source/rpc_server/srv_pipe_hnd.c

   1 #define OLD_NTDOMAIN 1
   2 /*
   3  *  Unix SMB/Netbios implementation.
   4  *  Version 1.9.
   5  *  RPC Pipe client / server routines
   6  *  Copyright (C) Andrew Tridgell              1992-1998,
   7  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   8  *  Copyright (C) Jeremy Allison                                    1999.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25
  26 #include "includes.h"
  27
  28
  29 #define PIPE            "\\PIPE\\"
  30 #define PIPELEN         strlen(PIPE)
  31
  32 extern int DEBUGLEVEL;
  33 static pipes_struct *chain_p;
  34 static int pipes_open;
  35
  36 #ifndef MAX_OPEN_PIPES
  37 #define MAX_OPEN_PIPES 64
  38 #endif
  39
  40 static pipes_struct *Pipes;
  41 static struct bitmap *bmap;
  42
  43 /* this must be larger than the sum of the open files and directories */
  44 static int pipe_handle_offset;
  45
  46 /****************************************************************************
  47  Set the pipe_handle_offset. Called from smbd/files.c
  48 ****************************************************************************/
  49
  50 void set_pipe_handle_offset(int max_open_files)
  51 {
  52   if(max_open_files < 0x7000)
  53     pipe_handle_offset = 0x7000;
  54   else
  55     pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
  56 }
  57
  58 /****************************************************************************
  59  Reset pipe chain handle number.
  60 ****************************************************************************/
  61 void reset_chain_p(void)
  62 {
  63         chain_p = NULL;
  64 }
  65
  66 /****************************************************************************
  67  Initialise pipe handle states.
  68 ****************************************************************************/
  69
  70 void init_rpc_pipe_hnd(void)
  71 {
  72         bmap = bitmap_allocate(MAX_OPEN_PIPES);
  73         if (!bmap)
  74                 exit_server("out of memory in init_rpc_pipe_hnd\n");
  75 }
  76
  77 /****************************************************************************
  78  Initialise an outgoing packet.
  79 ****************************************************************************/
  80
  81 static BOOL pipe_init_outgoing_data(output_data *o_data)
  82 {
  83         /* Reset the offset counters. */
  84         o_data->data_sent_length = 0;
  85         o_data->current_pdu_len = 0;
  86         o_data->current_pdu_sent = 0;
  87
  88         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
  89
  90         /* Free any memory in the current return data buffer. */
  91         prs_mem_free(&o_data->rdata);
  92
  93         /*
  94          * Initialize the outgoing RPC data buffer.
  95          * we will use this as the raw data area for replying to rpc requests.
  96          */
  97         if(!prs_init(&o_data->rdata, MAX_PDU_FRAG_LEN, 4, MARSHALL)) {
  98                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
  99                 return False;
 100         }
 101
 102         return True;
 103 }
 104
 105 /****************************************************************************
 106  Attempt to find a remote process to communicate RPC's with.
 107 ****************************************************************************/
 108
 109 static void attempt_remote_rpc_connect(pipes_struct *p)
 110 {
 111         struct user_creds usr;
 112         user_struct *vuser = get_valid_user_struct(p->vuid);
 113
 114         p->m = NULL;
 115
 116         if (vuser == NULL) {
 117                 DEBUG(4,("attempt_remote_rpc_connect: invalid vuid %d\n", (int)p->vuid));
 118                 return;
 119         }
 120
 121         ZERO_STRUCT(usr);
 122
 123         /* set up unix credentials from the smb side, to feed over the pipe */
 124         make_creds_unix(&usr.uxc, vuser->user.unix_name, vuser->user.smb_name,
 125                                         vuser->user.full_name, vuser->guest);
 126         usr.ptr_uxc = 1;
 127         make_creds_unix_sec(&usr.uxs, vuser->uid, vuser->gid,
 128                                         vuser->n_groups, vuser->groups);
 129         usr.ptr_uxs = 1;
 130
 131         usr.ptr_ssk = 1;
 132         DEBUG(10,("user session key not available (yet).\n"));
 133         DEBUG(10,("password-change operations may fail.\n"));
 134
 135 #if USER_SESSION_KEY_DEFINED_IN_VUSER_STRUCT
 136         memcpy(usr.usr_sess_key, vuser->usr_sess_key, sizeof(usr.usr_sess_key));
 137 #else
 138         memset(usr.usr_sess_key, 0, sizeof(usr.usr_sess_key));
 139 #endif
 140
 141         /* set up nt credentials from the smb side, to feed over the pipe */
 142         /* lkclXXXX todo!
 143         make_creds_nt(&usr.ntc);
 144         make_creds_nt_sec(&usr.nts);
 145         */
 146
 147         become_root(False); /* to connect to pipe */
 148         p->m = msrpc_use_add(p->name, sys_getpid(), &usr, False);
 149         unbecome_root(False);
 150
 151         if (p->m == NULL)
 152                 DEBUG(10,("attempt_remote_rpc_connect: msrpc redirect failed - using local implementation.\n"));
 153 }
 154
 155 /****************************************************************************
 156  Find first available pipe slot.
 157 ****************************************************************************/
 158
 159 pipes_struct *open_rpc_pipe_p(char *pipe_name,
 160                               connection_struct *conn, uint16 vuid)
 161 {
 162         int i;
 163         pipes_struct *p;
 164         static int next_pipe;
 165
 166         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
 167                  pipe_name, pipes_open));
 168
 169
 170         /* not repeating pipe numbers makes it easier to track things in
 171            log files and prevents client bugs where pipe numbers are reused
 172            over connection restarts */
 173         if (next_pipe == 0)
 174                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
 175
 176         i = bitmap_find(bmap, next_pipe);
 177
 178         if (i == -1) {
 179                 DEBUG(0,("ERROR! Out of pipe structures\n"));
 180                 return NULL;
 181         }
 182
 183         next_pipe = (i+1) % MAX_OPEN_PIPES;
 184
 185         for (p = Pipes; p; p = p->next)
 186                 DEBUG(5,("open pipes: name %s pnum=%x\n", p->name, p->pnum));
 187
 188         p = (pipes_struct *)malloc(sizeof(*p));
 189
 190         if (!p)
 191                 return NULL;
 192
 193         ZERO_STRUCTP(p);
 194
 195         DLIST_ADD(Pipes, p);
 196
 197         /*
 198          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 199          * We cheat here and say we're marshalling, as we intend to add incoming
 200          * data directly into the prs_struct and we want it to auto grow. We will
 201          * change the type to UNMARSALLING before processing the stream.
 202          */
 203
 204         if(!prs_init(&p->in_data.data, MAX_PDU_FRAG_LEN, 4, MARSHALL)) {
 205                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
 206                 return NULL;
 207         }
 208
 209         bitmap_set(bmap, i);
 210         i += pipe_handle_offset;
 211
 212         pipes_open++;
 213
 214         p->pnum = i;
 215
 216         p->open = True;
 217         p->device_state = 0;
 218         p->priority = 0;
 219         p->conn = conn;
 220         p->vuid  = vuid;
 221
 222         p->max_trans_reply = 0;
 223
 224         p->ntlmssp_chal_flags = 0;
 225         p->ntlmssp_auth_validated = False;
 226         p->ntlmssp_auth_requested = False;
 227
 228         p->pipe_bound = False;
 229         p->fault_state = False;
 230
 231         /*
 232          * Initialize the incoming RPC struct.
 233          */
 234
 235         p->in_data.pdu_needed_len = 0;
 236         p->in_data.pdu_received_len = 0;
 237
 238         /*
 239          * Initialize the outgoing RPC struct.
 240          */
 241
 242         p->out_data.current_pdu_len = 0;
 243         p->out_data.current_pdu_sent = 0;
 244         p->out_data.data_sent_length = 0;
 245
 246         /*
 247          * Initialize the outgoing RPC data buffer with no memory.
 248          */
 249         prs_init(&p->out_data.rdata, 0, 4, MARSHALL);
 250
 251         p->uid = (uid_t)-1;
 252         p->gid = (gid_t)-1;
 253
 254         fstrcpy(p->name, pipe_name);
 255
 256 #if 0
 257
 258    Comment out until memory leak fixed. JRA.
 259
 260         /*
 261          * For Luke - attempt to connect to RPC redirect process.
 262          */
 263
 264         attempt_remote_rpc_connect(p);
 265 #endif
 266
 267         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
 268                  pipe_name, i, pipes_open));
 269
 270         chain_p = p;
 271
 272         /* OVERWRITE p as a temp variable, to display all open pipes */
 273         for (p = Pipes; p; p = p->next)
 274                 DEBUG(5,("open pipes: name %s pnum=%x\n", p->name, p->pnum));
 275
 276         return chain_p;
 277 }
 278
 279 /****************************************************************************
 280  Sets the fault state on incoming packets.
 281 ****************************************************************************/
 282
 283 static void set_incoming_fault(pipes_struct *p)
 284 {
 285         prs_mem_free(&p->in_data.data);
 286         p->in_data.pdu_needed_len = 0;
 287         p->in_data.pdu_received_len = 0;
 288         p->fault_state = True;
 289         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : pnum = 0x%x\n",
 290                 p->name, p->pnum ));
 291 }
 292
 293 /****************************************************************************
 294  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
 295 ****************************************************************************/
 296
 297 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
 298 {
 299         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
 300
 301         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
 302                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
 303                         (unsigned int)p->in_data.pdu_received_len ));
 304
 305         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
 306         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
 307
 308         return (ssize_t)len_needed_to_complete_hdr;
 309 }
 310
 311 /****************************************************************************
 312  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
 313 ****************************************************************************/
 314
 315 static ssize_t unmarshall_rpc_header(pipes_struct *p)
 316 {
 317         /*
 318          * Unmarshall the header to determine the needed length.
 319          */
 320
 321         prs_struct rpc_in;
 322
 323         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
 324                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
 325                 set_incoming_fault(p);
 326                 return -1;
 327         }
 328
 329         prs_init( &rpc_in, 0, 4, UNMARSHALL);
 330         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
 331                                         p->in_data.pdu_received_len, False);
 332
 333         /*
 334          * Unmarshall the header as this will tell us how much
 335          * data we need to read to get the complete pdu.
 336          */
 337
 338         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
 339                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
 340                 set_incoming_fault(p);
 341                 return -1;
 342         }
 343
 344         /*
 345          * Validate the RPC header.
 346          */
 347
 348         if(p->hdr.major != 5 && p->hdr.minor != 0) {
 349                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
 350                 set_incoming_fault(p);
 351                 return -1;
 352         }
 353
 354         /*
 355          * If there is no data in the incoming buffer and it's a requst pdu then
 356          * ensure that the FIRST flag is set. If not then we have
 357          * a stream missmatch.
 358          */
 359
 360         if((p->hdr.pkt_type == RPC_REQUEST) && (prs_offset(&p->in_data.data) == 0) && !(p->hdr.flags & RPC_FLG_FIRST)) {
 361                 DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
 362                 set_incoming_fault(p);
 363                 return -1;
 364         }
 365
 366         /*
 367          * Ensure that the pdu length is sane.
 368          */
 369
 370         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > MAX_PDU_FRAG_LEN)) {
 371                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
 372                 set_incoming_fault(p);
 373                 return -1;
 374         }
 375
 376         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
 377                         (unsigned int)p->hdr.flags ));
 378
 379         /*
 380          * Adjust for the header we just ate.
 381          */
 382         p->in_data.pdu_received_len = 0;
 383         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
 384
 385         /*
 386          * Null the data we just ate.
 387          */
 388
 389         memset((char *)&p->in_data.current_in_pdu[0], '\0', RPC_HEADER_LEN);
 390
 391         return 0; /* No extra data processed. */
 392 }
 393
 394 /****************************************************************************
 395  Processes a request pdu. This will do auth processing if needed, and
 396  appends the data into the complete stream if the LAST flag is not set.
 397 ****************************************************************************/
 398
 399 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 400 {
 401         BOOL auth_verify = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SIGN);
 402         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 403                                 (auth_verify ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 404
 405         if(!p->pipe_bound) {
 406                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
 407                 set_incoming_fault(p);
 408                 return False;
 409         }
 410
 411         /*
 412          * Check if we need to do authentication processing.
 413          * This is only done on requests, not binds.
 414          */
 415
 416         /*
 417          * Read the RPC request header.
 418          */
 419
 420         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
 421                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
 422                 set_incoming_fault(p);
 423                 return False;
 424         }
 425
 426         if(p->ntlmssp_auth_validated && !api_pipe_auth_process(p, rpc_in_p)) {
 427                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
 428                 set_incoming_fault(p);
 429                 return False;
 430         }
 431
 432         if (p->ntlmssp_auth_requested && !p->ntlmssp_auth_validated) {
 433
 434                 /*
 435                  * Authentication _was_ requested and it already failed.
 436                  */
 437
 438                 DEBUG(0,("process_request_pdu: RPC request received on pipe %s where \
 439 authentication failed. Denying the request.\n", p->name));
 440                 set_incoming_fault(p);
 441         return False;
 442     }
 443
 444         /*
 445          * Check the data length doesn't go over the 1Mb limit.
 446          */
 447
 448         if(prs_data_size(&p->in_data.data) + data_len > 1024*1024) {
 449                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
 450                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
 451                 set_incoming_fault(p);
 452                 return False;
 453         }
 454
 455         /*
 456          * Append the data portion into the buffer and return.
 457          */
 458
 459         {
 460                 char *data_from = prs_data_p(rpc_in_p) + prs_offset(rpc_in_p);
 461
 462                 if(!prs_append_data(&p->in_data.data, data_from, data_len)) {
 463                         DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
 464                                         (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
 465                         set_incoming_fault(p);
 466                         return False;
 467                 }
 468
 469         }
 470
 471         if(p->hdr.flags & RPC_FLG_LAST) {
 472                 BOOL ret = False;
 473                 /*
 474                  * Ok - we finally have a complete RPC stream.
 475                  * Call the rpc command to process it.
 476                  */
 477
 478                 /*
 479                  * Set the parse offset to the start of the data and set the
 480                  * prs_struct to UNMARSHALL.
 481                  */
 482
 483                 prs_set_offset(&p->in_data.data, 0);
 484                 prs_switch_type(&p->in_data.data, UNMARSHALL);
 485
 486                 /*
 487                  * Process the complete data stream here.
 488                  */
 489
 490                 if(pipe_init_outgoing_data(&p->out_data))
 491                         ret = api_pipe_request(p);
 492
 493                 /*
 494                  * We have consumed the whole data stream. Set back to
 495                  * marshalling and set the offset back to the start of
 496                  * the buffer to re-use it (we could also do a prs_mem_free()
 497                  * and then re_init on the next start of PDU. Not sure which
 498                  * is best here.... JRA.
 499                  */
 500
 501                 prs_switch_type(&p->in_data.data, MARSHALL);
 502                 prs_set_offset(&p->in_data.data, 0);
 503                 return ret;
 504         }
 505
 506         return True;
 507 }
 508
 509 /****************************************************************************
 510  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
 511  already been parsed and stored in p->hdr.
 512 ****************************************************************************/
 513
 514 static ssize_t process_complete_pdu(pipes_struct *p)
 515 {
 516         prs_struct rpc_in;
 517         size_t data_len = p->in_data.pdu_received_len;
 518         char *data_p = (char *)&p->in_data.current_in_pdu[0];
 519         BOOL reply = False;
 520
 521         if(p->fault_state) {
 522                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
 523                         p->name ));
 524                 set_incoming_fault(p);
 525                 setup_fault_pdu(p);
 526                 return (ssize_t)data_len;
 527         }
 528
 529         prs_init( &rpc_in, 0, 4, UNMARSHALL);
 530         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
 531
 532         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
 533                         (unsigned int)p->hdr.pkt_type ));
 534
 535         switch (p->hdr.pkt_type) {
 536                 case RPC_BIND:
 537                 case RPC_ALTCONT:
 538                         /*
 539                          * We assume that a pipe bind is only in one pdu.
 540                          */
 541                         if(pipe_init_outgoing_data(&p->out_data))
 542                                 reply = api_pipe_bind_req(p, &rpc_in);
 543                         break;
 544                 case RPC_BINDRESP:
 545                         /*
 546                          * We assume that a pipe bind_resp is only in one pdu.
 547                          */
 548                         if(pipe_init_outgoing_data(&p->out_data))
 549                                 reply = api_pipe_bind_auth_resp(p, &rpc_in);
 550                         break;
 551                 case RPC_REQUEST:
 552                         reply = process_request_pdu(p, &rpc_in);
 553                         break;
 554                 default:
 555                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
 556                         break;
 557         }
 558
 559         if (!reply) {
 560                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
 561                 set_incoming_fault(p);
 562                 setup_fault_pdu(p);
 563         } else {
 564                 /*
 565                  * Reset the lengths. We're ready for a new pdu.
 566                  */
 567                 p->in_data.pdu_needed_len = 0;
 568                 p->in_data.pdu_received_len = 0;
 569         }
 570
 571         return (ssize_t)data_len;
 572 }
 573
 574 /****************************************************************************
 575  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
 576 ****************************************************************************/
 577
 578 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
 579 {
 580         size_t data_to_copy = MIN(n, MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
 581
 582         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
 583                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
 584                 (unsigned int)n ));
 585
 586         if(data_to_copy == 0) {
 587                 /*
 588                  * This is an error - data is being received and there is no
 589                  * space in the PDU. Free the received data and go into the fault state.
 590                  */
 591                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
 592 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
 593                 set_incoming_fault(p);
 594                 return -1;
 595         }
 596
 597         /*
 598          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
 599          * number of bytes before we can do anything.
 600          */
 601
 602         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
 603                 /*
 604                  * Always return here. If we have more data then the RPC_HEADER
 605                  * will be processed the next time around the loop.
 606                  */
 607                 return fill_rpc_header(p, data, data_to_copy);
 608         }
 609
 610         /*
 611          * At this point we know we have at least an RPC_HEADER_LEN amount of data
 612          * stored in current_in_pdu.
 613          */
 614
 615         /*
 616          * If pdu_needed_len is zero this is a new pdu.
 617          * Unmarshall the header so we know how much more
 618          * data we need, then loop again.
 619          */
 620
 621         if(p->in_data.pdu_needed_len == 0)
 622                 return unmarshall_rpc_header(p);
 623
 624         /*
 625          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
 626          * Keep reading until we have a full pdu.
 627          */
 628
 629         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
 630
 631         /*
 632          * Copy as much of the data as we need into the current_in_pdu buffer.
 633          */
 634
 635         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
 636         p->in_data.pdu_received_len += data_to_copy;
 637
 638         /*
 639          * Do we have a complete PDU ?
 640          */
 641
 642         if(p->in_data.pdu_received_len == p->in_data.pdu_needed_len)
 643                 return process_complete_pdu(p);
 644
 645         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
 646                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
 647
 648         return (ssize_t)data_to_copy;
 649
 650 }
 651
 652 /****************************************************************************
 653  Accepts incoming data on an rpc pipe.
 654 ****************************************************************************/
 655
 656 ssize_t write_to_pipe(pipes_struct *p, char *data, size_t n)
 657 {
 658         size_t data_left = n;
 659
 660         DEBUG(6,("write_to_pipe: %x", p->pnum));
 661
 662         DEBUG(6,(" name: %s open: %s len: %d\n",
 663                  p->name, BOOLSTR(p->open), (int)n));
 664
 665         dump_data(50, data, n);
 666
 667         while(data_left) {
 668                 ssize_t data_used;
 669
 670                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
 671
 672                 /*
 673                  * Deal with the redirect to the remote RPC daemon.
 674                  */
 675
 676                 if(p->m)
 677                         data_used = write(p->m->fd, data, data_left);
 678                 else
 679                         data_used = process_incoming_data(p, data, data_left);
 680
 681                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
 682
 683                 if(data_used < 0)
 684                         return -1;
 685
 686                 data_left -= data_used;
 687                 data += data_used;
 688         }
 689
 690         return n;
 691 }
 692
 693 /****************************************************************************
 694  Gets data from a remote TNG daemon. Gets data from the remote daemon into
 695  the outgoing prs_struct.
 696
 697  NB. Note to Luke : This code will be broken until Luke implements a length
 698  field before reply data...
 699
 700 ****************************************************************************/
 701
 702 static BOOL read_from_remote(pipes_struct *p)
 703 {
 704         uint32 data_len;
 705         uint32 data_len_left;
 706
 707         if(prs_offset(&p->out_data.rdata) == 0) {
 708
 709                 ssize_t len = 0;
 710
 711                 /*
 712                  * Read all the reply data as a stream of pre-created
 713                  * PDU's from the remote deamon into the rdata struct.
 714                  */
 715
 716             /*
 717                  * Create the response data buffer.
 718                  */
 719
 720                 if(!pipe_init_outgoing_data(&p->out_data)) {
 721                         DEBUG(0,("read_from_remote: failed to create outgoing buffer.\n"));
 722                         return False;
 723                 }
 724
 725                 /* Read from remote here. */
 726                 if((len = read_with_timeout(p->m->fd, prs_data_p(&p->out_data.rdata), 1, 65536, 10000)) < 0) {
 727                         DEBUG(0,("read_from_remote: failed to read from external daemon.\n"));
 728                         prs_mem_free(&p->out_data.rdata);
 729                         return False;
 730                 }
 731
 732                 /* Set the length we got. */
 733                 prs_set_offset(&p->out_data.rdata, (uint32)len);
 734         }
 735
 736         /*
 737          * The amount we send is the minimum of the available
 738          * space and the amount left to send.
 739          */
 740
 741         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 742
 743         /*
 744          * Ensure there really is data left to send.
 745          */
 746
 747         if(!data_len_left) {
 748                 DEBUG(0,("read_from_remote: no data left to send !\n"));
 749                 return False;
 750         }
 751
 752         data_len = MIN(data_len_left, MAX_PDU_FRAG_LEN);
 753
 754         return False; /* Notfinished... */
 755 }
 756
 757 /****************************************************************************
 758  Replies to a request to read data from a pipe.
 759
 760  Headers are interspersed with the data at PDU intervals. By the time
 761  this function is called, the start of the data could possibly have been
 762  read by an SMBtrans (file_offset != 0).
 763
 764  Calling create_rpc_reply() here is a hack. The data should already
 765  have been prepared into arrays of headers + data stream sections.
 766 ****************************************************************************/
 767
 768 ssize_t read_from_pipe(pipes_struct *p, char *data, size_t n)
 769 {
 770         uint32 pdu_remaining = 0;
 771         ssize_t data_returned = 0;
 772
 773         if (!p || !p->open) {
 774                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 775                 return -1;
 776         }
 777
 778         DEBUG(6,("read_from_pipe: %x", p->pnum));
 779
 780         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
 781
 782         /*
 783          * We cannot return more than one PDU length per
 784          * read request.
 785          */
 786
 787         if(n > MAX_PDU_FRAG_LEN) {
 788                 DEBUG(0,("read_from_pipe: loo large read (%u) requested on pipe %s. We can \
 789 only service %d sized reads.\n", (unsigned int)n, p->name, MAX_PDU_FRAG_LEN ));
 790                 return -1;
 791         }
 792
 793         /*
 794          * Determine if there is still data to send in the
 795          * pipe PDU buffer. Always send this first. Never
 796          * send more than is left in the current PDU. The
 797          * client should send a new read request for a new
 798          * PDU.
 799          */
 800
 801         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
 802                 data_returned = (ssize_t)MIN(n, pdu_remaining);
 803
 804                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
 805 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len,
 806                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
 807
 808                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
 809                 p->out_data.current_pdu_sent += (uint32)data_returned;
 810                 return data_returned;
 811         }
 812
 813         /*
 814          * At this point p->current_pdu_len == p->current_pdu_sent (which
 815          * may of course be zero if this is the first return fragment.
 816          */
 817
 818         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
 819 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
 820                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
 821
 822         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
 823                 /*
 824                  * We have sent all possible data. Return 0.
 825                  */
 826                 return 0;
 827         }
 828
 829         if(p->m) {
 830                 /*
 831                  * Remote to the RPC daemon.
 832                  */
 833                 if(!read_from_remote(p)) {
 834                         DEBUG(0,("read_from_pipe: %s: read_from_remote failed.\n", p->name ));
 835                         return -1;
 836                 }
 837
 838         } else {
 839
 840                 /*
 841                  * We need to create a new PDU from the data left in p->rdata.
 842                  * Create the header/data/footers. This also sets up the fields
 843                  * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
 844                  * and stores the outgoing PDU in p->current_pdu.
 845                  */
 846
 847                 if(!create_next_pdu(p)) {
 848                         DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
 849                         return -1;
 850                 }
 851         }
 852
 853         data_returned = MIN(n, p->out_data.current_pdu_len);
 854
 855         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
 856         p->out_data.current_pdu_sent += (uint32)data_returned;
 857         return data_returned;
 858 }
 859
 860 /****************************************************************************
 861  Wait device state on a pipe. Exactly what this is for is unknown...
 862 ****************************************************************************/
 863
 864 BOOL wait_rpc_pipe_hnd_state(pipes_struct *p, uint16 priority)
 865 {
 866         if (p == NULL)
 867                 return False;
 868
 869         if (p->open) {
 870                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
 871                          priority, p->name));
 872
 873                 p->priority = priority;
 874
 875                 return True;
 876         }
 877
 878         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
 879                  priority, p->name));
 880         return False;
 881 }
 882
 883
 884 /****************************************************************************
 885  Set device state on a pipe. Exactly what this is for is unknown...
 886 ****************************************************************************/
 887
 888 BOOL set_rpc_pipe_hnd_state(pipes_struct *p, uint16 device_state)
 889 {
 890         if (p == NULL)
 891                 return False;
 892
 893         if (p->open) {
 894                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
 895                          device_state, p->name));
 896
 897                 p->device_state = device_state;
 898
 899                 return True;
 900         }
 901
 902         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
 903                  device_state, p->name));
 904         return False;
 905 }
 906
 907
 908 /****************************************************************************
 909  Close an rpc pipe.
 910 ****************************************************************************/
 911
 912 BOOL close_rpc_pipe_hnd(pipes_struct *p, connection_struct *conn)
 913 {
 914         if (!p) {
 915                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
 916                 return False;
 917         }
 918
 919         prs_mem_free(&p->out_data.rdata);
 920         prs_mem_free(&p->in_data.data);
 921
 922         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
 923
 924         pipes_open--;
 925
 926         if (p->m != NULL) {
 927                 DEBUG(4,("close_rpc_pipe_hnd: closing msrpc redirect: "));
 928                 if (msrpc_use_del(p->m->pipe_name, &p->m->usr, False, NULL))
 929                         DEBUG(4,("OK\n"));
 930                 else
 931                         DEBUG(4,("FAILED\n"));
 932         }
 933
 934         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
 935                  p->name, p->pnum, pipes_open));
 936
 937         DLIST_REMOVE(Pipes, p);
 938
 939         ZERO_STRUCTP(p);
 940
 941         free(p);
 942
 943         return True;
 944 }
 945
 946 /****************************************************************************
 947  Find an rpc pipe given a pipe handle in a buffer and an offset.
 948 ****************************************************************************/
 949
 950 pipes_struct *get_rpc_pipe_p(char *buf, int where)
 951 {
 952         int pnum = SVAL(buf,where);
 953
 954         if (chain_p)
 955                 return chain_p;
 956
 957         return get_rpc_pipe(pnum);
 958 }
 959
 960 /****************************************************************************
 961  Find an rpc pipe given a pipe handle.
 962 ****************************************************************************/
 963
 964 pipes_struct *get_rpc_pipe(int pnum)
 965 {
 966         pipes_struct *p;
 967
 968         DEBUG(4,("search for pipe pnum=%x\n", pnum));
 969
 970         for (p=Pipes;p;p=p->next)
 971                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
 972                           p->name, p->pnum, pipes_open));
 973
 974         for (p=Pipes;p;p=p->next) {
 975                 if (p->pnum == pnum) {
 976                         chain_p = p;
 977                         return p;
 978                 }
 979         }
 980
 981         return NULL;
 982 }
 983
 984 #undef OLD_NTDOMAIN