source3/rpc_server/srv_pipe_hnd.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998,
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Jeremy Allison                                    1999.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24
  25 #include "includes.h"
  26
  27
  28 #define PIPE            "\\PIPE\\"
  29 #define PIPELEN         strlen(PIPE)
  30
  31 extern int DEBUGLEVEL;
  32 static pipes_struct *chain_p;
  33 static int pipes_open;
  34
  35 #ifndef MAX_OPEN_PIPES
  36 #define MAX_OPEN_PIPES 64
  37 #endif
  38
  39 static pipes_struct *Pipes;
  40 static struct bitmap *bmap;
  41
  42 /****************************************************************************
  43  Pipe iterator functions.
  44 ****************************************************************************/
  45
  46 pipes_struct *get_first_pipe(void)
  47 {
  48         return Pipes;
  49 }
  50
  51 pipes_struct *get_next_pipe(pipes_struct *p)
  52 {
  53         return p->next;
  54 }
  55
  56 /* this must be larger than the sum of the open files and directories */
  57 static int pipe_handle_offset;
  58
  59 /****************************************************************************
  60  Set the pipe_handle_offset. Called from smbd/files.c
  61 ****************************************************************************/
  62
  63 void set_pipe_handle_offset(int max_open_files)
  64 {
  65   if(max_open_files < 0x7000)
  66     pipe_handle_offset = 0x7000;
  67   else
  68     pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
  69 }
  70
  71 /****************************************************************************
  72  Reset pipe chain handle number.
  73 ****************************************************************************/
  74 void reset_chain_p(void)
  75 {
  76         chain_p = NULL;
  77 }
  78
  79 /****************************************************************************
  80  Initialise pipe handle states.
  81 ****************************************************************************/
  82
  83 void init_rpc_pipe_hnd(void)
  84 {
  85         bmap = bitmap_allocate(MAX_OPEN_PIPES);
  86         if (!bmap)
  87                 exit_server("out of memory in init_rpc_pipe_hnd\n");
  88 }
  89
  90 /****************************************************************************
  91  Initialise an outgoing packet.
  92 ****************************************************************************/
  93
  94 static BOOL pipe_init_outgoing_data(pipes_struct *p)
  95 {
  96         output_data *o_data = &p->out_data;
  97
  98         /* Reset the offset counters. */
  99         o_data->data_sent_length = 0;
 100         o_data->current_pdu_len = 0;
 101         o_data->current_pdu_sent = 0;
 102
 103         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
 104
 105         /* Free any memory in the current return data buffer. */
 106         prs_mem_free(&o_data->rdata);
 107
 108         /*
 109          * Initialize the outgoing RPC data buffer.
 110          * we will use this as the raw data area for replying to rpc requests.
 111          */
 112         if(!prs_init(&o_data->rdata, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 113                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
 114                 return False;
 115         }
 116
 117         return True;
 118 }
 119
 120 /****************************************************************************
 121  Find first available pipe slot.
 122 ****************************************************************************/
 123
 124 pipes_struct *open_rpc_pipe_p(char *pipe_name,
 125                               connection_struct *conn, uint16 vuid)
 126 {
 127         int i;
 128         pipes_struct *p;
 129         static int next_pipe;
 130
 131         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
 132                  pipe_name, pipes_open));
 133
 134
 135         /* not repeating pipe numbers makes it easier to track things in
 136            log files and prevents client bugs where pipe numbers are reused
 137            over connection restarts */
 138         if (next_pipe == 0)
 139                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
 140
 141         i = bitmap_find(bmap, next_pipe);
 142
 143         if (i == -1) {
 144                 DEBUG(0,("ERROR! Out of pipe structures\n"));
 145                 return NULL;
 146         }
 147
 148         next_pipe = (i+1) % MAX_OPEN_PIPES;
 149
 150         for (p = Pipes; p; p = p->next)
 151                 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));
 152
 153         p = (pipes_struct *)malloc(sizeof(*p));
 154
 155         if (!p)
 156                 return NULL;
 157
 158         ZERO_STRUCTP(p);
 159
 160         if ((p->mem_ctx = talloc_init()) == NULL) {
 161                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
 162                 free(p);
 163                 return NULL;
 164         }
 165
 166         if (!init_pipe_handle_list(p, pipe_name)) {
 167                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
 168                 talloc_destroy(p->mem_ctx);
 169                 free(p);
 170                 return NULL;
 171         }
 172
 173
 174         DLIST_ADD(Pipes, p);
 175
 176         /*
 177          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 178          * We cheat here and say we're marshalling, as we intend to add incoming
 179          * data directly into the prs_struct and we want it to auto grow. We will
 180          * change the type to UNMARSALLING before processing the stream.
 181          */
 182
 183         if(!prs_init(&p->in_data.data, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 184                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
 185                 return NULL;
 186         }
 187
 188         bitmap_set(bmap, i);
 189         i += pipe_handle_offset;
 190
 191         pipes_open++;
 192
 193         p->pnum = i;
 194
 195         p->open = True;
 196         p->device_state = 0;
 197         p->priority = 0;
 198         p->conn = conn;
 199         p->vuid  = vuid;
 200
 201         p->max_trans_reply = 0;
 202
 203         p->ntlmssp_chal_flags = 0;
 204         p->ntlmssp_auth_validated = False;
 205         p->ntlmssp_auth_requested = False;
 206
 207         p->pipe_bound = False;
 208         p->fault_state = False;
 209         p->endian = RPC_LITTLE_ENDIAN;
 210
 211         /*
 212          * Initialize the incoming RPC struct.
 213          */
 214
 215         p->in_data.pdu_needed_len = 0;
 216         p->in_data.pdu_received_len = 0;
 217
 218         /*
 219          * Initialize the outgoing RPC struct.
 220          */
 221
 222         p->out_data.current_pdu_len = 0;
 223         p->out_data.current_pdu_sent = 0;
 224         p->out_data.data_sent_length = 0;
 225
 226         /*
 227          * Initialize the outgoing RPC data buffer with no memory.
 228          */
 229         prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL);
 230
 231         ZERO_STRUCT(p->pipe_user);
 232
 233         p->pipe_user.uid = (uid_t)-1;
 234         p->pipe_user.gid = (gid_t)-1;
 235
 236         fstrcpy(p->name, pipe_name);
 237
 238         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
 239                  pipe_name, i, pipes_open));
 240
 241         chain_p = p;
 242
 243         /* OVERWRITE p as a temp variable, to display all open pipes */
 244         for (p = Pipes; p; p = p->next)
 245                 DEBUG(5,("open pipes: name %s pnum=%x\n", p->name, p->pnum));
 246
 247         return chain_p;
 248 }
 249
 250 /****************************************************************************
 251  Sets the fault state on incoming packets.
 252 ****************************************************************************/
 253
 254 static void set_incoming_fault(pipes_struct *p)
 255 {
 256         prs_mem_free(&p->in_data.data);
 257         p->in_data.pdu_needed_len = 0;
 258         p->in_data.pdu_received_len = 0;
 259         p->fault_state = True;
 260         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : pnum = 0x%x\n",
 261                 p->name, p->pnum ));
 262 }
 263
 264 /****************************************************************************
 265  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
 266 ****************************************************************************/
 267
 268 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
 269 {
 270         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
 271
 272         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
 273                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
 274                         (unsigned int)p->in_data.pdu_received_len ));
 275
 276         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
 277         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
 278
 279         return (ssize_t)len_needed_to_complete_hdr;
 280 }
 281
 282 /****************************************************************************
 283  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
 284 ****************************************************************************/
 285
 286 static ssize_t unmarshall_rpc_header(pipes_struct *p)
 287 {
 288         /*
 289          * Unmarshall the header to determine the needed length.
 290          */
 291
 292         prs_struct rpc_in;
 293
 294         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
 295                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
 296                 set_incoming_fault(p);
 297                 return -1;
 298         }
 299
 300         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 301         prs_set_endian_data( &rpc_in, p->endian);
 302
 303         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
 304                                         p->in_data.pdu_received_len, False);
 305
 306         /*
 307          * Unmarshall the header as this will tell us how much
 308          * data we need to read to get the complete pdu.
 309          * This also sets the endian flag in rpc_in.
 310          */
 311
 312         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
 313                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
 314                 set_incoming_fault(p);
 315                 prs_mem_free(&rpc_in);
 316                 return -1;
 317         }
 318
 319         /*
 320          * Validate the RPC header.
 321          */
 322
 323         if(p->hdr.major != 5 && p->hdr.minor != 0) {
 324                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
 325                 set_incoming_fault(p);
 326                 prs_mem_free(&rpc_in);
 327                 return -1;
 328         }
 329
 330         /*
 331          * If there's not data in the incoming buffer this should be the start of a new RPC.
 332          */
 333
 334         if(prs_offset(&p->in_data.data) == 0) {
 335
 336                 /*
 337                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
 338                  */
 339
 340                 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) {
 341                         /*
 342                          * Ensure that the FIRST flag is set. If not then we have
 343                          * a stream missmatch.
 344                          */
 345
 346                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
 347                         set_incoming_fault(p);
 348                         prs_mem_free(&rpc_in);
 349                         return -1;
 350                 }
 351
 352                 /*
 353                  * If this is the first PDU then set the endianness
 354                  * flag in the pipe. We will need this when parsing all
 355                  * data in this RPC.
 356                  */
 357
 358                 p->endian = rpc_in.bigendian_data;
 359
 360                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
 361                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
 362
 363         } else {
 364
 365                 /*
 366                  * If this is *NOT* the first PDU then check the endianness
 367                  * flag in the pipe is the same as that in the PDU.
 368                  */
 369
 370                 if (p->endian != rpc_in.bigendian_data) {
 371                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
 372                         set_incoming_fault(p);
 373                         prs_mem_free(&rpc_in);
 374                         return -1;
 375                 }
 376         }
 377
 378         /*
 379          * Ensure that the pdu length is sane.
 380          */
 381
 382         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > MAX_PDU_FRAG_LEN)) {
 383                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
 384                 set_incoming_fault(p);
 385                 prs_mem_free(&rpc_in);
 386                 return -1;
 387         }
 388
 389         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
 390                         (unsigned int)p->hdr.flags ));
 391
 392         /*
 393          * Adjust for the header we just ate.
 394          */
 395         p->in_data.pdu_received_len = 0;
 396         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
 397
 398         /*
 399          * Null the data we just ate.
 400          */
 401
 402         memset((char *)&p->in_data.current_in_pdu[0], '\0', RPC_HEADER_LEN);
 403
 404         prs_mem_free(&rpc_in);
 405
 406         return 0; /* No extra data processed. */
 407 }
 408
 409 /****************************************************************************
 410  Call this to free any talloc'ed memory. Do this before and after processing
 411  a complete PDU.
 412 ****************************************************************************/
 413
 414 void free_pipe_context(pipes_struct *p)
 415 {
 416         if (p->mem_ctx) {
 417                 DEBUG(3,("free_pipe_context: destroying talloc pool of size %u\n", talloc_pool_size(p->mem_ctx) ));
 418                 talloc_destroy_pool(p->mem_ctx);
 419         } else {
 420                 p->mem_ctx = talloc_init();
 421                 if (p->mem_ctx == NULL)
 422                         p->fault_state = True;
 423         }
 424 }
 425
 426 /****************************************************************************
 427  Processes a request pdu. This will do auth processing if needed, and
 428  appends the data into the complete stream if the LAST flag is not set.
 429 ****************************************************************************/
 430
 431 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 432 {
 433         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
 434         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 435                                 (auth_verify ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 436
 437         if(!p->pipe_bound) {
 438                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
 439                 set_incoming_fault(p);
 440                 return False;
 441         }
 442
 443         /*
 444          * Check if we need to do authentication processing.
 445          * This is only done on requests, not binds.
 446          */
 447
 448         /*
 449          * Read the RPC request header.
 450          */
 451
 452         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
 453                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
 454                 set_incoming_fault(p);
 455                 return False;
 456         }
 457
 458         if(p->ntlmssp_auth_validated && !api_pipe_auth_process(p, rpc_in_p)) {
 459                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
 460                 set_incoming_fault(p);
 461                 return False;
 462         }
 463
 464         if (p->ntlmssp_auth_requested && !p->ntlmssp_auth_validated) {
 465
 466                 /*
 467                  * Authentication _was_ requested and it already failed.
 468                  */
 469
 470                 DEBUG(0,("process_request_pdu: RPC request received on pipe %s where \
 471 authentication failed. Denying the request.\n", p->name));
 472                 set_incoming_fault(p);
 473         return False;
 474     }
 475
 476         /*
 477          * Check the data length doesn't go over the 10Mb limit.
 478          */
 479
 480         if(prs_data_size(&p->in_data.data) + data_len > 10*1024*1024) {
 481                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
 482                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
 483                 set_incoming_fault(p);
 484                 return False;
 485         }
 486
 487         /*
 488          * Append the data portion into the buffer and return.
 489          */
 490
 491         {
 492                 char *data_from = prs_data_p(rpc_in_p) + prs_offset(rpc_in_p);
 493
 494                 if(!prs_append_data(&p->in_data.data, data_from, data_len)) {
 495                         DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
 496                                         (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
 497                         set_incoming_fault(p);
 498                         return False;
 499                 }
 500
 501         }
 502
 503         if(p->hdr.flags & RPC_FLG_LAST) {
 504                 BOOL ret = False;
 505                 /*
 506                  * Ok - we finally have a complete RPC stream.
 507                  * Call the rpc command to process it.
 508                  */
 509
 510                 /*
 511                  * Ensure the internal prs buffer size is *exactly* the same
 512                  * size as the current offset.
 513                  */
 514
 515                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data)))
 516                 {
 517                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
 518                         set_incoming_fault(p);
 519                         return False;
 520                 }
 521
 522                 /*
 523                  * Set the parse offset to the start of the data and set the
 524                  * prs_struct to UNMARSHALL.
 525                  */
 526
 527                 prs_set_offset(&p->in_data.data, 0);
 528                 prs_switch_type(&p->in_data.data, UNMARSHALL);
 529
 530                 /*
 531                  * Process the complete data stream here.
 532                  */
 533
 534                 free_pipe_context(p);
 535
 536                 if(pipe_init_outgoing_data(p))
 537                         ret = api_pipe_request(p);
 538
 539                 free_pipe_context(p);
 540
 541                 /*
 542                  * We have consumed the whole data stream. Set back to
 543                  * marshalling and set the offset back to the start of
 544                  * the buffer to re-use it (we could also do a prs_mem_free()
 545                  * and then re_init on the next start of PDU. Not sure which
 546                  * is best here.... JRA.
 547                  */
 548
 549                 prs_switch_type(&p->in_data.data, MARSHALL);
 550                 prs_set_offset(&p->in_data.data, 0);
 551                 return ret;
 552         }
 553
 554         return True;
 555 }
 556
 557 /****************************************************************************
 558  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
 559  already been parsed and stored in p->hdr.
 560 ****************************************************************************/
 561
 562 static ssize_t process_complete_pdu(pipes_struct *p)
 563 {
 564         prs_struct rpc_in;
 565         size_t data_len = p->in_data.pdu_received_len;
 566         char *data_p = (char *)&p->in_data.current_in_pdu[0];
 567         BOOL reply = False;
 568
 569         if(p->fault_state) {
 570                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
 571                         p->name ));
 572                 set_incoming_fault(p);
 573                 setup_fault_pdu(p, 0x1c010002);
 574                 return (ssize_t)data_len;
 575         }
 576
 577         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 578
 579         /*
 580          * Ensure we're using the corrent endianness for both the
 581          * RPC header flags and the raw data we will be reading from.
 582          */
 583
 584         prs_set_endian_data( &rpc_in, p->endian);
 585         prs_set_endian_data( &p->in_data.data, p->endian);
 586
 587         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
 588
 589         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
 590                         (unsigned int)p->hdr.pkt_type ));
 591
 592         switch (p->hdr.pkt_type) {
 593                 case RPC_BIND:
 594                 case RPC_ALTCONT:
 595                         /*
 596                          * We assume that a pipe bind is only in one pdu.
 597                          */
 598                         if(pipe_init_outgoing_data(p))
 599                                 reply = api_pipe_bind_req(p, &rpc_in);
 600                         break;
 601                 case RPC_BINDRESP:
 602                         /*
 603                          * We assume that a pipe bind_resp is only in one pdu.
 604                          */
 605                         if(pipe_init_outgoing_data(p))
 606                                 reply = api_pipe_bind_auth_resp(p, &rpc_in);
 607                         break;
 608                 case RPC_REQUEST:
 609                         reply = process_request_pdu(p, &rpc_in);
 610                         break;
 611                 default:
 612                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
 613                         break;
 614         }
 615
 616         /* Reset to little endian. Probably don't need this but it won't hurt. */
 617         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
 618
 619         if (!reply) {
 620                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
 621                 set_incoming_fault(p);
 622                 setup_fault_pdu(p, 0x1c010002);
 623                 prs_mem_free(&rpc_in);
 624         } else {
 625                 /*
 626                  * Reset the lengths. We're ready for a new pdu.
 627                  */
 628                 p->in_data.pdu_needed_len = 0;
 629                 p->in_data.pdu_received_len = 0;
 630         }
 631
 632         prs_mem_free(&rpc_in);
 633         return (ssize_t)data_len;
 634 }
 635
 636 /****************************************************************************
 637  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
 638 ****************************************************************************/
 639
 640 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
 641 {
 642         size_t data_to_copy = MIN(n, MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
 643
 644         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
 645                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
 646                 (unsigned int)n ));
 647
 648         if(data_to_copy == 0) {
 649                 /*
 650                  * This is an error - data is being received and there is no
 651                  * space in the PDU. Free the received data and go into the fault state.
 652                  */
 653                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
 654 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
 655                 set_incoming_fault(p);
 656                 return -1;
 657         }
 658
 659         /*
 660          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
 661          * number of bytes before we can do anything.
 662          */
 663
 664         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
 665                 /*
 666                  * Always return here. If we have more data then the RPC_HEADER
 667                  * will be processed the next time around the loop.
 668                  */
 669                 return fill_rpc_header(p, data, data_to_copy);
 670         }
 671
 672         /*
 673          * At this point we know we have at least an RPC_HEADER_LEN amount of data
 674          * stored in current_in_pdu.
 675          */
 676
 677         /*
 678          * If pdu_needed_len is zero this is a new pdu.
 679          * Unmarshall the header so we know how much more
 680          * data we need, then loop again.
 681          */
 682
 683         if(p->in_data.pdu_needed_len == 0)
 684                 return unmarshall_rpc_header(p);
 685
 686         /*
 687          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
 688          * Keep reading until we have a full pdu.
 689          */
 690
 691         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
 692
 693         /*
 694          * Copy as much of the data as we need into the current_in_pdu buffer.
 695          */
 696
 697         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
 698         p->in_data.pdu_received_len += data_to_copy;
 699
 700         /*
 701          * Do we have a complete PDU ?
 702          */
 703
 704         if(p->in_data.pdu_received_len == p->in_data.pdu_needed_len)
 705                 return process_complete_pdu(p);
 706
 707         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
 708                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
 709
 710         return (ssize_t)data_to_copy;
 711
 712 }
 713
 714 /****************************************************************************
 715  Accepts incoming data on an rpc pipe.
 716 ****************************************************************************/
 717
 718 ssize_t write_to_pipe(pipes_struct *p, char *data, size_t n)
 719 {
 720         size_t data_left = n;
 721
 722         DEBUG(6,("write_to_pipe: %x", p->pnum));
 723
 724         DEBUG(6,(" name: %s open: %s len: %d\n",
 725                  p->name, BOOLSTR(p->open), (int)n));
 726
 727         dump_data(50, data, n);
 728
 729         while(data_left) {
 730                 ssize_t data_used;
 731
 732                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
 733
 734                 data_used = process_incoming_data(p, data, data_left);
 735
 736                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
 737
 738                 if(data_used < 0)
 739                         return -1;
 740
 741                 data_left -= data_used;
 742                 data += data_used;
 743         }
 744
 745         return n;
 746 }
 747
 748 /****************************************************************************
 749  Replies to a request to read data from a pipe.
 750
 751  Headers are interspersed with the data at PDU intervals. By the time
 752  this function is called, the start of the data could possibly have been
 753  read by an SMBtrans (file_offset != 0).
 754
 755  Calling create_rpc_reply() here is a hack. The data should already
 756  have been prepared into arrays of headers + data stream sections.
 757 ****************************************************************************/
 758
 759 ssize_t read_from_pipe(pipes_struct *p, char *data, size_t n)
 760 {
 761         uint32 pdu_remaining = 0;
 762         ssize_t data_returned = 0;
 763
 764         if (!p || !p->open) {
 765                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 766                 return -1;
 767         }
 768
 769         DEBUG(6,("read_from_pipe: %x", p->pnum));
 770
 771         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
 772
 773         /*
 774          * We cannot return more than one PDU length per
 775          * read request.
 776          */
 777
 778         /* This condition should result in the connection being closed.
 779            Netapp filers seem to set it to 0xffff which results in domain
 780            authentications failing.  Just ignore it so things work. */
 781
 782         if(n > MAX_PDU_FRAG_LEN) {
 783                 DEBUG(5,("read_from_pipe: too large read (%u) requested on "
 784                          "pipe %s. We can only service %d sized reads.\n",
 785                          (unsigned int)n, p->name, MAX_PDU_FRAG_LEN ));
 786         }
 787
 788         /*
 789          * Determine if there is still data to send in the
 790          * pipe PDU buffer. Always send this first. Never
 791          * send more than is left in the current PDU. The
 792          * client should send a new read request for a new
 793          * PDU.
 794          */
 795
 796         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
 797                 data_returned = (ssize_t)MIN(n, pdu_remaining);
 798
 799                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
 800 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len,
 801                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
 802
 803                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
 804                 p->out_data.current_pdu_sent += (uint32)data_returned;
 805                 goto out;
 806         }
 807
 808         /*
 809          * At this point p->current_pdu_len == p->current_pdu_sent (which
 810          * may of course be zero if this is the first return fragment.
 811          */
 812
 813         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
 814 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
 815                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
 816
 817         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
 818                 /*
 819                  * We have sent all possible data, return 0.
 820                  */
 821                 data_returned = 0;
 822                 goto out;
 823         }
 824
 825         /*
 826          * We need to create a new PDU from the data left in p->rdata.
 827          * Create the header/data/footers. This also sets up the fields
 828          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
 829          * and stores the outgoing PDU in p->current_pdu.
 830          */
 831
 832         if(!create_next_pdu(p)) {
 833                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
 834                 return -1;
 835         }
 836
 837         data_returned = MIN(n, p->out_data.current_pdu_len);
 838
 839         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
 840         p->out_data.current_pdu_sent += (uint32)data_returned;
 841
 842   out:
 843
 844         return data_returned;
 845 }
 846
 847 /****************************************************************************
 848  Wait device state on a pipe. Exactly what this is for is unknown...
 849 ****************************************************************************/
 850
 851 BOOL wait_rpc_pipe_hnd_state(pipes_struct *p, uint16 priority)
 852 {
 853         if (p == NULL)
 854                 return False;
 855
 856         if (p->open) {
 857                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
 858                          priority, p->name));
 859
 860                 p->priority = priority;
 861
 862                 return True;
 863         }
 864
 865         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
 866                  priority, p->name));
 867         return False;
 868 }
 869
 870
 871 /****************************************************************************
 872  Set device state on a pipe. Exactly what this is for is unknown...
 873 ****************************************************************************/
 874
 875 BOOL set_rpc_pipe_hnd_state(pipes_struct *p, uint16 device_state)
 876 {
 877         if (p == NULL)
 878                 return False;
 879
 880         if (p->open) {
 881                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
 882                          device_state, p->name));
 883
 884                 p->device_state = device_state;
 885
 886                 return True;
 887         }
 888
 889         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
 890                  device_state, p->name));
 891         return False;
 892 }
 893
 894
 895 /****************************************************************************
 896  Close an rpc pipe.
 897 ****************************************************************************/
 898
 899 BOOL close_rpc_pipe_hnd(pipes_struct *p, connection_struct *conn)
 900 {
 901         if (!p) {
 902                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
 903                 return False;
 904         }
 905
 906         prs_mem_free(&p->out_data.rdata);
 907         prs_mem_free(&p->in_data.data);
 908
 909         if (p->mem_ctx)
 910                 talloc_destroy(p->mem_ctx);
 911
 912         /* Free the handles database. */
 913         close_policy_by_pipe(p);
 914
 915         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
 916
 917         pipes_open--;
 918
 919         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
 920                  p->name, p->pnum, pipes_open));
 921
 922         DLIST_REMOVE(Pipes, p);
 923
 924         delete_nt_token(&p->pipe_user.nt_user_token);
 925         safe_free(p->pipe_user.groups);
 926
 927         ZERO_STRUCTP(p);
 928
 929         free(p);
 930
 931         return True;
 932 }
 933
 934 /****************************************************************************
 935  Find an rpc pipe given a pipe handle in a buffer and an offset.
 936 ****************************************************************************/
 937
 938 pipes_struct *get_rpc_pipe_p(char *buf, int where)
 939 {
 940         int pnum = SVAL(buf,where);
 941
 942         if (chain_p)
 943                 return chain_p;
 944
 945         return get_rpc_pipe(pnum);
 946 }
 947
 948 /****************************************************************************
 949  Find an rpc pipe given a pipe handle.
 950 ****************************************************************************/
 951
 952 pipes_struct *get_rpc_pipe(int pnum)
 953 {
 954         pipes_struct *p;
 955
 956         DEBUG(4,("search for pipe pnum=%x\n", pnum));
 957
 958         for (p=Pipes;p;p=p->next)
 959                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
 960                           p->name, p->pnum, pipes_open));
 961
 962         for (p=Pipes;p;p=p->next) {
 963                 if (p->pnum == pnum) {
 964                         chain_p = p;
 965                         return p;
 966                 }
 967         }
 968
 969         return NULL;
 970 }