source/rpc_server/srv_pipe_hnd.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998,
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Jeremy Allison                                    1999.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24
  25 #include "includes.h"
  26
  27
  28 #define PIPE            "\\PIPE\\"
  29 #define PIPELEN         strlen(PIPE)
  30
  31 extern int DEBUGLEVEL;
  32 static pipes_struct *chain_p;
  33 static int pipes_open;
  34
  35 #ifndef MAX_OPEN_PIPES
  36 #define MAX_OPEN_PIPES 64
  37 #endif
  38
  39 static pipes_struct *Pipes;
  40 static struct bitmap *bmap;
  41
  42 /* this must be larger than the sum of the open files and directories */
  43 static int pipe_handle_offset;
  44
  45 /****************************************************************************
  46  Set the pipe_handle_offset. Called from smbd/files.c
  47 ****************************************************************************/
  48
  49 void set_pipe_handle_offset(int max_open_files)
  50 {
  51   if(max_open_files < 0x7000)
  52     pipe_handle_offset = 0x7000;
  53   else
  54     pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
  55 }
  56
  57 /****************************************************************************
  58  Reset pipe chain handle number.
  59 ****************************************************************************/
  60 void reset_chain_p(void)
  61 {
  62         chain_p = NULL;
  63 }
  64
  65 /****************************************************************************
  66  Initialise pipe handle states.
  67 ****************************************************************************/
  68
  69 void init_rpc_pipe_hnd(void)
  70 {
  71         bmap = bitmap_allocate(MAX_OPEN_PIPES);
  72         if (!bmap)
  73                 exit_server("out of memory in init_rpc_pipe_hnd\n");
  74 }
  75
  76 /****************************************************************************
  77  Initialise an outgoing packet.
  78 ****************************************************************************/
  79
  80 static BOOL pipe_init_outgoing_data(output_data *o_data, uint32 len)
  81 {
  82         /* Reset the offset counters. */
  83         o_data->data_sent_length = 0;
  84         o_data->current_pdu_len = 0;
  85         o_data->current_pdu_sent = 0;
  86
  87         memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu));
  88
  89         /* Free any memory in the current return data buffer. */
  90         prs_mem_free(&o_data->rdata);
  91
  92         /*
  93          * Initialize the outgoing RPC data buffer.
  94          * we will use this as the raw data area for replying to rpc requests.
  95          */
  96         if(!prs_init(&o_data->rdata, len, 4, MARSHALL)) {
  97                 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
  98                 return False;
  99         }
 100
 101         return True;
 102 }
 103
 104 /****************************************************************************
 105  Attempt to find a remote process to communicate RPC's with.
 106 ****************************************************************************/
 107
 108 static void attempt_remote_rpc_connect(pipes_struct *p)
 109 {
 110         struct user_creds usr;
 111         user_struct *vuser = get_valid_user_struct(p->vuid);
 112
 113         p->m = NULL;
 114
 115         if (vuser == NULL) {
 116                 DEBUG(4,("attempt_remote_rpc_connect: invalid vuid %d\n", (int)p->vuid));
 117                 return;
 118         }
 119
 120         ZERO_STRUCT(usr);
 121
 122         /* set up unix credentials from the smb side, to feed over the pipe */
 123         make_creds_unix(&usr.uxc, vuser->user.unix_name, vuser->user.smb_name,
 124                                         vuser->user.real_name, vuser->guest);
 125         usr.ptr_uxc = 1;
 126         make_creds_unix_sec(&usr.uxs, vuser->uid, vuser->gid,
 127                                         vuser->n_groups, vuser->groups);
 128         usr.ptr_uxs = 1;
 129
 130         usr.ptr_ssk = 1;
 131         DEBUG(10,("user session key not available (yet).\n"));
 132         DEBUG(10,("password-change operations may fail.\n"));
 133
 134 #if USER_SESSION_KEY_DEFINED_IN_VUSER_STRUCT
 135         memcpy(usr.usr_sess_key, vuser->usr_sess_key, sizeof(usr.usr_sess_key));
 136 #else
 137         memset(usr.usr_sess_key, 0, sizeof(usr.usr_sess_key));
 138 #endif
 139
 140         /* set up nt credentials from the smb side, to feed over the pipe */
 141         /* lkclXXXX todo!
 142         make_creds_nt(&usr.ntc);
 143         make_creds_nt_sec(&usr.nts);
 144         */
 145
 146         become_root(False); /* to connect to pipe */
 147         p->m = msrpc_use_add(p->name, sys_getpid(), &usr, False);
 148         unbecome_root(False);
 149
 150         if (p->m == NULL)
 151                 DEBUG(10,("attempt_remote_rpc_connect: msrpc redirect failed - using local implementation.\n"));
 152 }
 153
 154 /****************************************************************************
 155  Find first available pipe slot.
 156 ****************************************************************************/
 157
 158 pipes_struct *open_rpc_pipe_p(char *pipe_name,
 159                               connection_struct *conn, uint16 vuid)
 160 {
 161         int i;
 162         pipes_struct *p;
 163         static int next_pipe;
 164
 165         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
 166                  pipe_name, pipes_open));
 167
 168
 169         /* not repeating pipe numbers makes it easier to track things in
 170            log files and prevents client bugs where pipe numbers are reused
 171            over connection restarts */
 172         if (next_pipe == 0)
 173                 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
 174
 175         i = bitmap_find(bmap, next_pipe);
 176
 177         if (i == -1) {
 178                 DEBUG(0,("ERROR! Out of pipe structures\n"));
 179                 return NULL;
 180         }
 181
 182         next_pipe = (i+1) % MAX_OPEN_PIPES;
 183
 184         for (p = Pipes; p; p = p->next)
 185                 DEBUG(5,("open pipes: name %s pnum=%x\n", p->name, p->pnum));
 186
 187         p = (pipes_struct *)malloc(sizeof(*p));
 188
 189         if (!p)
 190                 return NULL;
 191
 192         ZERO_STRUCTP(p);
 193
 194         DLIST_ADD(Pipes, p);
 195
 196         /*
 197          * Initialize the incoming RPC data buffer with one PDU worth of memory.
 198          * We cheat here and say we're marshalling, as we intend to add incoming
 199          * data directly into the prs_struct and we want it to auto grow. We will
 200          * change the type to UNMARSALLING before processing the stream.
 201          */
 202
 203         if(!prs_init(&p->in_data.data, MAX_PDU_FRAG_LEN, 4, MARSHALL)) {
 204                 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
 205                 return NULL;
 206         }
 207
 208         bitmap_set(bmap, i);
 209         i += pipe_handle_offset;
 210
 211         pipes_open++;
 212
 213         p->pnum = i;
 214
 215         p->open = True;
 216         p->device_state = 0;
 217         p->priority = 0;
 218         p->conn = conn;
 219         p->vuid  = vuid;
 220
 221         p->max_trans_reply = 0;
 222
 223         p->ntlmssp_chal_flags = 0;
 224         p->ntlmssp_auth_validated = False;
 225         p->ntlmssp_auth_requested = False;
 226
 227         p->pipe_bound = False;
 228         p->fault_state = False;
 229
 230         /*
 231          * Initialize the incoming RPC struct.
 232          */
 233
 234         p->in_data.pdu_needed_len = 0;
 235         p->in_data.pdu_received_len = 0;
 236
 237         /*
 238          * Initialize the outgoing RPC struct.
 239          */
 240
 241         p->out_data.current_pdu_len = 0;
 242         p->out_data.current_pdu_sent = 0;
 243         p->out_data.data_sent_length = 0;
 244
 245         /*
 246          * Initialize the outgoing RPC data buffer with no memory.
 247          */
 248         prs_init(&p->out_data.rdata, 0, 4, MARSHALL);
 249
 250         p->uid = (uid_t)-1;
 251         p->gid = (gid_t)-1;
 252
 253         fstrcpy(p->name, pipe_name);
 254
 255 #if 0
 256
 257    Comment out until memory leak fixed. JRA.
 258
 259         /*
 260          * For Luke - attempt to connect to RPC redirect process.
 261          */
 262
 263         attempt_remote_rpc_connect(p);
 264 #endif
 265
 266         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
 267                  pipe_name, i, pipes_open));
 268
 269         chain_p = p;
 270
 271         /* OVERWRITE p as a temp variable, to display all open pipes */
 272         for (p = Pipes; p; p = p->next)
 273                 DEBUG(5,("open pipes: name %s pnum=%x\n", p->name, p->pnum));
 274
 275         return chain_p;
 276 }
 277
 278 /****************************************************************************
 279  Sets the fault state on incoming packets.
 280 ****************************************************************************/
 281
 282 static void set_incoming_fault(pipes_struct *p)
 283 {
 284         prs_mem_free(&p->in_data.data);
 285         p->in_data.pdu_needed_len = 0;
 286         p->in_data.pdu_received_len = 0;
 287         p->fault_state = True;
 288         DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : pnum = 0x%x\n",
 289                 p->name, p->pnum ));
 290 }
 291
 292 /****************************************************************************
 293  Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
 294 ****************************************************************************/
 295
 296 static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy)
 297 {
 298         size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len);
 299
 300         DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
 301                         (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr,
 302                         (unsigned int)p->in_data.pdu_received_len ));
 303
 304         memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr);
 305         p->in_data.pdu_received_len += len_needed_to_complete_hdr;
 306
 307         return (ssize_t)len_needed_to_complete_hdr;
 308 }
 309
 310 /****************************************************************************
 311  Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
 312 ****************************************************************************/
 313
 314 static ssize_t unmarshall_rpc_header(pipes_struct *p)
 315 {
 316         /*
 317          * Unmarshall the header to determine the needed length.
 318          */
 319
 320         prs_struct rpc_in;
 321
 322         if(p->in_data.pdu_received_len != RPC_HEADER_LEN) {
 323                 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
 324                 set_incoming_fault(p);
 325                 return -1;
 326         }
 327
 328         prs_init( &rpc_in, 0, 4, UNMARSHALL);
 329         prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0],
 330                                         p->in_data.pdu_received_len, False);
 331
 332         /*
 333          * Unmarshall the header as this will tell us how much
 334          * data we need to read to get the complete pdu.
 335          */
 336
 337         if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) {
 338                 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
 339                 set_incoming_fault(p);
 340                 return -1;
 341         }
 342
 343         /*
 344          * Validate the RPC header.
 345          */
 346
 347         if(p->hdr.major != 5 && p->hdr.minor != 0) {
 348                 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
 349                 set_incoming_fault(p);
 350                 return -1;
 351         }
 352
 353         /*
 354          * If there is no data in the incoming buffer and it's a requst pdu then
 355          * ensure that the FIRST flag is set. If not then we have
 356          * a stream missmatch.
 357          */
 358
 359         if((p->hdr.pkt_type == RPC_REQUEST) && (prs_offset(&p->in_data.data) == 0) && !(p->hdr.flags & RPC_FLG_FIRST)) {
 360                 DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
 361                 set_incoming_fault(p);
 362                 return -1;
 363         }
 364
 365         /*
 366          * Ensure that the pdu length is sane.
 367          */
 368
 369         if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > MAX_PDU_FRAG_LEN)) {
 370                 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
 371                 set_incoming_fault(p);
 372                 return -1;
 373         }
 374
 375         DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type,
 376                         (unsigned int)p->hdr.flags ));
 377
 378         /*
 379          * Adjust for the header we just ate.
 380          */
 381         p->in_data.pdu_received_len = 0;
 382         p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN;
 383
 384         /*
 385          * Null the data we just ate.
 386          */
 387
 388         memset((char *)&p->in_data.current_in_pdu[0], '\0', RPC_HEADER_LEN);
 389
 390         return 0; /* No extra data processed. */
 391 }
 392
 393 /****************************************************************************
 394  Processes a request pdu. This will do auth processing if needed, and
 395  appends the data into the complete stream if the LAST flag is not set.
 396 ****************************************************************************/
 397
 398 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 399 {
 400         BOOL auth_verify = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SIGN);
 401         size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 402                                 (auth_verify ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 403
 404         if(!p->pipe_bound) {
 405                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
 406                 set_incoming_fault(p);
 407                 return False;
 408         }
 409
 410         /*
 411          * Check if we need to do authentication processing.
 412          * This is only done on requests, not binds.
 413          */
 414
 415         /*
 416          * Read the RPC request header.
 417          */
 418
 419         if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) {
 420                 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
 421                 set_incoming_fault(p);
 422                 return False;
 423         }
 424
 425         if(p->ntlmssp_auth_validated && !api_pipe_auth_process(p, rpc_in_p)) {
 426                 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
 427                 set_incoming_fault(p);
 428                 return False;
 429         }
 430
 431         if (p->ntlmssp_auth_requested && !p->ntlmssp_auth_validated) {
 432
 433                 /*
 434                  * Authentication _was_ requested and it already failed.
 435                  */
 436
 437                 DEBUG(0,("process_request_pdu: RPC request received on pipe %s where \
 438 authentication failed. Denying the request.\n", p->name));
 439                 set_incoming_fault(p);
 440         return False;
 441     }
 442
 443         /*
 444          * Check the data length doesn't go over the 1Mb limit.
 445          */
 446
 447         if(prs_data_size(&p->in_data.data) + data_len > 1024*1024) {
 448                 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
 449                                 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len ));
 450                 set_incoming_fault(p);
 451                 return False;
 452         }
 453
 454         /*
 455          * Append the data portion into the buffer and return.
 456          */
 457
 458         {
 459                 char *data_from = prs_data_p(rpc_in_p) + prs_offset(rpc_in_p);
 460
 461                 if(!prs_append_data(&p->in_data.data, data_from, data_len)) {
 462                         DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
 463                                         (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) ));
 464                         set_incoming_fault(p);
 465                         return False;
 466                 }
 467
 468         }
 469
 470         if(p->hdr.flags & RPC_FLG_LAST) {
 471                 BOOL ret = False;
 472                 /*
 473                  * Ok - we finally have a complete RPC stream.
 474                  * Call the rpc command to process it.
 475                  */
 476
 477                 /*
 478                  * Set the parse offset to the start of the data and set the
 479                  * prs_struct to UNMARSHALL.
 480                  */
 481
 482                 prs_set_offset(&p->in_data.data, 0);
 483                 prs_switch_type(&p->in_data.data, UNMARSHALL);
 484
 485                 /*
 486                  * Process the complete data stream here.
 487                  */
 488
 489                 if(pipe_init_outgoing_data(&p->out_data, MAX_PDU_FRAG_LEN))
 490                         ret = api_pipe_request(p);
 491
 492                 /*
 493                  * We have consumed the whole data stream. Set back to
 494                  * marshalling and set the offset back to the start of
 495                  * the buffer to re-use it (we could also do a prs_mem_free()
 496                  * and then re_init on the next start of PDU. Not sure which
 497                  * is best here.... JRA.
 498                  */
 499
 500                 prs_switch_type(&p->in_data.data, MARSHALL);
 501                 prs_set_offset(&p->in_data.data, 0);
 502                 return ret;
 503         }
 504
 505         return True;
 506 }
 507
 508 /****************************************************************************
 509  Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
 510  already been parsed and stored in p->hdr.
 511 ****************************************************************************/
 512
 513 static ssize_t process_complete_pdu(pipes_struct *p)
 514 {
 515         prs_struct rpc_in;
 516         size_t data_len = p->in_data.pdu_received_len;
 517         char *data_p = (char *)&p->in_data.current_in_pdu[0];
 518         BOOL reply = False;
 519
 520         if(p->fault_state) {
 521                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
 522                         p->name ));
 523                 set_incoming_fault(p);
 524                 setup_fault_pdu(p);
 525                 return (ssize_t)data_len;
 526         }
 527
 528         prs_init( &rpc_in, 0, 4, UNMARSHALL);
 529         prs_give_memory( &rpc_in, data_p, (uint32)data_len, False);
 530
 531         DEBUG(10,("process_complete_pdu: processing packet type %u\n",
 532                         (unsigned int)p->hdr.pkt_type ));
 533
 534         switch (p->hdr.pkt_type) {
 535                 case RPC_BIND:
 536                 case RPC_ALTCONT:
 537                         /*
 538                          * We assume that a pipe bind is only in one pdu.
 539                          */
 540                         if(pipe_init_outgoing_data(&p->out_data, MAX_PDU_FRAG_LEN))
 541                                 reply = api_pipe_bind_req(p, &rpc_in);
 542                         break;
 543                 case RPC_BINDRESP:
 544                         /*
 545                          * We assume that a pipe bind_resp is only in one pdu.
 546                          */
 547                         if(pipe_init_outgoing_data(&p->out_data, MAX_PDU_FRAG_LEN))
 548                                 reply = api_pipe_bind_auth_resp(p, &rpc_in);
 549                         break;
 550                 case RPC_REQUEST:
 551                         reply = process_request_pdu(p, &rpc_in);
 552                         break;
 553                 default:
 554                         DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type ));
 555                         break;
 556         }
 557
 558         if (!reply) {
 559                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name));
 560                 set_incoming_fault(p);
 561                 setup_fault_pdu(p);
 562         } else {
 563                 /*
 564                  * Reset the lengths. We're ready for a new pdu.
 565                  */
 566                 p->in_data.pdu_needed_len = 0;
 567                 p->in_data.pdu_received_len = 0;
 568         }
 569
 570         return (ssize_t)data_len;
 571 }
 572
 573 /****************************************************************************
 574  Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
 575 ****************************************************************************/
 576
 577 static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n)
 578 {
 579         size_t data_to_copy = MIN(n, MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len);
 580
 581         DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
 582                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len,
 583                 (unsigned int)n ));
 584
 585         if(data_to_copy == 0) {
 586                 /*
 587                  * This is an error - data is being received and there is no
 588                  * space in the PDU. Free the received data and go into the fault state.
 589                  */
 590                 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
 591 incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n ));
 592                 set_incoming_fault(p);
 593                 return -1;
 594         }
 595
 596         /*
 597          * If we have no data already, wait until we get at least a RPC_HEADER_LEN
 598          * number of bytes before we can do anything.
 599          */
 600
 601         if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) {
 602                 /*
 603                  * Always return here. If we have more data then the RPC_HEADER
 604                  * will be processed the next time around the loop.
 605                  */
 606                 return fill_rpc_header(p, data, data_to_copy);
 607         }
 608
 609         /*
 610          * At this point we know we have at least an RPC_HEADER_LEN amount of data
 611          * stored in current_in_pdu.
 612          */
 613
 614         /*
 615          * If pdu_needed_len is zero this is a new pdu.
 616          * Unmarshall the header so we know how much more
 617          * data we need, then loop again.
 618          */
 619
 620         if(p->in_data.pdu_needed_len == 0)
 621                 return unmarshall_rpc_header(p);
 622
 623         /*
 624          * Ok - at this point we have a valid RPC_HEADER in p->hdr.
 625          * Keep reading until we have a full pdu.
 626          */
 627
 628         data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
 629
 630         /*
 631          * Copy as much of the data as we need into the current_in_pdu buffer.
 632          */
 633
 634         memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy);
 635         p->in_data.pdu_received_len += data_to_copy;
 636
 637         /*
 638          * Do we have a complete PDU ?
 639          */
 640
 641         if(p->in_data.pdu_received_len == p->in_data.pdu_needed_len)
 642                 return process_complete_pdu(p);
 643
 644         DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
 645                 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len ));
 646
 647         return (ssize_t)data_to_copy;
 648
 649 }
 650
 651 /****************************************************************************
 652  Accepts incoming data on an rpc pipe.
 653 ****************************************************************************/
 654
 655 ssize_t write_to_pipe(pipes_struct *p, char *data, size_t n)
 656 {
 657         size_t data_left = n;
 658
 659         DEBUG(6,("write_to_pipe: %x", p->pnum));
 660
 661         DEBUG(6,(" name: %s open: %s len: %d\n",
 662                  p->name, BOOLSTR(p->open), (int)n));
 663
 664         dump_data(50, data, n);
 665
 666         while(data_left) {
 667                 ssize_t data_used;
 668
 669                 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left ));
 670
 671                 /*
 672                  * Deal with the redirect to the remote RPC daemon.
 673                  */
 674
 675                 if(p->m)
 676                         data_used = write(p->m->fd, data, data_left);
 677                 else
 678                         data_used = process_incoming_data(p, data, data_left);
 679
 680                 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used ));
 681
 682                 if(data_used < 0)
 683                         return -1;
 684
 685                 data_left -= data_used;
 686                 data += data_used;
 687         }
 688
 689         return n;
 690 }
 691
 692 /****************************************************************************
 693  Gets data from a remote TNG daemon. Gets data from the remote daemon into
 694  the outgoing prs_struct.
 695
 696  NB. Note to Luke : This code will be broken until Luke implements a length
 697  field before reply data...
 698
 699 ****************************************************************************/
 700
 701 static BOOL read_from_remote(pipes_struct *p)
 702 {
 703         uint32 data_len;
 704         uint32 data_len_left;
 705
 706         if(prs_offset(&p->out_data.rdata) == 0) {
 707
 708                 ssize_t len = 0;
 709
 710                 /*
 711                  * Read all the reply data as a stream of pre-created
 712                  * PDU's from the remote deamon into the rdata struct.
 713                  */
 714
 715             /*
 716                  * Create the response data buffer.
 717                  */
 718
 719                 if(!pipe_init_outgoing_data(&p->out_data, 65536)) {
 720                         DEBUG(0,("read_from_remote: failed to create outgoing buffer.\n"));
 721                         return False;
 722                 }
 723
 724                 /* Read from remote here. */
 725                 if((len = read_with_timeout(p->m->fd, prs_data_p(&p->out_data.rdata), 1, 65536, 10000)) < 0) {
 726                         DEBUG(0,("read_from_remote: failed to read from external daemon.\n"));
 727                         prs_mem_free(&p->out_data.rdata);
 728                         return False;
 729                 }
 730
 731                 /* Set the length we got. */
 732                 prs_set_offset(&p->out_data.rdata, (uint32)len);
 733         }
 734
 735         /*
 736          * The amount we send is the minimum of the available
 737          * space and the amount left to send.
 738          */
 739
 740         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 741
 742         /*
 743          * Ensure there really is data left to send.
 744          */
 745
 746         if(!data_len_left) {
 747                 DEBUG(0,("read_from_remote: no data left to send !\n"));
 748                 return False;
 749         }
 750
 751         data_len = MIN(data_len_left, MAX_PDU_FRAG_LEN);
 752
 753         return False; /* Notfinished... */
 754 }
 755
 756 /****************************************************************************
 757  Replies to a request to read data from a pipe.
 758
 759  Headers are interspersed with the data at PDU intervals. By the time
 760  this function is called, the start of the data could possibly have been
 761  read by an SMBtrans (file_offset != 0).
 762
 763  Calling create_rpc_reply() here is a hack. The data should already
 764  have been prepared into arrays of headers + data stream sections.
 765 ****************************************************************************/
 766
 767 ssize_t read_from_pipe(pipes_struct *p, char *data, size_t n)
 768 {
 769         uint32 pdu_remaining = 0;
 770         ssize_t data_returned = 0;
 771
 772         if (!p || !p->open) {
 773                 DEBUG(0,("read_from_pipe: pipe not open\n"));
 774                 return -1;
 775         }
 776
 777         DEBUG(6,("read_from_pipe: %x", p->pnum));
 778
 779         DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n));
 780
 781         /*
 782          * We cannot return more than one PDU length per
 783          * read request.
 784          */
 785
 786         if(n > MAX_PDU_FRAG_LEN) {
 787                 DEBUG(0,("read_from_pipe: loo large read (%u) requested on pipe %s. We can \
 788 only service %d sized reads.\n", (unsigned int)n, p->name, MAX_PDU_FRAG_LEN ));
 789                 return -1;
 790         }
 791
 792         /*
 793          * Determine if there is still data to send in the
 794          * pipe PDU buffer. Always send this first. Never
 795          * send more than is left in the current PDU. The
 796          * client should send a new read request for a new
 797          * PDU.
 798          */
 799
 800         if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) {
 801                 data_returned = (ssize_t)MIN(n, pdu_remaining);
 802
 803                 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
 804 returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len,
 805                         (unsigned int)p->out_data.current_pdu_sent, (int)data_returned));
 806
 807                 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned);
 808                 p->out_data.current_pdu_sent += (uint32)data_returned;
 809                 return data_returned;
 810         }
 811
 812         /*
 813          * At this point p->current_pdu_len == p->current_pdu_sent (which
 814          * may of course be zero if this is the first return fragment.
 815          */
 816
 817         DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
 818 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
 819                 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) ));
 820
 821         if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) {
 822                 /*
 823                  * We have sent all possible data. Return 0.
 824                  */
 825                 return 0;
 826         }
 827
 828         if(p->m) {
 829                 /*
 830                  * Remote to the RPC daemon.
 831                  */
 832                 if(!read_from_remote(p)) {
 833                         DEBUG(0,("read_from_pipe: %s: read_from_remote failed.\n", p->name ));
 834                         return -1;
 835                 }
 836
 837         } else {
 838
 839                 /*
 840                  * We need to create a new PDU from the data left in p->rdata.
 841                  * Create the header/data/footers. This also sets up the fields
 842                  * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
 843                  * and stores the outgoing PDU in p->current_pdu.
 844                  */
 845
 846                 if(!create_next_pdu(p)) {
 847                         DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name));
 848                         return -1;
 849                 }
 850         }
 851
 852         data_returned = MIN(n, p->out_data.current_pdu_len);
 853
 854         memcpy( data, p->out_data.current_pdu, (size_t)data_returned);
 855         p->out_data.current_pdu_sent += (uint32)data_returned;
 856         return data_returned;
 857 }
 858
 859 /****************************************************************************
 860  Wait device state on a pipe. Exactly what this is for is unknown...
 861 ****************************************************************************/
 862
 863 BOOL wait_rpc_pipe_hnd_state(pipes_struct *p, uint16 priority)
 864 {
 865         if (p == NULL)
 866                 return False;
 867
 868         if (p->open) {
 869                 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
 870                          priority, p->name));
 871
 872                 p->priority = priority;
 873
 874                 return True;
 875         }
 876
 877         DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
 878                  priority, p->name));
 879         return False;
 880 }
 881
 882
 883 /****************************************************************************
 884  Set device state on a pipe. Exactly what this is for is unknown...
 885 ****************************************************************************/
 886
 887 BOOL set_rpc_pipe_hnd_state(pipes_struct *p, uint16 device_state)
 888 {
 889         if (p == NULL)
 890                 return False;
 891
 892         if (p->open) {
 893                 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
 894                          device_state, p->name));
 895
 896                 p->device_state = device_state;
 897
 898                 return True;
 899         }
 900
 901         DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
 902                  device_state, p->name));
 903         return False;
 904 }
 905
 906
 907 /****************************************************************************
 908  Close an rpc pipe.
 909 ****************************************************************************/
 910
 911 BOOL close_rpc_pipe_hnd(pipes_struct *p, connection_struct *conn)
 912 {
 913         if (!p) {
 914                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
 915                 return False;
 916         }
 917
 918         prs_mem_free(&p->out_data.rdata);
 919         prs_mem_free(&p->in_data.data);
 920
 921         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
 922
 923         pipes_open--;
 924
 925         if (p->m != NULL) {
 926                 DEBUG(4,("close_rpc_pipe_hnd: closing msrpc redirect: "));
 927                 if (msrpc_use_del(p->m->pipe_name, &p->m->usr, False, NULL))
 928                         DEBUG(4,("OK\n"));
 929                 else
 930                         DEBUG(4,("FAILED\n"));
 931         }
 932
 933         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
 934                  p->name, p->pnum, pipes_open));
 935
 936         DLIST_REMOVE(Pipes, p);
 937
 938         ZERO_STRUCTP(p);
 939
 940         free(p);
 941
 942         return True;
 943 }
 944
 945 /****************************************************************************
 946  Find an rpc pipe given a pipe handle in a buffer and an offset.
 947 ****************************************************************************/
 948
 949 pipes_struct *get_rpc_pipe_p(char *buf, int where)
 950 {
 951         int pnum = SVAL(buf,where);
 952
 953         if (chain_p)
 954                 return chain_p;
 955
 956         return get_rpc_pipe(pnum);
 957 }
 958
 959 /****************************************************************************
 960  Find an rpc pipe given a pipe handle.
 961 ****************************************************************************/
 962
 963 pipes_struct *get_rpc_pipe(int pnum)
 964 {
 965         pipes_struct *p;
 966
 967         DEBUG(4,("search for pipe pnum=%x\n", pnum));
 968
 969         for (p=Pipes;p;p=p->next)
 970                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
 971                           p->name, p->pnum, pipes_open));
 972
 973         for (p=Pipes;p;p=p->next) {
 974                 if (p->pnum == pnum) {
 975                         chain_p = p;
 976                         return p;
 977                 }
 978         }
 979
 980         return NULL;
 981 }