic(struct ntvfs_module_context *ntvfs,
-                                struct smbsrv_request *req, const char *fname, 
-                                struct pipe_state **ps)
-{
-       struct pipe_state *p;
-       NTSTATUS status;
-       struct ipc_private *private = ntvfs->private_data;
-       void *context_data;
-       int fnum;
+       /* check for valid characters in name */
+       fname = strlower_talloc(p, fname);
 
-       if (!req->session || !req->session->session_info) {
-               return NT_STATUS_ACCESS_DENIED;
-       }
+       status = validate_pipename(fname);
+       NT_STATUS_NOT_OK_RETURN(status);
 
-       p = talloc(req, struct pipe_state);
-       NT_STATUS_HAVE_NO_MEMORY(p);
-
-       while (fname[0] == '\\') fname++;
-       
        p->pipe_name = talloc_asprintf(p, "\\pipe\\%s", fname);
        NT_STATUS_HAVE_NO_MEMORY(p->pipe_name);
 
-       status = find_pipe_ops(p->pipe_name, &p->ops, &context_data);
+       p->handle = h;
+       p->ipriv = ipriv;
 
-       /* FIXME: Perhaps fall back to opening /var/lib/samba/ipc/<pipename> ? */
-       if (NT_STATUS_IS_ERR(status)) {
-               DEBUG(0, ("Unable to find pipe ops for `%s'\n", p->pipe_name));
-               return status;
-       }
+       p->write_queue = tevent_queue_create(p, "ipc_write_queue");
+       NT_STATUS_HAVE_NO_MEMORY(p->write_queue);
 
-       status = p->ops->open(context_data, p->pipe_name, req->session->session_info, req->smb_conn->connection, p, &p->private_data);
-       if (NT_STATUS_IS_ERR(status)) {
-               return status;
-       }
+       p->read_queue = tevent_queue_create(p, "ipc_read_queue");
+       NT_STATUS_HAVE_NO_MEMORY(p->read_queue);
 
-       fnum = idr_get_new_above(private->idtree_fnum, p, IPC_BASE_FNUM, UINT16_MAX);
-       if (fnum == -1) {
-               return NT_STATUS_TOO_MANY_OPENED_FILES;
-       }
-
-       p->fnum = fnum;
-       p->ipc_state = 0x5ff;
+       state->ipriv = ipriv;
+       state->p = p;
+       state->req = req;
+       state->oi = oi;
 
-       DLIST_ADD(private->pipe_list, p);
+       status = auth_session_info_transport_from_session(state,
+                                                         req->session_info,
+                                                         ipriv->ntvfs->ctx->event_ctx,
+                                                         ipriv->ntvfs->ctx->lp_ctx,
+                                                         &state->session_info_transport);
 
-       p->smbpid = req->smbpid;
-       p->session = req->session;
-       p->private = private;
+       NT_STATUS_NOT_OK_RETURN(status);
 
-       *ps = p;
+       local_server_addr = ntvfs_get_local_address(ipriv->ntvfs);
+       remote_client_addr = ntvfs_get_remote_address(ipriv->ntvfs);
 
-       talloc_steal(private, p);
-
-       talloc_set_destructor(p, ipc_fd_destructor);
+       subreq = tstream_npa_connect_send(p,
+                                         ipriv->ntvfs->ctx->event_ctx,
+                                         directory,
+                                         fname,
+                                         remote_client_addr,
+                                         NULL,
+                                         local_server_addr,
+                                         NULL,
+                                         state->session_info_transport);
+       NT_STATUS_HAVE_NO_MEMORY(subreq);
+       tevent_req_set_callback(subreq, ipc_open_done, state);
 
+       req->async_states->state |= NTVFS_ASYNC_STATE_ASYNC;
        return NT_STATUS_OK;
 }
 
-/*
-  open a file with ntcreatex - used for MSRPC pipes
-*/
-static NTSTATUS ipc_open_ntcreatex(struct ntvfs_module_context *ntvfs,
-                                  struct smbsrv_request *req, union smb_open *oi)
+static void ipc_open_done(struct tevent_req *subreq)
 {
-       struct pipe_state *p;
+       struct ipc_open_state *state = tevent_req_callback_data(subreq,
+                                      struct ipc_open_state);
+       struct ipc_private *ipriv = state->ipriv;
+       struct pipe_state *p = state->p;
+       struct ntvfs_request *req = state->req;
+       union smb_open *oi = state->oi;
+       int ret;
+       int sys_errno;
        NTSTATUS status;
 
-       status = ipc_open_generic(ntvfs, req, oi->ntcreatex.in.fname, &p);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
+       ret = tstream_npa_connect_recv(subreq, &sys_errno,
+                                      p, &p->npipe,
+                                      &p->file_type,
+                                      &p->device_state,
+                                      &p->allocation_size);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               status = map_nt_error_from_unix_common(sys_errno);
+               goto reply;
        }
 
-       ZERO_STRUCT(oi->ntcreatex.out);
-       oi->ntcreatex.out.fnum = p->fnum;
-       oi->ntcreatex.out.ipc_state = p->ipc_state;
-       oi->ntcreatex.out.file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
-
-       return status;
-}
-
-/*
-  open a file with openx - used for MSRPC pipes
-*/
-static NTSTATUS ipc_open_openx(struct ntvfs_module_context *ntvfs,
-                              struct smbsrv_request *req, union smb_open *oi)
-{
-       struct pipe_state *p;
-       NTSTATUS status;
-       const char *fname = oi->openx.in.fname;
+       DLIST_ADD(ipriv->pipe_list, p);
+       talloc_set_destructor(p, ipc_fd_destructor);
 
-       status = ipc_open_generic(ntvfs, req, fname, &p);
+       status = ntvfs_handle_set_backend_data(p->handle, ipriv->ntvfs, p);
        if (!NT_STATUS_IS_OK(status)) {
-               return status;
+               goto reply;
        }
 
-       ZERO_STRUCT(oi->openx.out);
-       oi->openx.out.fnum = p->fnum;
-       oi->openx.out.ftype = 2;
-       oi->openx.out.devstate = p->ipc_state;
-       
-       return status;
-}
-
-/*
-  open a file - used for MSRPC pipes
-*/
-static NTSTATUS ipc_open(struct ntvfs_module_context *ntvfs,
-                               struct smbsrv_request *req, union smb_open *oi)
-{
-       NTSTATUS status;
-
        switch (oi->generic.level) {
        case RAW_OPEN_NTCREATEX:
-               status = ipc_open_ntcreatex(ntvfs, req, oi);
+               ZERO_STRUCT(oi->ntcreatex.out);
+               oi->ntcreatex.out.file.ntvfs    = p->handle;
+               oi->ntcreatex.out.oplock_level  = 0;
+               oi->ntcreatex.out.create_action = NTCREATEX_ACTION_EXISTED;
+               oi->ntcreatex.out.create_time   = 0;
+               oi->ntcreatex.out.access_time   = 0;
+               oi->ntcreatex.out.write_time    = 0;
+               oi->ntcreatex.out.change_time   = 0;
+               oi->ntcreatex.out.attrib        = FILE_ATTRIBUTE_NORMAL;
+               oi->ntcreatex.out.alloc_size    = p->allocation_size;
+               oi->ntcreatex.out.size          = 0;
+               oi->ntcreatex.out.file_type     = p->file_type;
+               oi->ntcreatex.out.ipc_state     = p->device_state;
+               oi->ntcreatex.out.is_directory  = 0;
                break;
        case RAW_OPEN_OPENX:
-               status = ipc_open_openx(ntvfs, req, oi);
+               ZERO_STRUCT(oi->openx.out);
+               oi->openx.out.file.ntvfs        = p->handle;
+               oi->openx.out.attrib            = FILE_ATTRIBUTE_NORMAL;
+               oi->openx.out.write_time        = 0;
+               oi->openx.out.size              = 0;
+               oi->openx.out.access            = 0;
+               oi->openx.out.ftype             = p->file_type;
+               oi->openx.out.devstate          = p->device_state;
+               oi->openx.out.action            = 0;
+               oi->openx.out.unique_fid        = 0;
+               oi->openx.out.access_mask       = 0;
+               oi->openx.out.unknown           = 0;
+               break;
+       case RAW_OPEN_SMB2:
+               ZERO_STRUCT(oi->smb2.out);
+               oi->smb2.out.file.ntvfs         = p->handle;
+               oi->smb2.out.oplock_level       = oi->smb2.in.oplock_level;
+               oi->smb2.out.create_action      = NTCREATEX_ACTION_EXISTED;
+               oi->smb2.out.create_time        = 0;
+               oi->smb2.out.access_time        = 0;
+               oi->smb2.out.write_time         = 0;
+               oi->smb2.out.change_time        = 0;
+               oi->smb2.out.alloc_size         = p->allocation_size;
+               oi->smb2.out.size               = 0;
+               oi->smb2.out.file_attr          = FILE_ATTRIBUTE_NORMAL;
+               oi->smb2.out.reserved2          = 0;
                break;
        default:
-               status = NT_STATUS_NOT_SUPPORTED;
                break;
        }
 
-       return status;
+reply:
+       req->async_states->status = status;
+       req->async_states->send_fn(req);
 }
 
 /*
   create a directory
 */
 static NTSTATUS ipc_mkdir(struct ntvfs_module_context *ntvfs,
-                         struct smbsrv_request *req, union smb_mkdir *md)
+                         struct ntvfs_request *req, union smb_mkdir *md)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -362,7 +440,7 @@ static NTSTATUS ipc_mkdir(struct ntvfs_module_context *ntvfs,
   remove a directory
 */
 static NTSTATUS ipc_rmdir(struct ntvfs_module_context *ntvfs,
-                         struct smbsrv_request *req, struct smb_rmdir *rd)
+                         struct ntvfs_request *req, struct smb_rmdir *rd)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -371,7 +449,7 @@ static NTSTATUS ipc_rmdir(struct ntvfs_module_context *ntvfs,
   rename a set of files
 */
 static NTSTATUS ipc_rename(struct ntvfs_module_context *ntvfs,
-                          struct smbsrv_request *req, union smb_rename *ren)
+                          struct ntvfs_request *req, union smb_rename *ren)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -380,95 +458,263 @@ static NTSTATUS ipc_rename(struct ntvfs_module_context *ntvfs,
   copy a set of files
 */
 static NTSTATUS ipc_copy(struct ntvfs_module_context *ntvfs,
-                        struct smbsrv_request *req, struct smb_copy *cp)
+                        struct ntvfs_request *req, struct smb_copy *cp)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
 
+struct ipc_readv_next_vector_state {
+       uint8_t *buf;
+       size_t len;
+       off_t ofs;
+       size_t remaining;
+};
+
+static void ipc_readv_next_vector_init(struct ipc_readv_next_vector_state *s,
+                                      uint8_t *buf, size_t len)
+{
+       ZERO_STRUCTP(s);
+
+       s->buf = buf;
+       s->len = MIN(len, UINT16_MAX);
+}
+
+static int ipc_readv_next_vector(struct tstream_context *stream,
+                                void *private_data,
+                                TALLOC_CTX *mem_ctx,
+                                struct iovec **_vector,
+                                size_t *count)
+{
+       struct ipc_readv_next_vector_state *state =
+               (struct ipc_readv_next_vector_state *)private_data;
+       struct iovec *vector;
+       ssize_t pending;
+       size_t wanted;
+
+       if (state->ofs == state->len) {
+               *_vector = NULL;
+               *count = 0;
+               return 0;
+       }
+
+       pending = tstream_pending_bytes(stream);
+       if (pending == -1) {
+               return -1;
+       }
+
+       if (pending == 0 && state->ofs != 0) {
+               /* return a short read */
+               *_vector = NULL;
+               *count = 0;
+               return 0;
+       }
+
+       if (pending == 0) {
+               /* we want at least one byte and recheck again */
+               wanted = 1;
+       } else {
+               size_t missing = state->len - state->ofs;
+               if (pending > missing) {
+                       /* there's more available */
+                       state->remaining = pending - missing;
+                       wanted = missing;
+               } else {
+                       /* read what we can get and recheck in the next cycle */
+                       wanted = pending;
+               }
+       }
+
+       vector = talloc_array(mem_ctx, struct iovec, 1);
+       if (!vector) {
+               return -1;
+       }
+
+       vector[0].iov_base = (char *) (state->buf + state->ofs);
+       vector[0].iov_len = wanted;
+
+       state->ofs += wanted;
+
+       *_vector = vector;
+       *count = 1;
+       return 0;
+}
+
+struct ipc_read_state {
+       struct ipc_private *ipriv;
+       struct pipe_state *p;
+       struct ntvfs_request *req;
+       union smb_read *rd;
+       struct ipc_readv_next_vector_state next_vector;
+};
+
+static void ipc_read_done(struct tevent_req *subreq);
+
 /*
   read from a file
 */
 static NTSTATUS ipc_read(struct ntvfs_module_context *ntvfs,
-                        struct smbsrv_request *req, union smb_read *rd)
+                        struct ntvfs_request *req, union smb_read *rd)
 {
-       struct ipc_private *private = ntvfs->private_data;
-       DATA_BLOB data;
-       uint16_t fnum;
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
        struct pipe_state *p;
-       NTSTATUS status = NT_STATUS_OK;
+       struct ipc_read_state *state;
+       struct tevent_req *subreq;
 
        if (rd->generic.level != RAW_READ_GENERIC) {
-               return ntvfs_map_read(req, rd, ntvfs);
+               return ntvfs_map_read(ntvfs, req, rd);
        }
 
-       fnum = rd->readx.in.fnum;
-
-       p = pipe_state_find(private, fnum);
+       p = pipe_state_find(ipriv, rd->readx.in.file.ntvfs);
        if (!p) {
                return NT_STATUS_INVALID_HANDLE;
        }
 
-       data.length = rd->readx.in.maxcnt;
-       data.data = rd->readx.out.data;
-       if (data.length > UINT16_MAX) {
-               data.length = UINT16_MAX;
+       state = talloc(req, struct ipc_read_state);
+       NT_STATUS_HAVE_NO_MEMORY(state);
+
+       state->ipriv = ipriv;
+       state->p = p;
+       state->req = req;
+       state->rd = rd;
+
+       /* rd->readx.out.data is already allocated */
+       ipc_readv_next_vector_init(&state->next_vector,
+                                  rd->readx.out.data,
+                                  rd->readx.in.maxcnt);
+
+       subreq = tstream_readv_pdu_queue_send(req,
+                                             ipriv->ntvfs->ctx->event_ctx,
+                                             p->npipe,
+                                             p->read_queue,
+                                             ipc_readv_next_vector,
+                                             &state->next_vector);
+       NT_STATUS_HAVE_NO_MEMORY(subreq);
+       tevent_req_set_callback(subreq, ipc_read_done, state);
+
+       req->async_states->state |= NTVFS_ASYNC_STATE_ASYNC;
+       return NT_STATUS_OK;
+}
+
+static void ipc_read_done(struct tevent_req *subreq)
+{
+       struct ipc_read_state *state =
+               tevent_req_callback_data(subreq,
+               struct ipc_read_state);
+       struct ntvfs_request *req = state->req;
+       union smb_read *rd = state->rd;
+       int ret;
+       int sys_errno;
+       NTSTATUS status;
+
+       ret = tstream_readv_pdu_queue_recv(subreq, &sys_errno);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               status = map_nt_error_from_unix_common(sys_errno);
+               goto reply;
        }
 
-       if (data.length != 0) {
-               status = p->ops->read(p->private_data, &data);
-               if (NT_STATUS_IS_ERR(status)) {
-                       return status;
-               }
+       status = NT_STATUS_OK;
+       if (state->next_vector.remaining > 0) {
+               status = STATUS_BUFFER_OVERFLOW;
        }
 
-       rd->readx.out.remaining = 0;
+       rd->readx.out.remaining = state->next_vector.remaining;
        rd->readx.out.compaction_mode = 0;
-       rd->readx.out.nread = data.length;
+       rd->readx.out.nread = ret;
 
-       return status;
+reply:
+       req->async_states->status = status;
+       req->async_states->send_fn(req);
 }
 
+struct ipc_write_state {
+       struct ipc_private *ipriv;
+       struct pipe_state *p;
+       struct ntvfs_request *req;
+       union smb_write *wr;
+       struct iovec iov;
+};
+
+static void ipc_write_done(struct tevent_req *subreq);
+
 /*
   write to a file
 */
 static NTSTATUS ipc_write(struct ntvfs_module_context *ntvfs,
-                         struct smbsrv_request *req, union smb_write *wr)
+                         struct ntvfs_request *req, union smb_write *wr)
 {
-       struct ipc_private *private = ntvfs->private_data;
-       DATA_BLOB data;
-       uint16_t fnum;
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
        struct pipe_state *p;
-       NTSTATUS status;
+       struct tevent_req *subreq;
+       struct ipc_write_state *state;
 
        if (wr->generic.level != RAW_WRITE_GENERIC) {
-               return ntvfs_map_write(req, wr, ntvfs);
+               return ntvfs_map_write(ntvfs, req, wr);
        }
 
-       fnum = wr->writex.in.fnum;
-       data.data = discard_const_p(void, wr->writex.in.data);
-       data.length = wr->writex.in.count;
-
-       p = pipe_state_find(private, fnum);
+       p = pipe_state_find(ipriv, wr->writex.in.file.ntvfs);
        if (!p) {
                return NT_STATUS_INVALID_HANDLE;
        }
 
-       status = p->ops->write(p->private_data, &data);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
+       state = talloc(req, struct ipc_write_state);
+       NT_STATUS_HAVE_NO_MEMORY(state);
+
+       state->ipriv = ipriv;
+       state->p = p;
+       state->req = req;
+       state->wr = wr;
+       state->iov.iov_base = discard_const_p(void, wr->writex.in.data);
+       state->iov.iov_len = wr->writex.in.count;
+
+       subreq = tstream_writev_queue_send(state,
+                                          ipriv->ntvfs->ctx->event_ctx,
+                                          p->npipe,
+                                          p->write_queue,
+                                          &state->iov, 1);
+       NT_STATUS_HAVE_NO_MEMORY(subreq);
+       tevent_req_set_callback(subreq, ipc_write_done, state);
+
+       req->async_states->state |= NTVFS_ASYNC_STATE_ASYNC;
+       return NT_STATUS_OK;
+}
+
+static void ipc_write_done(struct tevent_req *subreq)
+{
+       struct ipc_write_state *state =
+               tevent_req_callback_data(subreq,
+               struct ipc_write_state);
+       struct ntvfs_request *req = state->req;
+       union smb_write *wr = state->wr;
+       int ret;
+       int sys_errno;
+       NTSTATUS status;
+
+       ret = tstream_writev_queue_recv(subreq, &sys_errno);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               status = map_nt_error_from_unix_common(sys_errno);
+               goto reply;
        }
 
-       wr->writex.out.nwritten = data.length;
+       status = NT_STATUS_OK;
+
+       wr->writex.out.nwritten = ret;
        wr->writex.out.remaining = 0;
 
-       return NT_STATUS_OK;
+reply:
+       req->async_states->status = status;
+       req->async_states->send_fn(req);
 }
 
 /*
   seek in a file
 */
 static NTSTATUS ipc_seek(struct ntvfs_module_context *ntvfs,
-                        struct smbsrv_request *req, struct smb_seek *io)
+                        struct ntvfs_request *req,
+                        union smb_seek *io)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -477,7 +723,8 @@ static NTSTATUS ipc_seek(struct ntvfs_module_context *ntvfs,
   flush a file
 */
 static NTSTATUS ipc_flush(struct ntvfs_module_context *ntvfs,
-                         struct smbsrv_request *req, struct smb_flush *io)
+                         struct ntvfs_request *req,
+                         union smb_flush *io)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -486,16 +733,19 @@ static NTSTATUS ipc_flush(struct ntvfs_module_context *ntvfs,
   close a file
 */
 static NTSTATUS ipc_close(struct ntvfs_module_context *ntvfs,
-                         struct smbsrv_request *req, union smb_close *io)
+                         struct ntvfs_request *req, union smb_close *io)
 {
-       struct ipc_private *private = ntvfs->private_data;
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
        struct pipe_state *p;
 
-       if (io->generic.level != RAW_CLOSE_CLOSE) {
-               return ntvfs_map_close(req, io, ntvfs);
+       if (io->generic.level != RAW_CLOSE_GENERIC) {
+               return ntvfs_map_close(ntvfs, req, io);
        }
 
-       p = pipe_state_find(private, io->close.in.fnum);
+       ZERO_STRUCT(io->generic.out);
+
+       p = pipe_state_find(ipriv, io->generic.in.file.ntvfs);
        if (!p) {
                return NT_STATUS_INVALID_HANDLE;
        }
@@ -509,14 +759,16 @@ static NTSTATUS ipc_close(struct ntvfs_module_context *ntvfs,
   exit - closing files
 */
 static NTSTATUS ipc_exit(struct ntvfs_module_context *ntvfs,
-                        struct smbsrv_request *req)
+                        struct ntvfs_request *req)
 {
-       struct ipc_private *private = ntvfs->private_data;
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
        struct pipe_state *p, *next;
        
-       for (p=private->pipe_list; p; p=next) {
+       for (p=ipriv->pipe_list; p; p=next) {
                next = p->next;
-               if (p->smbpid == req->smbpid) {
+               if (p->handle->session_info == req->session_info &&
+                   p->handle->smbpid == req->smbpid) {
                        talloc_free(p);
                }
        }
@@ -528,14 +780,15 @@ static NTSTATUS ipc_exit(struct ntvfs_module_context *ntvfs,
   logoff - closing files open by the user
 */
 static NTSTATUS ipc_logoff(struct ntvfs_module_context *ntvfs,
-                          struct smbsrv_request *req)
+                          struct ntvfs_request *req)
 {
-       struct ipc_private *private = ntvfs->private_data;
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
        struct pipe_state *p, *next;
        
-       for (p=private->pipe_list; p; p=next) {
+       for (p=ipriv->pipe_list; p; p=next) {
                next = p->next;
-               if (p->session == req->session) {
+               if (p->handle->session_info == req->session_info) {
                        talloc_free(p);
                }
        }
@@ -547,8 +800,8 @@ static NTSTATUS ipc_logoff(struct ntvfs_module_context *ntvfs,
   setup for an async call
 */
 static NTSTATUS ipc_async_setup(struct ntvfs_module_context *ntvfs,
-                               struct smbsrv_request *req,
-                               void *private)
+                               struct ntvfs_request *req,
+                               void *private_data)
 {
        return NT_STATUS_OK;
 }
@@ -557,7 +810,7 @@ static NTSTATUS ipc_async_setup(struct ntvfs_module_context *ntvfs,
   cancel an async call
 */
 static NTSTATUS ipc_cancel(struct ntvfs_module_context *ntvfs,
-                          struct smbsrv_request *req)
+                          struct ntvfs_request *req)
 {
        return NT_STATUS_UNSUCCESSFUL;
 }
@@ -566,7 +819,7 @@ static NTSTATUS ipc_cancel(struct ntvfs_module_context *ntvfs,
   lock a byte range
 */
 static NTSTATUS ipc_lock(struct ntvfs_module_context *ntvfs,
-                        struct smbsrv_request *req, union smb_lock *lck)
+                        struct ntvfs_request *req, union smb_lock *lck)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -575,7 +828,7 @@ static NTSTATUS ipc_lock(struct ntvfs_module_context *ntvfs,
   set info on a open file
 */
 static NTSTATUS ipc_setfileinfo(struct ntvfs_module_context *ntvfs,
-                               struct smbsrv_request *req, union smb_setfileinfo *info)
+                               struct ntvfs_request *req, union smb_setfileinfo *info)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -584,9 +837,40 @@ static NTSTATUS ipc_setfileinfo(struct ntvfs_module_context *ntvfs,
   query info on a open file
 */
 static NTSTATUS ipc_qfileinfo(struct ntvfs_module_context *ntvfs,
-                             struct smbsrv_request *req, union smb_fileinfo *info)
+                             struct ntvfs_request *req, union smb_fileinfo *info)
 {
-       return NT_STATUS_ACCESS_DENIED;
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
+       struct pipe_state *p = pipe_state_find(ipriv, info->generic.in.file.ntvfs);
+       if (!p) {
+               return NT_STATUS_INVALID_HANDLE;
+       }
+       switch (info->generic.level) {
+       case RAW_FILEINFO_GENERIC: 
+       {
+               ZERO_STRUCT(info->generic.out);
+               info->generic.out.attrib = FILE_ATTRIBUTE_NORMAL;
+               info->generic.out.fname.s = strrchr(p->pipe_name, '\\');
+               info->generic.out.alloc_size = 4096;
+               info->generic.out.nlink = 1;
+               /* What the heck?  Match Win2k3: IPC$ pipes are delete pending */
+               info->generic.out.delete_pending = 1;
+               return NT_STATUS_OK;
+       }
+       case RAW_FILEINFO_ALT_NAME_INFO:
+       case RAW_FILEINFO_ALT_NAME_INFORMATION:
+       case RAW_FILEINFO_STREAM_INFO:
+       case RAW_FILEINFO_STREAM_INFORMATION:
+       case RAW_FILEINFO_COMPRESSION_INFO:
+       case RAW_FILEINFO_COMPRESSION_INFORMATION:
+       case RAW_FILEINFO_NETWORK_OPEN_INFORMATION:
+       case RAW_FILEINFO_ATTRIBUTE_TAG_INFORMATION:
+               return NT_STATUS_INVALID_PARAMETER;
+       case  RAW_FILEINFO_ALL_EAS:
+               return NT_STATUS_ACCESS_DENIED;
+       default:
+               return ntvfs_map_qfileinfo(ntvfs, req, info);
+       }
 }
 
 
@@ -594,7 +878,7 @@ static NTSTATUS ipc_qfileinfo(struct ntvfs_module_context *ntvfs,
   return filesystem info
 */
 static NTSTATUS ipc_fsinfo(struct ntvfs_module_context *ntvfs,
-                          struct smbsrv_request *req, union smb_fsinfo *fs)
+                          struct ntvfs_request *req, union smb_fsinfo *fs)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -603,7 +887,7 @@ static NTSTATUS ipc_fsinfo(struct ntvfs_module_context *ntvfs,
   return print queue info
 */
 static NTSTATUS ipc_lpq(struct ntvfs_module_context *ntvfs,
-                       struct smbsrv_request *req, union smb_lpq *lpq)
+                       struct ntvfs_request *req, union smb_lpq *lpq)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -612,9 +896,9 @@ static NTSTATUS ipc_lpq(struct ntvfs_module_context *ntvfs,
    list files in a directory matching a wildcard pattern
 */
 static NTSTATUS ipc_search_first(struct ntvfs_module_context *ntvfs,
-                         struct smbsrv_request *req, union smb_search_first *io,
+                         struct ntvfs_request *req, union smb_search_first *io,
                          void *search_private, 
-                         BOOL (*callback)(void *, union smb_search_data *))
+                         bool (*callback)(void *, const union smb_search_data *))
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -623,9 +907,9 @@ static NTSTATUS ipc_search_first(struct ntvfs_module_context *ntvfs,
    continue listing files in a directory 
 */
 static NTSTATUS ipc_search_next(struct ntvfs_module_context *ntvfs,
-                        struct smbsrv_request *req, union smb_search_next *io,
+                        struct ntvfs_request *req, union smb_search_next *io,
                         void *search_private, 
-                        BOOL (*callback)(void *, union smb_search_data *))
+                        bool (*callback)(void *, const union smb_search_data *))
 {
        return NT_STATUS_ACCESS_DENIED;
 }
@@ -634,110 +918,393 @@ static NTSTATUS ipc_search_next(struct ntvfs_module_context *ntvfs,
    end listing files in a directory 
 */
 static NTSTATUS ipc_search_close(struct ntvfs_module_context *ntvfs,
-                         struct smbsrv_request *req, union smb_search_close *io)
+                         struct ntvfs_request *req, union smb_search_close *io)
 {
        return NT_STATUS_ACCESS_DENIED;
 }
 
-/* SMBtrans - set named pipe state */
-static NTSTATUS ipc_np_set_nm_state(struct ntvfs_module_context *ntvfs,
-                               struct smbsrv_request *req, struct smb_trans2 *trans)
-{
-       struct ipc_private *private = ntvfs->private_data;
+struct ipc_trans_state {
+       struct ipc_private *ipriv;
        struct pipe_state *p;
+       struct ntvfs_request *req;
+       struct smb_trans2 *trans;
+       struct iovec writev_iov;
+       struct ipc_readv_next_vector_state next_vector;
+};
 
-       /* the fnum is in setup[1] */
-       p = pipe_state_find(private, trans->in.setup[1]);
+static void ipc_trans_writev_done(struct tevent_req *subreq);
+static void ipc_trans_readv_done(struct tevent_req *subreq);
+
+/* SMBtrans - handle a DCERPC command */
+static NTSTATUS ipc_dcerpc_cmd(struct ntvfs_module_context *ntvfs,
+                              struct ntvfs_request *req, struct smb_trans2 *trans)
+{
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
+       struct pipe_state *p;
+       DATA_BLOB fnum_key;
+       uint16_t fnum;
+       struct ipc_trans_state *state;
+       struct tevent_req *subreq;
+
+       /*
+        * the fnum is in setup[1], a 16 bit value
+        * the setup[*] values are already in host byteorder
+        * but ntvfs_handle_search_by_wire_key() expects
+        * network byteorder
+        */
+       SSVAL(&fnum, 0, trans->in.setup[1]);
+       fnum_key = data_blob_const(&fnum, 2);
+
+       p = pipe_state_find_key(ipriv, req, &fnum_key);
        if (!p) {
                return NT_STATUS_INVALID_HANDLE;
        }
 
-       if (trans->in.params.length != 2) {
-               return NT_STATUS_INVALID_PARAMETER;
+       /*
+        * Trans requests are only allowed
+        * if no other Trans or Read is active
+        */
+       if (tevent_queue_length(p->read_queue) > 0) {
+               return NT_STATUS_PIPE_BUSY;
        }
-       p->ipc_state = SVAL(trans->in.params.data, 0);
+
+       state = talloc(req, struct ipc_trans_state);
+       NT_STATUS_HAVE_NO_MEMORY(state);
 
        trans->out.setup_count = 0;
        trans->out.setup = NULL;
        trans->out.params = data_blob(NULL, 0);
-       trans->out.data = data_blob(NULL, 0);
-
+       trans->out.data = data_blob_talloc(req, NULL, trans->in.max_data);
+       NT_STATUS_HAVE_NO_MEMORY(trans->out.data.data);
+
+       state->ipriv = ipriv;
+       state->p = p;
+       state->req = req;
+       state->trans = trans;
+       state->writev_iov.iov_base = (char *) trans->in.data.data;
+       state->writev_iov.iov_len = trans->in.data.length;
+
+       ipc_readv_next_vector_init(&state->next_vector,
+                                  trans->out.data.data,
+                                  trans->out.data.length);
+
+       subreq = tstream_writev_queue_send(state,
+                                          ipriv->ntvfs->ctx->event_ctx,
+                                          p->npipe,
+                                          p->write_queue,
+                                          &state->writev_iov, 1);
+       NT_STATUS_HAVE_NO_MEMORY(subreq);
+       tevent_req_set_callback(subreq, ipc_trans_writev_done, state);
+
+       req->async_states->state |= NTVFS_ASYNC_STATE_ASYNC;
        return NT_STATUS_OK;
 }
 
-/* SMBtrans - named pipe transaction */
-static NTSTATUS ipc_np_trans(struct ntvfs_module_context *ntvfs,
-                               struct smbsrv_request *req, struct smb_trans2 *trans)
+static void ipc_trans_writev_done(struct tevent_req *subreq)
+{
+       struct ipc_trans_state *state =
+               tevent_req_callback_data(subreq,
+               struct ipc_trans_state);
+       struct ipc_private *ipriv = state->ipriv;
+       struct pipe_state *p = state->p;
+       struct ntvfs_request *req = state->req;
+       int ret;
+       int sys_errno;
+       NTSTATUS status;
+
+       ret = tstream_writev_queue_recv(subreq, &sys_errno);
+       TALLOC_FREE(subreq);
+       if (ret == 0) {
+               status = NT_STATUS_PIPE_DISCONNECTED;
+               goto reply;
+       } else if (ret == -1) {
+               status = map_nt_error_from_unix_common(sys_errno);
+               goto reply;
+       }
+
+       subreq = tstream_readv_pdu_queue_send(state,
+                                             ipriv->ntvfs->ctx->event_ctx,
+                                             p->npipe,
+                                             p->read_queue,
+                                             ipc_readv_next_vector,
+                                             &state->next_vector);
+       if (!subreq) {
+               status = NT_STATUS_NO_MEMORY;
+               goto reply;
+       }
+       tevent_req_set_callback(subreq, ipc_trans_readv_done, state);
+       return;
+
+reply:
+       req->async_states->status = status;
+       req->async_states->send_fn(req);
+}
+
+static void ipc_trans_readv_done(struct tevent_req *subreq)
 {
-       struct ipc_private *private = ntvfs->private_data;
+       struct ipc_trans_state *state =
+               tevent_req_callback_data(subreq,
+               struct ipc_trans_state);
+       struct ntvfs_request *req = state->req;
+       struct smb_trans2 *trans = state->trans;
+       int ret;
+       int sys_errno;
        NTSTATUS status;
+
+       ret = tstream_readv_pdu_queue_recv(subreq, &sys_errno);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               status = map_nt_error_from_unix_common(sys_errno);
+               goto reply;
+       }
+
+       status = NT_STATUS_OK;
+       if (state->next_vector.remaining > 0) {
+               status = STATUS_BUFFER_OVERFLOW;
+       }
+
+       trans->out.data.length = ret;
+
+reply:
+       req->async_states->status = status;
+       req->async_states->send_fn(req);
+}
+
+/* SMBtrans - set named pipe state */
+static NTSTATUS ipc_set_nm_pipe_state(struct ntvfs_module_context *ntvfs,
+                                     struct ntvfs_request *req, struct smb_trans2 *trans)
+{
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
        struct pipe_state *p;
+       DATA_BLOB fnum_key;
 
        /* the fnum is in setup[1] */
-       p = pipe_state_find(private, trans->in.setup[1]);
+       fnum_key = data_blob_const(&trans->in.setup[1], sizeof(trans->in.setup[1]));
+
+       p = pipe_state_find_key(ipriv, req, &fnum_key);
        if (!p) {
                return NT_STATUS_INVALID_HANDLE;
        }
 
-       if (trans->in.setup_count != 2) {
+       if (trans->in.params.length != 2) {
                return NT_STATUS_INVALID_PARAMETER;
        }
-       
-       trans->out.data = data_blob_talloc(req, NULL, trans->in.max_data);
-       if (!trans->out.data.data) {
-               return NT_STATUS_NO_MEMORY;
-       }
-       
-       status = p->ops->trans(p->private_data, &trans->in.data, &trans->out.data);
-       if (NT_STATUS_IS_ERR(status)) {
-               return status;
-       }
+
+       /*
+        * TODO: pass this to the tstream_npa logic
+        */
+       p->device_state = SVAL(trans->in.params.data, 0);
 
        trans->out.setup_count = 0;
        trans->out.setup = NULL;
        trans->out.params = data_blob(NULL, 0);
+       trans->out.data = data_blob(NULL, 0);
 
        return NT_STATUS_OK;
 }
 
+
 /* SMBtrans - used to provide access to SMB pipes */
 static NTSTATUS ipc_trans(struct ntvfs_module_context *ntvfs,
-                               struct smbsrv_request *req, struct smb_trans2 *trans)
+                               struct ntvfs_request *req, struct smb_trans2 *trans)
 {
        NTSTATUS status;
 
-       if (strequal(trans->in.trans_name, "\\PIPE\\")) { /* Named pipe */
-               switch (trans->in.setup[0]) {
-               case NAMED_PIPE_SETHANDLESTATE:
-                       status = ipc_np_set_nm_state(ntvfs, req, trans);
-                       break;
-               case NAMED_PIPE_TRANSACT:
-                       status = ipc_np_trans(ntvfs, req, trans);
-                       break;
-               default:
-                       status = NT_STATUS_INVALID_PARAMETER;
-                       break;
-               }
-       } else if (strequal(trans->in.trans_name, "\\PIPE\\LANMAN")) { /* RAP */
-               status = ipc_rap_call(req, trans);
-       } else {
-               DEBUG(1, ("Unknown transaction name `%s'\n", trans->in.trans_name));
-               status = NT_STATUS_NOT_SUPPORTED;
+       if (strequal(trans->in.trans_name, "\\PIPE\\LANMAN"))
+               return ipc_rap_call(req, ntvfs->ctx->event_ctx, ntvfs->ctx->lp_ctx, trans);
+
+               if (trans->in.setup_count != 2) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       switch (trans->in.setup[0]) {
+       case TRANSACT_SETNAMEDPIPEHANDLESTATE:
+               status = ipc_set_nm_pipe_state(ntvfs, req, trans);
+               break;
+       case TRANSACT_DCERPCCMD:
+               status = ipc_dcerpc_cmd(ntvfs, req, trans);
+               break;
+       default:
+               status = NT_STATUS_INVALID_PARAMETER;
+               break;
        }
 
        return status;
 }
 
+struct ipc_ioctl_state {
+       struct ipc_private *ipriv;
+       struct pipe_state *p;
+       struct ntvfs_request *req;
+       union smb_ioctl *io;
+       struct iovec writev_iov;
+       struct ipc_readv_next_vector_state next_vector;
+};
+
+static void ipc_ioctl_writev_done(struct tevent_req *subreq);
+static void ipc_ioctl_readv_done(struct tevent_req *subreq);
+
+static NTSTATUS ipc_ioctl_smb2(struct ntvfs_module_context *ntvfs,
+                              struct ntvfs_request *req, union smb_ioctl *io)
+{
+       struct ipc_private *ipriv = talloc_get_type_abort(ntvfs->private_data,
+                                   struct ipc_private);
+       struct pipe_state *p;
+       struct ipc_ioctl_state *state;
+       struct tevent_req *subreq;
+
+       switch (io->smb2.in.function) {
+       case FSCTL_NAMED_PIPE_READ_WRITE:
+               break;
+
+       default:
+               return NT_STATUS_FS_DRIVER_REQUIRED;
+       }
+
+       p = pipe_state_find(ipriv, io->smb2.in.file.ntvfs);
+       if (!p) {
+               return NT_STATUS_INVALID_HANDLE;
+       }
+
+       /*
+        * Trans requests are only allowed
+        * if no other Trans or Read is active
+        */
+       if (tevent_queue_length(p->read_queue) > 0) {
+               return NT_STATUS_PIPE_BUSY;
+       }
+
+       state = talloc(req, struct ipc_ioctl_state);
+       NT_STATUS_HAVE_NO_MEMORY(state);
+
+       io->smb2.out.reserved   = 0;
+       io->smb2.out.function   = io->smb2.in.function;
+       io->smb2.out.flags      = 0;
+       io->smb2.out.reserved2  = 0;
+       io->smb2.out.in         = data_blob_null;
+       io->smb2.out.out = data_blob_talloc(req, NULL, io->smb2.in.max_output_response);
+       NT_STATUS_HAVE_NO_MEMORY(io->smb2.out.out.data);
+
+       state->ipriv = ipriv;
+       state->p = p;
+       state->req = req;
+       state->io = io;
+       state->writev_iov.iov_base = (char *) io->smb2.in.out.data;
+       state->writev_iov.iov_len = io->smb2.in.out.length;
+
+       ipc_readv_next_vector_init(&state->next_vector,
+                                  io->smb2.out.out.data,
+                                  io->smb2.out.out.length);
+
+       subreq = tstream_writev_queue_send(state,
+                                          ipriv->ntvfs->ctx->event_ctx,
+                                          p->npipe,
+                                          p->write_queue,
+                                          &state->writev_iov, 1);
+       NT_STATUS_HAVE_NO_MEMORY(subreq);
+       tevent_req_set_callback(subreq, ipc_ioctl_writev_done, state);
+
+       req->async_states->state |= NTVFS_ASYNC_STATE_ASYNC;
+       return NT_STATUS_OK;
+}
+
+static void ipc_ioctl_writev_done(struct tevent_req *subreq)
+{
+       struct ipc_ioctl_state *state =
+               tevent_req_callback_data(subreq,
+               struct ipc_ioctl_state);
+       struct ipc_private *ipriv = state->ipriv;
+       struct pipe_state *p = state->p;
+       struct ntvfs_request *req = state->req;
+       int ret;
+       int sys_errno;
+       NTSTATUS status;
+
+       ret = tstream_writev_queue_recv(subreq, &sys_errno);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               status = map_nt_error_from_unix_common(sys_errno);
+               goto reply;
+       }
+
+       subreq = tstream_readv_pdu_queue_send(state,
+                                             ipriv->ntvfs->ctx->event_ctx,
+                                             p->npipe,
+                                             p->read_queue,
+                                             ipc_readv_next_vector,
+                                             &state->next_vector);
+       if (!subreq) {
+               status = NT_STATUS_NO_MEMORY;
+               goto reply;
+       }
+       tevent_req_set_callback(subreq, ipc_ioctl_readv_done, state);
+       return;
+
+reply:
+       req->async_states->status = status;
+       req->async_states->send_fn(req);
+}
+
+static void ipc_ioctl_readv_done(struct tevent_req *subreq)
+{
+       struct ipc_ioctl_state *state =
+               tevent_req_callback_data(subreq,
+               struct ipc_ioctl_state);
+       struct ntvfs_request *req = state->req;
+       union smb_ioctl *io = state->io;
+       int ret;
+       int sys_errno;
+       NTSTATUS status;
+
+       ret = tstream_readv_pdu_queue_recv(subreq, &sys_errno);
+       TALLOC_FREE(subreq);
+       if (ret == -1) {
+               status = map_nt_error_from_unix_common(sys_errno);
+               goto reply;
+       }
+
+       status = NT_STATUS_OK;
+       if (state->next_vector.remaining > 0) {
+               status = STATUS_BUFFER_OVERFLOW;
+       }
+
+       io->smb2.out.out.length = ret;
+
+reply:
+       req->async_states->status = status;
+       req->async_states->send_fn(req);
+}
+
+/*
+  ioctl interface
+*/
+static NTSTATUS ipc_ioctl(struct ntvfs_module_context *ntvfs,
+                         struct ntvfs_request *req, union smb_ioctl *io)
+{
+       switch (io->generic.level) {
+       case RAW_IOCTL_SMB2:
+               return ipc_ioctl_smb2(ntvfs, req, io);
+
+       case RAW_IOCTL_SMB2_NO_HANDLE:
+               return NT_STATUS_FS_DRIVER_REQUIRED;
+
+       default:
+               return NT_STATUS_ACCESS_DENIED;
+       }
+}
+
+
 /*
   initialialise the IPC backend, registering ourselves with the ntvfs subsystem
  */
-NTSTATUS ntvfs_ipc_init(void)
+NTSTATUS ntvfs_ipc_init(TALLOC_CTX *ctx)
 {
        NTSTATUS ret;
        struct ntvfs_ops ops;
-       init_module_fn static_init[] = STATIC_ntvfs_ipc_MODULES;
-       init_module_fn *shared_init;
-       
+       NTVFS_CURRENT_CRITICAL_SIZES(vers);
+
        ZERO_STRUCT(ops);
        
        /* fill in the name and type */
@@ -745,52 +1312,44 @@ NTSTATUS ntvfs_ipc_init(void)
        ops.type = NTVFS_IPC;
 
        /* fill in all the operations */
-       ops.connect = ipc_connect;
-       ops.disconnect = ipc_disconnect;
-       ops.unlink = ipc_unlink;
-       ops.chkpath = ipc_chkpath;
-       ops.qpathinfo = ipc_qpathinfo;
-       ops.setpathinfo = ipc_setpathinfo;
-       ops.openfile = ipc_open;
-       ops.mkdir = ipc_mkdir;
-       ops.rmdir = ipc_rmdir;
-       ops.rename = ipc_rename;
-       ops.copy = ipc_copy;
-       ops.ioctl = ipc_ioctl;
-       ops.read = ipc_read;
-       ops.write = ipc_write;
-       ops.seek = ipc_seek;
-       ops.flush = ipc_flush;  
-       ops.close = ipc_close;
-       ops.exit = ipc_exit;
-       ops.lock = ipc_lock;
-       ops.setfileinfo = ipc_setfileinfo;
-       ops.qfileinfo = ipc_qfileinfo;
-       ops.fsinfo = ipc_fsinfo;
-       ops.lpq = ipc_lpq;
-       ops.search_first = ipc_search_first;
-       ops.search_next = ipc_search_next;
-       ops.search_close = ipc_search_close;
-       ops.trans = ipc_trans;
-       ops.logoff = ipc_logoff;
-       ops.async_setup = ipc_async_setup;
-       ops.cancel = ipc_cancel;
+       ops.connect_fn = ipc_connect;
+       ops.disconnect_fn = ipc_disconnect;
+       ops.unlink_fn = ipc_unlink;
+       ops.chkpath_fn = ipc_chkpath;
+       ops.qpathinfo_fn = ipc_qpathinfo;
+       ops.setpathinfo_fn = ipc_setpathinfo;
+       ops.open_fn = ipc_open;
+       ops.mkdir_fn = ipc_mkdir;
+       ops.rmdir_fn = ipc_rmdir;
+       ops.rename_fn = ipc_rename;
+       ops.copy_fn = ipc_copy;
+       ops.ioctl_fn = ipc_ioctl;
+       ops.read_fn = ipc_read;
+       ops.write_fn = ipc_write;
+       ops.seek_fn = ipc_seek;
+       ops.flush_fn = ipc_flush;
+       ops.close_fn = ipc_close;
+       ops.exit_fn = ipc_exit;
+       ops.lock_fn = ipc_lock;
+       ops.setfileinfo_fn = ipc_setfileinfo;
+       ops.qfileinfo_fn = ipc_qfileinfo;
+       ops.fsinfo_fn = ipc_fsinfo;
+       ops.lpq_fn = ipc_lpq;
+       ops.search_first_fn = ipc_search_first;
+       ops.search_next_fn = ipc_search_next;
+       ops.search_close_fn = ipc_search_close;
+       ops.trans_fn = ipc_trans;
+       ops.logoff_fn = ipc_logoff;
+       ops.async_setup_fn = ipc_async_setup;
+       ops.cancel_fn = ipc_cancel;
 
        /* register ourselves with the NTVFS subsystem. */
-       ret = ntvfs_register(&ops);
+       ret = ntvfs_register(&ops, &vers);
 
        if (!NT_STATUS_IS_OK(ret)) {
                DEBUG(0,("Failed to register IPC backend!\n"));
                return ret;
        }
 
-       /* load available named pipe backends */
-       shared_init = load_samba_modules(NULL, "np");
-
-       run_init_functions(static_init);
-       run_init_functions(shared_init);
-
-       talloc_free(shared_init);
-
        return ret;
 }