source3/rpc_server/srv_pipe_hnd.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Jeremy Allison                                    1999.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_RPC_SRV
  27
  28 #define PIPE            "\\PIPE\\"
  29 #define PIPELEN         strlen(PIPE)
  30
  31 static smb_np_struct *chain_p;
  32 static int pipes_open;
  33
  34 #ifndef MAX_OPEN_PIPES
  35 #define MAX_OPEN_PIPES 2048
  36 #endif
  37
  38 static smb_np_struct *Pipes;
  39 static pipes_struct *InternalPipes;
  40 static struct bitmap *bmap;
  41
  42 /* TODO
  43  * the following prototypes are declared here to avoid
  44  * code being moved about too much for a patch to be
  45  * disrupted / less obvious.
  46  *
  47  * these functions, and associated functions that they
  48  * call, should be moved behind a .so module-loading
  49  * system _anyway_.  so that's the next step...
  50  */
  51
  52 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
  53                 BOOL *is_data_outstanding);
  54 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n);
  55 static BOOL close_internal_rpc_pipe_hnd(void *np_conn);
  56 static void *make_internal_rpc_pipe_p(char *pipe_name,
  57                               connection_struct *conn, uint16 vuid);
  58
  59 /****************************************************************************
  60  Pipe iterator functions.
  61 ****************************************************************************/
  62
  63 smb_np_struct *get_first_pipe(void)
  64 {
  65         return Pipes;
  66 }
  67
  68 smb_np_struct *get_next_pipe(smb_np_struct *p)
  69 {
  70         return p->next;
  71 }
  72
  73 /****************************************************************************
  74  Internal Pipe iterator functions.
  75 ****************************************************************************/
  76
  77 pipes_struct *get_first_internal_pipe(void)
  78 {
  79         return InternalPipes;
  80 }
  81
  82 pipes_struct *get_next_internal_pipe(pipes_struct *p)
  83 {
  84         return p->next;
  85 }
  86
  87 /* this must be larger than the sum of the open files and directories */
  88 static int pipe_handle_offset;
  89
  90 /****************************************************************************
  91  Set the pipe_handle_offset. Called from smbd/files.c
  92 ****************************************************************************/
  93
  94 void set_pipe_handle_offset(int max_open_files)
  95 {
  96   if(max_open_files < 0x7000)
  97     pipe_handle_offset = 0x7000;
  98   else
  99     pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
 100 }
 101
 102 /****************************************************************************
 103  Reset pipe chain handle number.
 104 ****************************************************************************/
 105 void reset_chain_p(void)
 106 {
 107         chain_p = NULL;
 108 }
 109
 110 /****************************************************************************
 111  Initialise pipe handle states.
 112 ****************************************************************************/
 113
 114 void init_rpc_pipe_hnd(void)
 115 {
 116         bmap = bitmap_allocate(MAX_OPEN_PIPES);
 117         if (!bmap)
 118                 exit_server("out of memory in init_rpc_pipe_hnd");
 119 }
 120
 121 /****************************************************************************
 122  Initialise an outgoing packet.
 123 ****************************************************************************/
 124
 125 static BOOL pipe_init_outgoing_data(pipes_struct *p)
 126 {
 127         output_data *o_data = &p->out_data;
 128
 129         /* Reset the offset counters. */
 130         o_data->data_sent_length = 0;
 131         o_data->current_pdu_len = 0;
 132         o_data->current_pdu_sent = 0;
 133
 134         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
 135
 136         /* Free any memory in the current return data buffer. */
 137         prs_mem_free(&o_data->rdata);
 138
 139         /*
 140          * Initialize the outgoing RPC data buffer.
 141          * we will use this as the raw data area for replying to rpc requests.
 142          */
 143         if(!prs_init(&o_data->rdata, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 144                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
 145                 return False;
 146         }
 147
 148         return True;
 149 }
 150
 151 /****************************************************************************
 152  Find first available pipe slot.
 153 ****************************************************************************/
 154
 155 smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 156                               connection_struct *conn, uint16 vuid)
 157 {
 158         int i;
 159         smb_np_struct *p, *p_it;
 160         static int next_pipe;
 161
 162         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
 163                  pipe_name, pipes_open));
 164
 165
 166         /* not repeating pipe numbers makes it easier to track things in
 167            log files and prevents client bugs where pipe numbers are reused
 168            over connection restarts */
 169         if (next_pipe == 0)
 170                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
 171
 172         i = bitmap_find(bmap, next_pipe);
 173
 174         if (i == -1) {
 175                 DEBUG(0,("ERROR! Out of pipe structures\n"));
 176                 return NULL;
 177         }
 178
 179         next_pipe = (i+1) % MAX_OPEN_PIPES;
 180
 181         for (p = Pipes; p; p = p->next)
 182                 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));
 183
 184         p = (smb_np_struct *)malloc(sizeof(*p));
 185
 186         if (!p)
 187         {
 188                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 189                 return NULL;
 190         }
 191
 192         ZERO_STRUCTP(p);
 193
 194         /* add a dso mechanism instead of this, here */
 195
 196         p->namedpipe_create = make_internal_rpc_pipe_p;
 197         p->namedpipe_read = read_from_internal_pipe;
 198         p->namedpipe_write = write_to_internal_pipe;
 199         p->namedpipe_close = close_internal_rpc_pipe_hnd;
 200
 201         p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
 202
 203         if (p->np_state == NULL) {
 204
 205                 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
 206                 SAFE_FREE(p);
 207                 return NULL;
 208         }
 209
 210
 211         DLIST_ADD(Pipes, p);
 212
 213         /*
 214          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 215          * We cheat here and say we're marshalling, as we intend to add incoming
 216          * data directly into the prs_struct and we want it to auto grow. We will
 217          * change the type to UNMARSALLING before processing the stream.
 218          */
 219
 220         bitmap_set(bmap, i);
 221         i += pipe_handle_offset;
 222
 223         pipes_open++;
 224
 225         p->pnum = i;
 226
 227         p->open = True;
 228         p->device_state = 0;
 229         p->priority = 0;
 230         p->conn = conn;
 231         p->vuid  = vuid;
 232
 233         p->max_trans_reply = 0;
 234
 235         fstrcpy(p->name, pipe_name);
 236
 237         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
 238                  pipe_name, i, pipes_open));
 239
 240         chain_p = p;
 241
 242         /* Iterate over p_it as a temp variable, to display all open pipes */
 243         for (p_it = Pipes; p_it; p_it = p_it->next)
 244                 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum));
 245
 246         return chain_p;
 247 }
 248
 249 /****************************************************************************
 250  * make an internal namedpipes structure
 251 ****************************************************************************/
 252
 253 static void *make_internal_rpc_pipe_p(char *pipe_name,
 254                               connection_struct *conn, uint16 vuid)
 255 {
 256         pipes_struct *p;
 257         user_struct *vuser = get_valid_user_struct(vuid);
 258
 259         DEBUG(4,("Create pipe requested %s\n", pipe_name));
 260
 261         if (!vuser && vuid != UID_FIELD_INVALID) {
 262                 DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid));
 263                 return NULL;
 264         }
 265
 266         p = (pipes_struct *)malloc(sizeof(*p));
 267
 268         if (!p)
 269         {
 270                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 271                 return NULL;
 272         }
 273
 274         ZERO_STRUCTP(p);
 275
 276         if ((p->mem_ctx = talloc_init()) == NULL) {
 277                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
 278                 SAFE_FREE(p);
 279                 return NULL;
 280         }
 281
 282         if (!init_pipe_handle_list(p, pipe_name)) {
 283                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
 284                 talloc_destroy(p->mem_ctx);
 285                 SAFE_FREE(p);
 286                 return NULL;
 287         }
 288
 289         /*
 290          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 291          * We cheat here and say we're marshalling, as we intend to add incoming
 292          * data directly into the prs_struct and we want it to auto grow. We will
 293          * change the type to UNMARSALLING before processing the stream.
 294          */
 295
 296         if(!prs_init(&p->in_data.data, MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 297                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
 298                 return NULL;
 299         }
 300
 301         DLIST_ADD(InternalPipes, p);
 302
 303         p->conn = conn;
 304
 305         /* Ensure the connection isn't idled whilst this pipe is open. */
 306         p->conn->num_files_open++;
 307
 308         p->vuid  = vuid;
 309
 310         p->ntlmssp_chal_flags = 0;
 311         p->ntlmssp_auth_validated = False;
 312         p->ntlmssp_auth_requested = False;
 313
 314         p->pipe_bound = False;
 315         p->fault_state = False;
 316         p->endian = RPC_LITTLE_ENDIAN;
 317
 318         ZERO_STRUCT(p->pipe_user);
 319
 320         p->pipe_user.uid = (uid_t)-1;
 321         p->pipe_user.gid = (gid_t)-1;
 322
 323         /* Store the session key */
 324         if (vuser) {
 325                 memcpy(p->session_key, vuser->session_key, sizeof(p->session_key));
 326         }
 327
 328         /*
 329          * Initialize the incoming RPC struct.
 330          */
 331
 332         p->in_data.pdu_needed_len = 0;
 333         p->in_data.pdu_received_len = 0;
 334
 335         /*
 336          * Initialize the outgoing RPC struct.
 337          */
 338
 339         p->out_data.current_pdu_len = 0;
 340         p->out_data.current_pdu_sent = 0;
 341         p->out_data.data_sent_length = 0;
 342
 343         /*
 344          * Initialize the outgoing RPC data buffer with no memory.
 345          */
 346         prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL);
 347
 348         fstrcpy(p->name, pipe_name);
 349
 350         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
 351                  pipe_name, pipes_open));
 352
 353         return (void*)p;
 354 }
 355
 356 /****************************************************************************
 357  Sets the fault state on incoming packets.
 358 ****************************************************************************/
 359
 360 static void set_incoming_fault(pipes_struct *p)
 361 {
 362         prs_mem_free(&p->in_data.data);
 363         p->in_data.pdu_needed_len = 0;
 364         p->in_data.pdu_received_len = 0;
 365         p->fault_state = True;
 366         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n",
 367                 p->name, p->vuid ));
 368 }
 369
 370 /****************************************************************************
 371  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
 372 ****************************************************************************/
 373
 374 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
 375 {
 376         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
 377
 378         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
 379                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
 380                         (unsigned int)p->in_data.pdu_received_len ));
 381
 382         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
 383         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
 384
 385         return (ssize_t)len_needed_to_complete_hdr;
 386 }
 387
 388 /****************************************************************************
 389  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
 390 ****************************************************************************/
 391
 392 static ssize_t unmarshall_rpc_header(pipes_struct *p)
 393 {
 394         /*
 395          * Unmarshall the header to determine the needed length.
 396          */
 397
 398         prs_struct rpc_in;
 399
 400         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
 401                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
 402                 set_incoming_fault(p);
 403                 return -1;
 404         }
 405
 406         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 407         prs_set_endian_data( &rpc_in, p->endian);
 408
 409         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
 410                                         p->in_data.pdu_received_len, False);
 411
 412         /*
 413          * Unmarshall the header as this will tell us how much
 414          * data we need to read to get the complete pdu.
 415          * This also sets the endian flag in rpc_in.
 416          */
 417
 418         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
 419                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
 420                 set_incoming_fault(p);
 421                 prs_mem_free(&rpc_in);
 422                 return -1;
 423         }
 424
 425         /*
 426          * Validate the RPC header.
 427          */
 428
 429         if(p->hdr.major != 5 && p->hdr.minor != 0) {
 430                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
 431                 set_incoming_fault(p);
 432                 prs_mem_free(&rpc_in);
 433                 return -1;
 434         }
 435
 436         /*
 437          * If there's not data in the incoming buffer this should be the start of a new RPC.
 438          */
 439
 440         if(prs_offset(&p->in_data.data) == 0) {
 441
 442                 /*
 443                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
 444                  */
 445
 446                 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) {
 447                         /*
 448                          * Ensure that the FIRST flag is set. If not then we have
 449                          * a stream missmatch.
 450                          */
 451
 452                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
 453                         set_incoming_fault(p);
 454                         prs_mem_free(&rpc_in);
 455                         return -1;
 456                 }
 457
 458                 /*
 459                  * If this is the first PDU then set the endianness
 460                  * flag in the pipe. We will need this when parsing all
 461                  * data in this RPC.
 462                  */
 463
 464                 p->endian = rpc_in.bigendian_data;
 465
 466                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
 467                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
 468
 469         } else {
 470
 471                 /*
 472                  * If this is *NOT* the first PDU then check the endianness
 473                  * flag in the pipe is the same as that in the PDU.
 474                  */
 475
 476                 if (p->endian != rpc_in.bigendian_data) {
 477                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
 478                         set_incoming_fault(p);
 479                         prs_mem_free(&rpc_in);
 480                         return -1;
 481                 }
 482         }
 483
 484         /*
 485          * Ensure that the pdu length is sane.
 486          */
 487
 488         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > MAX_PDU_FRAG_LEN)) {
 489                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
 490                 set_incoming_fault(p);
 491                 prs_mem_free(&rpc_in);
 492                 return -1;
 493         }
 494
 495         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
 496                         (unsigned int)p->hdr.flags ));
 497
 498         /*
 499          * Adjust for the header we just ate.
 500          */
 501         p->in_data.pdu_received_len = 0;
 502         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
 503
 504         /*
 505          * Null the data we just ate.
 506          */
 507
 508         memset((char *)&p->in_data.current_in_pdu[0], '\0', RPC_HEADER_LEN);
 509
 510         prs_mem_free(&rpc_in);
 511
 512         return 0; /* No extra data processed. */
 513 }
 514
 515 /****************************************************************************
 516  Call this to free any talloc'ed memory. Do this before and after processing
 517  a complete PDU.
 518 ****************************************************************************/
 519
 520 void free_pipe_context(pipes_struct *p)
 521 {
 522         if (p->mem_ctx) {
 523                 DEBUG(3,("free_pipe_context: destroying talloc pool of size %u\n", talloc_pool_size(p->mem_ctx) ));
 524                 talloc_destroy_pool(p->mem_ctx);
 525         } else {
 526                 p->mem_ctx = talloc_init();
 527                 if (p->mem_ctx == NULL)
 528                         p->fault_state = True;
 529         }
 530 }
 531
 532 /****************************************************************************
 533  Processes a request pdu. This will do auth processing if needed, and
 534  appends the data into the complete stream if the LAST flag is not set.
 535 ****************************************************************************/
 536
 537 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 538 {
 539         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
 540         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 541                                 (auth_verify ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 542
 543         if(!p->pipe_bound) {
 544                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
 545                 set_incoming_fault(p);
 546                 return False;
 547         }
 548
 549         /*
 550          * Check if we need to do authentication processing.
 551          * This is only done on requests, not binds.
 552          */
 553
 554         /*
 555          * Read the RPC request header.
 556          */
 557
 558         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
 559                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
 560                 set_incoming_fault(p);
 561                 return False;
 562         }
 563
 564         if(p->ntlmssp_auth_validated && !api_pipe_auth_process(p, rpc_in_p)) {
 565                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
 566                 set_incoming_fault(p);
 567                 return False;
 568         }
 569
 570         if (p->ntlmssp_auth_requested && !p->ntlmssp_auth_validated) {
 571
 572                 /*
 573                  * Authentication _was_ requested and it already failed.
 574                  */
 575
 576                 DEBUG(0,("process_request_pdu: RPC request received on pipe %s where \
 577 authentication failed. Denying the request.\n", p->name));
 578                 set_incoming_fault(p);
 579         return False;
 580     }
 581
 582         /*
 583          * Check the data length doesn't go over the 15Mb limit.
 584          * increased after observing a bug in the Windows NT 4.0 SP6a
 585          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
 586          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
 587          */
 588
 589         if(prs_offset(&p->in_data.data) + data_len > 15*1024*1024) {
 590                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
 591                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
 592                 set_incoming_fault(p);
 593                 return False;
 594         }
 595
 596         /*
 597          * Append the data portion into the buffer and return.
 598          */
 599
 600         {
 601                 char *data_from = prs_data_p(rpc_in_p) + prs_offset(rpc_in_p);
 602
 603                 if(!prs_append_data(&p->in_data.data, data_from, data_len)) {
 604                         DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
 605                                         (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
 606                         set_incoming_fault(p);
 607                         return False;
 608                 }
 609
 610         }
 611
 612         if(p->hdr.flags & RPC_FLG_LAST) {
 613                 BOOL ret = False;
 614                 /*
 615                  * Ok - we finally have a complete RPC stream.
 616                  * Call the rpc command to process it.
 617                  */
 618
 619                 /*
 620                  * Ensure the internal prs buffer size is *exactly* the same
 621                  * size as the current offset.
 622                  */
 623
 624                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data)))
 625                 {
 626                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
 627                         set_incoming_fault(p);
 628                         return False;
 629                 }
 630
 631                 /*
 632                  * Set the parse offset to the start of the data and set the
 633                  * prs_struct to UNMARSHALL.
 634                  */
 635
 636                 prs_set_offset(&p->in_data.data, 0);
 637                 prs_switch_type(&p->in_data.data, UNMARSHALL);
 638
 639                 /*
 640                  * Process the complete data stream here.
 641                  */
 642
 643                 free_pipe_context(p);
 644
 645                 if(pipe_init_outgoing_data(p))
 646                         ret = api_pipe_request(p);
 647
 648                 free_pipe_context(p);
 649
 650                 /*
 651                  * We have consumed the whole data stream. Set back to
 652                  * marshalling and set the offset back to the start of
 653                  * the buffer to re-use it (we could also do a prs_mem_free()
 654                  * and then re_init on the next start of PDU. Not sure which
 655                  * is best here.... JRA.
 656                  */
 657
 658                 prs_switch_type(&p->in_data.data, MARSHALL);
 659                 prs_set_offset(&p->in_data.data, 0);
 660                 return ret;
 661         }
 662
 663         return True;
 664 }
 665
 666 /****************************************************************************
 667  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
 668  already been parsed and stored in p->hdr.
 669 ****************************************************************************/
 670
 671 static ssize_t process_complete_pdu(pipes_struct *p)
 672 {
 673         prs_struct rpc_in;
 674         size_t data_len = p->in_data.pdu_received_len;
 675         char *data_p = (char *)&p->in_data.current_in_pdu[0];
 676         BOOL reply = False;
 677
 678         if(p->fault_state) {
 679                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
 680                         p->name ));
 681                 set_incoming_fault(p);
 682                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 683                 return (ssize_t)data_len;
 684         }
 685
 686         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 687
 688         /*
 689          * Ensure we're using the corrent endianness for both the
 690          * RPC header flags and the raw data we will be reading from.
 691          */
 692
 693         prs_set_endian_data( &rpc_in, p->endian);
 694         prs_set_endian_data( &p->in_data.data, p->endian);
 695
 696         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
 697
 698         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
 699                         (unsigned int)p->hdr.pkt_type ));
 700
 701         switch (p->hdr.pkt_type) {
 702                 case RPC_BIND:
 703                 case RPC_ALTCONT:
 704                         /*
 705                          * We assume that a pipe bind is only in one pdu.
 706                          */
 707                         if(pipe_init_outgoing_data(p))
 708                                 reply = api_pipe_bind_req(p, &rpc_in);
 709                         break;
 710                 case RPC_BINDRESP:
 711                         /*
 712                          * We assume that a pipe bind_resp is only in one pdu.
 713                          */
 714                         if(pipe_init_outgoing_data(p))
 715                                 reply = api_pipe_bind_auth_resp(p, &rpc_in);
 716                         break;
 717                 case RPC_REQUEST:
 718                         reply = process_request_pdu(p, &rpc_in);
 719                         break;
 720                 default:
 721                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
 722                         break;
 723         }
 724
 725         /* Reset to little endian. Probably don't need this but it won't hurt. */
 726         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
 727
 728         if (!reply) {
 729                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
 730                 set_incoming_fault(p);
 731                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 732                 prs_mem_free(&rpc_in);
 733         } else {
 734                 /*
 735                  * Reset the lengths. We're ready for a new pdu.
 736                  */
 737                 p->in_data.pdu_needed_len = 0;
 738                 p->in_data.pdu_received_len = 0;
 739         }
 740
 741         prs_mem_free(&rpc_in);
 742         return (ssize_t)data_len;
 743 }
 744
 745 /****************************************************************************
 746  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
 747 ****************************************************************************/
 748
 749 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
 750 {
 751         size_t data_to_copy = MIN(n, MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
 752
 753         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
 754                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
 755                 (unsigned int)n ));
 756
 757         if(data_to_copy == 0) {
 758                 /*
 759                  * This is an error - data is being received and there is no
 760                  * space in the PDU. Free the received data and go into the fault state.
 761                  */
 762                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
 763 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
 764                 set_incoming_fault(p);
 765                 return -1;
 766         }
 767
 768         /*
 769          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
 770          * number of bytes before we can do anything.
 771          */
 772
 773         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
 774                 /*
 775                  * Always return here. If we have more data then the RPC_HEADER
 776                  * will be processed the next time around the loop.
 777                  */
 778                 return fill_rpc_header(p, data, data_to_copy);
 779         }
 780
 781         /*
 782          * At this point we know we have at least an RPC_HEADER_LEN amount of data
 783          * stored in current_in_pdu.
 784          */
 785
 786         /*
 787          * If pdu_needed_len is zero this is a new pdu.
 788          * Unmarshall the header so we know how much more
 789          * data we need, then loop again.
 790          */
 791
 792         if(p->in_data.pdu_needed_len == 0)
 793                 return unmarshall_rpc_header(p);
 794
 795         /*
 796          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
 797          * Keep reading until we have a full pdu.
 798          */
 799
 800         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
 801
 802         /*
 803          * Copy as much of the data as we need into the current_in_pdu buffer.
 804          */
 805
 806         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
 807         p->in_data.pdu_received_len += data_to_copy;
 808
 809         /*
 810          * Do we have a complete PDU ?
 811          */
 812
 813         if(p->in_data.pdu_received_len == p->in_data.pdu_needed_len)
 814                 return process_complete_pdu(p);
 815
 816         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
 817                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
 818
 819         return (ssize_t)data_to_copy;
 820
 821 }
 822
 823 /****************************************************************************
 824  Accepts incoming data on an rpc pipe.
 825 ****************************************************************************/
 826
 827 ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n)
 828 {
 829         DEBUG(6,("write_to_pipe: %x", p->pnum));
 830
 831         DEBUG(6,(" name: %s open: %s len: %d\n",
 832                  p->name, BOOLSTR(p->open), (int)n));
 833
 834         dump_data(50, data, n);
 835
 836         return p->namedpipe_write(p->np_state, data, n);
 837 }
 838
 839 /****************************************************************************
 840  Accepts incoming data on an internal rpc pipe.
 841 ****************************************************************************/
 842
 843 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n)
 844 {
 845         pipes_struct *p = (pipes_struct*)np_conn;
 846         size_t data_left = n;
 847
 848         while(data_left) {
 849                 ssize_t data_used;
 850
 851                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
 852
 853                 data_used = process_incoming_data(p, data, data_left);
 854
 855                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
 856
 857                 if(data_used < 0)
 858                         return -1;
 859
 860                 data_left -= data_used;
 861                 data += data_used;
 862         }
 863
 864         return n;
 865 }
 866
 867 /****************************************************************************
 868  Replies to a request to read data from a pipe.
 869
 870  Headers are interspersed with the data at PDU intervals. By the time
 871  this function is called, the start of the data could possibly have been
 872  read by an SMBtrans (file_offset != 0).
 873
 874  Calling create_rpc_reply() here is a hack. The data should already
 875  have been prepared into arrays of headers + data stream sections.
 876 ****************************************************************************/
 877
 878 ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n,
 879                 BOOL *is_data_outstanding)
 880 {
 881         if (!p || !p->open) {
 882                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 883                 return -1;
 884         }
 885
 886         DEBUG(6,("read_from_pipe: %x", p->pnum));
 887
 888         return p->namedpipe_read(p->np_state, data, n, is_data_outstanding);
 889 }
 890
 891 /****************************************************************************
 892  Replies to a request to read data from a pipe.
 893
 894  Headers are interspersed with the data at PDU intervals. By the time
 895  this function is called, the start of the data could possibly have been
 896  read by an SMBtrans (file_offset != 0).
 897
 898  Calling create_rpc_reply() here is a hack. The data should already
 899  have been prepared into arrays of headers + data stream sections.
 900 ****************************************************************************/
 901
 902 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
 903                 BOOL *is_data_outstanding)
 904 {
 905         pipes_struct *p = (pipes_struct*)np_conn;
 906         uint32 pdu_remaining = 0;
 907         ssize_t data_returned = 0;
 908
 909         if (!p) {
 910                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 911                 return -1;
 912         }
 913
 914         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
 915
 916         /*
 917          * We cannot return more than one PDU length per
 918          * read request.
 919          */
 920
 921         /*
 922          * This condition should result in the connection being closed.
 923          * Netapp filers seem to set it to 0xffff which results in domain
 924          * authentications failing.  Just ignore it so things work.
 925          */
 926
 927         if(n > MAX_PDU_FRAG_LEN) {
 928                 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
 929 pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, MAX_PDU_FRAG_LEN ));
 930         }
 931
 932         /*
 933          * Determine if there is still data to send in the
 934          * pipe PDU buffer. Always send this first. Never
 935          * send more than is left in the current PDU. The
 936          * client should send a new read request for a new
 937          * PDU.
 938          */
 939
 940         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
 941                 data_returned = (ssize_t)MIN(n, pdu_remaining);
 942
 943                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
 944 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len,
 945                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
 946
 947                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
 948                 p->out_data.current_pdu_sent += (uint32)data_returned;
 949                 goto out;
 950         }
 951
 952         /*
 953          * At this point p->current_pdu_len == p->current_pdu_sent (which
 954          * may of course be zero if this is the first return fragment.
 955          */
 956
 957         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
 958 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
 959                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
 960
 961         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
 962                 /*
 963                  * We have sent all possible data, return 0.
 964                  */
 965                 data_returned = 0;
 966                 goto out;
 967         }
 968
 969         /*
 970          * We need to create a new PDU from the data left in p->rdata.
 971          * Create the header/data/footers. This also sets up the fields
 972          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
 973          * and stores the outgoing PDU in p->current_pdu.
 974          */
 975
 976         if(!create_next_pdu(p)) {
 977                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
 978                 return -1;
 979         }
 980
 981         data_returned = MIN(n, p->out_data.current_pdu_len);
 982
 983         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
 984         p->out_data.current_pdu_sent += (uint32)data_returned;
 985
 986   out:
 987
 988         (*is_data_outstanding) = p->out_data.current_pdu_len > n;
 989         return data_returned;
 990 }
 991
 992 /****************************************************************************
 993  Wait device state on a pipe. Exactly what this is for is unknown...
 994 ****************************************************************************/
 995
 996 BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority)
 997 {
 998         if (p == NULL)
 999                 return False;
1000
1001         if (p->open) {
1002                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
1003                          priority, p->name));
1004
1005                 p->priority = priority;
1006
1007                 return True;
1008         }
1009
1010         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
1011                  priority, p->name));
1012         return False;
1013 }
1014
1015
1016 /****************************************************************************
1017  Set device state on a pipe. Exactly what this is for is unknown...
1018 ****************************************************************************/
1019
1020 BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state)
1021 {
1022         if (p == NULL)
1023                 return False;
1024
1025         if (p->open) {
1026                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1027                          device_state, p->name));
1028
1029                 p->device_state = device_state;
1030
1031                 return True;
1032         }
1033
1034         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1035                  device_state, p->name));
1036         return False;
1037 }
1038
1039
1040 /****************************************************************************
1041  Close an rpc pipe.
1042 ****************************************************************************/
1043
1044 BOOL close_rpc_pipe_hnd(smb_np_struct *p)
1045 {
1046         if (!p) {
1047                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1048                 return False;
1049         }
1050
1051         p->namedpipe_close(p->np_state);
1052
1053         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
1054
1055         pipes_open--;
1056
1057         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
1058                  p->name, p->pnum, pipes_open));
1059
1060         DLIST_REMOVE(Pipes, p);
1061
1062         ZERO_STRUCTP(p);
1063
1064         SAFE_FREE(p);
1065
1066         return True;
1067 }
1068
1069 /****************************************************************************
1070  Close an rpc pipe.
1071 ****************************************************************************/
1072
1073 static BOOL close_internal_rpc_pipe_hnd(void *np_conn)
1074 {
1075         pipes_struct *p = (pipes_struct *)np_conn;
1076         if (!p) {
1077                 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1078                 return False;
1079         }
1080
1081         prs_mem_free(&p->out_data.rdata);
1082         prs_mem_free(&p->in_data.data);
1083
1084         if (p->mem_ctx)
1085                 talloc_destroy(p->mem_ctx);
1086
1087         /* Free the handles database. */
1088         close_policy_by_pipe(p);
1089
1090         delete_nt_token(&p->pipe_user.nt_user_token);
1091         SAFE_FREE(p->pipe_user.groups);
1092
1093         DLIST_REMOVE(InternalPipes, p);
1094
1095         p->conn->num_files_open--;
1096
1097         ZERO_STRUCTP(p);
1098
1099         SAFE_FREE(p);
1100
1101         return True;
1102 }
1103
1104 /****************************************************************************
1105  Find an rpc pipe given a pipe handle in a buffer and an offset.
1106 ****************************************************************************/
1107
1108 smb_np_struct *get_rpc_pipe_p(char *buf, int where)
1109 {
1110         int pnum = SVAL(buf,where);
1111
1112         if (chain_p)
1113                 return chain_p;
1114
1115         return get_rpc_pipe(pnum);
1116 }
1117
1118 /****************************************************************************
1119  Find an rpc pipe given a pipe handle.
1120 ****************************************************************************/
1121
1122 smb_np_struct *get_rpc_pipe(int pnum)
1123 {
1124         smb_np_struct *p;
1125
1126         DEBUG(4,("search for pipe pnum=%x\n", pnum));
1127
1128         for (p=Pipes;p;p=p->next)
1129                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
1130                           p->name, p->pnum, pipes_open));
1131
1132         for (p=Pipes;p;p=p->next) {
1133                 if (p->pnum == pnum) {
1134                         chain_p = p;
1135                         return p;
1136                 }
1137         }
1138
1139         return NULL;
1140 }