2 * Unix SMB/Netbios implementation.
4 * RPC Pipe client / server routines
5 * Copyright (C) Andrew Tridgell 1992-1998,
6 * Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
7 * Copyright (C) Jeremy Allison 1999.
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #define PIPE "\\PIPE\\"
29 #define PIPELEN strlen(PIPE)
31 static pipes_struct
*chain_p
;
32 static int pipes_open
;
35 * Sometimes I can't decide if I hate Windows printer driver
36 * writers more than I hate the Windows spooler service driver
37 * writers. This gets around a combination of bugs in the spooler
38 * and the HP 8500 PCL driver that causes a spooler spin. JRA.
40 * bumped up from 20 -> 64 after viewing traffic from WordPerfect
41 * 2002 running on NT 4.- SP6
44 #ifndef MAX_OPEN_SPOOLSS_PIPES
45 #define MAX_OPEN_SPOOLSS_PIPES 256
47 static int current_spoolss_pipes_open
;
49 static pipes_struct
*Pipes
;
50 static struct bitmap
*bmap
;
52 /****************************************************************************
53 Pipe iterator functions.
54 ****************************************************************************/
56 pipes_struct
*get_first_pipe(void)
61 pipes_struct
*get_next_pipe(pipes_struct
*p
)
66 /* this must be larger than the sum of the open files and directories */
67 static int pipe_handle_offset
;
69 /****************************************************************************
70 Set the pipe_handle_offset. Called from smbd/files.c
71 ****************************************************************************/
73 void set_pipe_handle_offset(int max_open_files
)
75 if(max_open_files
< 0x7000)
76 pipe_handle_offset
= 0x7000;
78 pipe_handle_offset
= max_open_files
+ 10; /* For safety. :-) */
81 /****************************************************************************
82 Reset pipe chain handle number.
83 ****************************************************************************/
84 void reset_chain_p(void)
89 /****************************************************************************
90 Initialise pipe handle states.
91 ****************************************************************************/
93 void init_rpc_pipe_hnd(void)
95 bmap
= bitmap_allocate(MAX_OPEN_PIPES
);
97 exit_server("out of memory in init_rpc_pipe_hnd");
100 /****************************************************************************
101 Initialise an outgoing packet.
102 ****************************************************************************/
104 static BOOL
pipe_init_outgoing_data(pipes_struct
*p
)
106 output_data
*o_data
= &p
->out_data
;
108 /* Reset the offset counters. */
109 o_data
->data_sent_length
= 0;
110 o_data
->current_pdu_len
= 0;
111 o_data
->current_pdu_sent
= 0;
113 memset(o_data
->current_pdu
, '\0', sizeof(o_data
->current_pdu
));
115 /* Free any memory in the current return data buffer. */
116 prs_mem_free(&o_data
->rdata
);
119 * Initialize the outgoing RPC data buffer.
120 * we will use this as the raw data area for replying to rpc requests.
122 if(!prs_init(&o_data
->rdata
, MAX_PDU_FRAG_LEN
, p
->mem_ctx
, MARSHALL
)) {
123 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
130 /****************************************************************************
131 Find first available pipe slot.
132 ****************************************************************************/
134 pipes_struct
*open_rpc_pipe_p(char *pipe_name
,
135 connection_struct
*conn
, uint16 vuid
)
139 static int next_pipe
;
140 BOOL is_spoolss_pipe
= False
;
142 DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
143 pipe_name
, pipes_open
));
145 if (strstr(pipe_name
, "spoolss"))
146 is_spoolss_pipe
= True
;
148 if (is_spoolss_pipe
&& current_spoolss_pipes_open
>= MAX_OPEN_SPOOLSS_PIPES
) {
149 DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n",
154 /* not repeating pipe numbers makes it easier to track things in
155 log files and prevents client bugs where pipe numbers are reused
156 over connection restarts */
158 next_pipe
= (sys_getpid() ^ time(NULL
)) % MAX_OPEN_PIPES
;
160 i
= bitmap_find(bmap
, next_pipe
);
163 DEBUG(0,("ERROR! Out of pipe structures\n"));
167 next_pipe
= (i
+1) % MAX_OPEN_PIPES
;
169 for (p
= Pipes
; p
; p
= p
->next
)
170 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p
->name
, p
->pnum
));
172 p
= (pipes_struct
*)malloc(sizeof(*p
));
179 if ((p
->mem_ctx
= talloc_init()) == NULL
) {
180 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
185 if (!init_pipe_handle_list(p
, pipe_name
)) {
186 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
187 talloc_destroy(p
->mem_ctx
);
196 * Initialize the incoming RPC data buffer with one PDU worth of memory.
197 * We cheat here and say we're marshalling, as we intend to add incoming
198 * data directly into the prs_struct and we want it to auto grow. We will
199 * change the type to UNMARSALLING before processing the stream.
202 if(!prs_init(&p
->in_data
.data
, MAX_PDU_FRAG_LEN
, p
->mem_ctx
, MARSHALL
)) {
203 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
208 i
+= pipe_handle_offset
;
220 p
->max_trans_reply
= 0;
222 p
->ntlmssp_chal_flags
= 0;
223 p
->ntlmssp_auth_validated
= False
;
224 p
->ntlmssp_auth_requested
= False
;
226 p
->pipe_bound
= False
;
227 p
->fault_state
= False
;
228 p
->endian
= RPC_LITTLE_ENDIAN
;
231 * Initialize the incoming RPC struct.
234 p
->in_data
.pdu_needed_len
= 0;
235 p
->in_data
.pdu_received_len
= 0;
238 * Initialize the outgoing RPC struct.
241 p
->out_data
.current_pdu_len
= 0;
242 p
->out_data
.current_pdu_sent
= 0;
243 p
->out_data
.data_sent_length
= 0;
246 * Initialize the outgoing RPC data buffer with no memory.
248 prs_init(&p
->out_data
.rdata
, 0, p
->mem_ctx
, MARSHALL
);
250 ZERO_STRUCT(p
->pipe_user
);
252 p
->pipe_user
.uid
= (uid_t
)-1;
253 p
->pipe_user
.gid
= (gid_t
)-1;
255 fstrcpy(p
->name
, pipe_name
);
257 DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
258 pipe_name
, i
, pipes_open
));
262 /* OVERWRITE p as a temp variable, to display all open pipes */
263 for (p
= Pipes
; p
; p
= p
->next
)
264 DEBUG(5,("open pipes: name %s pnum=%x\n", p
->name
, p
->pnum
));
267 current_spoolss_pipes_open
++;
270 * The connection can be idled whilst this pipe is open
271 * if there are no handles open. JRA.
277 /****************************************************************************
278 Sets the fault state on incoming packets.
279 ****************************************************************************/
281 static void set_incoming_fault(pipes_struct
*p
)
283 prs_mem_free(&p
->in_data
.data
);
284 p
->in_data
.pdu_needed_len
= 0;
285 p
->in_data
.pdu_received_len
= 0;
286 p
->fault_state
= True
;
287 DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : pnum = 0x%x\n",
291 /****************************************************************************
292 Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
293 ****************************************************************************/
295 static ssize_t
fill_rpc_header(pipes_struct
*p
, char *data
, size_t data_to_copy
)
297 size_t len_needed_to_complete_hdr
= MIN(data_to_copy
, RPC_HEADER_LEN
- p
->in_data
.pdu_received_len
);
299 DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
300 (unsigned int)data_to_copy
, (unsigned int)len_needed_to_complete_hdr
,
301 (unsigned int)p
->in_data
.pdu_received_len
));
303 memcpy((char *)&p
->in_data
.current_in_pdu
[p
->in_data
.pdu_received_len
], data
, len_needed_to_complete_hdr
);
304 p
->in_data
.pdu_received_len
+= len_needed_to_complete_hdr
;
306 return (ssize_t
)len_needed_to_complete_hdr
;
309 /****************************************************************************
310 Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
311 ****************************************************************************/
313 static ssize_t
unmarshall_rpc_header(pipes_struct
*p
)
316 * Unmarshall the header to determine the needed length.
321 if(p
->in_data
.pdu_received_len
!= RPC_HEADER_LEN
) {
322 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
323 set_incoming_fault(p
);
327 prs_init( &rpc_in
, 0, p
->mem_ctx
, UNMARSHALL
);
328 prs_set_endian_data( &rpc_in
, p
->endian
);
330 prs_give_memory( &rpc_in
, (char *)&p
->in_data
.current_in_pdu
[0],
331 p
->in_data
.pdu_received_len
, False
);
334 * Unmarshall the header as this will tell us how much
335 * data we need to read to get the complete pdu.
336 * This also sets the endian flag in rpc_in.
339 if(!smb_io_rpc_hdr("", &p
->hdr
, &rpc_in
, 0)) {
340 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
341 set_incoming_fault(p
);
342 prs_mem_free(&rpc_in
);
347 * Validate the RPC header.
350 if(p
->hdr
.major
!= 5 && p
->hdr
.minor
!= 0) {
351 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
352 set_incoming_fault(p
);
353 prs_mem_free(&rpc_in
);
358 * If there's not data in the incoming buffer this should be the start of a new RPC.
361 if(prs_offset(&p
->in_data
.data
) == 0) {
364 * AS/U doesn't set FIRST flag in a BIND packet it seems.
367 if ((p
->hdr
.pkt_type
== RPC_REQUEST
) && !(p
->hdr
.flags
& RPC_FLG_FIRST
)) {
369 * Ensure that the FIRST flag is set. If not then we have
370 * a stream missmatch.
373 DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
374 set_incoming_fault(p
);
375 prs_mem_free(&rpc_in
);
380 * If this is the first PDU then set the endianness
381 * flag in the pipe. We will need this when parsing all
385 p
->endian
= rpc_in
.bigendian_data
;
387 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
388 p
->endian
== RPC_LITTLE_ENDIAN
? "little-" : "big-" ));
393 * If this is *NOT* the first PDU then check the endianness
394 * flag in the pipe is the same as that in the PDU.
397 if (p
->endian
!= rpc_in
.bigendian_data
) {
398 DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p
->endian
));
399 set_incoming_fault(p
);
400 prs_mem_free(&rpc_in
);
406 * Ensure that the pdu length is sane.
409 if((p
->hdr
.frag_len
< RPC_HEADER_LEN
) || (p
->hdr
.frag_len
> MAX_PDU_FRAG_LEN
)) {
410 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
411 set_incoming_fault(p
);
412 prs_mem_free(&rpc_in
);
416 DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p
->hdr
.pkt_type
,
417 (unsigned int)p
->hdr
.flags
));
420 * Adjust for the header we just ate.
422 p
->in_data
.pdu_received_len
= 0;
423 p
->in_data
.pdu_needed_len
= (uint32
)p
->hdr
.frag_len
- RPC_HEADER_LEN
;
426 * Null the data we just ate.
429 memset((char *)&p
->in_data
.current_in_pdu
[0], '\0', RPC_HEADER_LEN
);
431 prs_mem_free(&rpc_in
);
433 return 0; /* No extra data processed. */
436 /****************************************************************************
437 Call this to free any talloc'ed memory. Do this before and after processing
439 ****************************************************************************/
441 void free_pipe_context(pipes_struct
*p
)
444 DEBUG(3,("free_pipe_context: destroying talloc pool of size %u\n", talloc_pool_size(p
->mem_ctx
) ));
445 talloc_destroy_pool(p
->mem_ctx
);
447 p
->mem_ctx
= talloc_init();
448 if (p
->mem_ctx
== NULL
)
449 p
->fault_state
= True
;
453 /****************************************************************************
454 Processes a request pdu. This will do auth processing if needed, and
455 appends the data into the complete stream if the LAST flag is not set.
456 ****************************************************************************/
458 static BOOL
process_request_pdu(pipes_struct
*p
, prs_struct
*rpc_in_p
)
460 BOOL auth_verify
= ((p
->ntlmssp_chal_flags
& NTLMSSP_NEGOTIATE_SIGN
) != 0);
461 size_t data_len
= p
->hdr
.frag_len
- RPC_HEADER_LEN
- RPC_HDR_REQ_LEN
-
462 (auth_verify
? RPC_HDR_AUTH_LEN
: 0) - p
->hdr
.auth_len
;
465 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
466 set_incoming_fault(p
);
471 * Check if we need to do authentication processing.
472 * This is only done on requests, not binds.
476 * Read the RPC request header.
479 if(!smb_io_rpc_hdr_req("req", &p
->hdr_req
, rpc_in_p
, 0)) {
480 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
481 set_incoming_fault(p
);
485 if(p
->ntlmssp_auth_validated
&& !api_pipe_auth_process(p
, rpc_in_p
)) {
486 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
487 set_incoming_fault(p
);
491 if (p
->ntlmssp_auth_requested
&& !p
->ntlmssp_auth_validated
) {
494 * Authentication _was_ requested and it already failed.
497 DEBUG(0,("process_request_pdu: RPC request received on pipe %s where \
498 authentication failed. Denying the request.\n", p
->name
));
499 set_incoming_fault(p
);
504 * Check the data length doesn't go over the 40Mb limit.
505 * increased after observing a bug in the Windows NT 4.0 SP6a
506 * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
507 * will not fit in the initial buffer of size 0x1068 --jerry 22/01/2002
510 if(prs_offset(&p
->in_data
.data
) + data_len
> 40*1024*1024) {
511 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
512 (unsigned int)prs_data_size(&p
->in_data
.data
), (unsigned int)data_len
));
513 set_incoming_fault(p
);
518 * Append the data portion into the buffer and return.
522 char *data_from
= prs_data_p(rpc_in_p
) + prs_offset(rpc_in_p
);
524 if(!prs_append_data(&p
->in_data
.data
, data_from
, data_len
)) {
525 DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
526 (unsigned int)data_len
, (unsigned int)prs_data_size(&p
->in_data
.data
) ));
527 set_incoming_fault(p
);
533 if(p
->hdr
.flags
& RPC_FLG_LAST
) {
536 * Ok - we finally have a complete RPC stream.
537 * Call the rpc command to process it.
541 * Ensure the internal prs buffer size is *exactly* the same
542 * size as the current offset.
545 if(!prs_set_buffer_size(&p
->in_data
.data
, prs_offset(&p
->in_data
.data
)))
547 DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
548 set_incoming_fault(p
);
553 * Set the parse offset to the start of the data and set the
554 * prs_struct to UNMARSHALL.
557 prs_set_offset(&p
->in_data
.data
, 0);
558 prs_switch_type(&p
->in_data
.data
, UNMARSHALL
);
561 * Process the complete data stream here.
564 free_pipe_context(p
);
566 if(pipe_init_outgoing_data(p
))
567 ret
= api_pipe_request(p
);
569 free_pipe_context(p
);
572 * We have consumed the whole data stream. Set back to
573 * marshalling and set the offset back to the start of
574 * the buffer to re-use it (we could also do a prs_mem_free()
575 * and then re_init on the next start of PDU. Not sure which
576 * is best here.... JRA.
579 prs_switch_type(&p
->in_data
.data
, MARSHALL
);
580 prs_set_offset(&p
->in_data
.data
, 0);
587 /****************************************************************************
588 Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
589 already been parsed and stored in p->hdr.
590 ****************************************************************************/
592 static ssize_t
process_complete_pdu(pipes_struct
*p
)
595 size_t data_len
= p
->in_data
.pdu_received_len
;
596 char *data_p
= (char *)&p
->in_data
.current_in_pdu
[0];
600 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
602 set_incoming_fault(p
);
603 setup_fault_pdu(p
, NT_STATUS(0x1c010002));
604 return (ssize_t
)data_len
;
607 prs_init( &rpc_in
, 0, p
->mem_ctx
, UNMARSHALL
);
610 * Ensure we're using the corrent endianness for both the
611 * RPC header flags and the raw data we will be reading from.
614 prs_set_endian_data( &rpc_in
, p
->endian
);
615 prs_set_endian_data( &p
->in_data
.data
, p
->endian
);
617 prs_give_memory( &rpc_in
, data_p
, (uint32
)data_len
, False
);
619 DEBUG(10,("process_complete_pdu: processing packet type %u\n",
620 (unsigned int)p
->hdr
.pkt_type
));
622 switch (p
->hdr
.pkt_type
) {
626 * We assume that a pipe bind is only in one pdu.
628 if(pipe_init_outgoing_data(p
))
629 reply
= api_pipe_bind_req(p
, &rpc_in
);
633 * We assume that a pipe bind_resp is only in one pdu.
635 if(pipe_init_outgoing_data(p
))
636 reply
= api_pipe_bind_auth_resp(p
, &rpc_in
);
639 reply
= process_request_pdu(p
, &rpc_in
);
642 DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p
->hdr
.pkt_type
));
646 /* Reset to little endian. Probably don't need this but it won't hurt. */
647 prs_set_endian_data( &p
->in_data
.data
, RPC_LITTLE_ENDIAN
);
650 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p
->pipe_srv_name
));
651 set_incoming_fault(p
);
652 setup_fault_pdu(p
, NT_STATUS(0x1c010002));
653 prs_mem_free(&rpc_in
);
656 * Reset the lengths. We're ready for a new pdu.
658 p
->in_data
.pdu_needed_len
= 0;
659 p
->in_data
.pdu_received_len
= 0;
662 prs_mem_free(&rpc_in
);
663 return (ssize_t
)data_len
;
666 /****************************************************************************
667 Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
668 ****************************************************************************/
670 static ssize_t
process_incoming_data(pipes_struct
*p
, char *data
, size_t n
)
672 size_t data_to_copy
= MIN(n
, MAX_PDU_FRAG_LEN
- p
->in_data
.pdu_received_len
);
674 DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
675 (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)p
->in_data
.pdu_needed_len
,
678 if(data_to_copy
== 0) {
680 * This is an error - data is being received and there is no
681 * space in the PDU. Free the received data and go into the fault state.
683 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
684 incoming data size = %u\n", (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)n
));
685 set_incoming_fault(p
);
690 * If we have no data already, wait until we get at least a RPC_HEADER_LEN
691 * number of bytes before we can do anything.
694 if((p
->in_data
.pdu_needed_len
== 0) && (p
->in_data
.pdu_received_len
< RPC_HEADER_LEN
)) {
696 * Always return here. If we have more data then the RPC_HEADER
697 * will be processed the next time around the loop.
699 return fill_rpc_header(p
, data
, data_to_copy
);
703 * At this point we know we have at least an RPC_HEADER_LEN amount of data
704 * stored in current_in_pdu.
708 * If pdu_needed_len is zero this is a new pdu.
709 * Unmarshall the header so we know how much more
710 * data we need, then loop again.
713 if(p
->in_data
.pdu_needed_len
== 0)
714 return unmarshall_rpc_header(p
);
717 * Ok - at this point we have a valid RPC_HEADER in p->hdr.
718 * Keep reading until we have a full pdu.
721 data_to_copy
= MIN(data_to_copy
, p
->in_data
.pdu_needed_len
);
724 * Copy as much of the data as we need into the current_in_pdu buffer.
727 memcpy( (char *)&p
->in_data
.current_in_pdu
[p
->in_data
.pdu_received_len
], data
, data_to_copy
);
728 p
->in_data
.pdu_received_len
+= data_to_copy
;
731 * Do we have a complete PDU ?
734 if(p
->in_data
.pdu_received_len
== p
->in_data
.pdu_needed_len
)
735 return process_complete_pdu(p
);
737 DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
738 (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)p
->in_data
.pdu_needed_len
));
740 return (ssize_t
)data_to_copy
;
744 /****************************************************************************
745 Accepts incoming data on an rpc pipe.
746 ****************************************************************************/
748 ssize_t
write_to_pipe(pipes_struct
*p
, char *data
, size_t n
)
750 size_t data_left
= n
;
752 DEBUG(6,("write_to_pipe: %x", p
->pnum
));
754 DEBUG(6,(" name: %s open: %s len: %d\n",
755 p
->name
, BOOLSTR(p
->open
), (int)n
));
757 dump_data(50, data
, n
);
762 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left
));
764 data_used
= process_incoming_data(p
, data
, data_left
);
766 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used
));
771 data_left
-= data_used
;
778 /****************************************************************************
779 Replies to a request to read data from a pipe.
781 Headers are interspersed with the data at PDU intervals. By the time
782 this function is called, the start of the data could possibly have been
783 read by an SMBtrans (file_offset != 0).
785 Calling create_rpc_reply() here is a hack. The data should already
786 have been prepared into arrays of headers + data stream sections.
787 ****************************************************************************/
789 ssize_t
read_from_pipe(pipes_struct
*p
, char *data
, size_t n
)
791 uint32 pdu_remaining
= 0;
792 ssize_t data_returned
= 0;
794 if (!p
|| !p
->open
) {
795 DEBUG(0,("read_from_pipe: pipe not open\n"));
799 DEBUG(6,("read_from_pipe: %x", p
->pnum
));
801 DEBUG(6,(" name: %s len: %u\n", p
->name
, (unsigned int)n
));
804 * We cannot return more than one PDU length per
809 * This condition should result in the connection being closed.
810 * Netapp filers seem to set it to 0xffff which results in domain
811 * authentications failing. Just ignore it so things work.
814 if(n
> MAX_PDU_FRAG_LEN
) {
815 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
816 pipe %s. We can only service %d sized reads.\n", (unsigned int)n
, p
->name
, MAX_PDU_FRAG_LEN
));
820 * Determine if there is still data to send in the
821 * pipe PDU buffer. Always send this first. Never
822 * send more than is left in the current PDU. The
823 * client should send a new read request for a new
827 if((pdu_remaining
= p
->out_data
.current_pdu_len
- p
->out_data
.current_pdu_sent
) > 0) {
828 data_returned
= (ssize_t
)MIN(n
, pdu_remaining
);
830 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
831 returning %d bytes.\n", p
->name
, (unsigned int)p
->out_data
.current_pdu_len
,
832 (unsigned int)p
->out_data
.current_pdu_sent
, (int)data_returned
));
834 memcpy( data
, &p
->out_data
.current_pdu
[p
->out_data
.current_pdu_sent
], (size_t)data_returned
);
835 p
->out_data
.current_pdu_sent
+= (uint32
)data_returned
;
840 * At this point p->current_pdu_len == p->current_pdu_sent (which
841 * may of course be zero if this is the first return fragment.
844 DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
845 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
846 p
->name
, (int)p
->fault_state
, (unsigned int)p
->out_data
.data_sent_length
, (unsigned int)prs_offset(&p
->out_data
.rdata
) ));
848 if(p
->out_data
.data_sent_length
>= prs_offset(&p
->out_data
.rdata
)) {
850 * We have sent all possible data, return 0.
857 * We need to create a new PDU from the data left in p->rdata.
858 * Create the header/data/footers. This also sets up the fields
859 * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
860 * and stores the outgoing PDU in p->current_pdu.
863 if(!create_next_pdu(p
)) {
864 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p
->name
));
868 data_returned
= MIN(n
, p
->out_data
.current_pdu_len
);
870 memcpy( data
, p
->out_data
.current_pdu
, (size_t)data_returned
);
871 p
->out_data
.current_pdu_sent
+= (uint32
)data_returned
;
875 return data_returned
;
878 /****************************************************************************
879 Wait device state on a pipe. Exactly what this is for is unknown...
880 ****************************************************************************/
882 BOOL
wait_rpc_pipe_hnd_state(pipes_struct
*p
, uint16 priority
)
888 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
891 p
->priority
= priority
;
896 DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
902 /****************************************************************************
903 Set device state on a pipe. Exactly what this is for is unknown...
904 ****************************************************************************/
906 BOOL
set_rpc_pipe_hnd_state(pipes_struct
*p
, uint16 device_state
)
912 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
913 device_state
, p
->name
));
915 p
->device_state
= device_state
;
920 DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
921 device_state
, p
->name
));
926 /****************************************************************************
928 ****************************************************************************/
930 BOOL
close_rpc_pipe_hnd(pipes_struct
*p
, connection_struct
*conn
)
933 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
937 if (strstr(p
->name
, "spoolss"))
938 current_spoolss_pipes_open
--;
940 prs_mem_free(&p
->out_data
.rdata
);
941 prs_mem_free(&p
->in_data
.data
);
944 talloc_destroy(p
->mem_ctx
);
946 /* Free the handles database. */
947 close_policy_by_pipe(p
);
949 bitmap_clear(bmap
, p
->pnum
- pipe_handle_offset
);
953 DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
954 p
->name
, p
->pnum
, pipes_open
));
956 DLIST_REMOVE(Pipes
, p
);
958 delete_nt_token(&p
->pipe_user
.nt_user_token
);
959 safe_free(p
->pipe_user
.groups
);
968 /****************************************************************************
969 Find an rpc pipe given a pipe handle in a buffer and an offset.
970 ****************************************************************************/
972 pipes_struct
*get_rpc_pipe_p(char *buf
, int where
)
974 int pnum
= SVAL(buf
,where
);
979 return get_rpc_pipe(pnum
);
982 /****************************************************************************
983 Find an rpc pipe given a pipe handle.
984 ****************************************************************************/
986 pipes_struct
*get_rpc_pipe(int pnum
)
990 DEBUG(4,("search for pipe pnum=%x\n", pnum
));
992 for (p
=Pipes
;p
;p
=p
->next
)
993 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
994 p
->name
, p
->pnum
, pipes_open
));
996 for (p
=Pipes
;p
;p
=p
->next
) {
997 if (p
->pnum
== pnum
) {