source3/rpc_server/srv_pipe_hnd.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Largely re-written : 2005
   6  *  Copyright (C) Jeremy Allison                1998 - 2005
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_RPC_SRV
  27
  28 #define PIPE            "\\PIPE\\"
  29 #define PIPELEN         strlen(PIPE)
  30
  31 static smb_np_struct *chain_p;
  32 static int pipes_open;
  33
  34 /*
  35  * Sometimes I can't decide if I hate Windows printer driver
  36  * writers more than I hate the Windows spooler service driver
  37  * writers. This gets around a combination of bugs in the spooler
  38  * and the HP 8500 PCL driver that causes a spooler spin. JRA.
  39  *
  40  * bumped up from 20 -> 64 after viewing traffic from WordPerfect
  41  * 2002 running on NT 4.- SP6
  42  * bumped up from 64 -> 256 after viewing traffic from con2prt
  43  * for lots of printers on a WinNT 4.x SP6 box.
  44  */
  45
  46 #ifndef MAX_OPEN_SPOOLSS_PIPES
  47 #define MAX_OPEN_SPOOLSS_PIPES 256
  48 #endif
  49 static int current_spoolss_pipes_open;
  50
  51 static smb_np_struct *Pipes;
  52 static pipes_struct *InternalPipes;
  53 static struct bitmap *bmap;
  54
  55 /* TODO
  56  * the following prototypes are declared here to avoid
  57  * code being moved about too much for a patch to be
  58  * disrupted / less obvious.
  59  *
  60  * these functions, and associated functions that they
  61  * call, should be moved behind a .so module-loading
  62  * system _anyway_.  so that's the next step...
  63  */
  64
  65 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
  66                 BOOL *is_data_outstanding);
  67 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n);
  68 static BOOL close_internal_rpc_pipe_hnd(void *np_conn);
  69 static void *make_internal_rpc_pipe_p(char *pipe_name,
  70                               connection_struct *conn, uint16 vuid);
  71
  72 /****************************************************************************
  73  Pipe iterator functions.
  74 ****************************************************************************/
  75
  76 smb_np_struct *get_first_pipe(void)
  77 {
  78         return Pipes;
  79 }
  80
  81 smb_np_struct *get_next_pipe(smb_np_struct *p)
  82 {
  83         return p->next;
  84 }
  85
  86 /****************************************************************************
  87  Internal Pipe iterator functions.
  88 ****************************************************************************/
  89
  90 pipes_struct *get_first_internal_pipe(void)
  91 {
  92         return InternalPipes;
  93 }
  94
  95 pipes_struct *get_next_internal_pipe(pipes_struct *p)
  96 {
  97         return p->next;
  98 }
  99
 100 /* this must be larger than the sum of the open files and directories */
 101 static int pipe_handle_offset;
 102
 103 /****************************************************************************
 104  Set the pipe_handle_offset. Called from smbd/files.c
 105 ****************************************************************************/
 106
 107 void set_pipe_handle_offset(int max_open_files)
 108 {
 109         if(max_open_files < 0x7000) {
 110                 pipe_handle_offset = 0x7000;
 111         } else {
 112                 pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
 113         }
 114 }
 115
 116 /****************************************************************************
 117  Reset pipe chain handle number.
 118 ****************************************************************************/
 119
 120 void reset_chain_p(void)
 121 {
 122         chain_p = NULL;
 123 }
 124
 125 /****************************************************************************
 126  Initialise pipe handle states.
 127 ****************************************************************************/
 128
 129 void init_rpc_pipe_hnd(void)
 130 {
 131         bmap = bitmap_allocate(MAX_OPEN_PIPES);
 132         if (!bmap) {
 133                 exit_server("out of memory in init_rpc_pipe_hnd");
 134         }
 135 }
 136
 137 /****************************************************************************
 138  Initialise an outgoing packet.
 139 ****************************************************************************/
 140
 141 static BOOL pipe_init_outgoing_data(pipes_struct *p)
 142 {
 143         output_data *o_data = &p->out_data;
 144
 145         /* Reset the offset counters. */
 146         o_data->data_sent_length = 0;
 147         o_data->current_pdu_len = 0;
 148         o_data->current_pdu_sent = 0;
 149
 150         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
 151
 152         /* Free any memory in the current return data buffer. */
 153         prs_mem_free(&o_data->rdata);
 154
 155         /*
 156          * Initialize the outgoing RPC data buffer.
 157          * we will use this as the raw data area for replying to rpc requests.
 158          */
 159         if(!prs_init(&o_data->rdata, RPC_MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 160                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
 161                 return False;
 162         }
 163
 164         return True;
 165 }
 166
 167 /****************************************************************************
 168  Find first available pipe slot.
 169 ****************************************************************************/
 170
 171 smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 172                               connection_struct *conn, uint16 vuid)
 173 {
 174         int i;
 175         smb_np_struct *p, *p_it;
 176         static int next_pipe;
 177         BOOL is_spoolss_pipe = False;
 178
 179         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
 180                  pipe_name, pipes_open));
 181
 182         if (strstr(pipe_name, "spoolss")) {
 183                 is_spoolss_pipe = True;
 184         }
 185
 186         if (is_spoolss_pipe && current_spoolss_pipes_open >= MAX_OPEN_SPOOLSS_PIPES) {
 187                 DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n",
 188                         pipe_name ));
 189                 return NULL;
 190         }
 191
 192         /* not repeating pipe numbers makes it easier to track things in
 193            log files and prevents client bugs where pipe numbers are reused
 194            over connection restarts */
 195
 196         if (next_pipe == 0) {
 197                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
 198         }
 199
 200         i = bitmap_find(bmap, next_pipe);
 201
 202         if (i == -1) {
 203                 DEBUG(0,("ERROR! Out of pipe structures\n"));
 204                 return NULL;
 205         }
 206
 207         next_pipe = (i+1) % MAX_OPEN_PIPES;
 208
 209         for (p = Pipes; p; p = p->next) {
 210                 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));
 211         }
 212
 213         p = SMB_MALLOC_P(smb_np_struct);
 214         if (!p) {
 215                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 216                 return NULL;
 217         }
 218
 219         ZERO_STRUCTP(p);
 220
 221         /* add a dso mechanism instead of this, here */
 222
 223         p->namedpipe_create = make_internal_rpc_pipe_p;
 224         p->namedpipe_read = read_from_internal_pipe;
 225         p->namedpipe_write = write_to_internal_pipe;
 226         p->namedpipe_close = close_internal_rpc_pipe_hnd;
 227
 228         p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
 229
 230         if (p->np_state == NULL) {
 231                 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
 232                 SAFE_FREE(p);
 233                 return NULL;
 234         }
 235
 236         DLIST_ADD(Pipes, p);
 237
 238         /*
 239          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 240          * We cheat here and say we're marshalling, as we intend to add incoming
 241          * data directly into the prs_struct and we want it to auto grow. We will
 242          * change the type to UNMARSALLING before processing the stream.
 243          */
 244
 245         bitmap_set(bmap, i);
 246         i += pipe_handle_offset;
 247
 248         pipes_open++;
 249
 250         p->pnum = i;
 251
 252         p->open = True;
 253         p->device_state = 0;
 254         p->priority = 0;
 255         p->conn = conn;
 256         p->vuid  = vuid;
 257
 258         p->max_trans_reply = 0;
 259
 260         fstrcpy(p->name, pipe_name);
 261
 262         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
 263                  pipe_name, i, pipes_open));
 264
 265         chain_p = p;
 266
 267         /* Iterate over p_it as a temp variable, to display all open pipes */
 268         for (p_it = Pipes; p_it; p_it = p_it->next) {
 269                 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum));
 270         }
 271
 272         return chain_p;
 273 }
 274
 275 /****************************************************************************
 276  Make an internal namedpipes structure
 277 ****************************************************************************/
 278
 279 static void *make_internal_rpc_pipe_p(char *pipe_name,
 280                               connection_struct *conn, uint16 vuid)
 281 {
 282         pipes_struct *p;
 283         user_struct *vuser = get_valid_user_struct(vuid);
 284
 285         DEBUG(4,("Create pipe requested %s\n", pipe_name));
 286
 287         if (!vuser && vuid != UID_FIELD_INVALID) {
 288                 DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid));
 289                 return NULL;
 290         }
 291
 292         p = SMB_MALLOC_P(pipes_struct);
 293
 294         if (!p) {
 295                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 296                 return NULL;
 297         }
 298
 299         ZERO_STRUCTP(p);
 300
 301         if ((p->mem_ctx = talloc_init("pipe %s %p", pipe_name, p)) == NULL) {
 302                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
 303                 SAFE_FREE(p);
 304                 return NULL;
 305         }
 306
 307         if ((p->pipe_state_mem_ctx = talloc_init("pipe_state %s %p", pipe_name, p)) == NULL) {
 308                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
 309                 talloc_destroy(p->mem_ctx);
 310                 SAFE_FREE(p);
 311                 return NULL;
 312         }
 313
 314         if (!init_pipe_handle_list(p, pipe_name)) {
 315                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
 316                 talloc_destroy(p->mem_ctx);
 317                 talloc_destroy(p->pipe_state_mem_ctx);
 318                 SAFE_FREE(p);
 319                 return NULL;
 320         }
 321
 322         /*
 323          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 324          * We cheat here and say we're marshalling, as we intend to add incoming
 325          * data directly into the prs_struct and we want it to auto grow. We will
 326          * change the type to UNMARSALLING before processing the stream.
 327          */
 328
 329         if(!prs_init(&p->in_data.data, RPC_MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 330                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
 331                 talloc_destroy(p->mem_ctx);
 332                 talloc_destroy(p->pipe_state_mem_ctx);
 333                 close_policy_by_pipe(p);
 334                 SAFE_FREE(p);
 335                 return NULL;
 336         }
 337
 338         DLIST_ADD(InternalPipes, p);
 339
 340         p->conn = conn;
 341
 342         p->vuid  = vuid;
 343
 344         p->endian = RPC_LITTLE_ENDIAN;
 345
 346         ZERO_STRUCT(p->pipe_user);
 347
 348         p->pipe_user.ut.uid = (uid_t)-1;
 349         p->pipe_user.ut.gid = (gid_t)-1;
 350
 351         /* Store the session key and NT_TOKEN */
 352         if (vuser) {
 353                 p->session_key = data_blob(vuser->session_key.data, vuser->session_key.length);
 354         }
 355
 356         /*
 357          * Initialize the outgoing RPC data buffer with no memory.
 358          */
 359         prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL);
 360
 361         fstrcpy(p->name, pipe_name);
 362
 363         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
 364                  pipe_name, pipes_open));
 365
 366         return (void*)p;
 367 }
 368
 369 /****************************************************************************
 370  Sets the fault state on incoming packets.
 371 ****************************************************************************/
 372
 373 static void set_incoming_fault(pipes_struct *p)
 374 {
 375         prs_mem_free(&p->in_data.data);
 376         p->in_data.pdu_needed_len = 0;
 377         p->in_data.pdu_received_len = 0;
 378         p->fault_state = True;
 379         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n",
 380                 p->name, p->vuid ));
 381 }
 382
 383 /****************************************************************************
 384  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
 385 ****************************************************************************/
 386
 387 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
 388 {
 389         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
 390
 391         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
 392                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
 393                         (unsigned int)p->in_data.pdu_received_len ));
 394
 395         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
 396         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
 397
 398         return (ssize_t)len_needed_to_complete_hdr;
 399 }
 400
 401 /****************************************************************************
 402  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
 403 ****************************************************************************/
 404
 405 static ssize_t unmarshall_rpc_header(pipes_struct *p)
 406 {
 407         /*
 408          * Unmarshall the header to determine the needed length.
 409          */
 410
 411         prs_struct rpc_in;
 412
 413         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
 414                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
 415                 set_incoming_fault(p);
 416                 return -1;
 417         }
 418
 419         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 420         prs_set_endian_data( &rpc_in, p->endian);
 421
 422         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
 423                                         p->in_data.pdu_received_len, False);
 424
 425         /*
 426          * Unmarshall the header as this will tell us how much
 427          * data we need to read to get the complete pdu.
 428          * This also sets the endian flag in rpc_in.
 429          */
 430
 431         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
 432                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
 433                 set_incoming_fault(p);
 434                 prs_mem_free(&rpc_in);
 435                 return -1;
 436         }
 437
 438         /*
 439          * Validate the RPC header.
 440          */
 441
 442         if(p->hdr.major != 5 && p->hdr.minor != 0) {
 443                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
 444                 set_incoming_fault(p);
 445                 prs_mem_free(&rpc_in);
 446                 return -1;
 447         }
 448
 449         /*
 450          * If there's not data in the incoming buffer this should be the start of a new RPC.
 451          */
 452
 453         if(prs_offset(&p->in_data.data) == 0) {
 454
 455                 /*
 456                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
 457                  */
 458
 459                 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) {
 460                         /*
 461                          * Ensure that the FIRST flag is set. If not then we have
 462                          * a stream missmatch.
 463                          */
 464
 465                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
 466                         set_incoming_fault(p);
 467                         prs_mem_free(&rpc_in);
 468                         return -1;
 469                 }
 470
 471                 /*
 472                  * If this is the first PDU then set the endianness
 473                  * flag in the pipe. We will need this when parsing all
 474                  * data in this RPC.
 475                  */
 476
 477                 p->endian = rpc_in.bigendian_data;
 478
 479                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
 480                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
 481
 482         } else {
 483
 484                 /*
 485                  * If this is *NOT* the first PDU then check the endianness
 486                  * flag in the pipe is the same as that in the PDU.
 487                  */
 488
 489                 if (p->endian != rpc_in.bigendian_data) {
 490                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
 491                         set_incoming_fault(p);
 492                         prs_mem_free(&rpc_in);
 493                         return -1;
 494                 }
 495         }
 496
 497         /*
 498          * Ensure that the pdu length is sane.
 499          */
 500
 501         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > RPC_MAX_PDU_FRAG_LEN)) {
 502                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
 503                 set_incoming_fault(p);
 504                 prs_mem_free(&rpc_in);
 505                 return -1;
 506         }
 507
 508         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
 509                         (unsigned int)p->hdr.flags ));
 510
 511         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
 512
 513         prs_mem_free(&rpc_in);
 514
 515         return 0; /* No extra data processed. */
 516 }
 517
 518 /****************************************************************************
 519  Call this to free any talloc'ed memory. Do this before and after processing
 520  a complete PDU.
 521 ****************************************************************************/
 522
 523 static void free_pipe_context(pipes_struct *p)
 524 {
 525         if (p->mem_ctx) {
 526                 DEBUG(3,("free_pipe_context: destroying talloc pool of size "
 527                          "%lu\n", (unsigned long)talloc_total_size(p->mem_ctx) ));
 528                 talloc_free_children(p->mem_ctx);
 529         } else {
 530                 p->mem_ctx = talloc_init("pipe %s %p", p->name, p);
 531                 if (p->mem_ctx == NULL) {
 532                         p->fault_state = True;
 533                 }
 534         }
 535 }
 536
 537 /****************************************************************************
 538  Processes a request pdu. This will do auth processing if needed, and
 539  appends the data into the complete stream if the LAST flag is not set.
 540 ****************************************************************************/
 541
 542 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 543 {
 544         uint32 ss_padding_len = 0;
 545         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 546                                 (p->hdr.auth_len ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 547
 548         if(!p->pipe_bound) {
 549                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
 550                 set_incoming_fault(p);
 551                 return False;
 552         }
 553
 554         /*
 555          * Check if we need to do authentication processing.
 556          * This is only done on requests, not binds.
 557          */
 558
 559         /*
 560          * Read the RPC request header.
 561          */
 562
 563         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
 564                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
 565                 set_incoming_fault(p);
 566                 return False;
 567         }
 568
 569         switch(p->auth.auth_type) {
 570                 case PIPE_AUTH_TYPE_NONE:
 571                         break;
 572
 573                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 574                 case PIPE_AUTH_TYPE_NTLMSSP:
 575                 {
 576                         NTSTATUS status;
 577                         if(!api_pipe_ntlmssp_auth_process(p, rpc_in_p, &ss_padding_len, &status)) {
 578                                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
 579                                 DEBUG(0,("process_request_pdu: error was %s.\n", nt_errstr(status) ));
 580                                 set_incoming_fault(p);
 581                                 return False;
 582                         }
 583                         break;
 584                 }
 585
 586                 case PIPE_AUTH_TYPE_SCHANNEL:
 587                         if (!api_pipe_schannel_process(p, rpc_in_p, &ss_padding_len)) {
 588                                 DEBUG(3,("process_request_pdu: failed to do schannel processing.\n"));
 589                                 set_incoming_fault(p);
 590                                 return False;
 591                         }
 592                         break;
 593
 594                 default:
 595                         DEBUG(0,("process_request_pdu: unknown auth type %u set.\n", (unsigned int)p->auth.auth_type ));
 596                         set_incoming_fault(p);
 597                         return False;
 598         }
 599
 600         /* Now we've done the sign/seal we can remove any padding data. */
 601         if (data_len > ss_padding_len) {
 602                 data_len -= ss_padding_len;
 603         }
 604
 605         /*
 606          * Check the data length doesn't go over the 15Mb limit.
 607          * increased after observing a bug in the Windows NT 4.0 SP6a
 608          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
 609          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
 610          */
 611
 612         if(prs_offset(&p->in_data.data) + data_len > 15*1024*1024) {
 613                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
 614                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
 615                 set_incoming_fault(p);
 616                 return False;
 617         }
 618
 619         /*
 620          * Append the data portion into the buffer and return.
 621          */
 622
 623         if(!prs_append_some_prs_data(&p->in_data.data, rpc_in_p, prs_offset(rpc_in_p), data_len)) {
 624                 DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
 625                                 (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
 626                 set_incoming_fault(p);
 627                 return False;
 628         }
 629
 630         if(p->hdr.flags & RPC_FLG_LAST) {
 631                 BOOL ret = False;
 632                 /*
 633                  * Ok - we finally have a complete RPC stream.
 634                  * Call the rpc command to process it.
 635                  */
 636
 637                 /*
 638                  * Ensure the internal prs buffer size is *exactly* the same
 639                  * size as the current offset.
 640                  */
 641
 642                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data))) {
 643                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
 644                         set_incoming_fault(p);
 645                         return False;
 646                 }
 647
 648                 /*
 649                  * Set the parse offset to the start of the data and set the
 650                  * prs_struct to UNMARSHALL.
 651                  */
 652
 653                 prs_set_offset(&p->in_data.data, 0);
 654                 prs_switch_type(&p->in_data.data, UNMARSHALL);
 655
 656                 /*
 657                  * Process the complete data stream here.
 658                  */
 659
 660                 free_pipe_context(p);
 661
 662                 if(pipe_init_outgoing_data(p)) {
 663                         ret = api_pipe_request(p);
 664                 }
 665
 666                 free_pipe_context(p);
 667
 668                 /*
 669                  * We have consumed the whole data stream. Set back to
 670                  * marshalling and set the offset back to the start of
 671                  * the buffer to re-use it (we could also do a prs_mem_free()
 672                  * and then re_init on the next start of PDU. Not sure which
 673                  * is best here.... JRA.
 674                  */
 675
 676                 prs_switch_type(&p->in_data.data, MARSHALL);
 677                 prs_set_offset(&p->in_data.data, 0);
 678                 return ret;
 679         }
 680
 681         return True;
 682 }
 683
 684 /****************************************************************************
 685  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
 686  already been parsed and stored in p->hdr.
 687 ****************************************************************************/
 688
 689 static void process_complete_pdu(pipes_struct *p)
 690 {
 691         prs_struct rpc_in;
 692         size_t data_len = p->in_data.pdu_received_len - RPC_HEADER_LEN;
 693         char *data_p = (char *)&p->in_data.current_in_pdu[RPC_HEADER_LEN];
 694         BOOL reply = False;
 695
 696         if(p->fault_state) {
 697                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
 698                         p->name ));
 699                 set_incoming_fault(p);
 700                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 701                 return;
 702         }
 703
 704         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 705
 706         /*
 707          * Ensure we're using the corrent endianness for both the
 708          * RPC header flags and the raw data we will be reading from.
 709          */
 710
 711         prs_set_endian_data( &rpc_in, p->endian);
 712         prs_set_endian_data( &p->in_data.data, p->endian);
 713
 714         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
 715
 716         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
 717                         (unsigned int)p->hdr.pkt_type ));
 718
 719         switch (p->hdr.pkt_type) {
 720                 case RPC_REQUEST:
 721                         reply = process_request_pdu(p, &rpc_in);
 722                         break;
 723
 724                 case RPC_PING: /* CL request - ignore... */
 725                         DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n",
 726                                 (unsigned int)p->hdr.pkt_type, p->name));
 727                         break;
 728
 729                 case RPC_RESPONSE: /* No responses here. */
 730                         DEBUG(0,("process_complete_pdu: Error. RPC_RESPONSE received from client on pipe %s.\n",
 731                                 p->name ));
 732                         break;
 733
 734                 case RPC_FAULT:
 735                 case RPC_WORKING: /* CL request - reply to a ping when a call in process. */
 736                 case RPC_NOCALL: /* CL - server reply to a ping call. */
 737                 case RPC_REJECT:
 738                 case RPC_ACK:
 739                 case RPC_CL_CANCEL:
 740                 case RPC_FACK:
 741                 case RPC_CANCEL_ACK:
 742                         DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n",
 743                                 (unsigned int)p->hdr.pkt_type, p->name));
 744                         break;
 745
 746                 case RPC_BIND:
 747                         /*
 748                          * We assume that a pipe bind is only in one pdu.
 749                          */
 750                         if(pipe_init_outgoing_data(p)) {
 751                                 reply = api_pipe_bind_req(p, &rpc_in);
 752                         }
 753                         break;
 754
 755                 case RPC_BINDACK:
 756                 case RPC_BINDNACK:
 757                         DEBUG(0,("process_complete_pdu: Error. RPC_BINDACK/RPC_BINDNACK packet type %u received on pipe %s.\n",
 758                                 (unsigned int)p->hdr.pkt_type, p->name));
 759                         break;
 760
 761
 762                 case RPC_ALTCONT:
 763                         /*
 764                          * We assume that a pipe bind is only in one pdu.
 765                          */
 766                         if(pipe_init_outgoing_data(p)) {
 767                                 reply = api_pipe_alter_context(p, &rpc_in);
 768                         }
 769                         break;
 770
 771                 case RPC_ALTCONTRESP:
 772                         DEBUG(0,("process_complete_pdu: Error. RPC_ALTCONTRESP on pipe %s: Should only be server -> client.\n",
 773                                 p->name));
 774                         break;
 775
 776                 case RPC_AUTH3:
 777                         /*
 778                          * The third packet in an NTLMSSP auth exchange.
 779                          */
 780                         if(pipe_init_outgoing_data(p)) {
 781                                 reply = api_pipe_bind_auth3(p, &rpc_in);
 782                         }
 783                         break;
 784
 785                 case RPC_SHUTDOWN:
 786                         DEBUG(0,("process_complete_pdu: Error. RPC_SHUTDOWN on pipe %s: Should only be server -> client.\n",
 787                                 p->name));
 788                         break;
 789
 790                 case RPC_CO_CANCEL:
 791                         /* For now just free all client data and continue processing. */
 792                         DEBUG(3,("process_complete_pdu: RPC_ORPHANED. Abandoning rpc call.\n"));
 793                         /* As we never do asynchronous RPC serving, we can never cancel a
 794                            call (as far as I know). If we ever did we'd have to send a cancel_ack
 795                            reply. For now, just free all client data and continue processing. */
 796                         reply = True;
 797                         break;
 798 #if 0
 799                         /* Enable this if we're doing async rpc. */
 800                         /* We must check the call-id matches the outstanding callid. */
 801                         if(pipe_init_outgoing_data(p)) {
 802                                 /* Send a cancel_ack PDU reply. */
 803                                 /* We should probably check the auth-verifier here. */
 804                                 reply = setup_cancel_ack_reply(p, &rpc_in);
 805                         }
 806                         break;
 807 #endif
 808
 809                 case RPC_ORPHANED:
 810                         /* We should probably check the auth-verifier here.
 811                            For now just free all client data and continue processing. */
 812                         DEBUG(3,("process_complete_pdu: RPC_ORPHANED. Abandoning rpc call.\n"));
 813                         reply = True;
 814                         break;
 815
 816                 default:
 817                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
 818                         break;
 819         }
 820
 821         /* Reset to little endian. Probably don't need this but it won't hurt. */
 822         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
 823
 824         if (!reply) {
 825                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
 826                 set_incoming_fault(p);
 827                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 828                 prs_mem_free(&rpc_in);
 829         } else {
 830                 /*
 831                  * Reset the lengths. We're ready for a new pdu.
 832                  */
 833                 p->in_data.pdu_needed_len = 0;
 834                 p->in_data.pdu_received_len = 0;
 835         }
 836
 837         prs_mem_free(&rpc_in);
 838 }
 839
 840 /****************************************************************************
 841  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
 842 ****************************************************************************/
 843
 844 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
 845 {
 846         size_t data_to_copy = MIN(n, RPC_MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
 847
 848         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
 849                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
 850                 (unsigned int)n ));
 851
 852         if(data_to_copy == 0) {
 853                 /*
 854                  * This is an error - data is being received and there is no
 855                  * space in the PDU. Free the received data and go into the fault state.
 856                  */
 857                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
 858 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
 859                 set_incoming_fault(p);
 860                 return -1;
 861         }
 862
 863         /*
 864          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
 865          * number of bytes before we can do anything.
 866          */
 867
 868         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
 869                 /*
 870                  * Always return here. If we have more data then the RPC_HEADER
 871                  * will be processed the next time around the loop.
 872                  */
 873                 return fill_rpc_header(p, data, data_to_copy);
 874         }
 875
 876         /*
 877          * At this point we know we have at least an RPC_HEADER_LEN amount of data
 878          * stored in current_in_pdu.
 879          */
 880
 881         /*
 882          * If pdu_needed_len is zero this is a new pdu.
 883          * Unmarshall the header so we know how much more
 884          * data we need, then loop again.
 885          */
 886
 887         if(p->in_data.pdu_needed_len == 0) {
 888                 ssize_t rret = unmarshall_rpc_header(p);
 889                 if (rret == -1 || p->in_data.pdu_needed_len > 0) {
 890                         return rret;
 891                 }
 892                 /* If rret == 0 and pdu_needed_len == 0 here we have a PDU that consists
 893                    of an RPC_HEADER only. This is a RPC_SHUTDOWN, RPC_CO_CANCEL or RPC_ORPHANED
 894                    pdu type. Deal with this in process_complete_pdu(). */
 895         }
 896
 897         /*
 898          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
 899          * Keep reading until we have a full pdu.
 900          */
 901
 902         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
 903
 904         /*
 905          * Copy as much of the data as we need into the current_in_pdu buffer.
 906          * pdu_needed_len becomes zero when we have a complete pdu.
 907          */
 908
 909         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
 910         p->in_data.pdu_received_len += data_to_copy;
 911         p->in_data.pdu_needed_len -= data_to_copy;
 912
 913         /*
 914          * Do we have a complete PDU ?
 915          * (return the number of bytes handled in the call)
 916          */
 917
 918         if(p->in_data.pdu_needed_len == 0) {
 919                 process_complete_pdu(p);
 920                 return data_to_copy;
 921         }
 922
 923         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
 924                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
 925
 926         return (ssize_t)data_to_copy;
 927 }
 928
 929 /****************************************************************************
 930  Accepts incoming data on an rpc pipe.
 931 ****************************************************************************/
 932
 933 ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n)
 934 {
 935         DEBUG(6,("write_to_pipe: %x", p->pnum));
 936
 937         DEBUG(6,(" name: %s open: %s len: %d\n",
 938                  p->name, BOOLSTR(p->open), (int)n));
 939
 940         dump_data(50, (uint8 *)data, n);
 941
 942         return p->namedpipe_write(p->np_state, data, n);
 943 }
 944
 945 /****************************************************************************
 946  Accepts incoming data on an internal rpc pipe.
 947 ****************************************************************************/
 948
 949 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n)
 950 {
 951         pipes_struct *p = (pipes_struct*)np_conn;
 952         size_t data_left = n;
 953
 954         while(data_left) {
 955                 ssize_t data_used;
 956
 957                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
 958
 959                 data_used = process_incoming_data(p, data, data_left);
 960
 961                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
 962
 963                 if(data_used < 0) {
 964                         return -1;
 965                 }
 966
 967                 data_left -= data_used;
 968                 data += data_used;
 969         }
 970
 971         return n;
 972 }
 973
 974 /****************************************************************************
 975  Replies to a request to read data from a pipe.
 976
 977  Headers are interspersed with the data at PDU intervals. By the time
 978  this function is called, the start of the data could possibly have been
 979  read by an SMBtrans (file_offset != 0).
 980
 981  Calling create_rpc_reply() here is a hack. The data should already
 982  have been prepared into arrays of headers + data stream sections.
 983 ****************************************************************************/
 984
 985 ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n,
 986                 BOOL *is_data_outstanding)
 987 {
 988         if (!p || !p->open) {
 989                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 990                 return -1;
 991         }
 992
 993         DEBUG(6,("read_from_pipe: %x", p->pnum));
 994
 995         return p->namedpipe_read(p->np_state, data, n, is_data_outstanding);
 996 }
 997
 998 /****************************************************************************
 999  Replies to a request to read data from a pipe.
1000
1001  Headers are interspersed with the data at PDU intervals. By the time
1002  this function is called, the start of the data could possibly have been
1003  read by an SMBtrans (file_offset != 0).
1004
1005  Calling create_rpc_reply() here is a hack. The data should already
1006  have been prepared into arrays of headers + data stream sections.
1007 ****************************************************************************/
1008
1009 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
1010                 BOOL *is_data_outstanding)
1011 {
1012         pipes_struct *p = (pipes_struct*)np_conn;
1013         uint32 pdu_remaining = 0;
1014         ssize_t data_returned = 0;
1015
1016         if (!p) {
1017                 DEBUG(0,("read_from_pipe: pipe not open\n"));
1018                 return -1;
1019         }
1020
1021         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
1022
1023         /*
1024          * We cannot return more than one PDU length per
1025          * read request.
1026          */
1027
1028         /*
1029          * This condition should result in the connection being closed.
1030          * Netapp filers seem to set it to 0xffff which results in domain
1031          * authentications failing.  Just ignore it so things work.
1032          */
1033
1034         if(n > RPC_MAX_PDU_FRAG_LEN) {
1035                 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
1036 pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, RPC_MAX_PDU_FRAG_LEN ));
1037         }
1038
1039         /*
1040          * Determine if there is still data to send in the
1041          * pipe PDU buffer. Always send this first. Never
1042          * send more than is left in the current PDU. The
1043          * client should send a new read request for a new
1044          * PDU.
1045          */
1046
1047         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
1048                 data_returned = (ssize_t)MIN(n, pdu_remaining);
1049
1050                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
1051 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len,
1052                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
1053
1054                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
1055                 p->out_data.current_pdu_sent += (uint32)data_returned;
1056                 goto out;
1057         }
1058
1059         /*
1060          * At this point p->current_pdu_len == p->current_pdu_sent (which
1061          * may of course be zero if this is the first return fragment.
1062          */
1063
1064         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
1065 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
1066                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
1067
1068         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
1069                 /*
1070                  * We have sent all possible data, return 0.
1071                  */
1072                 data_returned = 0;
1073                 goto out;
1074         }
1075
1076         /*
1077          * We need to create a new PDU from the data left in p->rdata.
1078          * Create the header/data/footers. This also sets up the fields
1079          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
1080          * and stores the outgoing PDU in p->current_pdu.
1081          */
1082
1083         if(!create_next_pdu(p)) {
1084                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
1085                 return -1;
1086         }
1087
1088         data_returned = MIN(n, p->out_data.current_pdu_len);
1089
1090         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
1091         p->out_data.current_pdu_sent += (uint32)data_returned;
1092
1093   out:
1094
1095         (*is_data_outstanding) = p->out_data.current_pdu_len > n;
1096         return data_returned;
1097 }
1098
1099 /****************************************************************************
1100  Wait device state on a pipe. Exactly what this is for is unknown...
1101 ****************************************************************************/
1102
1103 BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority)
1104 {
1105         if (p == NULL) {
1106                 return False;
1107         }
1108
1109         if (p->open) {
1110                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
1111                          priority, p->name));
1112
1113                 p->priority = priority;
1114
1115                 return True;
1116         }
1117
1118         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
1119                  priority, p->name));
1120         return False;
1121 }
1122
1123
1124 /****************************************************************************
1125  Set device state on a pipe. Exactly what this is for is unknown...
1126 ****************************************************************************/
1127
1128 BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state)
1129 {
1130         if (p == NULL) {
1131                 return False;
1132         }
1133
1134         if (p->open) {
1135                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1136                          device_state, p->name));
1137
1138                 p->device_state = device_state;
1139
1140                 return True;
1141         }
1142
1143         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1144                  device_state, p->name));
1145         return False;
1146 }
1147
1148
1149 /****************************************************************************
1150  Close an rpc pipe.
1151 ****************************************************************************/
1152
1153 BOOL close_rpc_pipe_hnd(smb_np_struct *p)
1154 {
1155         if (!p) {
1156                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1157                 return False;
1158         }
1159
1160         p->namedpipe_close(p->np_state);
1161
1162         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
1163
1164         pipes_open--;
1165
1166         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
1167                  p->name, p->pnum, pipes_open));
1168
1169         DLIST_REMOVE(Pipes, p);
1170
1171         /* TODO: Remove from pipe open db */
1172
1173         if ( !delete_pipe_opendb( p ) ) {
1174                 DEBUG(3,("close_rpc_pipe_hnd: failed to delete %s "
1175                         "pipe from open db.\n", p->name));
1176         }
1177
1178         ZERO_STRUCTP(p);
1179
1180         SAFE_FREE(p);
1181
1182         return True;
1183 }
1184
1185 /****************************************************************************
1186  Close all pipes on a connection.
1187 ****************************************************************************/
1188
1189 void pipe_close_conn(connection_struct *conn)
1190 {
1191         smb_np_struct *p, *next;
1192
1193         for (p=Pipes;p;p=next) {
1194                 next = p->next;
1195                 if (p->conn == conn) {
1196                         close_rpc_pipe_hnd(p);
1197                 }
1198         }
1199 }
1200
1201 /****************************************************************************
1202  Close an rpc pipe.
1203 ****************************************************************************/
1204
1205 static BOOL close_internal_rpc_pipe_hnd(void *np_conn)
1206 {
1207         pipes_struct *p = (pipes_struct *)np_conn;
1208         if (!p) {
1209                 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1210                 return False;
1211         }
1212
1213         prs_mem_free(&p->out_data.rdata);
1214         prs_mem_free(&p->in_data.data);
1215
1216         if (p->auth.auth_data_free_func) {
1217                 (*p->auth.auth_data_free_func)(&p->auth);
1218         }
1219
1220         if (p->mem_ctx) {
1221                 talloc_destroy(p->mem_ctx);
1222         }
1223
1224         if (p->pipe_state_mem_ctx) {
1225                 talloc_destroy(p->pipe_state_mem_ctx);
1226         }
1227
1228         free_pipe_rpc_context( p->contexts );
1229
1230         /* Free the handles database. */
1231         close_policy_by_pipe(p);
1232
1233         TALLOC_FREE(p->pipe_user.nt_user_token);
1234         data_blob_free(&p->session_key);
1235         SAFE_FREE(p->pipe_user.ut.groups);
1236
1237         DLIST_REMOVE(InternalPipes, p);
1238
1239         ZERO_STRUCTP(p);
1240
1241         SAFE_FREE(p);
1242
1243         return True;
1244 }
1245
1246 /****************************************************************************
1247  Find an rpc pipe given a pipe handle in a buffer and an offset.
1248 ****************************************************************************/
1249
1250 smb_np_struct *get_rpc_pipe_p(char *buf, int where)
1251 {
1252         int pnum = SVAL(buf,where);
1253
1254         if (chain_p) {
1255                 return chain_p;
1256         }
1257
1258         return get_rpc_pipe(pnum);
1259 }
1260
1261 /****************************************************************************
1262  Find an rpc pipe given a pipe handle.
1263 ****************************************************************************/
1264
1265 smb_np_struct *get_rpc_pipe(int pnum)
1266 {
1267         smb_np_struct *p;
1268
1269         DEBUG(4,("search for pipe pnum=%x\n", pnum));
1270
1271         for (p=Pipes;p;p=p->next) {
1272                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
1273                           p->name, p->pnum, pipes_open));
1274         }
1275
1276         for (p=Pipes;p;p=p->next) {
1277                 if (p->pnum == pnum) {
1278                         chain_p = p;
1279                         return p;
1280                 }
1281         }
1282
1283         return NULL;
1284 }