source3/rpc_server/srv_pipe_hnd.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998,
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Jeremy Allison                                    1999.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24 #include "includes.h"
  25
  26 #define PIPE            "\\PIPE\\"
  27 #define PIPELEN         strlen(PIPE)
  28
  29 static smb_np_struct *chain_p;
  30 static int pipes_open;
  31
  32 #ifndef MAX_OPEN_PIPES
  33 #define MAX_OPEN_PIPES 2048
  34 #endif
  35
  36 static smb_np_struct *Pipes;
  37 static pipes_struct *InternalPipes;
  38 static struct bitmap *bmap;
  39
  40 /* TODO
  41  * the following prototypes are declared here to avoid
  42  * code being moved about too much for a patch to be
  43  * disrupted / less obvious.
  44  *
  45  * these functions, and associated functions that they
  46  * call, should be moved behind a .so module-loading
  47  * system _anyway_.  so that's the next step...
  48  */
  49
  50 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
  51                 BOOL *is_data_outstanding);
  52 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n);
  53 static BOOL close_internal_rpc_pipe_hnd(void *np_conn);
  54 static void *make_internal_rpc_pipe_p(char *pipe_name,
  55                               connection_struct *conn, uint16 vuid);
  56
  57 /****************************************************************************
  58  Pipe iterator functions.
  59 ****************************************************************************/
  60
  61 smb_np_struct *get_first_pipe(void)
  62 {
  63         return Pipes;
  64 }
  65
  66 smb_np_struct *get_next_pipe(smb_np_struct *p)
  67 {
  68         return p->next;
  69 }
  70
  71 /****************************************************************************
  72  Internal Pipe iterator functions.
  73 ****************************************************************************/
  74
  75 pipes_struct *get_first_internal_pipe(void)
  76 {
  77         return InternalPipes;
  78 }
  79
  80 pipes_struct *get_next_internal_pipe(pipes_struct *p)
  81 {
  82         return p->next;
  83 }
  84
  85 /* this must be larger than the sum of the open files and directories */
  86 static int pipe_handle_offset;
  87
  88 /****************************************************************************
  89  Set the pipe_handle_offset. Called from smbd/files.c
  90 ****************************************************************************/
  91
  92 void set_pipe_handle_offset(int max_open_files)
  93 {
  94   if(max_open_files < 0x7000)
  95     pipe_handle_offset = 0x7000;
  96   else
  97     pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
  98 }
  99
 100 /****************************************************************************
 101  Reset pipe chain handle number.
 102 ****************************************************************************/
 103 void reset_chain_p(void)
 104 {
 105         chain_p = NULL;
 106 }
 107
 108 /****************************************************************************
 109  Initialise pipe handle states.
 110 ****************************************************************************/
 111
 112 void init_rpc_pipe_hnd(void)
 113 {
 114         bmap = bitmap_allocate(MAX_OPEN_PIPES);
 115         if (!bmap)
 116                 exit_server("out of memory in init_rpc_pipe_hnd");
 117 }
 118
 119 /****************************************************************************
 120  Initialise an outgoing packet.
 121 ****************************************************************************/
 122
 123 static BOOL pipe_init_outgoing_data(pipes_struct *p)
 124 {
 125         output_data *o_data = &p->out_data;
 126
 127         /* Reset the offset counters. */
 128         o_data->data_sent_length = 0;
 129         o_data->current_pdu_len = 0;
 130         o_data->current_pdu_sent = 0;
 131
 132         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
 133
 134         /* Free any memory in the current return data buffer. */
 135         prs_mem_free(&o_data->rdata);
 136
 137         /*
 138          * Initialize the outgoing RPC data buffer.
 139          * we will use this as the raw data area for replying to rpc requests.
 140          */
 141         if(!prs_init(&o_data->rdata, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 142                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
 143                 return False;
 144         }
 145
 146         return True;
 147 }
 148
 149 /****************************************************************************
 150  Find first available pipe slot.
 151 ****************************************************************************/
 152
 153 smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 154                               connection_struct *conn, uint16 vuid)
 155 {
 156         int i;
 157         smb_np_struct *p, *p_it;
 158         static int next_pipe;
 159
 160         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
 161                  pipe_name, pipes_open));
 162
 163
 164         /* not repeating pipe numbers makes it easier to track things in
 165            log files and prevents client bugs where pipe numbers are reused
 166            over connection restarts */
 167         if (next_pipe == 0)
 168                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
 169
 170         i = bitmap_find(bmap, next_pipe);
 171
 172         if (i == -1) {
 173                 DEBUG(0,("ERROR! Out of pipe structures\n"));
 174                 return NULL;
 175         }
 176
 177         next_pipe = (i+1) % MAX_OPEN_PIPES;
 178
 179         for (p = Pipes; p; p = p->next)
 180                 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));
 181
 182         p = (smb_np_struct *)malloc(sizeof(*p));
 183
 184         if (!p)
 185         {
 186                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 187                 return NULL;
 188         }
 189
 190         ZERO_STRUCTP(p);
 191
 192         /* add a dso mechanism instead of this, here */
 193
 194         p->namedpipe_create = make_internal_rpc_pipe_p;
 195         p->namedpipe_read = read_from_internal_pipe;
 196         p->namedpipe_write = write_to_internal_pipe;
 197         p->namedpipe_close = close_internal_rpc_pipe_hnd;
 198
 199         p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
 200
 201         if (p->np_state == NULL) {
 202
 203                 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
 204                 SAFE_FREE(p);
 205                 return NULL;
 206         }
 207
 208
 209         DLIST_ADD(Pipes, p);
 210
 211         /*
 212          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 213          * We cheat here and say we're marshalling, as we intend to add incoming
 214          * data directly into the prs_struct and we want it to auto grow. We will
 215          * change the type to UNMARSALLING before processing the stream.
 216          */
 217
 218         bitmap_set(bmap, i);
 219         i += pipe_handle_offset;
 220
 221         pipes_open++;
 222
 223         p->pnum = i;
 224
 225         p->open = True;
 226         p->device_state = 0;
 227         p->priority = 0;
 228         p->conn = conn;
 229         p->vuid  = vuid;
 230
 231         p->max_trans_reply = 0;
 232
 233         fstrcpy(p->name, pipe_name);
 234
 235         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
 236                  pipe_name, i, pipes_open));
 237
 238         chain_p = p;
 239
 240         /* Iterate over p_it as a temp variable, to display all open pipes */
 241         for (p_it = Pipes; p_it; p_it = p_it->next)
 242                 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum));
 243
 244         return chain_p;
 245 }
 246
 247 /****************************************************************************
 248  * make an internal namedpipes structure
 249 ****************************************************************************/
 250
 251 static void *make_internal_rpc_pipe_p(char *pipe_name,
 252                               connection_struct *conn, uint16 vuid)
 253 {
 254         pipes_struct *p;
 255
 256         DEBUG(4,("Create pipe requested %s\n", pipe_name));
 257
 258         p = (pipes_struct *)malloc(sizeof(*p));
 259
 260         if (!p)
 261         {
 262                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 263                 return NULL;
 264         }
 265
 266         ZERO_STRUCTP(p);
 267
 268         if ((p->mem_ctx = talloc_init()) == NULL) {
 269                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
 270                 SAFE_FREE(p);
 271                 return NULL;
 272         }
 273
 274         if (!init_pipe_handle_list(p, pipe_name)) {
 275                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
 276                 talloc_destroy(p->mem_ctx);
 277                 SAFE_FREE(p);
 278                 return NULL;
 279         }
 280
 281         /*
 282          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 283          * We cheat here and say we're marshalling, as we intend to add incoming
 284          * data directly into the prs_struct and we want it to auto grow. We will
 285          * change the type to UNMARSALLING before processing the stream.
 286          */
 287
 288         if(!prs_init(&p->in_data.data, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 289                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
 290                 return NULL;
 291         }
 292
 293         DLIST_ADD(InternalPipes, p);
 294
 295         p->conn = conn;
 296         p->vuid  = vuid;
 297
 298         p->ntlmssp_chal_flags = 0;
 299         p->ntlmssp_auth_validated = False;
 300         p->ntlmssp_auth_requested = False;
 301
 302         p->pipe_bound = False;
 303         p->fault_state = False;
 304         p->endian = RPC_LITTLE_ENDIAN;
 305
 306         ZERO_STRUCT(p->pipe_user);
 307
 308         p->pipe_user.uid = (uid_t)-1;
 309         p->pipe_user.gid = (gid_t)-1;
 310
 311         /*
 312          * Initialize the incoming RPC struct.
 313          */
 314
 315         p->in_data.pdu_needed_len = 0;
 316         p->in_data.pdu_received_len = 0;
 317
 318         /*
 319          * Initialize the outgoing RPC struct.
 320          */
 321
 322         p->out_data.current_pdu_len = 0;
 323         p->out_data.current_pdu_sent = 0;
 324         p->out_data.data_sent_length = 0;
 325
 326         /*
 327          * Initialize the outgoing RPC data buffer with no memory.
 328          */
 329         prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL);
 330
 331         fstrcpy(p->name, pipe_name);
 332
 333         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
 334                  pipe_name, pipes_open));
 335
 336         return (void*)p;
 337 }
 338
 339 /****************************************************************************
 340  Sets the fault state on incoming packets.
 341 ****************************************************************************/
 342
 343 static void set_incoming_fault(pipes_struct *p)
 344 {
 345         prs_mem_free(&p->in_data.data);
 346         p->in_data.pdu_needed_len = 0;
 347         p->in_data.pdu_received_len = 0;
 348         p->fault_state = True;
 349         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n",
 350                 p->name, p->vuid ));
 351 }
 352
 353 /****************************************************************************
 354  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
 355 ****************************************************************************/
 356
 357 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
 358 {
 359         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
 360
 361         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
 362                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
 363                         (unsigned int)p->in_data.pdu_received_len ));
 364
 365         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
 366         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
 367
 368         return (ssize_t)len_needed_to_complete_hdr;
 369 }
 370
 371 /****************************************************************************
 372  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
 373 ****************************************************************************/
 374
 375 static ssize_t unmarshall_rpc_header(pipes_struct *p)
 376 {
 377         /*
 378          * Unmarshall the header to determine the needed length.
 379          */
 380
 381         prs_struct rpc_in;
 382
 383         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
 384                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
 385                 set_incoming_fault(p);
 386                 return -1;
 387         }
 388
 389         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 390         prs_set_endian_data( &rpc_in, p->endian);
 391
 392         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
 393                                         p->in_data.pdu_received_len, False);
 394
 395         /*
 396          * Unmarshall the header as this will tell us how much
 397          * data we need to read to get the complete pdu.
 398          * This also sets the endian flag in rpc_in.
 399          */
 400
 401         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
 402                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
 403                 set_incoming_fault(p);
 404                 prs_mem_free(&rpc_in);
 405                 return -1;
 406         }
 407
 408         /*
 409          * Validate the RPC header.
 410          */
 411
 412         if(p->hdr.major != 5 && p->hdr.minor != 0) {
 413                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
 414                 set_incoming_fault(p);
 415                 prs_mem_free(&rpc_in);
 416                 return -1;
 417         }
 418
 419         /*
 420          * If there's not data in the incoming buffer this should be the start of a new RPC.
 421          */
 422
 423         if(prs_offset(&p->in_data.data) == 0) {
 424
 425                 /*
 426                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
 427                  */
 428
 429                 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) {
 430                         /*
 431                          * Ensure that the FIRST flag is set. If not then we have
 432                          * a stream missmatch.
 433                          */
 434
 435                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
 436                         set_incoming_fault(p);
 437                         prs_mem_free(&rpc_in);
 438                         return -1;
 439                 }
 440
 441                 /*
 442                  * If this is the first PDU then set the endianness
 443                  * flag in the pipe. We will need this when parsing all
 444                  * data in this RPC.
 445                  */
 446
 447                 p->endian = rpc_in.bigendian_data;
 448
 449                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
 450                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
 451
 452         } else {
 453
 454                 /*
 455                  * If this is *NOT* the first PDU then check the endianness
 456                  * flag in the pipe is the same as that in the PDU.
 457                  */
 458
 459                 if (p->endian != rpc_in.bigendian_data) {
 460                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
 461                         set_incoming_fault(p);
 462                         prs_mem_free(&rpc_in);
 463                         return -1;
 464                 }
 465         }
 466
 467         /*
 468          * Ensure that the pdu length is sane.
 469          */
 470
 471         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > MAX_PDU_FRAG_LEN)) {
 472                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
 473                 set_incoming_fault(p);
 474                 prs_mem_free(&rpc_in);
 475                 return -1;
 476         }
 477
 478         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
 479                         (unsigned int)p->hdr.flags ));
 480
 481         /*
 482          * Adjust for the header we just ate.
 483          */
 484         p->in_data.pdu_received_len = 0;
 485         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
 486
 487         /*
 488          * Null the data we just ate.
 489          */
 490
 491         memset((char *)&p->in_data.current_in_pdu[0], '\0', RPC_HEADER_LEN);
 492
 493         prs_mem_free(&rpc_in);
 494
 495         return 0; /* No extra data processed. */
 496 }
 497
 498 /****************************************************************************
 499  Call this to free any talloc'ed memory. Do this before and after processing
 500  a complete PDU.
 501 ****************************************************************************/
 502
 503 void free_pipe_context(pipes_struct *p)
 504 {
 505         if (p->mem_ctx) {
 506                 DEBUG(3,("free_pipe_context: destroying talloc pool of size %u\n", talloc_pool_size(p->mem_ctx) ));
 507                 talloc_destroy_pool(p->mem_ctx);
 508         } else {
 509                 p->mem_ctx = talloc_init();
 510                 if (p->mem_ctx == NULL)
 511                         p->fault_state = True;
 512         }
 513 }
 514
 515 /****************************************************************************
 516  Processes a request pdu. This will do auth processing if needed, and
 517  appends the data into the complete stream if the LAST flag is not set.
 518 ****************************************************************************/
 519
 520 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 521 {
 522         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
 523         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 524                                 (auth_verify ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 525
 526         if(!p->pipe_bound) {
 527                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
 528                 set_incoming_fault(p);
 529                 return False;
 530         }
 531
 532         /*
 533          * Check if we need to do authentication processing.
 534          * This is only done on requests, not binds.
 535          */
 536
 537         /*
 538          * Read the RPC request header.
 539          */
 540
 541         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
 542                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
 543                 set_incoming_fault(p);
 544                 return False;
 545         }
 546
 547         if(p->ntlmssp_auth_validated && !api_pipe_auth_process(p, rpc_in_p)) {
 548                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
 549                 set_incoming_fault(p);
 550                 return False;
 551         }
 552
 553         if (p->ntlmssp_auth_requested && !p->ntlmssp_auth_validated) {
 554
 555                 /*
 556                  * Authentication _was_ requested and it already failed.
 557                  */
 558
 559                 DEBUG(0,("process_request_pdu: RPC request received on pipe %s where \
 560 authentication failed. Denying the request.\n", p->name));
 561                 set_incoming_fault(p);
 562         return False;
 563     }
 564
 565         /*
 566          * Check the data length doesn't go over the 10Mb limit.
 567          */
 568
 569         if(prs_data_size(&p->in_data.data) + data_len > 10*1024*1024) {
 570                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
 571                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
 572                 set_incoming_fault(p);
 573                 return False;
 574         }
 575
 576         /*
 577          * Append the data portion into the buffer and return.
 578          */
 579
 580         {
 581                 char *data_from = prs_data_p(rpc_in_p) + prs_offset(rpc_in_p);
 582
 583                 if(!prs_append_data(&p->in_data.data, data_from, data_len)) {
 584                         DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
 585                                         (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
 586                         set_incoming_fault(p);
 587                         return False;
 588                 }
 589
 590         }
 591
 592         if(p->hdr.flags & RPC_FLG_LAST) {
 593                 BOOL ret = False;
 594                 /*
 595                  * Ok - we finally have a complete RPC stream.
 596                  * Call the rpc command to process it.
 597                  */
 598
 599                 /*
 600                  * Ensure the internal prs buffer size is *exactly* the same
 601                  * size as the current offset.
 602                  */
 603
 604                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data)))
 605                 {
 606                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
 607                         set_incoming_fault(p);
 608                         return False;
 609                 }
 610
 611                 /*
 612                  * Set the parse offset to the start of the data and set the
 613                  * prs_struct to UNMARSHALL.
 614                  */
 615
 616                 prs_set_offset(&p->in_data.data, 0);
 617                 prs_switch_type(&p->in_data.data, UNMARSHALL);
 618
 619                 /*
 620                  * Process the complete data stream here.
 621                  */
 622
 623                 free_pipe_context(p);
 624
 625                 if(pipe_init_outgoing_data(p))
 626                         ret = api_pipe_request(p);
 627
 628                 free_pipe_context(p);
 629
 630                 /*
 631                  * We have consumed the whole data stream. Set back to
 632                  * marshalling and set the offset back to the start of
 633                  * the buffer to re-use it (we could also do a prs_mem_free()
 634                  * and then re_init on the next start of PDU. Not sure which
 635                  * is best here.... JRA.
 636                  */
 637
 638                 prs_switch_type(&p->in_data.data, MARSHALL);
 639                 prs_set_offset(&p->in_data.data, 0);
 640                 return ret;
 641         }
 642
 643         return True;
 644 }
 645
 646 /****************************************************************************
 647  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
 648  already been parsed and stored in p->hdr.
 649 ****************************************************************************/
 650
 651 static ssize_t process_complete_pdu(pipes_struct *p)
 652 {
 653         prs_struct rpc_in;
 654         size_t data_len = p->in_data.pdu_received_len;
 655         char *data_p = (char *)&p->in_data.current_in_pdu[0];
 656         BOOL reply = False;
 657
 658         if(p->fault_state) {
 659                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
 660                         p->name ));
 661                 set_incoming_fault(p);
 662                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 663                 return (ssize_t)data_len;
 664         }
 665
 666         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 667
 668         /*
 669          * Ensure we're using the corrent endianness for both the
 670          * RPC header flags and the raw data we will be reading from.
 671          */
 672
 673         prs_set_endian_data( &rpc_in, p->endian);
 674         prs_set_endian_data( &p->in_data.data, p->endian);
 675
 676         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
 677
 678         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
 679                         (unsigned int)p->hdr.pkt_type ));
 680
 681         switch (p->hdr.pkt_type) {
 682                 case RPC_BIND:
 683                 case RPC_ALTCONT:
 684                         /*
 685                          * We assume that a pipe bind is only in one pdu.
 686                          */
 687                         if(pipe_init_outgoing_data(p))
 688                                 reply = api_pipe_bind_req(p, &rpc_in);
 689                         break;
 690                 case RPC_BINDRESP:
 691                         /*
 692                          * We assume that a pipe bind_resp is only in one pdu.
 693                          */
 694                         if(pipe_init_outgoing_data(p))
 695                                 reply = api_pipe_bind_auth_resp(p, &rpc_in);
 696                         break;
 697                 case RPC_REQUEST:
 698                         reply = process_request_pdu(p, &rpc_in);
 699                         break;
 700                 default:
 701                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
 702                         break;
 703         }
 704
 705         /* Reset to little endian. Probably don't need this but it won't hurt. */
 706         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
 707
 708         if (!reply) {
 709                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
 710                 set_incoming_fault(p);
 711                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 712                 prs_mem_free(&rpc_in);
 713         } else {
 714                 /*
 715                  * Reset the lengths. We're ready for a new pdu.
 716                  */
 717                 p->in_data.pdu_needed_len = 0;
 718                 p->in_data.pdu_received_len = 0;
 719         }
 720
 721         prs_mem_free(&rpc_in);
 722         return (ssize_t)data_len;
 723 }
 724
 725 /****************************************************************************
 726  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
 727 ****************************************************************************/
 728
 729 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
 730 {
 731         size_t data_to_copy = MIN(n, MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
 732
 733         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
 734                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
 735                 (unsigned int)n ));
 736
 737         if(data_to_copy == 0) {
 738                 /*
 739                  * This is an error - data is being received and there is no
 740                  * space in the PDU. Free the received data and go into the fault state.
 741                  */
 742                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
 743 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
 744                 set_incoming_fault(p);
 745                 return -1;
 746         }
 747
 748         /*
 749          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
 750          * number of bytes before we can do anything.
 751          */
 752
 753         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
 754                 /*
 755                  * Always return here. If we have more data then the RPC_HEADER
 756                  * will be processed the next time around the loop.
 757                  */
 758                 return fill_rpc_header(p, data, data_to_copy);
 759         }
 760
 761         /*
 762          * At this point we know we have at least an RPC_HEADER_LEN amount of data
 763          * stored in current_in_pdu.
 764          */
 765
 766         /*
 767          * If pdu_needed_len is zero this is a new pdu.
 768          * Unmarshall the header so we know how much more
 769          * data we need, then loop again.
 770          */
 771
 772         if(p->in_data.pdu_needed_len == 0)
 773                 return unmarshall_rpc_header(p);
 774
 775         /*
 776          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
 777          * Keep reading until we have a full pdu.
 778          */
 779
 780         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
 781
 782         /*
 783          * Copy as much of the data as we need into the current_in_pdu buffer.
 784          */
 785
 786         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
 787         p->in_data.pdu_received_len += data_to_copy;
 788
 789         /*
 790          * Do we have a complete PDU ?
 791          */
 792
 793         if(p->in_data.pdu_received_len == p->in_data.pdu_needed_len)
 794                 return process_complete_pdu(p);
 795
 796         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
 797                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
 798
 799         return (ssize_t)data_to_copy;
 800
 801 }
 802
 803 /****************************************************************************
 804  Accepts incoming data on an rpc pipe.
 805 ****************************************************************************/
 806
 807 ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n)
 808 {
 809         DEBUG(6,("write_to_pipe: %x", p->pnum));
 810
 811         DEBUG(6,(" name: %s open: %s len: %d\n",
 812                  p->name, BOOLSTR(p->open), (int)n));
 813
 814         dump_data(50, data, n);
 815
 816         return p->namedpipe_write(p->np_state, data, n);
 817 }
 818
 819 /****************************************************************************
 820  Accepts incoming data on an internal rpc pipe.
 821 ****************************************************************************/
 822
 823 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n)
 824 {
 825         pipes_struct *p = (pipes_struct*)np_conn;
 826         size_t data_left = n;
 827
 828         while(data_left) {
 829                 ssize_t data_used;
 830
 831                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
 832
 833                 data_used = process_incoming_data(p, data, data_left);
 834
 835                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
 836
 837                 if(data_used < 0)
 838                         return -1;
 839
 840                 data_left -= data_used;
 841                 data += data_used;
 842         }
 843
 844         return n;
 845 }
 846
 847 /****************************************************************************
 848  Replies to a request to read data from a pipe.
 849
 850  Headers are interspersed with the data at PDU intervals. By the time
 851  this function is called, the start of the data could possibly have been
 852  read by an SMBtrans (file_offset != 0).
 853
 854  Calling create_rpc_reply() here is a hack. The data should already
 855  have been prepared into arrays of headers + data stream sections.
 856 ****************************************************************************/
 857
 858 ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n,
 859                 BOOL *is_data_outstanding)
 860 {
 861         if (!p || !p->open) {
 862                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 863                 return -1;
 864         }
 865
 866         DEBUG(6,("read_from_pipe: %x", p->pnum));
 867
 868         return p->namedpipe_read(p->np_state, data, n, is_data_outstanding);
 869 }
 870
 871 /****************************************************************************
 872  Replies to a request to read data from a pipe.
 873
 874  Headers are interspersed with the data at PDU intervals. By the time
 875  this function is called, the start of the data could possibly have been
 876  read by an SMBtrans (file_offset != 0).
 877
 878  Calling create_rpc_reply() here is a hack. The data should already
 879  have been prepared into arrays of headers + data stream sections.
 880 ****************************************************************************/
 881
 882 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
 883                 BOOL *is_data_outstanding)
 884 {
 885         pipes_struct *p = (pipes_struct*)np_conn;
 886         uint32 pdu_remaining = 0;
 887         ssize_t data_returned = 0;
 888
 889         if (!p) {
 890                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 891                 return -1;
 892         }
 893
 894         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
 895
 896         /*
 897          * We cannot return more than one PDU length per
 898          * read request.
 899          */
 900
 901         /*
 902          * This condition should result in the connection being closed.
 903          * Netapp filers seem to set it to 0xffff which results in domain
 904          * authentications failing.  Just ignore it so things work.
 905          */
 906
 907         if(n > MAX_PDU_FRAG_LEN) {
 908                 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
 909 pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, MAX_PDU_FRAG_LEN ));
 910         }
 911
 912         /*
 913          * Determine if there is still data to send in the
 914          * pipe PDU buffer. Always send this first. Never
 915          * send more than is left in the current PDU. The
 916          * client should send a new read request for a new
 917          * PDU.
 918          */
 919
 920         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
 921                 data_returned = (ssize_t)MIN(n, pdu_remaining);
 922
 923                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
 924 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len,
 925                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
 926
 927                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
 928                 p->out_data.current_pdu_sent += (uint32)data_returned;
 929                 goto out;
 930         }
 931
 932         /*
 933          * At this point p->current_pdu_len == p->current_pdu_sent (which
 934          * may of course be zero if this is the first return fragment.
 935          */
 936
 937         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
 938 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
 939                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
 940
 941         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
 942                 /*
 943                  * We have sent all possible data, return 0.
 944                  */
 945                 data_returned = 0;
 946                 goto out;
 947         }
 948
 949         /*
 950          * We need to create a new PDU from the data left in p->rdata.
 951          * Create the header/data/footers. This also sets up the fields
 952          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
 953          * and stores the outgoing PDU in p->current_pdu.
 954          */
 955
 956         if(!create_next_pdu(p)) {
 957                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
 958                 return -1;
 959         }
 960
 961         data_returned = MIN(n, p->out_data.current_pdu_len);
 962
 963         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
 964         p->out_data.current_pdu_sent += (uint32)data_returned;
 965
 966   out:
 967
 968         (*is_data_outstanding) = p->out_data.current_pdu_len > n;
 969         return data_returned;
 970 }
 971
 972 /****************************************************************************
 973  Wait device state on a pipe. Exactly what this is for is unknown...
 974 ****************************************************************************/
 975
 976 BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority)
 977 {
 978         if (p == NULL)
 979                 return False;
 980
 981         if (p->open) {
 982                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
 983                          priority, p->name));
 984
 985                 p->priority = priority;
 986
 987                 return True;
 988         }
 989
 990         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
 991                  priority, p->name));
 992         return False;
 993 }
 994
 995
 996 /****************************************************************************
 997  Set device state on a pipe. Exactly what this is for is unknown...
 998 ****************************************************************************/
 999
1000 BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state)
1001 {
1002         if (p == NULL)
1003                 return False;
1004
1005         if (p->open) {
1006                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1007                          device_state, p->name));
1008
1009                 p->device_state = device_state;
1010
1011                 return True;
1012         }
1013
1014         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1015                  device_state, p->name));
1016         return False;
1017 }
1018
1019
1020 /****************************************************************************
1021  Close an rpc pipe.
1022 ****************************************************************************/
1023
1024 BOOL close_rpc_pipe_hnd(smb_np_struct *p)
1025 {
1026         if (!p) {
1027                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1028                 return False;
1029         }
1030
1031         p->namedpipe_close(p->np_state);
1032
1033         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
1034
1035         pipes_open--;
1036
1037         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
1038                  p->name, p->pnum, pipes_open));
1039
1040         DLIST_REMOVE(Pipes, p);
1041
1042         ZERO_STRUCTP(p);
1043
1044         SAFE_FREE(p);
1045
1046         return True;
1047 }
1048
1049 /****************************************************************************
1050  Close an rpc pipe.
1051 ****************************************************************************/
1052
1053 static BOOL close_internal_rpc_pipe_hnd(void *np_conn)
1054 {
1055         pipes_struct *p = (pipes_struct *)np_conn;
1056         if (!p) {
1057                 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1058                 return False;
1059         }
1060
1061         prs_mem_free(&p->out_data.rdata);
1062         prs_mem_free(&p->in_data.data);
1063
1064         if (p->mem_ctx)
1065                 talloc_destroy(p->mem_ctx);
1066
1067         /* Free the handles database. */
1068         close_policy_by_pipe(p);
1069
1070         delete_nt_token(&p->pipe_user.nt_user_token);
1071         SAFE_FREE(p->pipe_user.groups);
1072
1073         DLIST_REMOVE(InternalPipes, p);
1074
1075         ZERO_STRUCTP(p);
1076
1077         SAFE_FREE(p);
1078
1079         return True;
1080 }
1081
1082 /****************************************************************************
1083  Find an rpc pipe given a pipe handle in a buffer and an offset.
1084 ****************************************************************************/
1085
1086 smb_np_struct *get_rpc_pipe_p(char *buf, int where)
1087 {
1088         int pnum = SVAL(buf,where);
1089
1090         if (chain_p)
1091                 return chain_p;
1092
1093         return get_rpc_pipe(pnum);
1094 }
1095
1096 /****************************************************************************
1097  Find an rpc pipe given a pipe handle.
1098 ****************************************************************************/
1099
1100 smb_np_struct *get_rpc_pipe(int pnum)
1101 {
1102         smb_np_struct *p;
1103
1104         DEBUG(4,("search for pipe pnum=%x\n", pnum));
1105
1106         for (p=Pipes;p;p=p->next)
1107                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
1108                           p->name, p->pnum, pipes_open));
1109
1110         for (p=Pipes;p;p=p->next) {
1111                 if (p->pnum == pnum) {
1112                         chain_p = p;
1113                         return p;
1114                 }
1115         }
1116
1117         return NULL;
1118 }