2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1998,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
6 * Copyright (C) Jeremy Allison 1999.
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 #define DBGC_CLASS DBGC_RPC_SRV
28 #define PIPE "\\PIPE\\"
29 #define PIPELEN strlen(PIPE)
31 static smb_np_struct
*chain_p
;
32 static int pipes_open
;
35 * Sometimes I can't decide if I hate Windows printer driver
36 * writers more than I hate the Windows spooler service driver
37 * writers. This gets around a combination of bugs in the spooler
38 * and the HP 8500 PCL driver that causes a spooler spin. JRA.
40 * bumped up from 20 -> 64 after viewing traffic from WordPerfect
41 * 2002 running on NT 4.- SP6
42 * bumped up from 64 -> 256 after viewing traffic from con2prt
43 * for lots of printers on a WinNT 4.x SP6 box.
46 #ifndef MAX_OPEN_SPOOLSS_PIPES
47 #define MAX_OPEN_SPOOLSS_PIPES 256
49 static int current_spoolss_pipes_open
;
51 static smb_np_struct
*Pipes
;
52 static pipes_struct
*InternalPipes
;
53 static struct bitmap
*bmap
;
56 * the following prototypes are declared here to avoid
57 * code being moved about too much for a patch to be
58 * disrupted / less obvious.
60 * these functions, and associated functions that they
61 * call, should be moved behind a .so module-loading
62 * system _anyway_. so that's the next step...
65 static ssize_t
read_from_internal_pipe(void *np_conn
, char *data
, size_t n
,
66 BOOL
*is_data_outstanding
);
67 static ssize_t
write_to_internal_pipe(void *np_conn
, char *data
, size_t n
);
68 static BOOL
close_internal_rpc_pipe_hnd(void *np_conn
);
69 static void *make_internal_rpc_pipe_p(char *pipe_name
,
70 connection_struct
*conn
, uint16 vuid
);
72 /****************************************************************************
73 Pipe iterator functions.
74 ****************************************************************************/
76 smb_np_struct
*get_first_pipe(void)
81 smb_np_struct
*get_next_pipe(smb_np_struct
*p
)
86 /****************************************************************************
87 Internal Pipe iterator functions.
88 ****************************************************************************/
90 pipes_struct
*get_first_internal_pipe(void)
95 pipes_struct
*get_next_internal_pipe(pipes_struct
*p
)
100 /* this must be larger than the sum of the open files and directories */
101 static int pipe_handle_offset
;
103 /****************************************************************************
104 Set the pipe_handle_offset. Called from smbd/files.c
105 ****************************************************************************/
107 void set_pipe_handle_offset(int max_open_files
)
109 if(max_open_files
< 0x7000)
110 pipe_handle_offset
= 0x7000;
112 pipe_handle_offset
= max_open_files
+ 10; /* For safety. :-) */
115 /****************************************************************************
116 Reset pipe chain handle number.
117 ****************************************************************************/
119 void reset_chain_p(void)
124 /****************************************************************************
125 Initialise pipe handle states.
126 ****************************************************************************/
128 void init_rpc_pipe_hnd(void)
130 bmap
= bitmap_allocate(MAX_OPEN_PIPES
);
132 exit_server("out of memory in init_rpc_pipe_hnd");
135 /****************************************************************************
136 Initialise an outgoing packet.
137 ****************************************************************************/
139 static BOOL
pipe_init_outgoing_data(pipes_struct
*p
)
141 output_data
*o_data
= &p
->out_data
;
143 /* Reset the offset counters. */
144 o_data
->data_sent_length
= 0;
145 o_data
->current_pdu_len
= 0;
146 o_data
->current_pdu_sent
= 0;
148 memset(o_data
->current_pdu
, '\0', sizeof(o_data
->current_pdu
));
150 /* Free any memory in the current return data buffer. */
151 prs_mem_free(&o_data
->rdata
);
154 * Initialize the outgoing RPC data buffer.
155 * we will use this as the raw data area for replying to rpc requests.
157 if(!prs_init(&o_data
->rdata
, MAX_PDU_FRAG_LEN
, p
->mem_ctx
, MARSHALL
)) {
158 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
165 /****************************************************************************
166 Find first available pipe slot.
167 ****************************************************************************/
169 smb_np_struct
*open_rpc_pipe_p(char *pipe_name
,
170 connection_struct
*conn
, uint16 vuid
)
173 smb_np_struct
*p
, *p_it
;
174 static int next_pipe
;
175 BOOL is_spoolss_pipe
= False
;
177 DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
178 pipe_name
, pipes_open
));
180 if (strstr(pipe_name
, "spoolss"))
181 is_spoolss_pipe
= True
;
183 if (is_spoolss_pipe
&& current_spoolss_pipes_open
>= MAX_OPEN_SPOOLSS_PIPES
) {
184 DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n",
189 /* not repeating pipe numbers makes it easier to track things in
190 log files and prevents client bugs where pipe numbers are reused
191 over connection restarts */
193 next_pipe
= (sys_getpid() ^ time(NULL
)) % MAX_OPEN_PIPES
;
195 i
= bitmap_find(bmap
, next_pipe
);
198 DEBUG(0,("ERROR! Out of pipe structures\n"));
202 next_pipe
= (i
+1) % MAX_OPEN_PIPES
;
204 for (p
= Pipes
; p
; p
= p
->next
)
205 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p
->name
, p
->pnum
));
207 p
= (smb_np_struct
*)malloc(sizeof(*p
));
210 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
216 /* add a dso mechanism instead of this, here */
218 p
->namedpipe_create
= make_internal_rpc_pipe_p
;
219 p
->namedpipe_read
= read_from_internal_pipe
;
220 p
->namedpipe_write
= write_to_internal_pipe
;
221 p
->namedpipe_close
= close_internal_rpc_pipe_hnd
;
223 p
->np_state
= p
->namedpipe_create(pipe_name
, conn
, vuid
);
225 if (p
->np_state
== NULL
) {
226 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
234 * Initialize the incoming RPC data buffer with one PDU worth of memory.
235 * We cheat here and say we're marshalling, as we intend to add incoming
236 * data directly into the prs_struct and we want it to auto grow. We will
237 * change the type to UNMARSALLING before processing the stream.
241 i
+= pipe_handle_offset
;
253 p
->max_trans_reply
= 0;
255 fstrcpy(p
->name
, pipe_name
);
257 DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
258 pipe_name
, i
, pipes_open
));
262 /* Iterate over p_it as a temp variable, to display all open pipes */
263 for (p_it
= Pipes
; p_it
; p_it
= p_it
->next
)
264 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it
->name
, p_it
->pnum
));
269 /****************************************************************************
270 Make an internal namedpipes structure
271 ****************************************************************************/
273 static void *make_internal_rpc_pipe_p(char *pipe_name
,
274 connection_struct
*conn
, uint16 vuid
)
277 user_struct
*vuser
= get_valid_user_struct(vuid
);
279 DEBUG(4,("Create pipe requested %s\n", pipe_name
));
281 if (!vuser
&& vuid
!= UID_FIELD_INVALID
) {
282 DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid
));
286 p
= (pipes_struct
*)malloc(sizeof(*p
));
290 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
296 if ((p
->mem_ctx
= talloc_init("pipe %s %p", pipe_name
, p
)) == NULL
) {
297 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
302 if (!init_pipe_handle_list(p
, pipe_name
)) {
303 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
304 talloc_destroy(p
->mem_ctx
);
310 * Initialize the incoming RPC data buffer with one PDU worth of memory.
311 * We cheat here and say we're marshalling, as we intend to add incoming
312 * data directly into the prs_struct and we want it to auto grow. We will
313 * change the type to UNMARSALLING before processing the stream.
316 if(!prs_init(&p
->in_data
.data
, MAX_PDU_FRAG_LEN
, p
->mem_ctx
, MARSHALL
)) {
317 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
321 DLIST_ADD(InternalPipes
, p
);
325 /* Ensure the connection isn't idled whilst this pipe is open. */
326 p
->conn
->num_files_open
++;
330 p
->ntlmssp_chal_flags
= 0;
331 p
->ntlmssp_auth_validated
= False
;
332 p
->ntlmssp_auth_requested
= False
;
334 p
->pipe_bound
= False
;
335 p
->fault_state
= False
;
336 p
->endian
= RPC_LITTLE_ENDIAN
;
338 ZERO_STRUCT(p
->pipe_user
);
340 p
->pipe_user
.uid
= (uid_t
)-1;
341 p
->pipe_user
.gid
= (gid_t
)-1;
343 /* Store the session key and NT_TOKEN */
345 p
->session_key
= data_blob(vuser
->session_key
.data
, vuser
->session_key
.length
);
346 p
->pipe_user
.nt_user_token
= dup_nt_token(vuser
->nt_user_token
);
350 * Initialize the incoming RPC struct.
353 p
->in_data
.pdu_needed_len
= 0;
354 p
->in_data
.pdu_received_len
= 0;
357 * Initialize the outgoing RPC struct.
360 p
->out_data
.current_pdu_len
= 0;
361 p
->out_data
.current_pdu_sent
= 0;
362 p
->out_data
.data_sent_length
= 0;
365 * Initialize the outgoing RPC data buffer with no memory.
367 prs_init(&p
->out_data
.rdata
, 0, p
->mem_ctx
, MARSHALL
);
369 fstrcpy(p
->name
, pipe_name
);
371 DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
372 pipe_name
, pipes_open
));
377 /****************************************************************************
378 Sets the fault state on incoming packets.
379 ****************************************************************************/
381 static void set_incoming_fault(pipes_struct
*p
)
383 prs_mem_free(&p
->in_data
.data
);
384 p
->in_data
.pdu_needed_len
= 0;
385 p
->in_data
.pdu_received_len
= 0;
386 p
->fault_state
= True
;
387 DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n",
391 /****************************************************************************
392 Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
393 ****************************************************************************/
395 static ssize_t
fill_rpc_header(pipes_struct
*p
, char *data
, size_t data_to_copy
)
397 size_t len_needed_to_complete_hdr
= MIN(data_to_copy
, RPC_HEADER_LEN
- p
->in_data
.pdu_received_len
);
399 DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
400 (unsigned int)data_to_copy
, (unsigned int)len_needed_to_complete_hdr
,
401 (unsigned int)p
->in_data
.pdu_received_len
));
403 memcpy((char *)&p
->in_data
.current_in_pdu
[p
->in_data
.pdu_received_len
], data
, len_needed_to_complete_hdr
);
404 p
->in_data
.pdu_received_len
+= len_needed_to_complete_hdr
;
406 return (ssize_t
)len_needed_to_complete_hdr
;
409 /****************************************************************************
410 Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
411 ****************************************************************************/
413 static ssize_t
unmarshall_rpc_header(pipes_struct
*p
)
416 * Unmarshall the header to determine the needed length.
421 if(p
->in_data
.pdu_received_len
!= RPC_HEADER_LEN
) {
422 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
423 set_incoming_fault(p
);
427 prs_init( &rpc_in
, 0, p
->mem_ctx
, UNMARSHALL
);
428 prs_set_endian_data( &rpc_in
, p
->endian
);
430 prs_give_memory( &rpc_in
, (char *)&p
->in_data
.current_in_pdu
[0],
431 p
->in_data
.pdu_received_len
, False
);
434 * Unmarshall the header as this will tell us how much
435 * data we need to read to get the complete pdu.
436 * This also sets the endian flag in rpc_in.
439 if(!smb_io_rpc_hdr("", &p
->hdr
, &rpc_in
, 0)) {
440 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
441 set_incoming_fault(p
);
442 prs_mem_free(&rpc_in
);
447 * Validate the RPC header.
450 if(p
->hdr
.major
!= 5 && p
->hdr
.minor
!= 0) {
451 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
452 set_incoming_fault(p
);
453 prs_mem_free(&rpc_in
);
458 * If there's not data in the incoming buffer this should be the start of a new RPC.
461 if(prs_offset(&p
->in_data
.data
) == 0) {
464 * AS/U doesn't set FIRST flag in a BIND packet it seems.
467 if ((p
->hdr
.pkt_type
== RPC_REQUEST
) && !(p
->hdr
.flags
& RPC_FLG_FIRST
)) {
469 * Ensure that the FIRST flag is set. If not then we have
470 * a stream missmatch.
473 DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
474 set_incoming_fault(p
);
475 prs_mem_free(&rpc_in
);
480 * If this is the first PDU then set the endianness
481 * flag in the pipe. We will need this when parsing all
485 p
->endian
= rpc_in
.bigendian_data
;
487 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
488 p
->endian
== RPC_LITTLE_ENDIAN
? "little-" : "big-" ));
493 * If this is *NOT* the first PDU then check the endianness
494 * flag in the pipe is the same as that in the PDU.
497 if (p
->endian
!= rpc_in
.bigendian_data
) {
498 DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p
->endian
));
499 set_incoming_fault(p
);
500 prs_mem_free(&rpc_in
);
506 * Ensure that the pdu length is sane.
509 if((p
->hdr
.frag_len
< RPC_HEADER_LEN
) || (p
->hdr
.frag_len
> MAX_PDU_FRAG_LEN
)) {
510 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
511 set_incoming_fault(p
);
512 prs_mem_free(&rpc_in
);
516 DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p
->hdr
.pkt_type
,
517 (unsigned int)p
->hdr
.flags
));
520 * Adjust for the header we just ate.
522 p
->in_data
.pdu_received_len
= 0;
523 p
->in_data
.pdu_needed_len
= (uint32
)p
->hdr
.frag_len
- RPC_HEADER_LEN
;
526 * Null the data we just ate.
529 memset((char *)&p
->in_data
.current_in_pdu
[0], '\0', RPC_HEADER_LEN
);
531 prs_mem_free(&rpc_in
);
533 return 0; /* No extra data processed. */
536 /****************************************************************************
537 Call this to free any talloc'ed memory. Do this before and after processing
539 ****************************************************************************/
541 void free_pipe_context(pipes_struct
*p
)
544 DEBUG(3,("free_pipe_context: destroying talloc pool of size %lu\n", (unsigned long)talloc_pool_size(p
->mem_ctx
) ));
545 talloc_destroy_pool(p
->mem_ctx
);
547 p
->mem_ctx
= talloc_init("pipe %s %p", p
->name
, p
);
548 if (p
->mem_ctx
== NULL
)
549 p
->fault_state
= True
;
553 /****************************************************************************
554 Processes a request pdu. This will do auth processing if needed, and
555 appends the data into the complete stream if the LAST flag is not set.
556 ****************************************************************************/
558 static BOOL
process_request_pdu(pipes_struct
*p
, prs_struct
*rpc_in_p
)
560 BOOL auth_verify
= ((p
->ntlmssp_chal_flags
& NTLMSSP_NEGOTIATE_SIGN
) != 0);
561 size_t data_len
= p
->hdr
.frag_len
- RPC_HEADER_LEN
- RPC_HDR_REQ_LEN
-
562 (auth_verify
? RPC_HDR_AUTH_LEN
: 0) - p
->hdr
.auth_len
;
565 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
566 set_incoming_fault(p
);
571 * Check if we need to do authentication processing.
572 * This is only done on requests, not binds.
576 * Read the RPC request header.
579 if(!smb_io_rpc_hdr_req("req", &p
->hdr_req
, rpc_in_p
, 0)) {
580 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
581 set_incoming_fault(p
);
585 if(p
->ntlmssp_auth_validated
&& !api_pipe_auth_process(p
, rpc_in_p
)) {
586 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
587 set_incoming_fault(p
);
591 if (p
->ntlmssp_auth_requested
&& !p
->ntlmssp_auth_validated
) {
594 * Authentication _was_ requested and it already failed.
597 DEBUG(0,("process_request_pdu: RPC request received on pipe %s "
598 "where authentication failed. Denying the request.\n",
600 set_incoming_fault(p
);
604 if (p
->netsec_auth_validated
&& !api_pipe_netsec_process(p
, rpc_in_p
)) {
605 DEBUG(0,("process_request_pdu: failed to do schannel processing.\n"));
606 set_incoming_fault(p
);
611 * Check the data length doesn't go over the 15Mb limit.
612 * increased after observing a bug in the Windows NT 4.0 SP6a
613 * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
614 * will not fit in the initial buffer of size 0x1068 --jerry 22/01/2002
617 if(prs_offset(&p
->in_data
.data
) + data_len
> 15*1024*1024) {
618 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
619 (unsigned int)prs_data_size(&p
->in_data
.data
), (unsigned int)data_len
));
620 set_incoming_fault(p
);
625 * Append the data portion into the buffer and return.
628 if(!prs_append_some_prs_data(&p
->in_data
.data
, rpc_in_p
, prs_offset(rpc_in_p
), data_len
)) {
629 DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
630 (unsigned int)data_len
, (unsigned int)prs_data_size(&p
->in_data
.data
) ));
631 set_incoming_fault(p
);
635 if(p
->hdr
.flags
& RPC_FLG_LAST
) {
638 * Ok - we finally have a complete RPC stream.
639 * Call the rpc command to process it.
643 * Ensure the internal prs buffer size is *exactly* the same
644 * size as the current offset.
647 if(!prs_set_buffer_size(&p
->in_data
.data
, prs_offset(&p
->in_data
.data
)))
649 DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
650 set_incoming_fault(p
);
655 * Set the parse offset to the start of the data and set the
656 * prs_struct to UNMARSHALL.
659 prs_set_offset(&p
->in_data
.data
, 0);
660 prs_switch_type(&p
->in_data
.data
, UNMARSHALL
);
663 * Process the complete data stream here.
666 free_pipe_context(p
);
668 if(pipe_init_outgoing_data(p
))
669 ret
= api_pipe_request(p
);
671 free_pipe_context(p
);
674 * We have consumed the whole data stream. Set back to
675 * marshalling and set the offset back to the start of
676 * the buffer to re-use it (we could also do a prs_mem_free()
677 * and then re_init on the next start of PDU. Not sure which
678 * is best here.... JRA.
681 prs_switch_type(&p
->in_data
.data
, MARSHALL
);
682 prs_set_offset(&p
->in_data
.data
, 0);
689 /****************************************************************************
690 Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
691 already been parsed and stored in p->hdr.
692 ****************************************************************************/
694 static ssize_t
process_complete_pdu(pipes_struct
*p
)
697 size_t data_len
= p
->in_data
.pdu_received_len
;
698 char *data_p
= (char *)&p
->in_data
.current_in_pdu
[0];
702 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
704 set_incoming_fault(p
);
705 setup_fault_pdu(p
, NT_STATUS(0x1c010002));
706 return (ssize_t
)data_len
;
709 prs_init( &rpc_in
, 0, p
->mem_ctx
, UNMARSHALL
);
712 * Ensure we're using the corrent endianness for both the
713 * RPC header flags and the raw data we will be reading from.
716 prs_set_endian_data( &rpc_in
, p
->endian
);
717 prs_set_endian_data( &p
->in_data
.data
, p
->endian
);
719 prs_give_memory( &rpc_in
, data_p
, (uint32
)data_len
, False
);
721 DEBUG(10,("process_complete_pdu: processing packet type %u\n",
722 (unsigned int)p
->hdr
.pkt_type
));
724 switch (p
->hdr
.pkt_type
) {
728 * We assume that a pipe bind is only in one pdu.
730 if(pipe_init_outgoing_data(p
))
731 reply
= api_pipe_bind_req(p
, &rpc_in
);
735 * We assume that a pipe bind_resp is only in one pdu.
737 if(pipe_init_outgoing_data(p
))
738 reply
= api_pipe_bind_auth_resp(p
, &rpc_in
);
741 reply
= process_request_pdu(p
, &rpc_in
);
744 DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p
->hdr
.pkt_type
));
748 /* Reset to little endian. Probably don't need this but it won't hurt. */
749 prs_set_endian_data( &p
->in_data
.data
, RPC_LITTLE_ENDIAN
);
752 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p
->pipe_srv_name
));
753 set_incoming_fault(p
);
754 setup_fault_pdu(p
, NT_STATUS(0x1c010002));
755 prs_mem_free(&rpc_in
);
758 * Reset the lengths. We're ready for a new pdu.
760 p
->in_data
.pdu_needed_len
= 0;
761 p
->in_data
.pdu_received_len
= 0;
764 prs_mem_free(&rpc_in
);
765 return (ssize_t
)data_len
;
768 /****************************************************************************
769 Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
770 ****************************************************************************/
772 static ssize_t
process_incoming_data(pipes_struct
*p
, char *data
, size_t n
)
774 size_t data_to_copy
= MIN(n
, MAX_PDU_FRAG_LEN
- p
->in_data
.pdu_received_len
);
775 size_t old_pdu_received_len
= p
->in_data
.pdu_received_len
;
777 DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
778 (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)p
->in_data
.pdu_needed_len
,
781 if(data_to_copy
== 0) {
783 * This is an error - data is being received and there is no
784 * space in the PDU. Free the received data and go into the fault state.
786 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
787 incoming data size = %u\n", (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)n
));
788 set_incoming_fault(p
);
793 * If we have no data already, wait until we get at least a RPC_HEADER_LEN
794 * number of bytes before we can do anything.
797 if((p
->in_data
.pdu_needed_len
== 0) && (p
->in_data
.pdu_received_len
< RPC_HEADER_LEN
)) {
799 * Always return here. If we have more data then the RPC_HEADER
800 * will be processed the next time around the loop.
802 return fill_rpc_header(p
, data
, data_to_copy
);
806 * At this point we know we have at least an RPC_HEADER_LEN amount of data
807 * stored in current_in_pdu.
811 * If pdu_needed_len is zero this is a new pdu.
812 * Unmarshall the header so we know how much more
813 * data we need, then loop again.
816 if(p
->in_data
.pdu_needed_len
== 0)
817 return unmarshall_rpc_header(p
);
820 * Ok - at this point we have a valid RPC_HEADER in p->hdr.
821 * Keep reading until we have a full pdu.
824 data_to_copy
= MIN(data_to_copy
, p
->in_data
.pdu_needed_len
);
827 * Copy as much of the data as we need into the current_in_pdu buffer.
830 memcpy( (char *)&p
->in_data
.current_in_pdu
[p
->in_data
.pdu_received_len
], data
, data_to_copy
);
831 p
->in_data
.pdu_received_len
+= data_to_copy
;
834 * Do we have a complete PDU ?
835 * (return the nym of bytes handled in the call)
838 if(p
->in_data
.pdu_received_len
== p
->in_data
.pdu_needed_len
)
839 return process_complete_pdu(p
) - old_pdu_received_len
;
841 DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
842 (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)p
->in_data
.pdu_needed_len
));
844 return (ssize_t
)data_to_copy
;
848 /****************************************************************************
849 Accepts incoming data on an rpc pipe.
850 ****************************************************************************/
852 ssize_t
write_to_pipe(smb_np_struct
*p
, char *data
, size_t n
)
854 DEBUG(6,("write_to_pipe: %x", p
->pnum
));
856 DEBUG(6,(" name: %s open: %s len: %d\n",
857 p
->name
, BOOLSTR(p
->open
), (int)n
));
859 dump_data(50, data
, n
);
861 return p
->namedpipe_write(p
->np_state
, data
, n
);
864 /****************************************************************************
865 Accepts incoming data on an internal rpc pipe.
866 ****************************************************************************/
868 static ssize_t
write_to_internal_pipe(void *np_conn
, char *data
, size_t n
)
870 pipes_struct
*p
= (pipes_struct
*)np_conn
;
871 size_t data_left
= n
;
876 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left
));
878 data_used
= process_incoming_data(p
, data
, data_left
);
880 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used
));
885 data_left
-= data_used
;
892 /****************************************************************************
893 Replies to a request to read data from a pipe.
895 Headers are interspersed with the data at PDU intervals. By the time
896 this function is called, the start of the data could possibly have been
897 read by an SMBtrans (file_offset != 0).
899 Calling create_rpc_reply() here is a hack. The data should already
900 have been prepared into arrays of headers + data stream sections.
901 ****************************************************************************/
903 ssize_t
read_from_pipe(smb_np_struct
*p
, char *data
, size_t n
,
904 BOOL
*is_data_outstanding
)
906 if (!p
|| !p
->open
) {
907 DEBUG(0,("read_from_pipe: pipe not open\n"));
911 DEBUG(6,("read_from_pipe: %x", p
->pnum
));
913 return p
->namedpipe_read(p
->np_state
, data
, n
, is_data_outstanding
);
916 /****************************************************************************
917 Replies to a request to read data from a pipe.
919 Headers are interspersed with the data at PDU intervals. By the time
920 this function is called, the start of the data could possibly have been
921 read by an SMBtrans (file_offset != 0).
923 Calling create_rpc_reply() here is a hack. The data should already
924 have been prepared into arrays of headers + data stream sections.
925 ****************************************************************************/
927 static ssize_t
read_from_internal_pipe(void *np_conn
, char *data
, size_t n
,
928 BOOL
*is_data_outstanding
)
930 pipes_struct
*p
= (pipes_struct
*)np_conn
;
931 uint32 pdu_remaining
= 0;
932 ssize_t data_returned
= 0;
935 DEBUG(0,("read_from_pipe: pipe not open\n"));
939 DEBUG(6,(" name: %s len: %u\n", p
->name
, (unsigned int)n
));
942 * We cannot return more than one PDU length per
947 * This condition should result in the connection being closed.
948 * Netapp filers seem to set it to 0xffff which results in domain
949 * authentications failing. Just ignore it so things work.
952 if(n
> MAX_PDU_FRAG_LEN
) {
953 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
954 pipe %s. We can only service %d sized reads.\n", (unsigned int)n
, p
->name
, MAX_PDU_FRAG_LEN
));
958 * Determine if there is still data to send in the
959 * pipe PDU buffer. Always send this first. Never
960 * send more than is left in the current PDU. The
961 * client should send a new read request for a new
965 if((pdu_remaining
= p
->out_data
.current_pdu_len
- p
->out_data
.current_pdu_sent
) > 0) {
966 data_returned
= (ssize_t
)MIN(n
, pdu_remaining
);
968 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
969 returning %d bytes.\n", p
->name
, (unsigned int)p
->out_data
.current_pdu_len
,
970 (unsigned int)p
->out_data
.current_pdu_sent
, (int)data_returned
));
972 memcpy( data
, &p
->out_data
.current_pdu
[p
->out_data
.current_pdu_sent
], (size_t)data_returned
);
973 p
->out_data
.current_pdu_sent
+= (uint32
)data_returned
;
978 * At this point p->current_pdu_len == p->current_pdu_sent (which
979 * may of course be zero if this is the first return fragment.
982 DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
983 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
984 p
->name
, (int)p
->fault_state
, (unsigned int)p
->out_data
.data_sent_length
, (unsigned int)prs_offset(&p
->out_data
.rdata
) ));
986 if(p
->out_data
.data_sent_length
>= prs_offset(&p
->out_data
.rdata
)) {
988 * We have sent all possible data, return 0.
995 * We need to create a new PDU from the data left in p->rdata.
996 * Create the header/data/footers. This also sets up the fields
997 * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
998 * and stores the outgoing PDU in p->current_pdu.
1001 if(!create_next_pdu(p
)) {
1002 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p
->name
));
1006 data_returned
= MIN(n
, p
->out_data
.current_pdu_len
);
1008 memcpy( data
, p
->out_data
.current_pdu
, (size_t)data_returned
);
1009 p
->out_data
.current_pdu_sent
+= (uint32
)data_returned
;
1013 (*is_data_outstanding
) = p
->out_data
.current_pdu_len
> n
;
1014 return data_returned
;
1017 /****************************************************************************
1018 Wait device state on a pipe. Exactly what this is for is unknown...
1019 ****************************************************************************/
1021 BOOL
wait_rpc_pipe_hnd_state(smb_np_struct
*p
, uint16 priority
)
1027 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
1028 priority
, p
->name
));
1030 p
->priority
= priority
;
1035 DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
1036 priority
, p
->name
));
1041 /****************************************************************************
1042 Set device state on a pipe. Exactly what this is for is unknown...
1043 ****************************************************************************/
1045 BOOL
set_rpc_pipe_hnd_state(smb_np_struct
*p
, uint16 device_state
)
1051 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1052 device_state
, p
->name
));
1054 p
->device_state
= device_state
;
1059 DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1060 device_state
, p
->name
));
1065 /****************************************************************************
1067 ****************************************************************************/
1069 BOOL
close_rpc_pipe_hnd(smb_np_struct
*p
)
1072 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1076 p
->namedpipe_close(p
->np_state
);
1078 bitmap_clear(bmap
, p
->pnum
- pipe_handle_offset
);
1082 DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
1083 p
->name
, p
->pnum
, pipes_open
));
1085 DLIST_REMOVE(Pipes
, p
);
1094 /****************************************************************************
1096 ****************************************************************************/
1098 static BOOL
close_internal_rpc_pipe_hnd(void *np_conn
)
1100 pipes_struct
*p
= (pipes_struct
*)np_conn
;
1102 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1106 prs_mem_free(&p
->out_data
.rdata
);
1107 prs_mem_free(&p
->in_data
.data
);
1110 talloc_destroy(p
->mem_ctx
);
1112 free_pipe_rpc_context( p
->contexts
);
1114 /* Free the handles database. */
1115 close_policy_by_pipe(p
);
1117 delete_nt_token(&p
->pipe_user
.nt_user_token
);
1118 SAFE_FREE(p
->pipe_user
.groups
);
1120 DLIST_REMOVE(InternalPipes
, p
);
1122 p
->conn
->num_files_open
--;
1131 /****************************************************************************
1132 Find an rpc pipe given a pipe handle in a buffer and an offset.
1133 ****************************************************************************/
1135 smb_np_struct
*get_rpc_pipe_p(char *buf
, int where
)
1137 int pnum
= SVAL(buf
,where
);
1142 return get_rpc_pipe(pnum
);
1145 /****************************************************************************
1146 Find an rpc pipe given a pipe handle.
1147 ****************************************************************************/
1149 smb_np_struct
*get_rpc_pipe(int pnum
)
1153 DEBUG(4,("search for pipe pnum=%x\n", pnum
));
1155 for (p
=Pipes
;p
;p
=p
->next
)
1156 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
1157 p
->name
, p
->pnum
, pipes_open
));
1159 for (p
=Pipes
;p
;p
=p
->next
) {
1160 if (p
->pnum
== pnum
) {