Remove p->vuid
[samba.git] / source3 / rpc_server / srv_pipe_hnd.c
1 /* 
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *  Copyright (C) Andrew Tridgell              1992-1998,
5  *  Largely re-written : 2005
6  *  Copyright (C) Jeremy Allison                1998 - 2005
7  *  
8  *  This program is free software; you can redistribute it and/or modify
9  *  it under the terms of the GNU General Public License as published by
10  *  the Free Software Foundation; either version 3 of the License, or
11  *  (at your option) any later version.
12  *  
13  *  This program is distributed in the hope that it will be useful,
14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  *  GNU General Public License for more details.
17  *  
18  *  You should have received a copy of the GNU General Public License
19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
20  */
21
22 #include "includes.h"
23
24 #undef DBGC_CLASS
25 #define DBGC_CLASS DBGC_RPC_SRV
26
27 #define PIPE            "\\PIPE\\"
28 #define PIPELEN         strlen(PIPE)
29
30 static smb_np_struct *chain_p;
31 static int pipes_open;
32
33 /*
34  * Sometimes I can't decide if I hate Windows printer driver
35  * writers more than I hate the Windows spooler service driver
36  * writers. This gets around a combination of bugs in the spooler
37  * and the HP 8500 PCL driver that causes a spooler spin. JRA.
38  *
39  * bumped up from 20 -> 64 after viewing traffic from WordPerfect
40  * 2002 running on NT 4.- SP6
41  * bumped up from 64 -> 256 after viewing traffic from con2prt
42  * for lots of printers on a WinNT 4.x SP6 box.
43  */
44  
45 #ifndef MAX_OPEN_SPOOLSS_PIPES
46 #define MAX_OPEN_SPOOLSS_PIPES 256
47 #endif
48 static int current_spoolss_pipes_open;
49
50 static smb_np_struct *Pipes;
51 static pipes_struct *InternalPipes;
52 static struct bitmap *bmap;
53
54 /* TODO
55  * the following prototypes are declared here to avoid
56  * code being moved about too much for a patch to be
57  * disrupted / less obvious.
58  *
59  * these functions, and associated functions that they
60  * call, should be moved behind a .so module-loading
61  * system _anyway_.  so that's the next step...
62  */
63
64 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
65                 bool *is_data_outstanding);
66 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n);
67 static bool close_internal_rpc_pipe_hnd(void *np_conn);
68 static void *make_internal_rpc_pipe_p(const char *pipe_name, 
69                               connection_struct *conn, uint16 vuid);
70
71 /****************************************************************************
72  Internal Pipe iterator functions.
73 ****************************************************************************/
74
75 pipes_struct *get_first_internal_pipe(void)
76 {
77         return InternalPipes;
78 }
79
80 pipes_struct *get_next_internal_pipe(pipes_struct *p)
81 {
82         return p->next;
83 }
84
85 /* this must be larger than the sum of the open files and directories */
86 static int pipe_handle_offset;
87
88 /****************************************************************************
89  Set the pipe_handle_offset. Called from smbd/files.c
90 ****************************************************************************/
91
92 void set_pipe_handle_offset(int max_open_files)
93 {
94         if(max_open_files < 0x7000) {
95                 pipe_handle_offset = 0x7000;
96         } else {
97                 pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
98         }
99 }
100
101 /****************************************************************************
102  Reset pipe chain handle number.
103 ****************************************************************************/
104
105 void reset_chain_p(void)
106 {
107         chain_p = NULL;
108 }
109
110 /****************************************************************************
111  Initialise pipe handle states.
112 ****************************************************************************/
113
114 void init_rpc_pipe_hnd(void)
115 {
116         bmap = bitmap_allocate(MAX_OPEN_PIPES);
117         if (!bmap) {
118                 exit_server("out of memory in init_rpc_pipe_hnd");
119         }
120 }
121
122 /****************************************************************************
123  Initialise an outgoing packet.
124 ****************************************************************************/
125
126 static bool pipe_init_outgoing_data(pipes_struct *p)
127 {
128         output_data *o_data = &p->out_data;
129
130         /* Reset the offset counters. */
131         o_data->data_sent_length = 0;
132         o_data->current_pdu_len = 0;
133         o_data->current_pdu_sent = 0;
134
135         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
136
137         /* Free any memory in the current return data buffer. */
138         prs_mem_free(&o_data->rdata);
139
140         /*
141          * Initialize the outgoing RPC data buffer.
142          * we will use this as the raw data area for replying to rpc requests.
143          */     
144         if(!prs_init(&o_data->rdata, RPC_MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
145                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
146                 return False;
147         }
148
149         return True;
150 }
151
152 /****************************************************************************
153  Find first available pipe slot.
154 ****************************************************************************/
155
156 smb_np_struct *open_rpc_pipe_p(const char *pipe_name, 
157                               connection_struct *conn, uint16 vuid)
158 {
159         int i;
160         smb_np_struct *p, *p_it;
161         static int next_pipe;
162         bool is_spoolss_pipe = False;
163
164         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
165                  pipe_name, pipes_open));
166
167         if (strstr(pipe_name, "spoolss")) {
168                 is_spoolss_pipe = True;
169         }
170  
171         if (is_spoolss_pipe && current_spoolss_pipes_open >= MAX_OPEN_SPOOLSS_PIPES) {
172                 DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n",
173                         pipe_name ));
174                 return NULL;
175         }
176
177         /* not repeating pipe numbers makes it easier to track things in 
178            log files and prevents client bugs where pipe numbers are reused
179            over connection restarts */
180
181         if (next_pipe == 0) {
182                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
183         }
184
185         i = bitmap_find(bmap, next_pipe);
186
187         if (i == -1) {
188                 DEBUG(0,("ERROR! Out of pipe structures\n"));
189                 return NULL;
190         }
191
192         next_pipe = (i+1) % MAX_OPEN_PIPES;
193
194         for (p = Pipes; p; p = p->next) {
195                 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));  
196         }
197
198         p = talloc(NULL, smb_np_struct);
199         if (!p) {
200                 DEBUG(0,("ERROR! no memory for smb_np_struct!\n"));
201                 return NULL;
202         }
203
204         ZERO_STRUCTP(p);
205
206         p->name = talloc_strdup(p, pipe_name);
207         if (p->name == NULL) {
208                 TALLOC_FREE(p);
209                 DEBUG(0,("ERROR! no memory for pipe name!\n"));
210                 return NULL;
211         }
212
213         /* add a dso mechanism instead of this, here */
214
215         p->namedpipe_create = make_internal_rpc_pipe_p;
216         p->namedpipe_read = read_from_internal_pipe;
217         p->namedpipe_write = write_to_internal_pipe;
218         p->namedpipe_close = close_internal_rpc_pipe_hnd;
219
220         p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
221
222         if (p->np_state == NULL) {
223                 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
224                 TALLOC_FREE(p);
225                 return NULL;
226         }
227
228         DLIST_ADD(Pipes, p);
229
230         /*
231          * Initialize the incoming RPC data buffer with one PDU worth of memory.
232          * We cheat here and say we're marshalling, as we intend to add incoming
233          * data directly into the prs_struct and we want it to auto grow. We will
234          * change the type to UNMARSALLING before processing the stream.
235          */
236
237         bitmap_set(bmap, i);
238         i += pipe_handle_offset;
239
240         pipes_open++;
241
242         p->pnum = i;
243
244         p->open = True;
245         p->device_state = 0;
246         p->priority = 0;
247         p->conn = conn;
248         p->vuid  = vuid;
249
250         p->max_trans_reply = 0;
251
252         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
253                  pipe_name, i, pipes_open));
254         
255         chain_p = p;
256         
257         /* Iterate over p_it as a temp variable, to display all open pipes */ 
258         for (p_it = Pipes; p_it; p_it = p_it->next) {
259                 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum));  
260         }
261
262         return chain_p;
263 }
264
265 /****************************************************************************
266  Make an internal namedpipes structure
267 ****************************************************************************/
268
269 static void *make_internal_rpc_pipe_p(const char *pipe_name, 
270                               connection_struct *conn, uint16 vuid)
271 {
272         pipes_struct *p;
273         user_struct *vuser = get_valid_user_struct(vuid);
274
275         DEBUG(4,("Create pipe requested %s\n", pipe_name));
276
277         if (!vuser && vuid != UID_FIELD_INVALID) {
278                 DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid));
279                 return NULL;
280         }
281
282         p = TALLOC_ZERO_P(NULL, pipes_struct);
283
284         if (!p) {
285                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
286                 return NULL;
287         }
288
289         if ((p->mem_ctx = talloc_init("pipe %s %p", pipe_name, p)) == NULL) {
290                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
291                 TALLOC_FREE(p);
292                 return NULL;
293         }
294
295         if (!init_pipe_handle_list(p, pipe_name)) {
296                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
297                 talloc_destroy(p->mem_ctx);
298                 TALLOC_FREE(p);
299                 return NULL;
300         }
301
302         /*
303          * Initialize the incoming RPC data buffer with one PDU worth of memory.
304          * We cheat here and say we're marshalling, as we intend to add incoming
305          * data directly into the prs_struct and we want it to auto grow. We will
306          * change the type to UNMARSALLING before processing the stream.
307          */
308
309         if(!prs_init(&p->in_data.data, RPC_MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
310                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
311                 talloc_destroy(p->mem_ctx);
312                 close_policy_by_pipe(p);
313                 TALLOC_FREE(p);
314                 return NULL;
315         }
316
317         p->server_info = copy_serverinfo(p, conn->server_info);
318         if (p->server_info == NULL) {
319                 DEBUG(0, ("open_rpc_pipe_p: copy_serverinfo failed\n"));
320                 talloc_destroy(p->mem_ctx);
321                 close_policy_by_pipe(p);
322                 TALLOC_FREE(p);
323                 return NULL;
324         }
325
326         DLIST_ADD(InternalPipes, p);
327
328         memcpy(p->client_address, conn->client_address,
329                sizeof(p->client_address));
330
331         p->endian = RPC_LITTLE_ENDIAN;
332
333         ZERO_STRUCT(p->pipe_user);
334
335         p->pipe_user.ut.uid = (uid_t)-1;
336         p->pipe_user.ut.gid = (gid_t)-1;
337         
338         /* Store the session key and NT_TOKEN */
339         if (vuser) {
340                 p->pipe_user.nt_user_token = dup_nt_token(
341                         NULL, vuser->server_info->ptok);
342         }
343
344         /*
345          * Initialize the outgoing RPC data buffer with no memory.
346          */     
347         prs_init_empty(&p->out_data.rdata, p->mem_ctx, MARSHALL);
348         
349         fstrcpy(p->name, pipe_name);
350         
351         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
352                  pipe_name, pipes_open));
353
354         return (void*)p;
355 }
356
357 /****************************************************************************
358  Sets the fault state on incoming packets.
359 ****************************************************************************/
360
361 static void set_incoming_fault(pipes_struct *p)
362 {
363         prs_mem_free(&p->in_data.data);
364         p->in_data.pdu_needed_len = 0;
365         p->in_data.pdu_received_len = 0;
366         p->fault_state = True;
367         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
368                    p->name));
369 }
370
371 /****************************************************************************
372  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
373 ****************************************************************************/
374
375 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
376 {
377         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
378
379         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
380                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
381                         (unsigned int)p->in_data.pdu_received_len ));
382
383         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
384         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
385
386         return (ssize_t)len_needed_to_complete_hdr;
387 }
388
389 /****************************************************************************
390  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
391 ****************************************************************************/
392
393 static ssize_t unmarshall_rpc_header(pipes_struct *p)
394 {
395         /*
396          * Unmarshall the header to determine the needed length.
397          */
398
399         prs_struct rpc_in;
400
401         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
402                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
403                 set_incoming_fault(p);
404                 return -1;
405         }
406
407         prs_init_empty( &rpc_in, p->mem_ctx, UNMARSHALL);
408         prs_set_endian_data( &rpc_in, p->endian);
409
410         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
411                                         p->in_data.pdu_received_len, False);
412
413         /*
414          * Unmarshall the header as this will tell us how much
415          * data we need to read to get the complete pdu.
416          * This also sets the endian flag in rpc_in.
417          */
418
419         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
420                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
421                 set_incoming_fault(p);
422                 prs_mem_free(&rpc_in);
423                 return -1;
424         }
425
426         /*
427          * Validate the RPC header.
428          */
429
430         if(p->hdr.major != 5 && p->hdr.minor != 0) {
431                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
432                 set_incoming_fault(p);
433                 prs_mem_free(&rpc_in);
434                 return -1;
435         }
436
437         /*
438          * If there's not data in the incoming buffer this should be the start of a new RPC.
439          */
440
441         if(prs_offset(&p->in_data.data) == 0) {
442
443                 /*
444                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
445                  */
446
447                 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) {
448                         /*
449                          * Ensure that the FIRST flag is set. If not then we have
450                          * a stream missmatch.
451                          */
452
453                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
454                         set_incoming_fault(p);
455                         prs_mem_free(&rpc_in);
456                         return -1;
457                 }
458
459                 /*
460                  * If this is the first PDU then set the endianness
461                  * flag in the pipe. We will need this when parsing all
462                  * data in this RPC.
463                  */
464
465                 p->endian = rpc_in.bigendian_data;
466
467                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
468                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
469
470         } else {
471
472                 /*
473                  * If this is *NOT* the first PDU then check the endianness
474                  * flag in the pipe is the same as that in the PDU.
475                  */
476
477                 if (p->endian != rpc_in.bigendian_data) {
478                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
479                         set_incoming_fault(p);
480                         prs_mem_free(&rpc_in);
481                         return -1;
482                 }
483         }
484
485         /*
486          * Ensure that the pdu length is sane.
487          */
488
489         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > RPC_MAX_PDU_FRAG_LEN)) {
490                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
491                 set_incoming_fault(p);
492                 prs_mem_free(&rpc_in);
493                 return -1;
494         }
495
496         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
497                         (unsigned int)p->hdr.flags ));
498
499         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
500
501         prs_mem_free(&rpc_in);
502
503         return 0; /* No extra data processed. */
504 }
505
506 /****************************************************************************
507  Call this to free any talloc'ed memory. Do this before and after processing
508  a complete PDU.
509 ****************************************************************************/
510
511 static void free_pipe_context(pipes_struct *p)
512 {
513         if (p->mem_ctx) {
514                 DEBUG(3,("free_pipe_context: destroying talloc pool of size "
515                          "%lu\n", (unsigned long)talloc_total_size(p->mem_ctx) ));
516                 talloc_free_children(p->mem_ctx);
517         } else {
518                 p->mem_ctx = talloc_init("pipe %s %p", p->name, p);
519                 if (p->mem_ctx == NULL) {
520                         p->fault_state = True;
521                 }
522         }
523 }
524
525 /****************************************************************************
526  Processes a request pdu. This will do auth processing if needed, and
527  appends the data into the complete stream if the LAST flag is not set.
528 ****************************************************************************/
529
530 static bool process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
531 {
532         uint32 ss_padding_len = 0;
533         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
534                                 (p->hdr.auth_len ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
535
536         if(!p->pipe_bound) {
537                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
538                 set_incoming_fault(p);
539                 return False;
540         }
541
542         /*
543          * Check if we need to do authentication processing.
544          * This is only done on requests, not binds.
545          */
546
547         /*
548          * Read the RPC request header.
549          */
550
551         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
552                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
553                 set_incoming_fault(p);
554                 return False;
555         }
556
557         switch(p->auth.auth_type) {
558                 case PIPE_AUTH_TYPE_NONE:
559                         break;
560
561                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
562                 case PIPE_AUTH_TYPE_NTLMSSP:
563                 {
564                         NTSTATUS status;
565                         if(!api_pipe_ntlmssp_auth_process(p, rpc_in_p, &ss_padding_len, &status)) {
566                                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
567                                 DEBUG(0,("process_request_pdu: error was %s.\n", nt_errstr(status) ));
568                                 set_incoming_fault(p);
569                                 return False;
570                         }
571                         break;
572                 }
573
574                 case PIPE_AUTH_TYPE_SCHANNEL:
575                         if (!api_pipe_schannel_process(p, rpc_in_p, &ss_padding_len)) {
576                                 DEBUG(3,("process_request_pdu: failed to do schannel processing.\n"));
577                                 set_incoming_fault(p);
578                                 return False;
579                         }
580                         break;
581
582                 default:
583                         DEBUG(0,("process_request_pdu: unknown auth type %u set.\n", (unsigned int)p->auth.auth_type ));
584                         set_incoming_fault(p);
585                         return False;
586         }
587
588         /* Now we've done the sign/seal we can remove any padding data. */
589         if (data_len > ss_padding_len) {
590                 data_len -= ss_padding_len;
591         }
592
593         /*
594          * Check the data length doesn't go over the 15Mb limit.
595          * increased after observing a bug in the Windows NT 4.0 SP6a
596          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
597          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
598          */
599         
600         if(prs_offset(&p->in_data.data) + data_len > 15*1024*1024) {
601                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
602                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
603                 set_incoming_fault(p);
604                 return False;
605         }
606
607         /*
608          * Append the data portion into the buffer and return.
609          */
610
611         if(!prs_append_some_prs_data(&p->in_data.data, rpc_in_p, prs_offset(rpc_in_p), data_len)) {
612                 DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
613                                 (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
614                 set_incoming_fault(p);
615                 return False;
616         }
617
618         if(p->hdr.flags & RPC_FLG_LAST) {
619                 bool ret = False;
620                 /*
621                  * Ok - we finally have a complete RPC stream.
622                  * Call the rpc command to process it.
623                  */
624
625                 /*
626                  * Ensure the internal prs buffer size is *exactly* the same
627                  * size as the current offset.
628                  */
629
630                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data))) {
631                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
632                         set_incoming_fault(p);
633                         return False;
634                 }
635
636                 /*
637                  * Set the parse offset to the start of the data and set the
638                  * prs_struct to UNMARSHALL.
639                  */
640
641                 prs_set_offset(&p->in_data.data, 0);
642                 prs_switch_type(&p->in_data.data, UNMARSHALL);
643
644                 /*
645                  * Process the complete data stream here.
646                  */
647
648                 free_pipe_context(p);
649
650                 if(pipe_init_outgoing_data(p)) {
651                         ret = api_pipe_request(p);
652                 }
653
654                 free_pipe_context(p);
655
656                 /*
657                  * We have consumed the whole data stream. Set back to
658                  * marshalling and set the offset back to the start of
659                  * the buffer to re-use it (we could also do a prs_mem_free()
660                  * and then re_init on the next start of PDU. Not sure which
661                  * is best here.... JRA.
662                  */
663
664                 prs_switch_type(&p->in_data.data, MARSHALL);
665                 prs_set_offset(&p->in_data.data, 0);
666                 return ret;
667         }
668
669         return True;
670 }
671
672 /****************************************************************************
673  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
674  already been parsed and stored in p->hdr.
675 ****************************************************************************/
676
677 static void process_complete_pdu(pipes_struct *p)
678 {
679         prs_struct rpc_in;
680         size_t data_len = p->in_data.pdu_received_len - RPC_HEADER_LEN;
681         char *data_p = (char *)&p->in_data.current_in_pdu[RPC_HEADER_LEN];
682         bool reply = False;
683
684         if(p->fault_state) {
685                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
686                         p->name ));
687                 set_incoming_fault(p);
688                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
689                 return;
690         }
691
692         prs_init_empty( &rpc_in, p->mem_ctx, UNMARSHALL);
693
694         /*
695          * Ensure we're using the corrent endianness for both the 
696          * RPC header flags and the raw data we will be reading from.
697          */
698
699         prs_set_endian_data( &rpc_in, p->endian);
700         prs_set_endian_data( &p->in_data.data, p->endian);
701
702         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
703
704         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
705                         (unsigned int)p->hdr.pkt_type ));
706
707         switch (p->hdr.pkt_type) {
708                 case RPC_REQUEST:
709                         reply = process_request_pdu(p, &rpc_in);
710                         break;
711
712                 case RPC_PING: /* CL request - ignore... */
713                         DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n",
714                                 (unsigned int)p->hdr.pkt_type, p->name));
715                         break;
716
717                 case RPC_RESPONSE: /* No responses here. */
718                         DEBUG(0,("process_complete_pdu: Error. RPC_RESPONSE received from client on pipe %s.\n",
719                                 p->name ));
720                         break;
721
722                 case RPC_FAULT:
723                 case RPC_WORKING: /* CL request - reply to a ping when a call in process. */
724                 case RPC_NOCALL: /* CL - server reply to a ping call. */
725                 case RPC_REJECT:
726                 case RPC_ACK:
727                 case RPC_CL_CANCEL:
728                 case RPC_FACK:
729                 case RPC_CANCEL_ACK:
730                         DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n",
731                                 (unsigned int)p->hdr.pkt_type, p->name));
732                         break;
733
734                 case RPC_BIND:
735                         /*
736                          * We assume that a pipe bind is only in one pdu.
737                          */
738                         if(pipe_init_outgoing_data(p)) {
739                                 reply = api_pipe_bind_req(p, &rpc_in);
740                         }
741                         break;
742
743                 case RPC_BINDACK:
744                 case RPC_BINDNACK:
745                         DEBUG(0,("process_complete_pdu: Error. RPC_BINDACK/RPC_BINDNACK packet type %u received on pipe %s.\n",
746                                 (unsigned int)p->hdr.pkt_type, p->name));
747                         break;
748
749
750                 case RPC_ALTCONT:
751                         /*
752                          * We assume that a pipe bind is only in one pdu.
753                          */
754                         if(pipe_init_outgoing_data(p)) {
755                                 reply = api_pipe_alter_context(p, &rpc_in);
756                         }
757                         break;
758
759                 case RPC_ALTCONTRESP:
760                         DEBUG(0,("process_complete_pdu: Error. RPC_ALTCONTRESP on pipe %s: Should only be server -> client.\n",
761                                 p->name));
762                         break;
763
764                 case RPC_AUTH3:
765                         /*
766                          * The third packet in an NTLMSSP auth exchange.
767                          */
768                         if(pipe_init_outgoing_data(p)) {
769                                 reply = api_pipe_bind_auth3(p, &rpc_in);
770                         }
771                         break;
772
773                 case RPC_SHUTDOWN:
774                         DEBUG(0,("process_complete_pdu: Error. RPC_SHUTDOWN on pipe %s: Should only be server -> client.\n",
775                                 p->name));
776                         break;
777
778                 case RPC_CO_CANCEL:
779                         /* For now just free all client data and continue processing. */
780                         DEBUG(3,("process_complete_pdu: RPC_ORPHANED. Abandoning rpc call.\n"));
781                         /* As we never do asynchronous RPC serving, we can never cancel a
782                            call (as far as I know). If we ever did we'd have to send a cancel_ack
783                            reply. For now, just free all client data and continue processing. */
784                         reply = True;
785                         break;
786 #if 0
787                         /* Enable this if we're doing async rpc. */
788                         /* We must check the call-id matches the outstanding callid. */
789                         if(pipe_init_outgoing_data(p)) {
790                                 /* Send a cancel_ack PDU reply. */
791                                 /* We should probably check the auth-verifier here. */
792                                 reply = setup_cancel_ack_reply(p, &rpc_in);
793                         }
794                         break;
795 #endif
796
797                 case RPC_ORPHANED:
798                         /* We should probably check the auth-verifier here.
799                            For now just free all client data and continue processing. */
800                         DEBUG(3,("process_complete_pdu: RPC_ORPHANED. Abandoning rpc call.\n"));
801                         reply = True;
802                         break;
803
804                 default:
805                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
806                         break;
807         }
808
809         /* Reset to little endian. Probably don't need this but it won't hurt. */
810         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
811
812         if (!reply) {
813                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
814                 set_incoming_fault(p);
815                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
816                 prs_mem_free(&rpc_in);
817         } else {
818                 /*
819                  * Reset the lengths. We're ready for a new pdu.
820                  */
821                 p->in_data.pdu_needed_len = 0;
822                 p->in_data.pdu_received_len = 0;
823         }
824
825         prs_mem_free(&rpc_in);
826 }
827
828 /****************************************************************************
829  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
830 ****************************************************************************/
831
832 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
833 {
834         size_t data_to_copy = MIN(n, RPC_MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
835
836         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
837                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
838                 (unsigned int)n ));
839
840         if(data_to_copy == 0) {
841                 /*
842                  * This is an error - data is being received and there is no
843                  * space in the PDU. Free the received data and go into the fault state.
844                  */
845                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
846 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
847                 set_incoming_fault(p);
848                 return -1;
849         }
850
851         /*
852          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
853          * number of bytes before we can do anything.
854          */
855
856         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
857                 /*
858                  * Always return here. If we have more data then the RPC_HEADER
859                  * will be processed the next time around the loop.
860                  */
861                 return fill_rpc_header(p, data, data_to_copy);
862         }
863
864         /*
865          * At this point we know we have at least an RPC_HEADER_LEN amount of data
866          * stored in current_in_pdu.
867          */
868
869         /*
870          * If pdu_needed_len is zero this is a new pdu. 
871          * Unmarshall the header so we know how much more
872          * data we need, then loop again.
873          */
874
875         if(p->in_data.pdu_needed_len == 0) {
876                 ssize_t rret = unmarshall_rpc_header(p);
877                 if (rret == -1 || p->in_data.pdu_needed_len > 0) {
878                         return rret;
879                 }
880                 /* If rret == 0 and pdu_needed_len == 0 here we have a PDU that consists
881                    of an RPC_HEADER only. This is a RPC_SHUTDOWN, RPC_CO_CANCEL or RPC_ORPHANED
882                    pdu type. Deal with this in process_complete_pdu(). */
883         }
884
885         /*
886          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
887          * Keep reading until we have a full pdu.
888          */
889
890         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
891
892         /*
893          * Copy as much of the data as we need into the current_in_pdu buffer.
894          * pdu_needed_len becomes zero when we have a complete pdu.
895          */
896
897         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
898         p->in_data.pdu_received_len += data_to_copy;
899         p->in_data.pdu_needed_len -= data_to_copy;
900
901         /*
902          * Do we have a complete PDU ?
903          * (return the number of bytes handled in the call)
904          */
905
906         if(p->in_data.pdu_needed_len == 0) {
907                 process_complete_pdu(p);
908                 return data_to_copy;
909         }
910
911         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
912                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
913
914         return (ssize_t)data_to_copy;
915 }
916
917 /****************************************************************************
918  Accepts incoming data on an rpc pipe.
919 ****************************************************************************/
920
921 ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n)
922 {
923         DEBUG(6,("write_to_pipe: %x", p->pnum));
924
925         DEBUG(6,(" name: %s open: %s len: %d\n",
926                  p->name, BOOLSTR(p->open), (int)n));
927
928         dump_data(50, (uint8 *)data, n);
929
930         return p->namedpipe_write(p->np_state, data, n);
931 }
932
933 /****************************************************************************
934  Accepts incoming data on an internal rpc pipe.
935 ****************************************************************************/
936
937 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n)
938 {
939         pipes_struct *p = (pipes_struct*)np_conn;
940         size_t data_left = n;
941
942         while(data_left) {
943                 ssize_t data_used;
944
945                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
946
947                 data_used = process_incoming_data(p, data, data_left);
948
949                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
950
951                 if(data_used < 0) {
952                         return -1;
953                 }
954
955                 data_left -= data_used;
956                 data += data_used;
957         }       
958
959         return n;
960 }
961
962 /****************************************************************************
963  Replies to a request to read data from a pipe.
964
965  Headers are interspersed with the data at PDU intervals. By the time
966  this function is called, the start of the data could possibly have been
967  read by an SMBtrans (file_offset != 0).
968
969  Calling create_rpc_reply() here is a hack. The data should already
970  have been prepared into arrays of headers + data stream sections.
971 ****************************************************************************/
972
973 ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n,
974                 bool *is_data_outstanding)
975 {
976         if (!p || !p->open) {
977                 DEBUG(0,("read_from_pipe: pipe not open\n"));
978                 return -1;              
979         }
980
981         DEBUG(6,("read_from_pipe: %x", p->pnum));
982
983         return p->namedpipe_read(p->np_state, data, n, is_data_outstanding);
984 }
985
986 /****************************************************************************
987  Replies to a request to read data from a pipe.
988
989  Headers are interspersed with the data at PDU intervals. By the time
990  this function is called, the start of the data could possibly have been
991  read by an SMBtrans (file_offset != 0).
992
993  Calling create_rpc_reply() here is a hack. The data should already
994  have been prepared into arrays of headers + data stream sections.
995 ****************************************************************************/
996
997 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
998                 bool *is_data_outstanding)
999 {
1000         pipes_struct *p = (pipes_struct*)np_conn;
1001         uint32 pdu_remaining = 0;
1002         ssize_t data_returned = 0;
1003
1004         if (!p) {
1005                 DEBUG(0,("read_from_pipe: pipe not open\n"));
1006                 return -1;              
1007         }
1008
1009         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
1010
1011         /*
1012          * We cannot return more than one PDU length per
1013          * read request.
1014          */
1015
1016         /*
1017          * This condition should result in the connection being closed.  
1018          * Netapp filers seem to set it to 0xffff which results in domain
1019          * authentications failing.  Just ignore it so things work.
1020          */
1021
1022         if(n > RPC_MAX_PDU_FRAG_LEN) {
1023                 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
1024 pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, RPC_MAX_PDU_FRAG_LEN ));
1025                 n = RPC_MAX_PDU_FRAG_LEN;
1026         }
1027
1028         /*
1029          * Determine if there is still data to send in the
1030          * pipe PDU buffer. Always send this first. Never
1031          * send more than is left in the current PDU. The
1032          * client should send a new read request for a new
1033          * PDU.
1034          */
1035
1036         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
1037                 data_returned = (ssize_t)MIN(n, pdu_remaining);
1038
1039                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
1040 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len, 
1041                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
1042
1043                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
1044                 p->out_data.current_pdu_sent += (uint32)data_returned;
1045                 goto out;
1046         }
1047
1048         /*
1049          * At this point p->current_pdu_len == p->current_pdu_sent (which
1050          * may of course be zero if this is the first return fragment.
1051          */
1052
1053         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
1054 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
1055                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
1056
1057         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
1058                 /*
1059                  * We have sent all possible data, return 0.
1060                  */
1061                 data_returned = 0;
1062                 goto out;
1063         }
1064
1065         /*
1066          * We need to create a new PDU from the data left in p->rdata.
1067          * Create the header/data/footers. This also sets up the fields
1068          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
1069          * and stores the outgoing PDU in p->current_pdu.
1070          */
1071
1072         if(!create_next_pdu(p)) {
1073                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
1074                 return -1;
1075         }
1076
1077         data_returned = MIN(n, p->out_data.current_pdu_len);
1078
1079         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
1080         p->out_data.current_pdu_sent += (uint32)data_returned;
1081
1082   out:
1083
1084         (*is_data_outstanding) = p->out_data.current_pdu_len > n;
1085         return data_returned;
1086 }
1087
1088 /****************************************************************************
1089  Wait device state on a pipe. Exactly what this is for is unknown...
1090 ****************************************************************************/
1091
1092 bool wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority)
1093 {
1094         if (p == NULL) {
1095                 return False;
1096         }
1097
1098         if (p->open) {
1099                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
1100                          priority, p->name));
1101
1102                 p->priority = priority;
1103                 
1104                 return True;
1105         } 
1106
1107         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
1108                  priority, p->name));
1109         return False;
1110 }
1111
1112
1113 /****************************************************************************
1114  Set device state on a pipe. Exactly what this is for is unknown...
1115 ****************************************************************************/
1116
1117 bool set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state)
1118 {
1119         if (p == NULL) {
1120                 return False;
1121         }
1122
1123         if (p->open) {
1124                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1125                          device_state, p->name));
1126
1127                 p->device_state = device_state;
1128                 
1129                 return True;
1130         } 
1131
1132         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1133                  device_state, p->name));
1134         return False;
1135 }
1136
1137
1138 /****************************************************************************
1139  Close an rpc pipe.
1140 ****************************************************************************/
1141
1142 bool close_rpc_pipe_hnd(smb_np_struct *p)
1143 {
1144         if (!p) {
1145                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1146                 return False;
1147         }
1148
1149         p->namedpipe_close(p->np_state);
1150
1151         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
1152
1153         pipes_open--;
1154
1155         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n", 
1156                  p->name, p->pnum, pipes_open));  
1157
1158         DLIST_REMOVE(Pipes, p);
1159         
1160         /* TODO: Remove from pipe open db */
1161         
1162         if ( !delete_pipe_opendb( p ) ) {
1163                 DEBUG(3,("close_rpc_pipe_hnd: failed to delete %s "
1164                         "pipe from open db.\n", p->name));
1165         }
1166
1167         TALLOC_FREE(p);
1168
1169         return True;
1170 }
1171
1172 /****************************************************************************
1173  Close all pipes on a connection.
1174 ****************************************************************************/
1175
1176 void pipe_close_conn(connection_struct *conn)
1177 {
1178         smb_np_struct *p, *next;
1179
1180         for (p=Pipes;p;p=next) {
1181                 next = p->next;
1182                 if (p->conn == conn) {
1183                         close_rpc_pipe_hnd(p);
1184                 }
1185         }
1186 }
1187
1188 /****************************************************************************
1189  Close an rpc pipe.
1190 ****************************************************************************/
1191
1192 static bool close_internal_rpc_pipe_hnd(void *np_conn)
1193 {
1194         pipes_struct *p = (pipes_struct *)np_conn;
1195         if (!p) {
1196                 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1197                 return False;
1198         }
1199
1200         prs_mem_free(&p->out_data.rdata);
1201         prs_mem_free(&p->in_data.data);
1202
1203         if (p->auth.auth_data_free_func) {
1204                 (*p->auth.auth_data_free_func)(&p->auth);
1205         }
1206
1207         if (p->mem_ctx) {
1208                 talloc_destroy(p->mem_ctx);
1209         }
1210
1211         free_pipe_rpc_context( p->contexts );
1212
1213         /* Free the handles database. */
1214         close_policy_by_pipe(p);
1215
1216         TALLOC_FREE(p->pipe_user.nt_user_token);
1217         SAFE_FREE(p->pipe_user.ut.groups);
1218
1219         DLIST_REMOVE(InternalPipes, p);
1220
1221         ZERO_STRUCTP(p);
1222
1223         TALLOC_FREE(p);
1224         
1225         return True;
1226 }
1227
1228 /****************************************************************************
1229  Find an rpc pipe given a pipe handle in a buffer and an offset.
1230 ****************************************************************************/
1231
1232 smb_np_struct *get_rpc_pipe_p(uint16 pnum)
1233 {
1234         if (chain_p) {
1235                 return chain_p;
1236         }
1237
1238         return get_rpc_pipe(pnum);
1239 }
1240
1241 /****************************************************************************
1242  Find an rpc pipe given a pipe handle.
1243 ****************************************************************************/
1244
1245 smb_np_struct *get_rpc_pipe(int pnum)
1246 {
1247         smb_np_struct *p;
1248
1249         DEBUG(4,("search for pipe pnum=%x\n", pnum));
1250
1251         for (p=Pipes;p;p=p->next) {
1252                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n", 
1253                           p->name, p->pnum, pipes_open));  
1254         }
1255
1256         for (p=Pipes;p;p=p->next) {
1257                 if (p->pnum == pnum) {
1258                         chain_p = p;
1259                         return p;
1260                 }
1261         }
1262
1263         return NULL;
1264 }