This is the current patch from Luke Leighton <lckl@samba-tng.org> to add a
[ira/wip.git] / source3 / rpc_server / srv_pipe_hnd.c
1 /* 
2  *  Unix SMB/Netbios implementation.
3  *  Version 1.9.
4  *  RPC Pipe client / server routines
5  *  Copyright (C) Andrew Tridgell              1992-1998,
6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
7  *  Copyright (C) Jeremy Allison                                    1999.
8  *  
9  *  This program is free software; you can redistribute it and/or modify
10  *  it under the terms of the GNU General Public License as published by
11  *  the Free Software Foundation; either version 2 of the License, or
12  *  (at your option) any later version.
13  *  
14  *  This program is distributed in the hope that it will be useful,
15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17  *  GNU General Public License for more details.
18  *  
19  *  You should have received a copy of the GNU General Public License
20  *  along with this program; if not, write to the Free Software
21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22  */
23
24 #include "includes.h"
25
26 #define PIPE            "\\PIPE\\"
27 #define PIPELEN         strlen(PIPE)
28
29 static smb_np_struct *chain_p;
30 static int pipes_open;
31
32 #ifndef MAX_OPEN_PIPES
33 #define MAX_OPEN_PIPES 2048
34 #endif
35
36 static smb_np_struct *Pipes;
37 static pipes_struct *InternalPipes;
38 static struct bitmap *bmap;
39
40 /* TODO
41  * the following prototypes are declared here to avoid
42  * code being moved about too much for a patch to be
43  * disrupted / less obvious.
44  *
45  * these functions, and associated functions that they
46  * call, should be moved behind a .so module-loading
47  * system _anyway_.  so that's the next step...
48  */
49
50 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
51                 BOOL *is_data_outstanding);
52 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n);
53 static BOOL close_internal_rpc_pipe_hnd(void *np_conn);
54 static void *make_internal_rpc_pipe_p(char *pipe_name, 
55                               connection_struct *conn, uint16 vuid);
56
57 /****************************************************************************
58  Pipe iterator functions.
59 ****************************************************************************/
60
61 smb_np_struct *get_first_pipe(void)
62 {
63         return Pipes;
64 }
65
66 smb_np_struct *get_next_pipe(smb_np_struct *p)
67 {
68         return p->next;
69 }
70
71 /****************************************************************************
72  Internal Pipe iterator functions.
73 ****************************************************************************/
74
75 pipes_struct *get_first_internal_pipe(void)
76 {
77         return InternalPipes;
78 }
79
80 pipes_struct *get_next_internal_pipe(pipes_struct *p)
81 {
82         return p->next;
83 }
84
85 /* this must be larger than the sum of the open files and directories */
86 static int pipe_handle_offset;
87
88 /****************************************************************************
89  Set the pipe_handle_offset. Called from smbd/files.c
90 ****************************************************************************/
91
92 void set_pipe_handle_offset(int max_open_files)
93 {
94   if(max_open_files < 0x7000)
95     pipe_handle_offset = 0x7000;
96   else
97     pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
98 }
99
100 /****************************************************************************
101  Reset pipe chain handle number.
102 ****************************************************************************/
103 void reset_chain_p(void)
104 {
105         chain_p = NULL;
106 }
107
108 /****************************************************************************
109  Initialise pipe handle states.
110 ****************************************************************************/
111
112 void init_rpc_pipe_hnd(void)
113 {
114         bmap = bitmap_allocate(MAX_OPEN_PIPES);
115         if (!bmap)
116                 exit_server("out of memory in init_rpc_pipe_hnd");
117 }
118
119 /****************************************************************************
120  Initialise an outgoing packet.
121 ****************************************************************************/
122
123 static BOOL pipe_init_outgoing_data(pipes_struct *p)
124 {
125         output_data *o_data = &p->out_data;
126
127         /* Reset the offset counters. */
128         o_data->data_sent_length = 0;
129         o_data->current_pdu_len = 0;
130         o_data->current_pdu_sent = 0;
131
132         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
133
134         /* Free any memory in the current return data buffer. */
135         prs_mem_free(&o_data->rdata);
136
137         /*
138          * Initialize the outgoing RPC data buffer.
139          * we will use this as the raw data area for replying to rpc requests.
140          */     
141         if(!prs_init(&o_data->rdata, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
142                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
143                 return False;
144         }
145
146         return True;
147 }
148
149 /****************************************************************************
150  Find first available pipe slot.
151 ****************************************************************************/
152
153 smb_np_struct *open_rpc_pipe_p(char *pipe_name, 
154                               connection_struct *conn, uint16 vuid)
155 {
156         int i;
157         smb_np_struct *p, *p_it;
158         static int next_pipe;
159
160         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
161                  pipe_name, pipes_open));
162
163         
164         /* not repeating pipe numbers makes it easier to track things in 
165            log files and prevents client bugs where pipe numbers are reused
166            over connection restarts */
167         if (next_pipe == 0)
168                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
169
170         i = bitmap_find(bmap, next_pipe);
171
172         if (i == -1) {
173                 DEBUG(0,("ERROR! Out of pipe structures\n"));
174                 return NULL;
175         }
176
177         next_pipe = (i+1) % MAX_OPEN_PIPES;
178
179         for (p = Pipes; p; p = p->next)
180                 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));  
181
182         p = (smb_np_struct *)malloc(sizeof(*p));
183
184         if (!p)
185         {
186                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
187                 return NULL;
188         }
189
190         ZERO_STRUCTP(p);
191
192         /* add a dso mechanism instead of this, here */
193
194         p->namedpipe_create = make_internal_rpc_pipe_p;
195         p->namedpipe_read = read_from_internal_pipe;
196         p->namedpipe_write = write_to_internal_pipe;
197         p->namedpipe_close = close_internal_rpc_pipe_hnd;
198
199         p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
200
201         if (p->np_state == NULL) {
202
203                 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
204                 SAFE_FREE(p);
205                 return NULL;
206         }
207
208
209         DLIST_ADD(Pipes, p);
210
211         /*
212          * Initialize the incoming RPC data buffer with one PDU worth of memory.
213          * We cheat here and say we're marshalling, as we intend to add incoming
214          * data directly into the prs_struct and we want it to auto grow. We will
215          * change the type to UNMARSALLING before processing the stream.
216          */
217
218         bitmap_set(bmap, i);
219         i += pipe_handle_offset;
220
221         pipes_open++;
222
223         p->pnum = i;
224
225         p->open = True;
226         p->device_state = 0;
227         p->priority = 0;
228         p->conn = conn;
229         p->vuid  = vuid;
230
231         p->max_trans_reply = 0;
232         
233         fstrcpy(p->name, pipe_name);
234         
235         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
236                  pipe_name, i, pipes_open));
237         
238         chain_p = p;
239         
240         /* Iterate over p_it as a temp variable, to display all open pipes */ 
241         for (p_it = Pipes; p_it; p_it = p_it->next)
242                 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum));  
243
244         return chain_p;
245 }
246
247 /****************************************************************************
248  * make an internal namedpipes structure
249 ****************************************************************************/
250
251 static void *make_internal_rpc_pipe_p(char *pipe_name, 
252                               connection_struct *conn, uint16 vuid)
253 {
254         pipes_struct *p;
255
256         DEBUG(4,("Create pipe requested %s\n", pipe_name));
257
258         p = (pipes_struct *)malloc(sizeof(*p));
259
260         if (!p)
261         {
262                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
263                 return NULL;
264         }
265
266         ZERO_STRUCTP(p);
267
268         if ((p->mem_ctx = talloc_init()) == NULL) {
269                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
270                 SAFE_FREE(p);
271                 return NULL;
272         }
273
274         if (!init_pipe_handle_list(p, pipe_name)) {
275                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
276                 talloc_destroy(p->mem_ctx);
277                 SAFE_FREE(p);
278                 return NULL;
279         }
280
281         /*
282          * Initialize the incoming RPC data buffer with one PDU worth of memory.
283          * We cheat here and say we're marshalling, as we intend to add incoming
284          * data directly into the prs_struct and we want it to auto grow. We will
285          * change the type to UNMARSALLING before processing the stream.
286          */
287
288         if(!prs_init(&p->in_data.data, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
289                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
290                 return NULL;
291         }
292
293         DLIST_ADD(InternalPipes, p);
294
295         p->conn = conn;
296         p->vuid  = vuid;
297
298         p->ntlmssp_chal_flags = 0;
299         p->ntlmssp_auth_validated = False;
300         p->ntlmssp_auth_requested = False;
301
302         p->pipe_bound = False;
303         p->fault_state = False;
304         p->endian = RPC_LITTLE_ENDIAN;
305
306         ZERO_STRUCT(p->pipe_user);
307
308         p->pipe_user.uid = (uid_t)-1;
309         p->pipe_user.gid = (gid_t)-1;
310         
311         /*
312          * Initialize the incoming RPC struct.
313          */
314
315         p->in_data.pdu_needed_len = 0;
316         p->in_data.pdu_received_len = 0;
317
318         /*
319          * Initialize the outgoing RPC struct.
320          */
321
322         p->out_data.current_pdu_len = 0;
323         p->out_data.current_pdu_sent = 0;
324         p->out_data.data_sent_length = 0;
325
326         /*
327          * Initialize the outgoing RPC data buffer with no memory.
328          */     
329         prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL);
330         
331         fstrcpy(p->name, pipe_name);
332         
333         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
334                  pipe_name, pipes_open));
335
336         return (void*)p;
337 }
338
339 /****************************************************************************
340  Sets the fault state on incoming packets.
341 ****************************************************************************/
342
343 static void set_incoming_fault(pipes_struct *p)
344 {
345         prs_mem_free(&p->in_data.data);
346         p->in_data.pdu_needed_len = 0;
347         p->in_data.pdu_received_len = 0;
348         p->fault_state = True;
349         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n",
350                 p->name, p->vuid ));
351 }
352
353 /****************************************************************************
354  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
355 ****************************************************************************/
356
357 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
358 {
359         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
360
361         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
362                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
363                         (unsigned int)p->in_data.pdu_received_len ));
364
365         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
366         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
367
368         return (ssize_t)len_needed_to_complete_hdr;
369 }
370
371 /****************************************************************************
372  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
373 ****************************************************************************/
374
375 static ssize_t unmarshall_rpc_header(pipes_struct *p)
376 {
377         /*
378          * Unmarshall the header to determine the needed length.
379          */
380
381         prs_struct rpc_in;
382
383         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
384                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
385                 set_incoming_fault(p);
386                 return -1;
387         }
388
389         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
390         prs_set_endian_data( &rpc_in, p->endian);
391
392         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
393                                         p->in_data.pdu_received_len, False);
394
395         /*
396          * Unmarshall the header as this will tell us how much
397          * data we need to read to get the complete pdu.
398          * This also sets the endian flag in rpc_in.
399          */
400
401         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
402                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
403                 set_incoming_fault(p);
404                 prs_mem_free(&rpc_in);
405                 return -1;
406         }
407
408         /*
409          * Validate the RPC header.
410          */
411
412         if(p->hdr.major != 5 && p->hdr.minor != 0) {
413                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
414                 set_incoming_fault(p);
415                 prs_mem_free(&rpc_in);
416                 return -1;
417         }
418
419         /*
420          * If there's not data in the incoming buffer this should be the start of a new RPC.
421          */
422
423         if(prs_offset(&p->in_data.data) == 0) {
424
425                 /*
426                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
427                  */
428
429                 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) {
430                         /*
431                          * Ensure that the FIRST flag is set. If not then we have
432                          * a stream missmatch.
433                          */
434
435                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
436                         set_incoming_fault(p);
437                         prs_mem_free(&rpc_in);
438                         return -1;
439                 }
440
441                 /*
442                  * If this is the first PDU then set the endianness
443                  * flag in the pipe. We will need this when parsing all
444                  * data in this RPC.
445                  */
446
447                 p->endian = rpc_in.bigendian_data;
448
449                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
450                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
451
452         } else {
453
454                 /*
455                  * If this is *NOT* the first PDU then check the endianness
456                  * flag in the pipe is the same as that in the PDU.
457                  */
458
459                 if (p->endian != rpc_in.bigendian_data) {
460                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
461                         set_incoming_fault(p);
462                         prs_mem_free(&rpc_in);
463                         return -1;
464                 }
465         }
466
467         /*
468          * Ensure that the pdu length is sane.
469          */
470
471         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > MAX_PDU_FRAG_LEN)) {
472                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
473                 set_incoming_fault(p);
474                 prs_mem_free(&rpc_in);
475                 return -1;
476         }
477
478         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
479                         (unsigned int)p->hdr.flags ));
480
481         /*
482          * Adjust for the header we just ate.
483          */
484         p->in_data.pdu_received_len = 0;
485         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
486
487         /*
488          * Null the data we just ate.
489          */
490
491         memset((char *)&p->in_data.current_in_pdu[0], '\0', RPC_HEADER_LEN);
492
493         prs_mem_free(&rpc_in);
494
495         return 0; /* No extra data processed. */
496 }
497
498 /****************************************************************************
499  Call this to free any talloc'ed memory. Do this before and after processing
500  a complete PDU.
501 ****************************************************************************/
502
503 void free_pipe_context(pipes_struct *p)
504 {
505         if (p->mem_ctx) {
506                 DEBUG(3,("free_pipe_context: destroying talloc pool of size %u\n", talloc_pool_size(p->mem_ctx) ));
507                 talloc_destroy_pool(p->mem_ctx);
508         } else {
509                 p->mem_ctx = talloc_init();
510                 if (p->mem_ctx == NULL)
511                         p->fault_state = True;
512         }
513 }
514
515 /****************************************************************************
516  Processes a request pdu. This will do auth processing if needed, and
517  appends the data into the complete stream if the LAST flag is not set.
518 ****************************************************************************/
519
520 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
521 {
522         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
523         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
524                                 (auth_verify ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
525
526         if(!p->pipe_bound) {
527                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
528                 set_incoming_fault(p);
529                 return False;
530         }
531
532         /*
533          * Check if we need to do authentication processing.
534          * This is only done on requests, not binds.
535          */
536
537         /*
538          * Read the RPC request header.
539          */
540
541         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
542                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
543                 set_incoming_fault(p);
544                 return False;
545         }
546
547         if(p->ntlmssp_auth_validated && !api_pipe_auth_process(p, rpc_in_p)) {
548                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
549                 set_incoming_fault(p);
550                 return False;
551         }
552
553         if (p->ntlmssp_auth_requested && !p->ntlmssp_auth_validated) {
554
555                 /*
556                  * Authentication _was_ requested and it already failed.
557                  */
558
559                 DEBUG(0,("process_request_pdu: RPC request received on pipe %s where \
560 authentication failed. Denying the request.\n", p->name));
561                 set_incoming_fault(p);
562         return False;
563     }
564
565         /*
566          * Check the data length doesn't go over the 10Mb limit.
567          */
568         
569         if(prs_data_size(&p->in_data.data) + data_len > 10*1024*1024) {
570                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
571                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
572                 set_incoming_fault(p);
573                 return False;
574         }
575
576         /*
577          * Append the data portion into the buffer and return.
578          */
579
580         {
581                 char *data_from = prs_data_p(rpc_in_p) + prs_offset(rpc_in_p);
582
583                 if(!prs_append_data(&p->in_data.data, data_from, data_len)) {
584                         DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
585                                         (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
586                         set_incoming_fault(p);
587                         return False;
588                 }
589
590         }
591
592         if(p->hdr.flags & RPC_FLG_LAST) {
593                 BOOL ret = False;
594                 /*
595                  * Ok - we finally have a complete RPC stream.
596                  * Call the rpc command to process it.
597                  */
598
599                 /*
600                  * Ensure the internal prs buffer size is *exactly* the same
601                  * size as the current offset.
602                  */
603
604                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data)))
605                 {
606                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
607                         set_incoming_fault(p);
608                         return False;
609                 }
610
611                 /*
612                  * Set the parse offset to the start of the data and set the
613                  * prs_struct to UNMARSHALL.
614                  */
615
616                 prs_set_offset(&p->in_data.data, 0);
617                 prs_switch_type(&p->in_data.data, UNMARSHALL);
618
619                 /*
620                  * Process the complete data stream here.
621                  */
622
623                 free_pipe_context(p);
624
625                 if(pipe_init_outgoing_data(p))
626                         ret = api_pipe_request(p);
627
628                 free_pipe_context(p);
629
630                 /*
631                  * We have consumed the whole data stream. Set back to
632                  * marshalling and set the offset back to the start of
633                  * the buffer to re-use it (we could also do a prs_mem_free()
634                  * and then re_init on the next start of PDU. Not sure which
635                  * is best here.... JRA.
636                  */
637
638                 prs_switch_type(&p->in_data.data, MARSHALL);
639                 prs_set_offset(&p->in_data.data, 0);
640                 return ret;
641         }
642
643         return True;
644 }
645
646 /****************************************************************************
647  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
648  already been parsed and stored in p->hdr.
649 ****************************************************************************/
650
651 static ssize_t process_complete_pdu(pipes_struct *p)
652 {
653         prs_struct rpc_in;
654         size_t data_len = p->in_data.pdu_received_len;
655         char *data_p = (char *)&p->in_data.current_in_pdu[0];
656         BOOL reply = False;
657
658         if(p->fault_state) {
659                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
660                         p->name ));
661                 set_incoming_fault(p);
662                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
663                 return (ssize_t)data_len;
664         }
665
666         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
667
668         /*
669          * Ensure we're using the corrent endianness for both the 
670          * RPC header flags and the raw data we will be reading from.
671          */
672
673         prs_set_endian_data( &rpc_in, p->endian);
674         prs_set_endian_data( &p->in_data.data, p->endian);
675
676         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
677
678         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
679                         (unsigned int)p->hdr.pkt_type ));
680
681         switch (p->hdr.pkt_type) {
682                 case RPC_BIND:
683                 case RPC_ALTCONT:
684                         /*
685                          * We assume that a pipe bind is only in one pdu.
686                          */
687                         if(pipe_init_outgoing_data(p))
688                                 reply = api_pipe_bind_req(p, &rpc_in);
689                         break;
690                 case RPC_BINDRESP:
691                         /*
692                          * We assume that a pipe bind_resp is only in one pdu.
693                          */
694                         if(pipe_init_outgoing_data(p))
695                                 reply = api_pipe_bind_auth_resp(p, &rpc_in);
696                         break;
697                 case RPC_REQUEST:
698                         reply = process_request_pdu(p, &rpc_in);
699                         break;
700                 default:
701                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
702                         break;
703         }
704
705         /* Reset to little endian. Probably don't need this but it won't hurt. */
706         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
707
708         if (!reply) {
709                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
710                 set_incoming_fault(p);
711                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
712                 prs_mem_free(&rpc_in);
713         } else {
714                 /*
715                  * Reset the lengths. We're ready for a new pdu.
716                  */
717                 p->in_data.pdu_needed_len = 0;
718                 p->in_data.pdu_received_len = 0;
719         }
720
721         prs_mem_free(&rpc_in);
722         return (ssize_t)data_len;
723 }
724
725 /****************************************************************************
726  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
727 ****************************************************************************/
728
729 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
730 {
731         size_t data_to_copy = MIN(n, MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
732
733         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
734                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
735                 (unsigned int)n ));
736
737         if(data_to_copy == 0) {
738                 /*
739                  * This is an error - data is being received and there is no
740                  * space in the PDU. Free the received data and go into the fault state.
741                  */
742                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
743 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
744                 set_incoming_fault(p);
745                 return -1;
746         }
747
748         /*
749          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
750          * number of bytes before we can do anything.
751          */
752
753         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
754                 /*
755                  * Always return here. If we have more data then the RPC_HEADER
756                  * will be processed the next time around the loop.
757                  */
758                 return fill_rpc_header(p, data, data_to_copy);
759         }
760
761         /*
762          * At this point we know we have at least an RPC_HEADER_LEN amount of data
763          * stored in current_in_pdu.
764          */
765
766         /*
767          * If pdu_needed_len is zero this is a new pdu. 
768          * Unmarshall the header so we know how much more
769          * data we need, then loop again.
770          */
771
772         if(p->in_data.pdu_needed_len == 0)
773                 return unmarshall_rpc_header(p);
774
775         /*
776          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
777          * Keep reading until we have a full pdu.
778          */
779
780         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
781
782         /*
783          * Copy as much of the data as we need into the current_in_pdu buffer.
784          */
785
786         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
787         p->in_data.pdu_received_len += data_to_copy;
788
789         /*
790          * Do we have a complete PDU ?
791          */
792
793         if(p->in_data.pdu_received_len == p->in_data.pdu_needed_len)
794                 return process_complete_pdu(p);
795
796         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
797                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
798
799         return (ssize_t)data_to_copy;
800
801 }
802
803 /****************************************************************************
804  Accepts incoming data on an rpc pipe.
805 ****************************************************************************/
806
807 ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n)
808 {
809         DEBUG(6,("write_to_pipe: %x", p->pnum));
810
811         DEBUG(6,(" name: %s open: %s len: %d\n",
812                  p->name, BOOLSTR(p->open), (int)n));
813
814         dump_data(50, data, n);
815
816         return p->namedpipe_write(p->np_state, data, n);
817 }
818
819 /****************************************************************************
820  Accepts incoming data on an internal rpc pipe.
821 ****************************************************************************/
822
823 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n)
824 {
825         pipes_struct *p = (pipes_struct*)np_conn;
826         size_t data_left = n;
827
828         while(data_left) {
829                 ssize_t data_used;
830
831                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
832
833                 data_used = process_incoming_data(p, data, data_left);
834
835                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
836
837                 if(data_used < 0)
838                         return -1;
839
840                 data_left -= data_used;
841                 data += data_used;
842         }       
843
844         return n;
845 }
846
847 /****************************************************************************
848  Replies to a request to read data from a pipe.
849
850  Headers are interspersed with the data at PDU intervals. By the time
851  this function is called, the start of the data could possibly have been
852  read by an SMBtrans (file_offset != 0).
853
854  Calling create_rpc_reply() here is a hack. The data should already
855  have been prepared into arrays of headers + data stream sections.
856 ****************************************************************************/
857
858 ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n,
859                 BOOL *is_data_outstanding)
860 {
861         if (!p || !p->open) {
862                 DEBUG(0,("read_from_pipe: pipe not open\n"));
863                 return -1;              
864         }
865
866         DEBUG(6,("read_from_pipe: %x", p->pnum));
867
868         return p->namedpipe_read(p->np_state, data, n, is_data_outstanding);
869 }
870
871 /****************************************************************************
872  Replies to a request to read data from a pipe.
873
874  Headers are interspersed with the data at PDU intervals. By the time
875  this function is called, the start of the data could possibly have been
876  read by an SMBtrans (file_offset != 0).
877
878  Calling create_rpc_reply() here is a hack. The data should already
879  have been prepared into arrays of headers + data stream sections.
880 ****************************************************************************/
881
882 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
883                 BOOL *is_data_outstanding)
884 {
885         pipes_struct *p = (pipes_struct*)np_conn;
886         uint32 pdu_remaining = 0;
887         ssize_t data_returned = 0;
888
889         if (!p) {
890                 DEBUG(0,("read_from_pipe: pipe not open\n"));
891                 return -1;              
892         }
893
894         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
895
896         /*
897          * We cannot return more than one PDU length per
898          * read request.
899          */
900
901         /*
902          * This condition should result in the connection being closed.  
903          * Netapp filers seem to set it to 0xffff which results in domain
904          * authentications failing.  Just ignore it so things work.
905          */
906
907         if(n > MAX_PDU_FRAG_LEN) {
908                 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
909 pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, MAX_PDU_FRAG_LEN ));
910         }
911
912         /*
913          * Determine if there is still data to send in the
914          * pipe PDU buffer. Always send this first. Never
915          * send more than is left in the current PDU. The
916          * client should send a new read request for a new
917          * PDU.
918          */
919
920         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
921                 data_returned = (ssize_t)MIN(n, pdu_remaining);
922
923                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
924 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len, 
925                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
926
927                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
928                 p->out_data.current_pdu_sent += (uint32)data_returned;
929                 goto out;
930         }
931
932         /*
933          * At this point p->current_pdu_len == p->current_pdu_sent (which
934          * may of course be zero if this is the first return fragment.
935          */
936
937         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
938 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
939                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
940
941         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
942                 /*
943                  * We have sent all possible data, return 0.
944                  */
945                 data_returned = 0;
946                 goto out;
947         }
948
949         /*
950          * We need to create a new PDU from the data left in p->rdata.
951          * Create the header/data/footers. This also sets up the fields
952          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
953          * and stores the outgoing PDU in p->current_pdu.
954          */
955
956         if(!create_next_pdu(p)) {
957                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
958                 return -1;
959         }
960
961         data_returned = MIN(n, p->out_data.current_pdu_len);
962
963         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
964         p->out_data.current_pdu_sent += (uint32)data_returned;
965
966   out:
967
968         (*is_data_outstanding) = p->out_data.current_pdu_len > n;
969         return data_returned;
970 }
971
972 /****************************************************************************
973  Wait device state on a pipe. Exactly what this is for is unknown...
974 ****************************************************************************/
975
976 BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority)
977 {
978         if (p == NULL)
979                 return False;
980
981         if (p->open) {
982                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
983                          priority, p->name));
984
985                 p->priority = priority;
986                 
987                 return True;
988         } 
989
990         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
991                  priority, p->name));
992         return False;
993 }
994
995
996 /****************************************************************************
997  Set device state on a pipe. Exactly what this is for is unknown...
998 ****************************************************************************/
999
1000 BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state)
1001 {
1002         if (p == NULL)
1003                 return False;
1004
1005         if (p->open) {
1006                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1007                          device_state, p->name));
1008
1009                 p->device_state = device_state;
1010                 
1011                 return True;
1012         } 
1013
1014         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1015                  device_state, p->name));
1016         return False;
1017 }
1018
1019
1020 /****************************************************************************
1021  Close an rpc pipe.
1022 ****************************************************************************/
1023
1024 BOOL close_rpc_pipe_hnd(smb_np_struct *p)
1025 {
1026         if (!p) {
1027                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1028                 return False;
1029         }
1030
1031         p->namedpipe_close(p->np_state);
1032
1033         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
1034
1035         pipes_open--;
1036
1037         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n", 
1038                  p->name, p->pnum, pipes_open));  
1039
1040         DLIST_REMOVE(Pipes, p);
1041
1042         ZERO_STRUCTP(p);
1043
1044         SAFE_FREE(p);
1045         
1046         return True;
1047 }
1048
1049 /****************************************************************************
1050  Close an rpc pipe.
1051 ****************************************************************************/
1052
1053 static BOOL close_internal_rpc_pipe_hnd(void *np_conn)
1054 {
1055         pipes_struct *p = (pipes_struct *)np_conn;
1056         if (!p) {
1057                 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1058                 return False;
1059         }
1060
1061         prs_mem_free(&p->out_data.rdata);
1062         prs_mem_free(&p->in_data.data);
1063
1064         if (p->mem_ctx)
1065                 talloc_destroy(p->mem_ctx);
1066
1067         /* Free the handles database. */
1068         close_policy_by_pipe(p);
1069
1070         delete_nt_token(&p->pipe_user.nt_user_token);
1071         SAFE_FREE(p->pipe_user.groups);
1072
1073         DLIST_REMOVE(InternalPipes, p);
1074
1075         ZERO_STRUCTP(p);
1076
1077         SAFE_FREE(p);
1078         
1079         return True;
1080 }
1081
1082 /****************************************************************************
1083  Find an rpc pipe given a pipe handle in a buffer and an offset.
1084 ****************************************************************************/
1085
1086 smb_np_struct *get_rpc_pipe_p(char *buf, int where)
1087 {
1088         int pnum = SVAL(buf,where);
1089
1090         if (chain_p)
1091                 return chain_p;
1092
1093         return get_rpc_pipe(pnum);
1094 }
1095
1096 /****************************************************************************
1097  Find an rpc pipe given a pipe handle.
1098 ****************************************************************************/
1099
1100 smb_np_struct *get_rpc_pipe(int pnum)
1101 {
1102         smb_np_struct *p;
1103
1104         DEBUG(4,("search for pipe pnum=%x\n", pnum));
1105
1106         for (p=Pipes;p;p=p->next)
1107                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n", 
1108                           p->name, p->pnum, pipes_open));  
1109
1110         for (p=Pipes;p;p=p->next) {
1111                 if (p->pnum == pnum) {
1112                         chain_p = p;
1113                         return p;
1114                 }
1115         }
1116
1117         return NULL;
1118 }