source3/rpc_server/srv_pipe_hnd.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Largely re-written : 2005
   6  *  Copyright (C) Jeremy Allison                1998 - 2005
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "../librpc/gen_ndr/srv_spoolss.h"
  24 #include "librpc/gen_ndr/ndr_named_pipe_auth.h"
  25 #include "../libcli/named_pipe_auth/npa_tstream.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_RPC_SRV
  29
  30 static int pipes_open;
  31
  32 static pipes_struct *InternalPipes;
  33
  34 /* TODO
  35  * the following prototypes are declared here to avoid
  36  * code being moved about too much for a patch to be
  37  * disrupted / less obvious.
  38  *
  39  * these functions, and associated functions that they
  40  * call, should be moved behind a .so module-loading
  41  * system _anyway_.  so that's the next step...
  42  */
  43
  44 static int close_internal_rpc_pipe_hnd(struct pipes_struct *p);
  45
  46 /****************************************************************************
  47  Internal Pipe iterator functions.
  48 ****************************************************************************/
  49
  50 pipes_struct *get_first_internal_pipe(void)
  51 {
  52         return InternalPipes;
  53 }
  54
  55 pipes_struct *get_next_internal_pipe(pipes_struct *p)
  56 {
  57         return p->next;
  58 }
  59
  60 /****************************************************************************
  61  Initialise an outgoing packet.
  62 ****************************************************************************/
  63
  64 static bool pipe_init_outgoing_data(pipes_struct *p)
  65 {
  66         output_data *o_data = &p->out_data;
  67
  68         /* Reset the offset counters. */
  69         o_data->data_sent_length = 0;
  70         o_data->current_pdu_sent = 0;
  71
  72         prs_mem_free(&o_data->frag);
  73
  74         /* Free any memory in the current return data buffer. */
  75         prs_mem_free(&o_data->rdata);
  76
  77         /*
  78          * Initialize the outgoing RPC data buffer.
  79          * we will use this as the raw data area for replying to rpc requests.
  80          */
  81         if(!prs_init(&o_data->rdata, 128, p->mem_ctx, MARSHALL)) {
  82                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
  83                 return False;
  84         }
  85
  86         return True;
  87 }
  88
  89 /****************************************************************************
  90  Make an internal namedpipes structure
  91 ****************************************************************************/
  92
  93 static struct pipes_struct *make_internal_rpc_pipe_p(TALLOC_CTX *mem_ctx,
  94                                                      const struct ndr_syntax_id *syntax,
  95                                                      const char *client_address,
  96                                                      struct auth_serversupplied_info *server_info)
  97 {
  98         pipes_struct *p;
  99
 100         DEBUG(4,("Create pipe requested %s\n",
 101                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
 102
 103         p = TALLOC_ZERO_P(mem_ctx, struct pipes_struct);
 104
 105         if (!p) {
 106                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 107                 return NULL;
 108         }
 109
 110         p->mem_ctx = talloc_named(p, 0, "pipe %s %p",
 111                                  get_pipe_name_from_syntax(talloc_tos(),
 112                                                            syntax), p);
 113         if (p->mem_ctx == NULL) {
 114                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
 115                 TALLOC_FREE(p);
 116                 return NULL;
 117         }
 118
 119         if (!init_pipe_handle_list(p, syntax)) {
 120                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
 121                 TALLOC_FREE(p);
 122                 return NULL;
 123         }
 124
 125         /*
 126          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 127          * We cheat here and say we're marshalling, as we intend to add incoming
 128          * data directly into the prs_struct and we want it to auto grow. We will
 129          * change the type to UNMARSALLING before processing the stream.
 130          */
 131
 132         if(!prs_init(&p->in_data.data, 128, p->mem_ctx, MARSHALL)) {
 133                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
 134                 close_policy_by_pipe(p);
 135                 TALLOC_FREE(p);
 136                 return NULL;
 137         }
 138
 139         p->server_info = copy_serverinfo(p, server_info);
 140         if (p->server_info == NULL) {
 141                 DEBUG(0, ("open_rpc_pipe_p: copy_serverinfo failed\n"));
 142                 close_policy_by_pipe(p);
 143                 TALLOC_FREE(p);
 144                 return NULL;
 145         }
 146
 147         DLIST_ADD(InternalPipes, p);
 148
 149         memcpy(p->client_address, client_address, sizeof(p->client_address));
 150
 151         p->endian = RPC_LITTLE_ENDIAN;
 152
 153         /*
 154          * Initialize the outgoing RPC data buffer with no memory.
 155          */
 156         prs_init_empty(&p->out_data.rdata, p->mem_ctx, MARSHALL);
 157
 158         p->syntax = *syntax;
 159
 160         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
 161                  get_pipe_name_from_syntax(talloc_tos(), syntax), pipes_open));
 162
 163         talloc_set_destructor(p, close_internal_rpc_pipe_hnd);
 164
 165         return p;
 166 }
 167
 168 /****************************************************************************
 169  Sets the fault state on incoming packets.
 170 ****************************************************************************/
 171
 172 static void set_incoming_fault(pipes_struct *p)
 173 {
 174         prs_mem_free(&p->in_data.data);
 175         p->in_data.pdu_needed_len = 0;
 176         p->in_data.pdu_received_len = 0;
 177         p->fault_state = True;
 178         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
 179                    get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 180 }
 181
 182 /****************************************************************************
 183  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
 184 ****************************************************************************/
 185
 186 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
 187 {
 188         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
 189
 190         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
 191                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
 192                         (unsigned int)p->in_data.pdu_received_len ));
 193
 194         if (p->in_data.current_in_pdu == NULL) {
 195                 p->in_data.current_in_pdu = talloc_array(p, uint8_t,
 196                                                          RPC_HEADER_LEN);
 197         }
 198         if (p->in_data.current_in_pdu == NULL) {
 199                 DEBUG(0, ("talloc failed\n"));
 200                 return -1;
 201         }
 202
 203         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
 204         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
 205
 206         return (ssize_t)len_needed_to_complete_hdr;
 207 }
 208
 209 /****************************************************************************
 210  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
 211 ****************************************************************************/
 212
 213 static ssize_t unmarshall_rpc_header(pipes_struct *p)
 214 {
 215         /*
 216          * Unmarshall the header to determine the needed length.
 217          */
 218
 219         prs_struct rpc_in;
 220
 221         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
 222                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
 223                 set_incoming_fault(p);
 224                 return -1;
 225         }
 226
 227         prs_init_empty( &rpc_in, p->mem_ctx, UNMARSHALL);
 228         prs_set_endian_data( &rpc_in, p->endian);
 229
 230         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
 231                                         p->in_data.pdu_received_len, False);
 232
 233         /*
 234          * Unmarshall the header as this will tell us how much
 235          * data we need to read to get the complete pdu.
 236          * This also sets the endian flag in rpc_in.
 237          */
 238
 239         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
 240                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
 241                 set_incoming_fault(p);
 242                 prs_mem_free(&rpc_in);
 243                 return -1;
 244         }
 245
 246         /*
 247          * Validate the RPC header.
 248          */
 249
 250         if(p->hdr.major != 5 && p->hdr.minor != 0) {
 251                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
 252                 set_incoming_fault(p);
 253                 prs_mem_free(&rpc_in);
 254                 return -1;
 255         }
 256
 257         /*
 258          * If there's not data in the incoming buffer this should be the start of a new RPC.
 259          */
 260
 261         if(prs_offset(&p->in_data.data) == 0) {
 262
 263                 /*
 264                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
 265                  */
 266
 267                 if ((p->hdr.pkt_type == DCERPC_PKT_REQUEST) && !(p->hdr.flags & DCERPC_PFC_FLAG_FIRST)) {
 268                         /*
 269                          * Ensure that the FIRST flag is set. If not then we have
 270                          * a stream missmatch.
 271                          */
 272
 273                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
 274                         set_incoming_fault(p);
 275                         prs_mem_free(&rpc_in);
 276                         return -1;
 277                 }
 278
 279                 /*
 280                  * If this is the first PDU then set the endianness
 281                  * flag in the pipe. We will need this when parsing all
 282                  * data in this RPC.
 283                  */
 284
 285                 p->endian = rpc_in.bigendian_data;
 286
 287                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
 288                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
 289
 290         } else {
 291
 292                 /*
 293                  * If this is *NOT* the first PDU then check the endianness
 294                  * flag in the pipe is the same as that in the PDU.
 295                  */
 296
 297                 if (p->endian != rpc_in.bigendian_data) {
 298                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
 299                         set_incoming_fault(p);
 300                         prs_mem_free(&rpc_in);
 301                         return -1;
 302                 }
 303         }
 304
 305         /*
 306          * Ensure that the pdu length is sane.
 307          */
 308
 309         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > RPC_MAX_PDU_FRAG_LEN)) {
 310                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
 311                 set_incoming_fault(p);
 312                 prs_mem_free(&rpc_in);
 313                 return -1;
 314         }
 315
 316         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
 317                         (unsigned int)p->hdr.flags ));
 318
 319         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
 320
 321         prs_mem_free(&rpc_in);
 322
 323         p->in_data.current_in_pdu = TALLOC_REALLOC_ARRAY(
 324                 p, p->in_data.current_in_pdu, uint8_t, p->hdr.frag_len);
 325         if (p->in_data.current_in_pdu == NULL) {
 326                 DEBUG(0, ("talloc failed\n"));
 327                 set_incoming_fault(p);
 328                 return -1;
 329         }
 330
 331         return 0; /* No extra data processed. */
 332 }
 333
 334 /****************************************************************************
 335  Call this to free any talloc'ed memory. Do this before and after processing
 336  a complete PDU.
 337 ****************************************************************************/
 338
 339 static void free_pipe_context(pipes_struct *p)
 340 {
 341         if (p->mem_ctx) {
 342                 DEBUG(3,("free_pipe_context: destroying talloc pool of size "
 343                          "%lu\n", (unsigned long)talloc_total_size(p->mem_ctx) ));
 344                 talloc_free_children(p->mem_ctx);
 345         } else {
 346                 p->mem_ctx = talloc_named(p, 0, "pipe %s %p",
 347                                     get_pipe_name_from_syntax(talloc_tos(),
 348                                                               &p->syntax), p);
 349                 if (p->mem_ctx == NULL) {
 350                         p->fault_state = True;
 351                 }
 352         }
 353 }
 354
 355 /****************************************************************************
 356  Processes a request pdu. This will do auth processing if needed, and
 357  appends the data into the complete stream if the LAST flag is not set.
 358 ****************************************************************************/
 359
 360 static bool process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 361 {
 362         uint32 ss_padding_len = 0;
 363         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 364                                 (p->hdr.auth_len ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 365
 366         if(!p->pipe_bound) {
 367                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
 368                 set_incoming_fault(p);
 369                 return False;
 370         }
 371
 372         /*
 373          * Check if we need to do authentication processing.
 374          * This is only done on requests, not binds.
 375          */
 376
 377         /*
 378          * Read the RPC request header.
 379          */
 380
 381         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
 382                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
 383                 set_incoming_fault(p);
 384                 return False;
 385         }
 386
 387         switch(p->auth.auth_type) {
 388                 case PIPE_AUTH_TYPE_NONE:
 389                         break;
 390
 391                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 392                 case PIPE_AUTH_TYPE_NTLMSSP:
 393                 {
 394                         NTSTATUS status;
 395                         if(!api_pipe_ntlmssp_auth_process(p, rpc_in_p, &ss_padding_len, &status)) {
 396                                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
 397                                 DEBUG(0,("process_request_pdu: error was %s.\n", nt_errstr(status) ));
 398                                 set_incoming_fault(p);
 399                                 return False;
 400                         }
 401                         break;
 402                 }
 403
 404                 case PIPE_AUTH_TYPE_SCHANNEL:
 405                         if (!api_pipe_schannel_process(p, rpc_in_p, &ss_padding_len)) {
 406                                 DEBUG(3,("process_request_pdu: failed to do schannel processing.\n"));
 407                                 set_incoming_fault(p);
 408                                 return False;
 409                         }
 410                         break;
 411
 412                 default:
 413                         DEBUG(0,("process_request_pdu: unknown auth type %u set.\n", (unsigned int)p->auth.auth_type ));
 414                         set_incoming_fault(p);
 415                         return False;
 416         }
 417
 418         /* Now we've done the sign/seal we can remove any padding data. */
 419         if (data_len > ss_padding_len) {
 420                 data_len -= ss_padding_len;
 421         }
 422
 423         /*
 424          * Check the data length doesn't go over the 15Mb limit.
 425          * increased after observing a bug in the Windows NT 4.0 SP6a
 426          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
 427          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
 428          */
 429
 430         if(prs_offset(&p->in_data.data) + data_len > MAX_RPC_DATA_SIZE) {
 431                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
 432                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
 433                 set_incoming_fault(p);
 434                 return False;
 435         }
 436
 437         /*
 438          * Append the data portion into the buffer and return.
 439          */
 440
 441         if(!prs_append_some_prs_data(&p->in_data.data, rpc_in_p, prs_offset(rpc_in_p), data_len)) {
 442                 DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
 443                                 (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
 444                 set_incoming_fault(p);
 445                 return False;
 446         }
 447
 448         if(p->hdr.flags & DCERPC_PFC_FLAG_LAST) {
 449                 bool ret = False;
 450                 /*
 451                  * Ok - we finally have a complete RPC stream.
 452                  * Call the rpc command to process it.
 453                  */
 454
 455                 /*
 456                  * Ensure the internal prs buffer size is *exactly* the same
 457                  * size as the current offset.
 458                  */
 459
 460                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data))) {
 461                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
 462                         set_incoming_fault(p);
 463                         return False;
 464                 }
 465
 466                 /*
 467                  * Set the parse offset to the start of the data and set the
 468                  * prs_struct to UNMARSHALL.
 469                  */
 470
 471                 prs_set_offset(&p->in_data.data, 0);
 472                 prs_switch_type(&p->in_data.data, UNMARSHALL);
 473
 474                 /*
 475                  * Process the complete data stream here.
 476                  */
 477
 478                 free_pipe_context(p);
 479
 480                 if(pipe_init_outgoing_data(p)) {
 481                         ret = api_pipe_request(p);
 482                 }
 483
 484                 free_pipe_context(p);
 485
 486                 /*
 487                  * We have consumed the whole data stream. Set back to
 488                  * marshalling and set the offset back to the start of
 489                  * the buffer to re-use it (we could also do a prs_mem_free()
 490                  * and then re_init on the next start of PDU. Not sure which
 491                  * is best here.... JRA.
 492                  */
 493
 494                 prs_switch_type(&p->in_data.data, MARSHALL);
 495                 prs_set_offset(&p->in_data.data, 0);
 496                 return ret;
 497         }
 498
 499         return True;
 500 }
 501
 502 /****************************************************************************
 503  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
 504  already been parsed and stored in p->hdr.
 505 ****************************************************************************/
 506
 507 static void process_complete_pdu(pipes_struct *p)
 508 {
 509         prs_struct rpc_in;
 510         size_t data_len = p->in_data.pdu_received_len - RPC_HEADER_LEN;
 511         char *data_p = (char *)&p->in_data.current_in_pdu[RPC_HEADER_LEN];
 512         bool reply = False;
 513
 514         if(p->fault_state) {
 515                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
 516                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 517                 set_incoming_fault(p);
 518                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 519                 return;
 520         }
 521
 522         prs_init_empty( &rpc_in, p->mem_ctx, UNMARSHALL);
 523
 524         /*
 525          * Ensure we're using the corrent endianness for both the
 526          * RPC header flags and the raw data we will be reading from.
 527          */
 528
 529         prs_set_endian_data( &rpc_in, p->endian);
 530         prs_set_endian_data( &p->in_data.data, p->endian);
 531
 532         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
 533
 534         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
 535                         (unsigned int)p->hdr.pkt_type ));
 536
 537         switch (p->hdr.pkt_type) {
 538                 case DCERPC_PKT_REQUEST:
 539                         reply = process_request_pdu(p, &rpc_in);
 540                         break;
 541
 542                 case DCERPC_PKT_PING: /* CL request - ignore... */
 543                         DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n",
 544                                 (unsigned int)p->hdr.pkt_type,
 545                                  get_pipe_name_from_syntax(talloc_tos(),
 546                                                            &p->syntax)));
 547                         break;
 548
 549                 case DCERPC_PKT_RESPONSE: /* No responses here. */
 550                         DEBUG(0,("process_complete_pdu: Error. DCERPC_PKT_RESPONSE received from client on pipe %s.\n",
 551                                  get_pipe_name_from_syntax(talloc_tos(),
 552                                                            &p->syntax)));
 553                         break;
 554
 555                 case DCERPC_PKT_FAULT:
 556                 case DCERPC_PKT_WORKING: /* CL request - reply to a ping when a call in process. */
 557                 case DCERPC_PKT_NOCALL: /* CL - server reply to a ping call. */
 558                 case DCERPC_PKT_REJECT:
 559                 case DCERPC_PKT_ACK:
 560                 case DCERPC_PKT_CL_CANCEL:
 561                 case DCERPC_PKT_FACK:
 562                 case DCERPC_PKT_CANCEL_ACK:
 563                         DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n",
 564                                 (unsigned int)p->hdr.pkt_type,
 565                                  get_pipe_name_from_syntax(talloc_tos(),
 566                                                            &p->syntax)));
 567                         break;
 568
 569                 case DCERPC_PKT_BIND:
 570                         /*
 571                          * We assume that a pipe bind is only in one pdu.
 572                          */
 573                         if(pipe_init_outgoing_data(p)) {
 574                                 reply = api_pipe_bind_req(p, &rpc_in);
 575                         }
 576                         break;
 577
 578                 case DCERPC_PKT_BIND_ACK:
 579                 case DCERPC_PKT_BIND_NAK:
 580                         DEBUG(0,("process_complete_pdu: Error. DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK packet type %u received on pipe %s.\n",
 581                                 (unsigned int)p->hdr.pkt_type,
 582                                  get_pipe_name_from_syntax(talloc_tos(),
 583                                                            &p->syntax)));
 584                         break;
 585
 586
 587                 case DCERPC_PKT_ALTER:
 588                         /*
 589                          * We assume that a pipe bind is only in one pdu.
 590                          */
 591                         if(pipe_init_outgoing_data(p)) {
 592                                 reply = api_pipe_alter_context(p, &rpc_in);
 593                         }
 594                         break;
 595
 596                 case DCERPC_PKT_ALTER_RESP:
 597                         DEBUG(0,("process_complete_pdu: Error. DCERPC_PKT_ALTER_RESP on pipe %s: Should only be server -> client.\n",
 598                                  get_pipe_name_from_syntax(talloc_tos(),
 599                                                            &p->syntax)));
 600                         break;
 601
 602                 case DCERPC_PKT_AUTH3:
 603                         /*
 604                          * The third packet in an NTLMSSP auth exchange.
 605                          */
 606                         if(pipe_init_outgoing_data(p)) {
 607                                 reply = api_pipe_bind_auth3(p, &rpc_in);
 608                         }
 609                         break;
 610
 611                 case DCERPC_PKT_SHUTDOWN:
 612                         DEBUG(0,("process_complete_pdu: Error. DCERPC_PKT_SHUTDOWN on pipe %s: Should only be server -> client.\n",
 613                                  get_pipe_name_from_syntax(talloc_tos(),
 614                                                            &p->syntax)));
 615                         break;
 616
 617                 case DCERPC_PKT_CO_CANCEL:
 618                         /* For now just free all client data and continue processing. */
 619                         DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL. Abandoning rpc call.\n"));
 620                         /* As we never do asynchronous RPC serving, we can never cancel a
 621                            call (as far as I know). If we ever did we'd have to send a cancel_ack
 622                            reply. For now, just free all client data and continue processing. */
 623                         reply = True;
 624                         break;
 625 #if 0
 626                         /* Enable this if we're doing async rpc. */
 627                         /* We must check the call-id matches the outstanding callid. */
 628                         if(pipe_init_outgoing_data(p)) {
 629                                 /* Send a cancel_ack PDU reply. */
 630                                 /* We should probably check the auth-verifier here. */
 631                                 reply = setup_cancel_ack_reply(p, &rpc_in);
 632                         }
 633                         break;
 634 #endif
 635
 636                 case DCERPC_PKT_ORPHANED:
 637                         /* We should probably check the auth-verifier here.
 638                            For now just free all client data and continue processing. */
 639                         DEBUG(3,("process_complete_pdu: DCERPC_PKT_ORPHANED. Abandoning rpc call.\n"));
 640                         reply = True;
 641                         break;
 642
 643                 default:
 644                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
 645                         break;
 646         }
 647
 648         /* Reset to little endian. Probably don't need this but it won't hurt. */
 649         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
 650
 651         if (!reply) {
 652                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on "
 653                          "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
 654                                                                 &p->syntax)));
 655                 set_incoming_fault(p);
 656                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 657                 prs_mem_free(&rpc_in);
 658         } else {
 659                 /*
 660                  * Reset the lengths. We're ready for a new pdu.
 661                  */
 662                 TALLOC_FREE(p->in_data.current_in_pdu);
 663                 p->in_data.pdu_needed_len = 0;
 664                 p->in_data.pdu_received_len = 0;
 665         }
 666
 667         prs_mem_free(&rpc_in);
 668 }
 669
 670 /****************************************************************************
 671  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
 672 ****************************************************************************/
 673
 674 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
 675 {
 676         size_t data_to_copy = MIN(n, RPC_MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
 677
 678         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
 679                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
 680                 (unsigned int)n ));
 681
 682         if(data_to_copy == 0) {
 683                 /*
 684                  * This is an error - data is being received and there is no
 685                  * space in the PDU. Free the received data and go into the fault state.
 686                  */
 687                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
 688 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
 689                 set_incoming_fault(p);
 690                 return -1;
 691         }
 692
 693         /*
 694          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
 695          * number of bytes before we can do anything.
 696          */
 697
 698         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
 699                 /*
 700                  * Always return here. If we have more data then the RPC_HEADER
 701                  * will be processed the next time around the loop.
 702                  */
 703                 return fill_rpc_header(p, data, data_to_copy);
 704         }
 705
 706         /*
 707          * At this point we know we have at least an RPC_HEADER_LEN amount of data
 708          * stored in current_in_pdu.
 709          */
 710
 711         /*
 712          * If pdu_needed_len is zero this is a new pdu.
 713          * Unmarshall the header so we know how much more
 714          * data we need, then loop again.
 715          */
 716
 717         if(p->in_data.pdu_needed_len == 0) {
 718                 ssize_t rret = unmarshall_rpc_header(p);
 719                 if (rret == -1 || p->in_data.pdu_needed_len > 0) {
 720                         return rret;
 721                 }
 722                 /* If rret == 0 and pdu_needed_len == 0 here we have a PDU that consists
 723                    of an RPC_HEADER only. This is a DCERPC_PKT_SHUTDOWN, DCERPC_PKT_CO_CANCEL or DCERPC_PKT_ORPHANED
 724                    pdu type. Deal with this in process_complete_pdu(). */
 725         }
 726
 727         /*
 728          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
 729          * Keep reading until we have a full pdu.
 730          */
 731
 732         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
 733
 734         /*
 735          * Copy as much of the data as we need into the current_in_pdu buffer.
 736          * pdu_needed_len becomes zero when we have a complete pdu.
 737          */
 738
 739         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
 740         p->in_data.pdu_received_len += data_to_copy;
 741         p->in_data.pdu_needed_len -= data_to_copy;
 742
 743         /*
 744          * Do we have a complete PDU ?
 745          * (return the number of bytes handled in the call)
 746          */
 747
 748         if(p->in_data.pdu_needed_len == 0) {
 749                 process_complete_pdu(p);
 750                 return data_to_copy;
 751         }
 752
 753         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
 754                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
 755
 756         return (ssize_t)data_to_copy;
 757 }
 758
 759 /****************************************************************************
 760  Accepts incoming data on an internal rpc pipe.
 761 ****************************************************************************/
 762
 763 static ssize_t write_to_internal_pipe(struct pipes_struct *p, char *data, size_t n)
 764 {
 765         size_t data_left = n;
 766
 767         while(data_left) {
 768                 ssize_t data_used;
 769
 770                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
 771
 772                 data_used = process_incoming_data(p, data, data_left);
 773
 774                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
 775
 776                 if(data_used < 0) {
 777                         return -1;
 778                 }
 779
 780                 data_left -= data_used;
 781                 data += data_used;
 782         }
 783
 784         return n;
 785 }
 786
 787 /****************************************************************************
 788  Replies to a request to read data from a pipe.
 789
 790  Headers are interspersed with the data at PDU intervals. By the time
 791  this function is called, the start of the data could possibly have been
 792  read by an SMBtrans (file_offset != 0).
 793
 794  Calling create_rpc_reply() here is a hack. The data should already
 795  have been prepared into arrays of headers + data stream sections.
 796 ****************************************************************************/
 797
 798 static ssize_t read_from_internal_pipe(struct pipes_struct *p, char *data, size_t n,
 799                                        bool *is_data_outstanding)
 800 {
 801         uint32 pdu_remaining = 0;
 802         ssize_t data_returned = 0;
 803
 804         if (!p) {
 805                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 806                 return -1;
 807         }
 808
 809         DEBUG(6,(" name: %s len: %u\n",
 810                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
 811                  (unsigned int)n));
 812
 813         /*
 814          * We cannot return more than one PDU length per
 815          * read request.
 816          */
 817
 818         /*
 819          * This condition should result in the connection being closed.
 820          * Netapp filers seem to set it to 0xffff which results in domain
 821          * authentications failing.  Just ignore it so things work.
 822          */
 823
 824         if(n > RPC_MAX_PDU_FRAG_LEN) {
 825                 DEBUG(5,("read_from_pipe: too large read (%u) requested on "
 826                          "pipe %s. We can only service %d sized reads.\n",
 827                          (unsigned int)n,
 828                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
 829                          RPC_MAX_PDU_FRAG_LEN ));
 830                 n = RPC_MAX_PDU_FRAG_LEN;
 831         }
 832
 833         /*
 834          * Determine if there is still data to send in the
 835          * pipe PDU buffer. Always send this first. Never
 836          * send more than is left in the current PDU. The
 837          * client should send a new read request for a new
 838          * PDU.
 839          */
 840
 841         pdu_remaining = prs_offset(&p->out_data.frag)
 842                 - p->out_data.current_pdu_sent;
 843
 844         if (pdu_remaining > 0) {
 845                 data_returned = (ssize_t)MIN(n, pdu_remaining);
 846
 847                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, "
 848                           "current_pdu_sent = %u returning %d bytes.\n",
 849                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
 850                           (unsigned int)prs_offset(&p->out_data.frag),
 851                           (unsigned int)p->out_data.current_pdu_sent,
 852                           (int)data_returned));
 853
 854                 memcpy(data,
 855                        prs_data_p(&p->out_data.frag)
 856                        + p->out_data.current_pdu_sent,
 857                        data_returned);
 858
 859                 p->out_data.current_pdu_sent += (uint32)data_returned;
 860                 goto out;
 861         }
 862
 863         /*
 864          * At this point p->current_pdu_len == p->current_pdu_sent (which
 865          * may of course be zero if this is the first return fragment.
 866          */
 867
 868         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length "
 869                   "= %u, prs_offset(&p->out_data.rdata) = %u.\n",
 870                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
 871                   (int)p->fault_state,
 872                   (unsigned int)p->out_data.data_sent_length,
 873                   (unsigned int)prs_offset(&p->out_data.rdata) ));
 874
 875         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
 876                 /*
 877                  * We have sent all possible data, return 0.
 878                  */
 879                 data_returned = 0;
 880                 goto out;
 881         }
 882
 883         /*
 884          * We need to create a new PDU from the data left in p->rdata.
 885          * Create the header/data/footers. This also sets up the fields
 886          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
 887          * and stores the outgoing PDU in p->current_pdu.
 888          */
 889
 890         if(!create_next_pdu(p)) {
 891                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n",
 892                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 893                 return -1;
 894         }
 895
 896         data_returned = MIN(n, prs_offset(&p->out_data.frag));
 897
 898         memcpy( data, prs_data_p(&p->out_data.frag), (size_t)data_returned);
 899         p->out_data.current_pdu_sent += (uint32)data_returned;
 900
 901   out:
 902         (*is_data_outstanding) = prs_offset(&p->out_data.frag) > n;
 903
 904         if (p->out_data.current_pdu_sent == prs_offset(&p->out_data.frag)) {
 905                 /* We've returned everything in the out_data.frag
 906                  * so we're done with this pdu. Free it and reset
 907                  * current_pdu_sent. */
 908                 p->out_data.current_pdu_sent = 0;
 909                 prs_mem_free(&p->out_data.frag);
 910         }
 911         return data_returned;
 912 }
 913
 914 /****************************************************************************
 915  Close an rpc pipe.
 916 ****************************************************************************/
 917
 918 static int close_internal_rpc_pipe_hnd(struct pipes_struct *p)
 919 {
 920         if (!p) {
 921                 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
 922                 return False;
 923         }
 924
 925         prs_mem_free(&p->out_data.frag);
 926         prs_mem_free(&p->out_data.rdata);
 927         prs_mem_free(&p->in_data.data);
 928
 929         if (p->auth.auth_data_free_func) {
 930                 (*p->auth.auth_data_free_func)(&p->auth);
 931         }
 932
 933         free_pipe_rpc_context( p->contexts );
 934
 935         /* Free the handles database. */
 936         close_policy_by_pipe(p);
 937
 938         DLIST_REMOVE(InternalPipes, p);
 939
 940         ZERO_STRUCTP(p);
 941
 942         return 0;
 943 }
 944
 945 bool fsp_is_np(struct files_struct *fsp)
 946 {
 947         enum FAKE_FILE_TYPE type;
 948
 949         if ((fsp == NULL) || (fsp->fake_file_handle == NULL)) {
 950                 return false;
 951         }
 952
 953         type = fsp->fake_file_handle->type;
 954
 955         return ((type == FAKE_FILE_TYPE_NAMED_PIPE)
 956                 || (type == FAKE_FILE_TYPE_NAMED_PIPE_PROXY));
 957 }
 958
 959 struct np_proxy_state {
 960         uint16_t file_type;
 961         uint16_t device_state;
 962         uint64_t allocation_size;
 963         struct tstream_context *npipe;
 964         struct tevent_queue *read_queue;
 965         struct tevent_queue *write_queue;
 966 };
 967
 968 static struct np_proxy_state *make_external_rpc_pipe_p(TALLOC_CTX *mem_ctx,
 969                                 const char *pipe_name,
 970                                 const struct tsocket_address *local_address,
 971                                 const struct tsocket_address *remote_address,
 972                                 struct auth_serversupplied_info *server_info)
 973 {
 974         struct np_proxy_state *result;
 975         char *socket_np_dir;
 976         const char *socket_dir;
 977         struct tevent_context *ev;
 978         struct tevent_req *subreq;
 979         struct netr_SamInfo3 *info3;
 980         NTSTATUS status;
 981         bool ok;
 982         int ret;
 983         int sys_errno;
 984
 985         result = talloc(mem_ctx, struct np_proxy_state);
 986         if (result == NULL) {
 987                 DEBUG(0, ("talloc failed\n"));
 988                 return NULL;
 989         }
 990
 991         result->read_queue = tevent_queue_create(result, "np_read");
 992         if (result->read_queue == NULL) {
 993                 DEBUG(0, ("tevent_queue_create failed\n"));
 994                 goto fail;
 995         }
 996
 997         result->write_queue = tevent_queue_create(result, "np_write");
 998         if (result->write_queue == NULL) {
 999                 DEBUG(0, ("tevent_queue_create failed\n"));
1000                 goto fail;
1001         }
1002
1003         ev = s3_tevent_context_init(talloc_tos());
1004         if (ev == NULL) {
1005                 DEBUG(0, ("s3_tevent_context_init failed\n"));
1006                 goto fail;
1007         }
1008
1009         socket_dir = lp_parm_const_string(
1010                 GLOBAL_SECTION_SNUM, "external_rpc_pipe", "socket_dir",
1011                 get_dyn_NCALRPCDIR());
1012         if (socket_dir == NULL) {
1013                 DEBUG(0, ("externan_rpc_pipe:socket_dir not set\n"));
1014                 goto fail;
1015         }
1016         socket_np_dir = talloc_asprintf(talloc_tos(), "%s/np", socket_dir);
1017         if (socket_np_dir == NULL) {
1018                 DEBUG(0, ("talloc_asprintf failed\n"));
1019                 goto fail;
1020         }
1021
1022         info3 = talloc_zero(talloc_tos(), struct netr_SamInfo3);
1023         if (info3 == NULL) {
1024                 DEBUG(0, ("talloc failed\n"));
1025                 goto fail;
1026         }
1027
1028         status = serverinfo_to_SamInfo3(server_info, NULL, 0, info3);
1029         if (!NT_STATUS_IS_OK(status)) {
1030                 TALLOC_FREE(info3);
1031                 DEBUG(0, ("serverinfo_to_SamInfo3 failed: %s\n",
1032                           nt_errstr(status)));
1033                 goto fail;
1034         }
1035
1036         become_root();
1037         subreq = tstream_npa_connect_send(talloc_tos(), ev,
1038                                           socket_np_dir,
1039                                           pipe_name,
1040                                           remote_address, /* client_addr */
1041                                           NULL, /* client_name */
1042                                           local_address, /* server_addr */
1043                                           NULL, /* server_name */
1044                                           info3,
1045                                           server_info->user_session_key,
1046                                           data_blob_null /* delegated_creds */);
1047         if (subreq == NULL) {
1048                 unbecome_root();
1049                 DEBUG(0, ("tstream_npa_connect_send failed\n"));
1050                 goto fail;
1051         }
1052         ok = tevent_req_poll(subreq, ev);
1053         unbecome_root();
1054         if (!ok) {
1055                 DEBUG(0, ("tevent_req_poll failed for tstream_npa_connect: %s\n",
1056                           strerror(errno)));
1057                 goto fail;
1058
1059         }
1060         ret = tstream_npa_connect_recv(subreq, &sys_errno,
1061                                        result,
1062                                        &result->npipe,
1063                                        &result->file_type,
1064                                        &result->device_state,
1065                                        &result->allocation_size);
1066         TALLOC_FREE(subreq);
1067         if (ret != 0) {
1068                 DEBUG(0, ("tstream_npa_connect_recv failed: %s\n",
1069                           strerror(sys_errno)));
1070                 goto fail;
1071         }
1072
1073         return result;
1074
1075  fail:
1076         TALLOC_FREE(result);
1077         return NULL;
1078 }
1079
1080 NTSTATUS np_open(TALLOC_CTX *mem_ctx, const char *name,
1081                  const struct tsocket_address *local_address,
1082                  const struct tsocket_address *remote_address,
1083                  struct auth_serversupplied_info *server_info,
1084                  struct fake_file_handle **phandle)
1085 {
1086         const char **proxy_list;
1087         struct fake_file_handle *handle;
1088
1089         proxy_list = lp_parm_string_list(-1, "np", "proxy", NULL);
1090
1091         handle = talloc(mem_ctx, struct fake_file_handle);
1092         if (handle == NULL) {
1093                 return NT_STATUS_NO_MEMORY;
1094         }
1095
1096         if ((proxy_list != NULL) && str_list_check_ci(proxy_list, name)) {
1097                 struct np_proxy_state *p;
1098
1099                 p = make_external_rpc_pipe_p(handle, name,
1100                                              local_address,
1101                                              remote_address,
1102                                              server_info);
1103
1104                 handle->type = FAKE_FILE_TYPE_NAMED_PIPE_PROXY;
1105                 handle->private_data = p;
1106         } else {
1107                 struct pipes_struct *p;
1108                 struct ndr_syntax_id syntax;
1109                 const char *client_address;
1110
1111                 if (!is_known_pipename(name, &syntax)) {
1112                         TALLOC_FREE(handle);
1113                         return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1114                 }
1115
1116                 if (tsocket_address_is_inet(remote_address, "ip")) {
1117                         client_address = tsocket_address_inet_addr_string(
1118                                                 remote_address,
1119                                                 talloc_tos());
1120                         if (client_address == NULL) {
1121                                 TALLOC_FREE(handle);
1122                                 return NT_STATUS_NO_MEMORY;
1123                         }
1124                 } else {
1125                         client_address = "";
1126                 }
1127
1128                 p = make_internal_rpc_pipe_p(handle, &syntax, client_address,
1129                                              server_info);
1130
1131                 handle->type = FAKE_FILE_TYPE_NAMED_PIPE;
1132                 handle->private_data = p;
1133         }
1134
1135         if (handle->private_data == NULL) {
1136                 TALLOC_FREE(handle);
1137                 return NT_STATUS_PIPE_NOT_AVAILABLE;
1138         }
1139
1140         *phandle = handle;
1141
1142         return NT_STATUS_OK;
1143 }
1144
1145 bool np_read_in_progress(struct fake_file_handle *handle)
1146 {
1147         if (handle->type == FAKE_FILE_TYPE_NAMED_PIPE) {
1148                 return false;
1149         }
1150
1151         if (handle->type == FAKE_FILE_TYPE_NAMED_PIPE_PROXY) {
1152                 struct np_proxy_state *p = talloc_get_type_abort(
1153                         handle->private_data, struct np_proxy_state);
1154                 size_t read_count;
1155
1156                 read_count = tevent_queue_length(p->read_queue);
1157                 if (read_count > 0) {
1158                         return true;
1159                 }
1160
1161                 return false;
1162         }
1163
1164         return false;
1165 }
1166
1167 struct np_write_state {
1168         struct event_context *ev;
1169         struct np_proxy_state *p;
1170         struct iovec iov;
1171         ssize_t nwritten;
1172 };
1173
1174 static void np_write_done(struct tevent_req *subreq);
1175
1176 struct tevent_req *np_write_send(TALLOC_CTX *mem_ctx, struct event_context *ev,
1177                                  struct fake_file_handle *handle,
1178                                  const uint8_t *data, size_t len)
1179 {
1180         struct tevent_req *req;
1181         struct np_write_state *state;
1182         NTSTATUS status;
1183
1184         DEBUG(6, ("np_write_send: len: %d\n", (int)len));
1185         dump_data(50, data, len);
1186
1187         req = tevent_req_create(mem_ctx, &state, struct np_write_state);
1188         if (req == NULL) {
1189                 return NULL;
1190         }
1191
1192         if (len == 0) {
1193                 state->nwritten = 0;
1194                 status = NT_STATUS_OK;
1195                 goto post_status;
1196         }
1197
1198         if (handle->type == FAKE_FILE_TYPE_NAMED_PIPE) {
1199                 struct pipes_struct *p = talloc_get_type_abort(
1200                         handle->private_data, struct pipes_struct);
1201
1202                 state->nwritten = write_to_internal_pipe(p, (char *)data, len);
1203
1204                 status = (state->nwritten >= 0)
1205                         ? NT_STATUS_OK : NT_STATUS_UNEXPECTED_IO_ERROR;
1206                 goto post_status;
1207         }
1208
1209         if (handle->type == FAKE_FILE_TYPE_NAMED_PIPE_PROXY) {
1210                 struct np_proxy_state *p = talloc_get_type_abort(
1211                         handle->private_data, struct np_proxy_state);
1212                 struct tevent_req *subreq;
1213
1214                 state->ev = ev;
1215                 state->p = p;
1216                 state->iov.iov_base = CONST_DISCARD(void *, data);
1217                 state->iov.iov_len = len;
1218
1219                 subreq = tstream_writev_queue_send(state, ev,
1220                                                    p->npipe,
1221                                                    p->write_queue,
1222                                                    &state->iov, 1);
1223                 if (subreq == NULL) {
1224                         goto fail;
1225                 }
1226                 tevent_req_set_callback(subreq, np_write_done, req);
1227                 return req;
1228         }
1229
1230         status = NT_STATUS_INVALID_HANDLE;
1231  post_status:
1232         if (NT_STATUS_IS_OK(status)) {
1233                 tevent_req_done(req);
1234         } else {
1235                 tevent_req_nterror(req, status);
1236         }
1237         return tevent_req_post(req, ev);
1238  fail:
1239         TALLOC_FREE(req);
1240         return NULL;
1241 }
1242
1243 static void np_write_done(struct tevent_req *subreq)
1244 {
1245         struct tevent_req *req = tevent_req_callback_data(
1246                 subreq, struct tevent_req);
1247         struct np_write_state *state = tevent_req_data(
1248                 req, struct np_write_state);
1249         ssize_t received;
1250         int err;
1251
1252         received = tstream_writev_queue_recv(subreq, &err);
1253         if (received < 0) {
1254                 tevent_req_nterror(req, map_nt_error_from_unix(err));
1255                 return;
1256         }
1257         state->nwritten = received;
1258         tevent_req_done(req);
1259 }
1260
1261 NTSTATUS np_write_recv(struct tevent_req *req, ssize_t *pnwritten)
1262 {
1263         struct np_write_state *state = tevent_req_data(
1264                 req, struct np_write_state);
1265         NTSTATUS status;
1266
1267         if (tevent_req_is_nterror(req, &status)) {
1268                 return status;
1269         }
1270         *pnwritten = state->nwritten;
1271         return NT_STATUS_OK;
1272 }
1273
1274 struct np_ipc_readv_next_vector_state {
1275         uint8_t *buf;
1276         size_t len;
1277         off_t ofs;
1278         size_t remaining;
1279 };
1280
1281 static void np_ipc_readv_next_vector_init(struct np_ipc_readv_next_vector_state *s,
1282                                           uint8_t *buf, size_t len)
1283 {
1284         ZERO_STRUCTP(s);
1285
1286         s->buf = buf;
1287         s->len = MIN(len, UINT16_MAX);
1288 }
1289
1290 static int np_ipc_readv_next_vector(struct tstream_context *stream,
1291                                     void *private_data,
1292                                     TALLOC_CTX *mem_ctx,
1293                                     struct iovec **_vector,
1294                                     size_t *count)
1295 {
1296         struct np_ipc_readv_next_vector_state *state =
1297                 (struct np_ipc_readv_next_vector_state *)private_data;
1298         struct iovec *vector;
1299         ssize_t pending;
1300         size_t wanted;
1301
1302         if (state->ofs == state->len) {
1303                 *_vector = NULL;
1304                 *count = 0;
1305                 return 0;
1306         }
1307
1308         pending = tstream_pending_bytes(stream);
1309         if (pending == -1) {
1310                 return -1;
1311         }
1312
1313         if (pending == 0 && state->ofs != 0) {
1314                 /* return a short read */
1315                 *_vector = NULL;
1316                 *count = 0;
1317                 return 0;
1318         }
1319
1320         if (pending == 0) {
1321                 /* we want at least one byte and recheck again */
1322                 wanted = 1;
1323         } else {
1324                 size_t missing = state->len - state->ofs;
1325                 if (pending > missing) {
1326                         /* there's more available */
1327                         state->remaining = pending - missing;
1328                         wanted = missing;
1329                 } else {
1330                         /* read what we can get and recheck in the next cycle */
1331                         wanted = pending;
1332                 }
1333         }
1334
1335         vector = talloc_array(mem_ctx, struct iovec, 1);
1336         if (!vector) {
1337                 return -1;
1338         }
1339
1340         vector[0].iov_base = state->buf + state->ofs;
1341         vector[0].iov_len = wanted;
1342
1343         state->ofs += wanted;
1344
1345         *_vector = vector;
1346         *count = 1;
1347         return 0;
1348 }
1349
1350 struct np_read_state {
1351         struct np_proxy_state *p;
1352         struct np_ipc_readv_next_vector_state next_vector;
1353
1354         size_t nread;
1355         bool is_data_outstanding;
1356 };
1357
1358 static void np_read_done(struct tevent_req *subreq);
1359
1360 struct tevent_req *np_read_send(TALLOC_CTX *mem_ctx, struct event_context *ev,
1361                                 struct fake_file_handle *handle,
1362                                 uint8_t *data, size_t len)
1363 {
1364         struct tevent_req *req;
1365         struct np_read_state *state;
1366         NTSTATUS status;
1367
1368         req = tevent_req_create(mem_ctx, &state, struct np_read_state);
1369         if (req == NULL) {
1370                 return NULL;
1371         }
1372
1373         if (handle->type == FAKE_FILE_TYPE_NAMED_PIPE) {
1374                 struct pipes_struct *p = talloc_get_type_abort(
1375                         handle->private_data, struct pipes_struct);
1376
1377                 state->nread = read_from_internal_pipe(
1378                         p, (char *)data, len, &state->is_data_outstanding);
1379
1380                 status = (state->nread >= 0)
1381                         ? NT_STATUS_OK : NT_STATUS_UNEXPECTED_IO_ERROR;
1382                 goto post_status;
1383         }
1384
1385         if (handle->type == FAKE_FILE_TYPE_NAMED_PIPE_PROXY) {
1386                 struct np_proxy_state *p = talloc_get_type_abort(
1387                         handle->private_data, struct np_proxy_state);
1388                 struct tevent_req *subreq;
1389
1390                 np_ipc_readv_next_vector_init(&state->next_vector,
1391                                               data, len);
1392
1393                 subreq = tstream_readv_pdu_queue_send(state,
1394                                                       ev,
1395                                                       p->npipe,
1396                                                       p->read_queue,
1397                                                       np_ipc_readv_next_vector,
1398                                                       &state->next_vector);
1399                 if (subreq == NULL) {
1400
1401                 }
1402                 tevent_req_set_callback(subreq, np_read_done, req);
1403                 return req;
1404         }
1405
1406         status = NT_STATUS_INVALID_HANDLE;
1407  post_status:
1408         if (NT_STATUS_IS_OK(status)) {
1409                 tevent_req_done(req);
1410         } else {
1411                 tevent_req_nterror(req, status);
1412         }
1413         return tevent_req_post(req, ev);
1414 }
1415
1416 static void np_read_done(struct tevent_req *subreq)
1417 {
1418         struct tevent_req *req = tevent_req_callback_data(
1419                 subreq, struct tevent_req);
1420         struct np_read_state *state = tevent_req_data(
1421                 req, struct np_read_state);
1422         ssize_t ret;
1423         int err;
1424
1425         ret = tstream_readv_pdu_queue_recv(subreq, &err);
1426         TALLOC_FREE(subreq);
1427         if (ret == -1) {
1428                 tevent_req_nterror(req, map_nt_error_from_unix(err));
1429                 return;
1430         }
1431
1432         state->nread = ret;
1433         state->is_data_outstanding = (state->next_vector.remaining > 0);
1434
1435         tevent_req_done(req);
1436         return;
1437 }
1438
1439 NTSTATUS np_read_recv(struct tevent_req *req, ssize_t *nread,
1440                       bool *is_data_outstanding)
1441 {
1442         struct np_read_state *state = tevent_req_data(
1443                 req, struct np_read_state);
1444         NTSTATUS status;
1445
1446         if (tevent_req_is_nterror(req, &status)) {
1447                 return status;
1448         }
1449         *nread = state->nread;
1450         *is_data_outstanding = state->is_data_outstanding;
1451         return NT_STATUS_OK;
1452 }
1453
1454 /**
1455  * @brief Create a new RPC client context which uses a local dispatch function.
1456  *
1457  * @param[in]  mem_ctx  The memory context to use.
1458  *
1459  * @param[in]  abstract_syntax Normally the syntax_id of the autogenerated
1460  *                             ndr_table_<name>.
1461  *
1462  * @param[in]  dispatch The corresponding autogenerated dispatch function
1463  *                      rpc_<name>_dispatch.
1464  *
1465  * @param[in]  serversupplied_info The server supplied authentication function.
1466  *
1467  * @param[out] presult  A pointer to store the connected rpc client pipe.
1468  *
1469  * @return              NT_STATUS_OK on success, a corresponding NT status if an
1470  *                      error occured.
1471  *
1472  * @code
1473  *   struct rpc_pipe_client *winreg_pipe;
1474  *   NTSTATUS status;
1475  *
1476  *   status = rpc_pipe_open_internal(tmp_ctx,
1477  *                                   &ndr_table_winreg.syntax_id,
1478  *                                   rpc_winreg_dispatch,
1479  *                                   p->server_info,
1480  *                                   &winreg_pipe);
1481  * @endcode
1482  */
1483 NTSTATUS rpc_pipe_open_internal(TALLOC_CTX *mem_ctx,
1484                                 const struct ndr_syntax_id *abstract_syntax,
1485                                 NTSTATUS (*dispatch) (struct rpc_pipe_client *cli,
1486                                                       TALLOC_CTX *mem_ctx,
1487                                                       const struct ndr_interface_table *table,
1488                                                       uint32_t opnum, void *r),
1489                                 struct auth_serversupplied_info *serversupplied_info,
1490                                 struct rpc_pipe_client **presult)
1491 {
1492         struct rpc_pipe_client *result;
1493
1494         result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
1495         if (result == NULL) {
1496                 return NT_STATUS_NO_MEMORY;
1497         }
1498
1499         result->abstract_syntax = *abstract_syntax;
1500         result->transfer_syntax = ndr_transfer_syntax;
1501         result->dispatch = dispatch;
1502
1503         result->pipes_struct = make_internal_rpc_pipe_p(
1504                 result, abstract_syntax, "", serversupplied_info);
1505         if (result->pipes_struct == NULL) {
1506                 TALLOC_FREE(result);
1507                 return NT_STATUS_NO_MEMORY;
1508         }
1509
1510         result->max_xmit_frag = -1;
1511         result->max_recv_frag = -1;
1512
1513         *presult = result;
1514         return NT_STATUS_OK;
1515 }
1516
1517 /**
1518  * @brief Create a new RPC client context which uses a local dispatch function.
1519  *
1520  * @param[in]  conn  The connection struct that will hold the pipe
1521  *
1522  * @param[out] spoolss_pipe  A pointer to the connected rpc client pipe.
1523  *
1524  * @return              NT_STATUS_OK on success, a corresponding NT status if an
1525  *                      error occured.
1526  */
1527 NTSTATUS rpc_connect_spoolss_pipe(connection_struct *conn,
1528                                   struct rpc_pipe_client **spoolss_pipe)
1529 {
1530         NTSTATUS status;
1531
1532         /* TODO: check and handle disconnections */
1533
1534         if (!conn->spoolss_pipe) {
1535                 status = rpc_pipe_open_internal(conn,
1536                                                 &ndr_table_spoolss.syntax_id,
1537                                                 rpc_spoolss_dispatch,
1538                                                 conn->server_info,
1539                                                 &conn->spoolss_pipe);
1540                 if (!NT_STATUS_IS_OK(status)) {
1541                         return status;
1542                 }
1543         }
1544
1545         *spoolss_pipe = conn->spoolss_pipe;
1546         return NT_STATUS_OK;
1547 }