This commit was manufactured by cvs2svn to create branch 'SAMBA_3_0'.(This used to...
[samba.git] / source3 / rpc_server / srv_pipe_hnd.c
1 /* 
2  *  Unix SMB/CIFS implementation.
3  *  RPC Pipe client / server routines
4  *  Copyright (C) Andrew Tridgell              1992-1998,
5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
6  *  Copyright (C) Jeremy Allison                                    1999.
7  *  
8  *  This program is free software; you can redistribute it and/or modify
9  *  it under the terms of the GNU General Public License as published by
10  *  the Free Software Foundation; either version 2 of the License, or
11  *  (at your option) any later version.
12  *  
13  *  This program is distributed in the hope that it will be useful,
14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  *  GNU General Public License for more details.
17  *  
18  *  You should have received a copy of the GNU General Public License
19  *  along with this program; if not, write to the Free Software
20  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21  */
22
23 #include "includes.h"
24
25 #define PIPE            "\\PIPE\\"
26 #define PIPELEN         strlen(PIPE)
27
28 static smb_np_struct *chain_p;
29 static int pipes_open;
30
31 #ifndef MAX_OPEN_PIPES
32 #define MAX_OPEN_PIPES 2048
33 #endif
34
35 static smb_np_struct *Pipes;
36 static pipes_struct *InternalPipes;
37 static struct bitmap *bmap;
38
39 /* TODO
40  * the following prototypes are declared here to avoid
41  * code being moved about too much for a patch to be
42  * disrupted / less obvious.
43  *
44  * these functions, and associated functions that they
45  * call, should be moved behind a .so module-loading
46  * system _anyway_.  so that's the next step...
47  */
48
49 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
50                 BOOL *is_data_outstanding);
51 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n);
52 static BOOL close_internal_rpc_pipe_hnd(void *np_conn);
53 static void *make_internal_rpc_pipe_p(char *pipe_name, 
54                               connection_struct *conn, uint16 vuid);
55
56 /****************************************************************************
57  Pipe iterator functions.
58 ****************************************************************************/
59
60 smb_np_struct *get_first_pipe(void)
61 {
62         return Pipes;
63 }
64
65 smb_np_struct *get_next_pipe(smb_np_struct *p)
66 {
67         return p->next;
68 }
69
70 /****************************************************************************
71  Internal Pipe iterator functions.
72 ****************************************************************************/
73
74 pipes_struct *get_first_internal_pipe(void)
75 {
76         return InternalPipes;
77 }
78
79 pipes_struct *get_next_internal_pipe(pipes_struct *p)
80 {
81         return p->next;
82 }
83
84 /* this must be larger than the sum of the open files and directories */
85 static int pipe_handle_offset;
86
87 /****************************************************************************
88  Set the pipe_handle_offset. Called from smbd/files.c
89 ****************************************************************************/
90
91 void set_pipe_handle_offset(int max_open_files)
92 {
93   if(max_open_files < 0x7000)
94     pipe_handle_offset = 0x7000;
95   else
96     pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
97 }
98
99 /****************************************************************************
100  Reset pipe chain handle number.
101 ****************************************************************************/
102 void reset_chain_p(void)
103 {
104         chain_p = NULL;
105 }
106
107 /****************************************************************************
108  Initialise pipe handle states.
109 ****************************************************************************/
110
111 void init_rpc_pipe_hnd(void)
112 {
113         bmap = bitmap_allocate(MAX_OPEN_PIPES);
114         if (!bmap)
115                 exit_server("out of memory in init_rpc_pipe_hnd");
116 }
117
118 /****************************************************************************
119  Initialise an outgoing packet.
120 ****************************************************************************/
121
122 static BOOL pipe_init_outgoing_data(pipes_struct *p)
123 {
124         output_data *o_data = &p->out_data;
125
126         /* Reset the offset counters. */
127         o_data->data_sent_length = 0;
128         o_data->current_pdu_len = 0;
129         o_data->current_pdu_sent = 0;
130
131         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
132
133         /* Free any memory in the current return data buffer. */
134         prs_mem_free(&o_data->rdata);
135
136         /*
137          * Initialize the outgoing RPC data buffer.
138          * we will use this as the raw data area for replying to rpc requests.
139          */     
140         if(!prs_init(&o_data->rdata, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
141                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
142                 return False;
143         }
144
145         return True;
146 }
147
148 /****************************************************************************
149  Find first available pipe slot.
150 ****************************************************************************/
151
152 smb_np_struct *open_rpc_pipe_p(char *pipe_name, 
153                               connection_struct *conn, uint16 vuid)
154 {
155         int i;
156         smb_np_struct *p, *p_it;
157         static int next_pipe;
158
159         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
160                  pipe_name, pipes_open));
161
162         
163         /* not repeating pipe numbers makes it easier to track things in 
164            log files and prevents client bugs where pipe numbers are reused
165            over connection restarts */
166         if (next_pipe == 0)
167                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
168
169         i = bitmap_find(bmap, next_pipe);
170
171         if (i == -1) {
172                 DEBUG(0,("ERROR! Out of pipe structures\n"));
173                 return NULL;
174         }
175
176         next_pipe = (i+1) % MAX_OPEN_PIPES;
177
178         for (p = Pipes; p; p = p->next)
179                 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));  
180
181         p = (smb_np_struct *)malloc(sizeof(*p));
182
183         if (!p)
184         {
185                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
186                 return NULL;
187         }
188
189         ZERO_STRUCTP(p);
190
191         /* add a dso mechanism instead of this, here */
192
193         p->namedpipe_create = make_internal_rpc_pipe_p;
194         p->namedpipe_read = read_from_internal_pipe;
195         p->namedpipe_write = write_to_internal_pipe;
196         p->namedpipe_close = close_internal_rpc_pipe_hnd;
197
198         p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
199
200         if (p->np_state == NULL) {
201
202                 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
203                 SAFE_FREE(p);
204                 return NULL;
205         }
206
207
208         DLIST_ADD(Pipes, p);
209
210         /*
211          * Initialize the incoming RPC data buffer with one PDU worth of memory.
212          * We cheat here and say we're marshalling, as we intend to add incoming
213          * data directly into the prs_struct and we want it to auto grow. We will
214          * change the type to UNMARSALLING before processing the stream.
215          */
216
217         bitmap_set(bmap, i);
218         i += pipe_handle_offset;
219
220         pipes_open++;
221
222         p->pnum = i;
223
224         p->open = True;
225         p->device_state = 0;
226         p->priority = 0;
227         p->conn = conn;
228         p->vuid  = vuid;
229
230         p->max_trans_reply = 0;
231         
232         fstrcpy(p->name, pipe_name);
233         
234         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
235                  pipe_name, i, pipes_open));
236         
237         chain_p = p;
238         
239         /* Iterate over p_it as a temp variable, to display all open pipes */ 
240         for (p_it = Pipes; p_it; p_it = p_it->next)
241                 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum));  
242
243         return chain_p;
244 }
245
246 /****************************************************************************
247  * make an internal namedpipes structure
248 ****************************************************************************/
249
250 static void *make_internal_rpc_pipe_p(char *pipe_name, 
251                               connection_struct *conn, uint16 vuid)
252 {
253         pipes_struct *p;
254         user_struct *vuser = get_valid_user_struct(vuid);
255
256         DEBUG(4,("Create pipe requested %s\n", pipe_name));
257
258         if (!vuser && vuid != UID_FIELD_INVALID) {
259                 DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid));
260                 return NULL;
261         }
262
263         p = (pipes_struct *)malloc(sizeof(*p));
264
265         if (!p)
266         {
267                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
268                 return NULL;
269         }
270
271         ZERO_STRUCTP(p);
272
273         if ((p->mem_ctx = talloc_init()) == NULL) {
274                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
275                 SAFE_FREE(p);
276                 return NULL;
277         }
278
279         if (!init_pipe_handle_list(p, pipe_name)) {
280                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
281                 talloc_destroy(p->mem_ctx);
282                 SAFE_FREE(p);
283                 return NULL;
284         }
285
286         /*
287          * Initialize the incoming RPC data buffer with one PDU worth of memory.
288          * We cheat here and say we're marshalling, as we intend to add incoming
289          * data directly into the prs_struct and we want it to auto grow. We will
290          * change the type to UNMARSALLING before processing the stream.
291          */
292
293         if(!prs_init(&p->in_data.data, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
294                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
295                 return NULL;
296         }
297
298         DLIST_ADD(InternalPipes, p);
299
300         p->conn = conn;
301         p->vuid  = vuid;
302
303         p->ntlmssp_chal_flags = 0;
304         p->ntlmssp_auth_validated = False;
305         p->ntlmssp_auth_requested = False;
306
307         p->pipe_bound = False;
308         p->fault_state = False;
309         p->endian = RPC_LITTLE_ENDIAN;
310
311         ZERO_STRUCT(p->pipe_user);
312
313         p->pipe_user.uid = (uid_t)-1;
314         p->pipe_user.gid = (gid_t)-1;
315         
316         /* Store the session key */
317         if (vuser) {
318                 memcpy(p->session_key, vuser->session_key, sizeof(p->session_key));
319         }
320
321         /*
322          * Initialize the incoming RPC struct.
323          */
324
325         p->in_data.pdu_needed_len = 0;
326         p->in_data.pdu_received_len = 0;
327
328         /*
329          * Initialize the outgoing RPC struct.
330          */
331
332         p->out_data.current_pdu_len = 0;
333         p->out_data.current_pdu_sent = 0;
334         p->out_data.data_sent_length = 0;
335
336         /*
337          * Initialize the outgoing RPC data buffer with no memory.
338          */     
339         prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL);
340         
341         fstrcpy(p->name, pipe_name);
342         
343         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
344                  pipe_name, pipes_open));
345
346         return (void*)p;
347 }
348
349 /****************************************************************************
350  Sets the fault state on incoming packets.
351 ****************************************************************************/
352
353 static void set_incoming_fault(pipes_struct *p)
354 {
355         prs_mem_free(&p->in_data.data);
356         p->in_data.pdu_needed_len = 0;
357         p->in_data.pdu_received_len = 0;
358         p->fault_state = True;
359         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n",
360                 p->name, p->vuid ));
361 }
362
363 /****************************************************************************
364  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
365 ****************************************************************************/
366
367 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
368 {
369         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
370
371         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
372                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
373                         (unsigned int)p->in_data.pdu_received_len ));
374
375         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
376         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
377
378         return (ssize_t)len_needed_to_complete_hdr;
379 }
380
381 /****************************************************************************
382  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
383 ****************************************************************************/
384
385 static ssize_t unmarshall_rpc_header(pipes_struct *p)
386 {
387         /*
388          * Unmarshall the header to determine the needed length.
389          */
390
391         prs_struct rpc_in;
392
393         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
394                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
395                 set_incoming_fault(p);
396                 return -1;
397         }
398
399         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
400         prs_set_endian_data( &rpc_in, p->endian);
401
402         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
403                                         p->in_data.pdu_received_len, False);
404
405         /*
406          * Unmarshall the header as this will tell us how much
407          * data we need to read to get the complete pdu.
408          * This also sets the endian flag in rpc_in.
409          */
410
411         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
412                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
413                 set_incoming_fault(p);
414                 prs_mem_free(&rpc_in);
415                 return -1;
416         }
417
418         /*
419          * Validate the RPC header.
420          */
421
422         if(p->hdr.major != 5 && p->hdr.minor != 0) {
423                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
424                 set_incoming_fault(p);
425                 prs_mem_free(&rpc_in);
426                 return -1;
427         }
428
429         /*
430          * If there's not data in the incoming buffer this should be the start of a new RPC.
431          */
432
433         if(prs_offset(&p->in_data.data) == 0) {
434
435                 /*
436                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
437                  */
438
439                 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) {
440                         /*
441                          * Ensure that the FIRST flag is set. If not then we have
442                          * a stream missmatch.
443                          */
444
445                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
446                         set_incoming_fault(p);
447                         prs_mem_free(&rpc_in);
448                         return -1;
449                 }
450
451                 /*
452                  * If this is the first PDU then set the endianness
453                  * flag in the pipe. We will need this when parsing all
454                  * data in this RPC.
455                  */
456
457                 p->endian = rpc_in.bigendian_data;
458
459                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
460                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
461
462         } else {
463
464                 /*
465                  * If this is *NOT* the first PDU then check the endianness
466                  * flag in the pipe is the same as that in the PDU.
467                  */
468
469                 if (p->endian != rpc_in.bigendian_data) {
470                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
471                         set_incoming_fault(p);
472                         prs_mem_free(&rpc_in);
473                         return -1;
474                 }
475         }
476
477         /*
478          * Ensure that the pdu length is sane.
479          */
480
481         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > MAX_PDU_FRAG_LEN)) {
482                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
483                 set_incoming_fault(p);
484                 prs_mem_free(&rpc_in);
485                 return -1;
486         }
487
488         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
489                         (unsigned int)p->hdr.flags ));
490
491         /*
492          * Adjust for the header we just ate.
493          */
494         p->in_data.pdu_received_len = 0;
495         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
496
497         /*
498          * Null the data we just ate.
499          */
500
501         memset((char *)&p->in_data.current_in_pdu[0], '\0', RPC_HEADER_LEN);
502
503         prs_mem_free(&rpc_in);
504
505         return 0; /* No extra data processed. */
506 }
507
508 /****************************************************************************
509  Call this to free any talloc'ed memory. Do this before and after processing
510  a complete PDU.
511 ****************************************************************************/
512
513 void free_pipe_context(pipes_struct *p)
514 {
515         if (p->mem_ctx) {
516                 DEBUG(3,("free_pipe_context: destroying talloc pool of size %u\n", talloc_pool_size(p->mem_ctx) ));
517                 talloc_destroy_pool(p->mem_ctx);
518         } else {
519                 p->mem_ctx = talloc_init();
520                 if (p->mem_ctx == NULL)
521                         p->fault_state = True;
522         }
523 }
524
525 /****************************************************************************
526  Processes a request pdu. This will do auth processing if needed, and
527  appends the data into the complete stream if the LAST flag is not set.
528 ****************************************************************************/
529
530 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
531 {
532         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
533         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
534                                 (auth_verify ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
535
536         if(!p->pipe_bound) {
537                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
538                 set_incoming_fault(p);
539                 return False;
540         }
541
542         /*
543          * Check if we need to do authentication processing.
544          * This is only done on requests, not binds.
545          */
546
547         /*
548          * Read the RPC request header.
549          */
550
551         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
552                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
553                 set_incoming_fault(p);
554                 return False;
555         }
556
557         if(p->ntlmssp_auth_validated && !api_pipe_auth_process(p, rpc_in_p)) {
558                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
559                 set_incoming_fault(p);
560                 return False;
561         }
562
563         if (p->ntlmssp_auth_requested && !p->ntlmssp_auth_validated) {
564
565                 /*
566                  * Authentication _was_ requested and it already failed.
567                  */
568
569                 DEBUG(0,("process_request_pdu: RPC request received on pipe %s where \
570 authentication failed. Denying the request.\n", p->name));
571                 set_incoming_fault(p);
572         return False;
573     }
574
575         /*
576          * Check the data length doesn't go over the 15Mb limit.
577          * increased after observing a bug in the Windows NT 4.0 SP6a
578          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
579          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
580          */
581         
582         if(prs_offset(&p->in_data.data) + data_len > 15*1024*1024) {
583                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
584                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
585                 set_incoming_fault(p);
586                 return False;
587         }
588
589         /*
590          * Append the data portion into the buffer and return.
591          */
592
593         {
594                 char *data_from = prs_data_p(rpc_in_p) + prs_offset(rpc_in_p);
595
596                 if(!prs_append_data(&p->in_data.data, data_from, data_len)) {
597                         DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
598                                         (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
599                         set_incoming_fault(p);
600                         return False;
601                 }
602
603         }
604
605         if(p->hdr.flags & RPC_FLG_LAST) {
606                 BOOL ret = False;
607                 /*
608                  * Ok - we finally have a complete RPC stream.
609                  * Call the rpc command to process it.
610                  */
611
612                 /*
613                  * Ensure the internal prs buffer size is *exactly* the same
614                  * size as the current offset.
615                  */
616
617                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data)))
618                 {
619                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
620                         set_incoming_fault(p);
621                         return False;
622                 }
623
624                 /*
625                  * Set the parse offset to the start of the data and set the
626                  * prs_struct to UNMARSHALL.
627                  */
628
629                 prs_set_offset(&p->in_data.data, 0);
630                 prs_switch_type(&p->in_data.data, UNMARSHALL);
631
632                 /*
633                  * Process the complete data stream here.
634                  */
635
636                 free_pipe_context(p);
637
638                 if(pipe_init_outgoing_data(p))
639                         ret = api_pipe_request(p);
640
641                 free_pipe_context(p);
642
643                 /*
644                  * We have consumed the whole data stream. Set back to
645                  * marshalling and set the offset back to the start of
646                  * the buffer to re-use it (we could also do a prs_mem_free()
647                  * and then re_init on the next start of PDU. Not sure which
648                  * is best here.... JRA.
649                  */
650
651                 prs_switch_type(&p->in_data.data, MARSHALL);
652                 prs_set_offset(&p->in_data.data, 0);
653                 return ret;
654         }
655
656         return True;
657 }
658
659 /****************************************************************************
660  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
661  already been parsed and stored in p->hdr.
662 ****************************************************************************/
663
664 static ssize_t process_complete_pdu(pipes_struct *p)
665 {
666         prs_struct rpc_in;
667         size_t data_len = p->in_data.pdu_received_len;
668         char *data_p = (char *)&p->in_data.current_in_pdu[0];
669         BOOL reply = False;
670
671         if(p->fault_state) {
672                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
673                         p->name ));
674                 set_incoming_fault(p);
675                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
676                 return (ssize_t)data_len;
677         }
678
679         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
680
681         /*
682          * Ensure we're using the corrent endianness for both the 
683          * RPC header flags and the raw data we will be reading from.
684          */
685
686         prs_set_endian_data( &rpc_in, p->endian);
687         prs_set_endian_data( &p->in_data.data, p->endian);
688
689         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
690
691         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
692                         (unsigned int)p->hdr.pkt_type ));
693
694         switch (p->hdr.pkt_type) {
695                 case RPC_BIND:
696                 case RPC_ALTCONT:
697                         /*
698                          * We assume that a pipe bind is only in one pdu.
699                          */
700                         if(pipe_init_outgoing_data(p))
701                                 reply = api_pipe_bind_req(p, &rpc_in);
702                         break;
703                 case RPC_BINDRESP:
704                         /*
705                          * We assume that a pipe bind_resp is only in one pdu.
706                          */
707                         if(pipe_init_outgoing_data(p))
708                                 reply = api_pipe_bind_auth_resp(p, &rpc_in);
709                         break;
710                 case RPC_REQUEST:
711                         reply = process_request_pdu(p, &rpc_in);
712                         break;
713                 default:
714                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
715                         break;
716         }
717
718         /* Reset to little endian. Probably don't need this but it won't hurt. */
719         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
720
721         if (!reply) {
722                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
723                 set_incoming_fault(p);
724                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
725                 prs_mem_free(&rpc_in);
726         } else {
727                 /*
728                  * Reset the lengths. We're ready for a new pdu.
729                  */
730                 p->in_data.pdu_needed_len = 0;
731                 p->in_data.pdu_received_len = 0;
732         }
733
734         prs_mem_free(&rpc_in);
735         return (ssize_t)data_len;
736 }
737
738 /****************************************************************************
739  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
740 ****************************************************************************/
741
742 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
743 {
744         size_t data_to_copy = MIN(n, MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
745
746         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
747                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
748                 (unsigned int)n ));
749
750         if(data_to_copy == 0) {
751                 /*
752                  * This is an error - data is being received and there is no
753                  * space in the PDU. Free the received data and go into the fault state.
754                  */
755                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
756 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
757                 set_incoming_fault(p);
758                 return -1;
759         }
760
761         /*
762          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
763          * number of bytes before we can do anything.
764          */
765
766         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
767                 /*
768                  * Always return here. If we have more data then the RPC_HEADER
769                  * will be processed the next time around the loop.
770                  */
771                 return fill_rpc_header(p, data, data_to_copy);
772         }
773
774         /*
775          * At this point we know we have at least an RPC_HEADER_LEN amount of data
776          * stored in current_in_pdu.
777          */
778
779         /*
780          * If pdu_needed_len is zero this is a new pdu. 
781          * Unmarshall the header so we know how much more
782          * data we need, then loop again.
783          */
784
785         if(p->in_data.pdu_needed_len == 0)
786                 return unmarshall_rpc_header(p);
787
788         /*
789          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
790          * Keep reading until we have a full pdu.
791          */
792
793         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
794
795         /*
796          * Copy as much of the data as we need into the current_in_pdu buffer.
797          */
798
799         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
800         p->in_data.pdu_received_len += data_to_copy;
801
802         /*
803          * Do we have a complete PDU ?
804          */
805
806         if(p->in_data.pdu_received_len == p->in_data.pdu_needed_len)
807                 return process_complete_pdu(p);
808
809         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
810                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
811
812         return (ssize_t)data_to_copy;
813
814 }
815
816 /****************************************************************************
817  Accepts incoming data on an rpc pipe.
818 ****************************************************************************/
819
820 ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n)
821 {
822         DEBUG(6,("write_to_pipe: %x", p->pnum));
823
824         DEBUG(6,(" name: %s open: %s len: %d\n",
825                  p->name, BOOLSTR(p->open), (int)n));
826
827         dump_data(50, data, n);
828
829         return p->namedpipe_write(p->np_state, data, n);
830 }
831
832 /****************************************************************************
833  Accepts incoming data on an internal rpc pipe.
834 ****************************************************************************/
835
836 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n)
837 {
838         pipes_struct *p = (pipes_struct*)np_conn;
839         size_t data_left = n;
840
841         while(data_left) {
842                 ssize_t data_used;
843
844                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
845
846                 data_used = process_incoming_data(p, data, data_left);
847
848                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
849
850                 if(data_used < 0)
851                         return -1;
852
853                 data_left -= data_used;
854                 data += data_used;
855         }       
856
857         return n;
858 }
859
860 /****************************************************************************
861  Replies to a request to read data from a pipe.
862
863  Headers are interspersed with the data at PDU intervals. By the time
864  this function is called, the start of the data could possibly have been
865  read by an SMBtrans (file_offset != 0).
866
867  Calling create_rpc_reply() here is a hack. The data should already
868  have been prepared into arrays of headers + data stream sections.
869 ****************************************************************************/
870
871 ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n,
872                 BOOL *is_data_outstanding)
873 {
874         if (!p || !p->open) {
875                 DEBUG(0,("read_from_pipe: pipe not open\n"));
876                 return -1;              
877         }
878
879         DEBUG(6,("read_from_pipe: %x", p->pnum));
880
881         return p->namedpipe_read(p->np_state, data, n, is_data_outstanding);
882 }
883
884 /****************************************************************************
885  Replies to a request to read data from a pipe.
886
887  Headers are interspersed with the data at PDU intervals. By the time
888  this function is called, the start of the data could possibly have been
889  read by an SMBtrans (file_offset != 0).
890
891  Calling create_rpc_reply() here is a hack. The data should already
892  have been prepared into arrays of headers + data stream sections.
893 ****************************************************************************/
894
895 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
896                 BOOL *is_data_outstanding)
897 {
898         pipes_struct *p = (pipes_struct*)np_conn;
899         uint32 pdu_remaining = 0;
900         ssize_t data_returned = 0;
901
902         if (!p) {
903                 DEBUG(0,("read_from_pipe: pipe not open\n"));
904                 return -1;              
905         }
906
907         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
908
909         /*
910          * We cannot return more than one PDU length per
911          * read request.
912          */
913
914         /*
915          * This condition should result in the connection being closed.  
916          * Netapp filers seem to set it to 0xffff which results in domain
917          * authentications failing.  Just ignore it so things work.
918          */
919
920         if(n > MAX_PDU_FRAG_LEN) {
921                 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
922 pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, MAX_PDU_FRAG_LEN ));
923         }
924
925         /*
926          * Determine if there is still data to send in the
927          * pipe PDU buffer. Always send this first. Never
928          * send more than is left in the current PDU. The
929          * client should send a new read request for a new
930          * PDU.
931          */
932
933         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
934                 data_returned = (ssize_t)MIN(n, pdu_remaining);
935
936                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
937 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len, 
938                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
939
940                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
941                 p->out_data.current_pdu_sent += (uint32)data_returned;
942                 goto out;
943         }
944
945         /*
946          * At this point p->current_pdu_len == p->current_pdu_sent (which
947          * may of course be zero if this is the first return fragment.
948          */
949
950         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
951 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
952                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
953
954         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
955                 /*
956                  * We have sent all possible data, return 0.
957                  */
958                 data_returned = 0;
959                 goto out;
960         }
961
962         /*
963          * We need to create a new PDU from the data left in p->rdata.
964          * Create the header/data/footers. This also sets up the fields
965          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
966          * and stores the outgoing PDU in p->current_pdu.
967          */
968
969         if(!create_next_pdu(p)) {
970                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
971                 return -1;
972         }
973
974         data_returned = MIN(n, p->out_data.current_pdu_len);
975
976         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
977         p->out_data.current_pdu_sent += (uint32)data_returned;
978
979   out:
980
981         (*is_data_outstanding) = p->out_data.current_pdu_len > n;
982         return data_returned;
983 }
984
985 /****************************************************************************
986  Wait device state on a pipe. Exactly what this is for is unknown...
987 ****************************************************************************/
988
989 BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority)
990 {
991         if (p == NULL)
992                 return False;
993
994         if (p->open) {
995                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
996                          priority, p->name));
997
998                 p->priority = priority;
999                 
1000                 return True;
1001         } 
1002
1003         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
1004                  priority, p->name));
1005         return False;
1006 }
1007
1008
1009 /****************************************************************************
1010  Set device state on a pipe. Exactly what this is for is unknown...
1011 ****************************************************************************/
1012
1013 BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state)
1014 {
1015         if (p == NULL)
1016                 return False;
1017
1018         if (p->open) {
1019                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1020                          device_state, p->name));
1021
1022                 p->device_state = device_state;
1023                 
1024                 return True;
1025         } 
1026
1027         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1028                  device_state, p->name));
1029         return False;
1030 }
1031
1032
1033 /****************************************************************************
1034  Close an rpc pipe.
1035 ****************************************************************************/
1036
1037 BOOL close_rpc_pipe_hnd(smb_np_struct *p)
1038 {
1039         if (!p) {
1040                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1041                 return False;
1042         }
1043
1044         p->namedpipe_close(p->np_state);
1045
1046         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
1047
1048         pipes_open--;
1049
1050         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n", 
1051                  p->name, p->pnum, pipes_open));  
1052
1053         DLIST_REMOVE(Pipes, p);
1054
1055         ZERO_STRUCTP(p);
1056
1057         SAFE_FREE(p);
1058         
1059         return True;
1060 }
1061
1062 /****************************************************************************
1063  Close an rpc pipe.
1064 ****************************************************************************/
1065
1066 static BOOL close_internal_rpc_pipe_hnd(void *np_conn)
1067 {
1068         pipes_struct *p = (pipes_struct *)np_conn;
1069         if (!p) {
1070                 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1071                 return False;
1072         }
1073
1074         prs_mem_free(&p->out_data.rdata);
1075         prs_mem_free(&p->in_data.data);
1076
1077         if (p->mem_ctx)
1078                 talloc_destroy(p->mem_ctx);
1079
1080         /* Free the handles database. */
1081         close_policy_by_pipe(p);
1082
1083         delete_nt_token(&p->pipe_user.nt_user_token);
1084         SAFE_FREE(p->pipe_user.groups);
1085
1086         DLIST_REMOVE(InternalPipes, p);
1087
1088         ZERO_STRUCTP(p);
1089
1090         SAFE_FREE(p);
1091         
1092         return True;
1093 }
1094
1095 /****************************************************************************
1096  Find an rpc pipe given a pipe handle in a buffer and an offset.
1097 ****************************************************************************/
1098
1099 smb_np_struct *get_rpc_pipe_p(char *buf, int where)
1100 {
1101         int pnum = SVAL(buf,where);
1102
1103         if (chain_p)
1104                 return chain_p;
1105
1106         return get_rpc_pipe(pnum);
1107 }
1108
1109 /****************************************************************************
1110  Find an rpc pipe given a pipe handle.
1111 ****************************************************************************/
1112
1113 smb_np_struct *get_rpc_pipe(int pnum)
1114 {
1115         smb_np_struct *p;
1116
1117         DEBUG(4,("search for pipe pnum=%x\n", pnum));
1118
1119         for (p=Pipes;p;p=p->next)
1120                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n", 
1121                           p->name, p->pnum, pipes_open));  
1122
1123         for (p=Pipes;p;p=p->next) {
1124                 if (p->pnum == pnum) {
1125                         chain_p = p;
1126                         return p;
1127                 }
1128         }
1129
1130         return NULL;
1131 }