source/rpc_server/srv_pipe_hnd.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Largely re-written : 2005
   6  *  Copyright (C) Jeremy Allison                1998 - 2005
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21  */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_RPC_SRV
  27
  28 #define PIPE            "\\PIPE\\"
  29 #define PIPELEN         strlen(PIPE)
  30
  31 static smb_np_struct *chain_p;
  32 static int pipes_open;
  33
  34 /*
  35  * Sometimes I can't decide if I hate Windows printer driver
  36  * writers more than I hate the Windows spooler service driver
  37  * writers. This gets around a combination of bugs in the spooler
  38  * and the HP 8500 PCL driver that causes a spooler spin. JRA.
  39  *
  40  * bumped up from 20 -> 64 after viewing traffic from WordPerfect
  41  * 2002 running on NT 4.- SP6
  42  * bumped up from 64 -> 256 after viewing traffic from con2prt
  43  * for lots of printers on a WinNT 4.x SP6 box.
  44  */
  45
  46 #ifndef MAX_OPEN_SPOOLSS_PIPES
  47 #define MAX_OPEN_SPOOLSS_PIPES 256
  48 #endif
  49 static int current_spoolss_pipes_open;
  50
  51 static smb_np_struct *Pipes;
  52 static pipes_struct *InternalPipes;
  53 static struct bitmap *bmap;
  54
  55 /* TODO
  56  * the following prototypes are declared here to avoid
  57  * code being moved about too much for a patch to be
  58  * disrupted / less obvious.
  59  *
  60  * these functions, and associated functions that they
  61  * call, should be moved behind a .so module-loading
  62  * system _anyway_.  so that's the next step...
  63  */
  64
  65 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
  66                 BOOL *is_data_outstanding);
  67 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n);
  68 static BOOL close_internal_rpc_pipe_hnd(void *np_conn);
  69 static void *make_internal_rpc_pipe_p(char *pipe_name,
  70                               connection_struct *conn, uint16 vuid);
  71
  72 /****************************************************************************
  73  Pipe iterator functions.
  74 ****************************************************************************/
  75
  76 smb_np_struct *get_first_pipe(void)
  77 {
  78         return Pipes;
  79 }
  80
  81 smb_np_struct *get_next_pipe(smb_np_struct *p)
  82 {
  83         return p->next;
  84 }
  85
  86 /****************************************************************************
  87  Internal Pipe iterator functions.
  88 ****************************************************************************/
  89
  90 pipes_struct *get_first_internal_pipe(void)
  91 {
  92         return InternalPipes;
  93 }
  94
  95 pipes_struct *get_next_internal_pipe(pipes_struct *p)
  96 {
  97         return p->next;
  98 }
  99
 100 /* this must be larger than the sum of the open files and directories */
 101 static int pipe_handle_offset;
 102
 103 /****************************************************************************
 104  Set the pipe_handle_offset. Called from smbd/files.c
 105 ****************************************************************************/
 106
 107 void set_pipe_handle_offset(int max_open_files)
 108 {
 109         if(max_open_files < 0x7000) {
 110                 pipe_handle_offset = 0x7000;
 111         } else {
 112                 pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
 113         }
 114 }
 115
 116 /****************************************************************************
 117  Reset pipe chain handle number.
 118 ****************************************************************************/
 119
 120 void reset_chain_p(void)
 121 {
 122         chain_p = NULL;
 123 }
 124
 125 /****************************************************************************
 126  Initialise pipe handle states.
 127 ****************************************************************************/
 128
 129 void init_rpc_pipe_hnd(void)
 130 {
 131         bmap = bitmap_allocate(MAX_OPEN_PIPES);
 132         if (!bmap) {
 133                 exit_server("out of memory in init_rpc_pipe_hnd");
 134         }
 135 }
 136
 137 /****************************************************************************
 138  Initialise an outgoing packet.
 139 ****************************************************************************/
 140
 141 static BOOL pipe_init_outgoing_data(pipes_struct *p)
 142 {
 143         output_data *o_data = &p->out_data;
 144
 145         /* Reset the offset counters. */
 146         o_data->data_sent_length = 0;
 147         o_data->current_pdu_len = 0;
 148         o_data->current_pdu_sent = 0;
 149
 150         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
 151
 152         /* Free any memory in the current return data buffer. */
 153         prs_mem_free(&o_data->rdata);
 154
 155         /*
 156          * Initialize the outgoing RPC data buffer.
 157          * we will use this as the raw data area for replying to rpc requests.
 158          */
 159         if(!prs_init(&o_data->rdata, RPC_MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 160                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
 161                 return False;
 162         }
 163
 164         return True;
 165 }
 166
 167 /****************************************************************************
 168  Find first available pipe slot.
 169 ****************************************************************************/
 170
 171 smb_np_struct *open_rpc_pipe_p(char *pipe_name,
 172                               connection_struct *conn, uint16 vuid)
 173 {
 174         int i;
 175         smb_np_struct *p, *p_it;
 176         static int next_pipe;
 177         BOOL is_spoolss_pipe = False;
 178
 179         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
 180                  pipe_name, pipes_open));
 181
 182         if (strstr(pipe_name, "spoolss")) {
 183                 is_spoolss_pipe = True;
 184         }
 185
 186         if (is_spoolss_pipe && current_spoolss_pipes_open >= MAX_OPEN_SPOOLSS_PIPES) {
 187                 DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n",
 188                         pipe_name ));
 189                 return NULL;
 190         }
 191
 192         /* not repeating pipe numbers makes it easier to track things in
 193            log files and prevents client bugs where pipe numbers are reused
 194            over connection restarts */
 195
 196         if (next_pipe == 0) {
 197                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
 198         }
 199
 200         i = bitmap_find(bmap, next_pipe);
 201
 202         if (i == -1) {
 203                 DEBUG(0,("ERROR! Out of pipe structures\n"));
 204                 return NULL;
 205         }
 206
 207         next_pipe = (i+1) % MAX_OPEN_PIPES;
 208
 209         for (p = Pipes; p; p = p->next) {
 210                 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum));
 211         }
 212
 213         p = SMB_MALLOC_P(smb_np_struct);
 214         if (!p) {
 215                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 216                 return NULL;
 217         }
 218
 219         ZERO_STRUCTP(p);
 220
 221         /* add a dso mechanism instead of this, here */
 222
 223         p->namedpipe_create = make_internal_rpc_pipe_p;
 224         p->namedpipe_read = read_from_internal_pipe;
 225         p->namedpipe_write = write_to_internal_pipe;
 226         p->namedpipe_close = close_internal_rpc_pipe_hnd;
 227
 228         p->np_state = p->namedpipe_create(pipe_name, conn, vuid);
 229
 230         if (p->np_state == NULL) {
 231                 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
 232                 SAFE_FREE(p);
 233                 return NULL;
 234         }
 235
 236         DLIST_ADD(Pipes, p);
 237
 238         /*
 239          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 240          * We cheat here and say we're marshalling, as we intend to add incoming
 241          * data directly into the prs_struct and we want it to auto grow. We will
 242          * change the type to UNMARSALLING before processing the stream.
 243          */
 244
 245         bitmap_set(bmap, i);
 246         i += pipe_handle_offset;
 247
 248         pipes_open++;
 249
 250         p->pnum = i;
 251
 252         p->open = True;
 253         p->device_state = 0;
 254         p->priority = 0;
 255         p->conn = conn;
 256         p->vuid  = vuid;
 257
 258         p->max_trans_reply = 0;
 259
 260         fstrcpy(p->name, pipe_name);
 261
 262         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
 263                  pipe_name, i, pipes_open));
 264
 265         chain_p = p;
 266
 267         /* Iterate over p_it as a temp variable, to display all open pipes */
 268         for (p_it = Pipes; p_it; p_it = p_it->next) {
 269                 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum));
 270         }
 271
 272         return chain_p;
 273 }
 274
 275 /****************************************************************************
 276  Make an internal namedpipes structure
 277 ****************************************************************************/
 278
 279 static void *make_internal_rpc_pipe_p(char *pipe_name,
 280                               connection_struct *conn, uint16 vuid)
 281 {
 282         pipes_struct *p;
 283         user_struct *vuser = get_valid_user_struct(vuid);
 284
 285         DEBUG(4,("Create pipe requested %s\n", pipe_name));
 286
 287         if (!vuser && vuid != UID_FIELD_INVALID) {
 288                 DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid));
 289                 return NULL;
 290         }
 291
 292         p = SMB_MALLOC_P(pipes_struct);
 293
 294         if (!p) {
 295                 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
 296                 return NULL;
 297         }
 298
 299         ZERO_STRUCTP(p);
 300
 301         if ((p->mem_ctx = talloc_init("pipe %s %p", pipe_name, p)) == NULL) {
 302                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
 303                 SAFE_FREE(p);
 304                 return NULL;
 305         }
 306
 307         if ((p->pipe_state_mem_ctx = talloc_init("pipe_state %s %p", pipe_name, p)) == NULL) {
 308                 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
 309                 talloc_destroy(p->mem_ctx);
 310                 SAFE_FREE(p);
 311                 return NULL;
 312         }
 313
 314         if (!init_pipe_handle_list(p, pipe_name)) {
 315                 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
 316                 talloc_destroy(p->mem_ctx);
 317                 talloc_destroy(p->pipe_state_mem_ctx);
 318                 SAFE_FREE(p);
 319                 return NULL;
 320         }
 321
 322         /*
 323          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 324          * We cheat here and say we're marshalling, as we intend to add incoming
 325          * data directly into the prs_struct and we want it to auto grow. We will
 326          * change the type to UNMARSALLING before processing the stream.
 327          */
 328
 329         if(!prs_init(&p->in_data.data, RPC_MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) {
 330                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
 331                 talloc_destroy(p->mem_ctx);
 332                 talloc_destroy(p->pipe_state_mem_ctx);
 333                 return NULL;
 334         }
 335
 336         DLIST_ADD(InternalPipes, p);
 337
 338         p->conn = conn;
 339
 340         /* Ensure the connection isn't idled whilst this pipe is open. */
 341         p->conn->num_files_open++;
 342
 343         p->vuid  = vuid;
 344
 345         p->endian = RPC_LITTLE_ENDIAN;
 346
 347         ZERO_STRUCT(p->pipe_user);
 348
 349         p->pipe_user.uid = (uid_t)-1;
 350         p->pipe_user.gid = (gid_t)-1;
 351
 352         /* Store the session key and NT_TOKEN */
 353         if (vuser) {
 354                 p->session_key = data_blob(vuser->session_key.data, vuser->session_key.length);
 355                 p->pipe_user.nt_user_token = dup_nt_token(vuser->nt_user_token);
 356         }
 357
 358         /*
 359          * Initialize the outgoing RPC data buffer with no memory.
 360          */
 361         prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL);
 362
 363         fstrcpy(p->name, pipe_name);
 364
 365         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
 366                  pipe_name, pipes_open));
 367
 368         return (void*)p;
 369 }
 370
 371 /****************************************************************************
 372  Sets the fault state on incoming packets.
 373 ****************************************************************************/
 374
 375 static void set_incoming_fault(pipes_struct *p)
 376 {
 377         prs_mem_free(&p->in_data.data);
 378         p->in_data.pdu_needed_len = 0;
 379         p->in_data.pdu_received_len = 0;
 380         p->fault_state = True;
 381         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n",
 382                 p->name, p->vuid ));
 383 }
 384
 385 /****************************************************************************
 386  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
 387 ****************************************************************************/
 388
 389 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
 390 {
 391         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
 392
 393         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
 394                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
 395                         (unsigned int)p->in_data.pdu_received_len ));
 396
 397         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
 398         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
 399
 400         return (ssize_t)len_needed_to_complete_hdr;
 401 }
 402
 403 /****************************************************************************
 404  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
 405 ****************************************************************************/
 406
 407 static ssize_t unmarshall_rpc_header(pipes_struct *p)
 408 {
 409         /*
 410          * Unmarshall the header to determine the needed length.
 411          */
 412
 413         prs_struct rpc_in;
 414
 415         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
 416                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
 417                 set_incoming_fault(p);
 418                 return -1;
 419         }
 420
 421         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 422         prs_set_endian_data( &rpc_in, p->endian);
 423
 424         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
 425                                         p->in_data.pdu_received_len, False);
 426
 427         /*
 428          * Unmarshall the header as this will tell us how much
 429          * data we need to read to get the complete pdu.
 430          * This also sets the endian flag in rpc_in.
 431          */
 432
 433         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
 434                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
 435                 set_incoming_fault(p);
 436                 prs_mem_free(&rpc_in);
 437                 return -1;
 438         }
 439
 440         /*
 441          * Validate the RPC header.
 442          */
 443
 444         if(p->hdr.major != 5 && p->hdr.minor != 0) {
 445                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
 446                 set_incoming_fault(p);
 447                 prs_mem_free(&rpc_in);
 448                 return -1;
 449         }
 450
 451         /*
 452          * If there's not data in the incoming buffer this should be the start of a new RPC.
 453          */
 454
 455         if(prs_offset(&p->in_data.data) == 0) {
 456
 457                 /*
 458                  * AS/U doesn't set FIRST flag in a BIND packet it seems.
 459                  */
 460
 461                 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) {
 462                         /*
 463                          * Ensure that the FIRST flag is set. If not then we have
 464                          * a stream missmatch.
 465                          */
 466
 467                         DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
 468                         set_incoming_fault(p);
 469                         prs_mem_free(&rpc_in);
 470                         return -1;
 471                 }
 472
 473                 /*
 474                  * If this is the first PDU then set the endianness
 475                  * flag in the pipe. We will need this when parsing all
 476                  * data in this RPC.
 477                  */
 478
 479                 p->endian = rpc_in.bigendian_data;
 480
 481                 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
 482                                 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" ));
 483
 484         } else {
 485
 486                 /*
 487                  * If this is *NOT* the first PDU then check the endianness
 488                  * flag in the pipe is the same as that in the PDU.
 489                  */
 490
 491                 if (p->endian != rpc_in.bigendian_data) {
 492                         DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian));
 493                         set_incoming_fault(p);
 494                         prs_mem_free(&rpc_in);
 495                         return -1;
 496                 }
 497         }
 498
 499         /*
 500          * Ensure that the pdu length is sane.
 501          */
 502
 503         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > RPC_MAX_PDU_FRAG_LEN)) {
 504                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
 505                 set_incoming_fault(p);
 506                 prs_mem_free(&rpc_in);
 507                 return -1;
 508         }
 509
 510         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
 511                         (unsigned int)p->hdr.flags ));
 512
 513         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
 514
 515         prs_mem_free(&rpc_in);
 516
 517         return 0; /* No extra data processed. */
 518 }
 519
 520 /****************************************************************************
 521  Call this to free any talloc'ed memory. Do this before and after processing
 522  a complete PDU.
 523 ****************************************************************************/
 524
 525 static void free_pipe_context(pipes_struct *p)
 526 {
 527         if (p->mem_ctx) {
 528                 DEBUG(3,("free_pipe_context: destroying talloc pool of size "
 529                          "%lu\n", (unsigned long)talloc_total_size(p->mem_ctx) ));
 530                 talloc_free_children(p->mem_ctx);
 531         } else {
 532                 p->mem_ctx = talloc_init("pipe %s %p", p->name, p);
 533                 if (p->mem_ctx == NULL) {
 534                         p->fault_state = True;
 535                 }
 536         }
 537 }
 538
 539 /****************************************************************************
 540  Processes a request pdu. This will do auth processing if needed, and
 541  appends the data into the complete stream if the LAST flag is not set.
 542 ****************************************************************************/
 543
 544 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 545 {
 546         uint32 ss_padding_len = 0;
 547         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 548                                 (p->hdr.auth_len ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 549
 550         if(!p->pipe_bound) {
 551                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
 552                 set_incoming_fault(p);
 553                 return False;
 554         }
 555
 556         /*
 557          * Check if we need to do authentication processing.
 558          * This is only done on requests, not binds.
 559          */
 560
 561         /*
 562          * Read the RPC request header.
 563          */
 564
 565         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
 566                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
 567                 set_incoming_fault(p);
 568                 return False;
 569         }
 570
 571         switch(p->auth.auth_type) {
 572                 case PIPE_AUTH_TYPE_NONE:
 573                         break;
 574
 575                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 576                 case PIPE_AUTH_TYPE_NTLMSSP:
 577                 {
 578                         NTSTATUS status;
 579                         if(!api_pipe_ntlmssp_auth_process(p, rpc_in_p, &ss_padding_len, &status)) {
 580                                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
 581                                 DEBUG(0,("process_request_pdu: error was %s.\n", nt_errstr(status) ));
 582                                 set_incoming_fault(p);
 583                                 return False;
 584                         }
 585                         break;
 586                 }
 587
 588                 case PIPE_AUTH_TYPE_SCHANNEL:
 589                         if (!api_pipe_schannel_process(p, rpc_in_p, &ss_padding_len)) {
 590                                 DEBUG(3,("process_request_pdu: failed to do schannel processing.\n"));
 591                                 set_incoming_fault(p);
 592                                 return False;
 593                         }
 594                         break;
 595
 596                 default:
 597                         DEBUG(0,("process_request_pdu: unknown auth type %u set.\n", (unsigned int)p->auth.auth_type ));
 598                         set_incoming_fault(p);
 599                         return False;
 600         }
 601
 602         /* Now we've done the sign/seal we can remove any padding data. */
 603         if (data_len > ss_padding_len) {
 604                 data_len -= ss_padding_len;
 605         }
 606
 607         /*
 608          * Check the data length doesn't go over the 15Mb limit.
 609          * increased after observing a bug in the Windows NT 4.0 SP6a
 610          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
 611          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
 612          */
 613
 614         if(prs_offset(&p->in_data.data) + data_len > 15*1024*1024) {
 615                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
 616                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
 617                 set_incoming_fault(p);
 618                 return False;
 619         }
 620
 621         /*
 622          * Append the data portion into the buffer and return.
 623          */
 624
 625         if(!prs_append_some_prs_data(&p->in_data.data, rpc_in_p, prs_offset(rpc_in_p), data_len)) {
 626                 DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
 627                                 (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
 628                 set_incoming_fault(p);
 629                 return False;
 630         }
 631
 632         if(p->hdr.flags & RPC_FLG_LAST) {
 633                 BOOL ret = False;
 634                 /*
 635                  * Ok - we finally have a complete RPC stream.
 636                  * Call the rpc command to process it.
 637                  */
 638
 639                 /*
 640                  * Ensure the internal prs buffer size is *exactly* the same
 641                  * size as the current offset.
 642                  */
 643
 644                 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data))) {
 645                         DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
 646                         set_incoming_fault(p);
 647                         return False;
 648                 }
 649
 650                 /*
 651                  * Set the parse offset to the start of the data and set the
 652                  * prs_struct to UNMARSHALL.
 653                  */
 654
 655                 prs_set_offset(&p->in_data.data, 0);
 656                 prs_switch_type(&p->in_data.data, UNMARSHALL);
 657
 658                 /*
 659                  * Process the complete data stream here.
 660                  */
 661
 662                 free_pipe_context(p);
 663
 664                 if(pipe_init_outgoing_data(p)) {
 665                         ret = api_pipe_request(p);
 666                 }
 667
 668                 free_pipe_context(p);
 669
 670                 /*
 671                  * We have consumed the whole data stream. Set back to
 672                  * marshalling and set the offset back to the start of
 673                  * the buffer to re-use it (we could also do a prs_mem_free()
 674                  * and then re_init on the next start of PDU. Not sure which
 675                  * is best here.... JRA.
 676                  */
 677
 678                 prs_switch_type(&p->in_data.data, MARSHALL);
 679                 prs_set_offset(&p->in_data.data, 0);
 680                 return ret;
 681         }
 682
 683         return True;
 684 }
 685
 686 /****************************************************************************
 687  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
 688  already been parsed and stored in p->hdr.
 689 ****************************************************************************/
 690
 691 static void process_complete_pdu(pipes_struct *p)
 692 {
 693         prs_struct rpc_in;
 694         size_t data_len = p->in_data.pdu_received_len - RPC_HEADER_LEN;
 695         char *data_p = (char *)&p->in_data.current_in_pdu[RPC_HEADER_LEN];
 696         BOOL reply = False;
 697
 698         if(p->fault_state) {
 699                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
 700                         p->name ));
 701                 set_incoming_fault(p);
 702                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 703                 return;
 704         }
 705
 706         prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL);
 707
 708         /*
 709          * Ensure we're using the corrent endianness for both the
 710          * RPC header flags and the raw data we will be reading from.
 711          */
 712
 713         prs_set_endian_data( &rpc_in, p->endian);
 714         prs_set_endian_data( &p->in_data.data, p->endian);
 715
 716         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
 717
 718         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
 719                         (unsigned int)p->hdr.pkt_type ));
 720
 721         switch (p->hdr.pkt_type) {
 722                 case RPC_BIND:
 723                         /*
 724                          * We assume that a pipe bind is only in one pdu.
 725                          */
 726                         if(pipe_init_outgoing_data(p)) {
 727                                 reply = api_pipe_bind_req(p, &rpc_in);
 728                         }
 729                         break;
 730                 case RPC_ALTCONT:
 731                         /*
 732                          * We assume that a pipe bind is only in one pdu.
 733                          */
 734                         if(pipe_init_outgoing_data(p)) {
 735                                 reply = api_pipe_alter_context(p, &rpc_in);
 736                         }
 737                         break;
 738                 case RPC_AUTH3:
 739                         /*
 740                          * The third packet in an NTLMSSP auth exchange.
 741                          */
 742                         if(pipe_init_outgoing_data(p)) {
 743                                 reply = api_pipe_bind_auth3(p, &rpc_in);
 744                         }
 745                         break;
 746                 case RPC_REQUEST:
 747                         reply = process_request_pdu(p, &rpc_in);
 748                         break;
 749                 default:
 750                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
 751                         break;
 752         }
 753
 754         /* Reset to little endian. Probably don't need this but it won't hurt. */
 755         prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN);
 756
 757         if (!reply) {
 758                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
 759                 set_incoming_fault(p);
 760                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 761                 prs_mem_free(&rpc_in);
 762         } else {
 763                 /*
 764                  * Reset the lengths. We're ready for a new pdu.
 765                  */
 766                 p->in_data.pdu_needed_len = 0;
 767                 p->in_data.pdu_received_len = 0;
 768         }
 769
 770         prs_mem_free(&rpc_in);
 771 }
 772
 773 /****************************************************************************
 774  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
 775 ****************************************************************************/
 776
 777 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
 778 {
 779         size_t data_to_copy = MIN(n, RPC_MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
 780
 781         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
 782                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
 783                 (unsigned int)n ));
 784
 785         if(data_to_copy == 0) {
 786                 /*
 787                  * This is an error - data is being received and there is no
 788                  * space in the PDU. Free the received data and go into the fault state.
 789                  */
 790                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
 791 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
 792                 set_incoming_fault(p);
 793                 return -1;
 794         }
 795
 796         /*
 797          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
 798          * number of bytes before we can do anything.
 799          */
 800
 801         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
 802                 /*
 803                  * Always return here. If we have more data then the RPC_HEADER
 804                  * will be processed the next time around the loop.
 805                  */
 806                 return fill_rpc_header(p, data, data_to_copy);
 807         }
 808
 809         /*
 810          * At this point we know we have at least an RPC_HEADER_LEN amount of data
 811          * stored in current_in_pdu.
 812          */
 813
 814         /*
 815          * If pdu_needed_len is zero this is a new pdu.
 816          * Unmarshall the header so we know how much more
 817          * data we need, then loop again.
 818          */
 819
 820         if(p->in_data.pdu_needed_len == 0) {
 821                 return unmarshall_rpc_header(p);
 822         }
 823
 824         /*
 825          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
 826          * Keep reading until we have a full pdu.
 827          */
 828
 829         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
 830
 831         /*
 832          * Copy as much of the data as we need into the current_in_pdu buffer.
 833          * pdu_needed_len becomes zero when we have a complete pdu.
 834          */
 835
 836         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
 837         p->in_data.pdu_received_len += data_to_copy;
 838         p->in_data.pdu_needed_len -= data_to_copy;
 839
 840         /*
 841          * Do we have a complete PDU ?
 842          * (return the number of bytes handled in the call)
 843          */
 844
 845         if(p->in_data.pdu_needed_len == 0) {
 846                 process_complete_pdu(p);
 847                 return data_to_copy;
 848         }
 849
 850         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
 851                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
 852
 853         return (ssize_t)data_to_copy;
 854 }
 855
 856 /****************************************************************************
 857  Accepts incoming data on an rpc pipe.
 858 ****************************************************************************/
 859
 860 ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n)
 861 {
 862         DEBUG(6,("write_to_pipe: %x", p->pnum));
 863
 864         DEBUG(6,(" name: %s open: %s len: %d\n",
 865                  p->name, BOOLSTR(p->open), (int)n));
 866
 867         dump_data(50, data, n);
 868
 869         return p->namedpipe_write(p->np_state, data, n);
 870 }
 871
 872 /****************************************************************************
 873  Accepts incoming data on an internal rpc pipe.
 874 ****************************************************************************/
 875
 876 static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n)
 877 {
 878         pipes_struct *p = (pipes_struct*)np_conn;
 879         size_t data_left = n;
 880
 881         while(data_left) {
 882                 ssize_t data_used;
 883
 884                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
 885
 886                 data_used = process_incoming_data(p, data, data_left);
 887
 888                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
 889
 890                 if(data_used < 0) {
 891                         return -1;
 892                 }
 893
 894                 data_left -= data_used;
 895                 data += data_used;
 896         }
 897
 898         return n;
 899 }
 900
 901 /****************************************************************************
 902  Replies to a request to read data from a pipe.
 903
 904  Headers are interspersed with the data at PDU intervals. By the time
 905  this function is called, the start of the data could possibly have been
 906  read by an SMBtrans (file_offset != 0).
 907
 908  Calling create_rpc_reply() here is a hack. The data should already
 909  have been prepared into arrays of headers + data stream sections.
 910 ****************************************************************************/
 911
 912 ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n,
 913                 BOOL *is_data_outstanding)
 914 {
 915         if (!p || !p->open) {
 916                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 917                 return -1;
 918         }
 919
 920         DEBUG(6,("read_from_pipe: %x", p->pnum));
 921
 922         return p->namedpipe_read(p->np_state, data, n, is_data_outstanding);
 923 }
 924
 925 /****************************************************************************
 926  Replies to a request to read data from a pipe.
 927
 928  Headers are interspersed with the data at PDU intervals. By the time
 929  this function is called, the start of the data could possibly have been
 930  read by an SMBtrans (file_offset != 0).
 931
 932  Calling create_rpc_reply() here is a hack. The data should already
 933  have been prepared into arrays of headers + data stream sections.
 934 ****************************************************************************/
 935
 936 static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n,
 937                 BOOL *is_data_outstanding)
 938 {
 939         pipes_struct *p = (pipes_struct*)np_conn;
 940         uint32 pdu_remaining = 0;
 941         ssize_t data_returned = 0;
 942
 943         if (!p) {
 944                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 945                 return -1;
 946         }
 947
 948         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
 949
 950         /*
 951          * We cannot return more than one PDU length per
 952          * read request.
 953          */
 954
 955         /*
 956          * This condition should result in the connection being closed.
 957          * Netapp filers seem to set it to 0xffff which results in domain
 958          * authentications failing.  Just ignore it so things work.
 959          */
 960
 961         if(n > RPC_MAX_PDU_FRAG_LEN) {
 962                 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
 963 pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, RPC_MAX_PDU_FRAG_LEN ));
 964         }
 965
 966         /*
 967          * Determine if there is still data to send in the
 968          * pipe PDU buffer. Always send this first. Never
 969          * send more than is left in the current PDU. The
 970          * client should send a new read request for a new
 971          * PDU.
 972          */
 973
 974         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
 975                 data_returned = (ssize_t)MIN(n, pdu_remaining);
 976
 977                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
 978 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len,
 979                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
 980
 981                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
 982                 p->out_data.current_pdu_sent += (uint32)data_returned;
 983                 goto out;
 984         }
 985
 986         /*
 987          * At this point p->current_pdu_len == p->current_pdu_sent (which
 988          * may of course be zero if this is the first return fragment.
 989          */
 990
 991         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
 992 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
 993                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
 994
 995         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
 996                 /*
 997                  * We have sent all possible data, return 0.
 998                  */
 999                 data_returned = 0;
1000                 goto out;
1001         }
1002
1003         /*
1004          * We need to create a new PDU from the data left in p->rdata.
1005          * Create the header/data/footers. This also sets up the fields
1006          * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
1007          * and stores the outgoing PDU in p->current_pdu.
1008          */
1009
1010         if(!create_next_pdu(p)) {
1011                 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
1012                 return -1;
1013         }
1014
1015         data_returned = MIN(n, p->out_data.current_pdu_len);
1016
1017         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
1018         p->out_data.current_pdu_sent += (uint32)data_returned;
1019
1020   out:
1021
1022         (*is_data_outstanding) = p->out_data.current_pdu_len > n;
1023         return data_returned;
1024 }
1025
1026 /****************************************************************************
1027  Wait device state on a pipe. Exactly what this is for is unknown...
1028 ****************************************************************************/
1029
1030 BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority)
1031 {
1032         if (p == NULL) {
1033                 return False;
1034         }
1035
1036         if (p->open) {
1037                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
1038                          priority, p->name));
1039
1040                 p->priority = priority;
1041
1042                 return True;
1043         }
1044
1045         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
1046                  priority, p->name));
1047         return False;
1048 }
1049
1050
1051 /****************************************************************************
1052  Set device state on a pipe. Exactly what this is for is unknown...
1053 ****************************************************************************/
1054
1055 BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state)
1056 {
1057         if (p == NULL) {
1058                 return False;
1059         }
1060
1061         if (p->open) {
1062                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1063                          device_state, p->name));
1064
1065                 p->device_state = device_state;
1066
1067                 return True;
1068         }
1069
1070         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1071                  device_state, p->name));
1072         return False;
1073 }
1074
1075
1076 /****************************************************************************
1077  Close an rpc pipe.
1078 ****************************************************************************/
1079
1080 BOOL close_rpc_pipe_hnd(smb_np_struct *p)
1081 {
1082         if (!p) {
1083                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1084                 return False;
1085         }
1086
1087         p->namedpipe_close(p->np_state);
1088
1089         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
1090
1091         pipes_open--;
1092
1093         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
1094                  p->name, p->pnum, pipes_open));
1095
1096         DLIST_REMOVE(Pipes, p);
1097
1098         ZERO_STRUCTP(p);
1099
1100         SAFE_FREE(p);
1101
1102         return True;
1103 }
1104
1105 /****************************************************************************
1106  Close all pipes on a connection.
1107 ****************************************************************************/
1108
1109 void pipe_close_conn(connection_struct *conn)
1110 {
1111         smb_np_struct *p, *next;
1112
1113         for (p=Pipes;p;p=next) {
1114                 next = p->next;
1115                 if (p->conn == conn) {
1116                         close_rpc_pipe_hnd(p);
1117                 }
1118         }
1119 }
1120
1121 /****************************************************************************
1122  Close an rpc pipe.
1123 ****************************************************************************/
1124
1125 static BOOL close_internal_rpc_pipe_hnd(void *np_conn)
1126 {
1127         pipes_struct *p = (pipes_struct *)np_conn;
1128         if (!p) {
1129                 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1130                 return False;
1131         }
1132
1133         prs_mem_free(&p->out_data.rdata);
1134         prs_mem_free(&p->in_data.data);
1135
1136         if (p->auth.auth_data_free_func) {
1137                 (*p->auth.auth_data_free_func)(&p->auth);
1138         }
1139
1140         if (p->mem_ctx) {
1141                 talloc_destroy(p->mem_ctx);
1142         }
1143
1144         if (p->pipe_state_mem_ctx) {
1145                 talloc_destroy(p->pipe_state_mem_ctx);
1146         }
1147
1148         free_pipe_rpc_context( p->contexts );
1149
1150         /* Free the handles database. */
1151         close_policy_by_pipe(p);
1152
1153         delete_nt_token(&p->pipe_user.nt_user_token);
1154         data_blob_free(&p->session_key);
1155         SAFE_FREE(p->pipe_user.groups);
1156
1157         DLIST_REMOVE(InternalPipes, p);
1158
1159         p->conn->num_files_open--;
1160
1161         ZERO_STRUCTP(p);
1162
1163         SAFE_FREE(p);
1164
1165         return True;
1166 }
1167
1168 /****************************************************************************
1169  Find an rpc pipe given a pipe handle in a buffer and an offset.
1170 ****************************************************************************/
1171
1172 smb_np_struct *get_rpc_pipe_p(char *buf, int where)
1173 {
1174         int pnum = SVAL(buf,where);
1175
1176         if (chain_p) {
1177                 return chain_p;
1178         }
1179
1180         return get_rpc_pipe(pnum);
1181 }
1182
1183 /****************************************************************************
1184  Find an rpc pipe given a pipe handle.
1185 ****************************************************************************/
1186
1187 smb_np_struct *get_rpc_pipe(int pnum)
1188 {
1189         smb_np_struct *p;
1190
1191         DEBUG(4,("search for pipe pnum=%x\n", pnum));
1192
1193         for (p=Pipes;p;p=p->next) {
1194                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
1195                           p->name, p->pnum, pipes_open));
1196         }
1197
1198         for (p=Pipes;p;p=p->next) {
1199                 if (p->pnum == pnum) {
1200                         chain_p = p;
1201                         return p;
1202                 }
1203         }
1204
1205         return NULL;
1206 }