2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1998,
5 * Largely re-written : 2005
6 * Copyright (C) Jeremy Allison 1998 - 2005
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 #define DBGC_CLASS DBGC_RPC_SRV
27 #define PIPE "\\PIPE\\"
28 #define PIPELEN strlen(PIPE)
30 static smb_np_struct
*chain_p
;
31 static int pipes_open
;
34 * Sometimes I can't decide if I hate Windows printer driver
35 * writers more than I hate the Windows spooler service driver
36 * writers. This gets around a combination of bugs in the spooler
37 * and the HP 8500 PCL driver that causes a spooler spin. JRA.
39 * bumped up from 20 -> 64 after viewing traffic from WordPerfect
40 * 2002 running on NT 4.- SP6
41 * bumped up from 64 -> 256 after viewing traffic from con2prt
42 * for lots of printers on a WinNT 4.x SP6 box.
45 #ifndef MAX_OPEN_SPOOLSS_PIPES
46 #define MAX_OPEN_SPOOLSS_PIPES 256
48 static int current_spoolss_pipes_open
;
50 static smb_np_struct
*Pipes
;
51 static pipes_struct
*InternalPipes
;
52 static struct bitmap
*bmap
;
55 * the following prototypes are declared here to avoid
56 * code being moved about too much for a patch to be
57 * disrupted / less obvious.
59 * these functions, and associated functions that they
60 * call, should be moved behind a .so module-loading
61 * system _anyway_. so that's the next step...
64 static ssize_t
read_from_internal_pipe(void *np_conn
, char *data
, size_t n
,
65 bool *is_data_outstanding
);
66 static ssize_t
write_to_internal_pipe(void *np_conn
, char *data
, size_t n
);
67 static bool close_internal_rpc_pipe_hnd(void *np_conn
);
68 static void *make_internal_rpc_pipe_p(const char *pipe_name
,
69 connection_struct
*conn
, uint16 vuid
);
71 /****************************************************************************
72 Internal Pipe iterator functions.
73 ****************************************************************************/
75 pipes_struct
*get_first_internal_pipe(void)
80 pipes_struct
*get_next_internal_pipe(pipes_struct
*p
)
85 /* this must be larger than the sum of the open files and directories */
86 static int pipe_handle_offset
;
88 /****************************************************************************
89 Set the pipe_handle_offset. Called from smbd/files.c
90 ****************************************************************************/
92 void set_pipe_handle_offset(int max_open_files
)
94 if(max_open_files
< 0x7000) {
95 pipe_handle_offset
= 0x7000;
97 pipe_handle_offset
= max_open_files
+ 10; /* For safety. :-) */
101 /****************************************************************************
102 Reset pipe chain handle number.
103 ****************************************************************************/
105 void reset_chain_p(void)
110 /****************************************************************************
111 Initialise pipe handle states.
112 ****************************************************************************/
114 void init_rpc_pipe_hnd(void)
116 bmap
= bitmap_allocate(MAX_OPEN_PIPES
);
118 exit_server("out of memory in init_rpc_pipe_hnd");
122 /****************************************************************************
123 Initialise an outgoing packet.
124 ****************************************************************************/
126 static bool pipe_init_outgoing_data(pipes_struct
*p
)
128 output_data
*o_data
= &p
->out_data
;
130 /* Reset the offset counters. */
131 o_data
->data_sent_length
= 0;
132 o_data
->current_pdu_len
= 0;
133 o_data
->current_pdu_sent
= 0;
135 memset(o_data
->current_pdu
, '\0', sizeof(o_data
->current_pdu
));
137 /* Free any memory in the current return data buffer. */
138 prs_mem_free(&o_data
->rdata
);
141 * Initialize the outgoing RPC data buffer.
142 * we will use this as the raw data area for replying to rpc requests.
144 if(!prs_init(&o_data
->rdata
, RPC_MAX_PDU_FRAG_LEN
, p
->mem_ctx
, MARSHALL
)) {
145 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n"));
152 /****************************************************************************
153 Find first available pipe slot.
154 ****************************************************************************/
156 smb_np_struct
*open_rpc_pipe_p(const char *pipe_name
,
157 connection_struct
*conn
, uint16 vuid
)
160 smb_np_struct
*p
, *p_it
;
161 static int next_pipe
;
162 bool is_spoolss_pipe
= False
;
164 DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
165 pipe_name
, pipes_open
));
167 if (strstr(pipe_name
, "spoolss")) {
168 is_spoolss_pipe
= True
;
171 if (is_spoolss_pipe
&& current_spoolss_pipes_open
>= MAX_OPEN_SPOOLSS_PIPES
) {
172 DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n",
177 /* not repeating pipe numbers makes it easier to track things in
178 log files and prevents client bugs where pipe numbers are reused
179 over connection restarts */
181 if (next_pipe
== 0) {
182 next_pipe
= (sys_getpid() ^ time(NULL
)) % MAX_OPEN_PIPES
;
185 i
= bitmap_find(bmap
, next_pipe
);
188 DEBUG(0,("ERROR! Out of pipe structures\n"));
192 next_pipe
= (i
+1) % MAX_OPEN_PIPES
;
194 for (p
= Pipes
; p
; p
= p
->next
) {
195 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p
->name
, p
->pnum
));
198 p
= talloc(NULL
, smb_np_struct
);
200 DEBUG(0,("ERROR! no memory for smb_np_struct!\n"));
206 p
->name
= talloc_strdup(p
, pipe_name
);
207 if (p
->name
== NULL
) {
209 DEBUG(0,("ERROR! no memory for pipe name!\n"));
213 /* add a dso mechanism instead of this, here */
215 p
->namedpipe_create
= make_internal_rpc_pipe_p
;
216 p
->namedpipe_read
= read_from_internal_pipe
;
217 p
->namedpipe_write
= write_to_internal_pipe
;
218 p
->namedpipe_close
= close_internal_rpc_pipe_hnd
;
220 p
->np_state
= p
->namedpipe_create(pipe_name
, conn
, vuid
);
222 if (p
->np_state
== NULL
) {
223 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n"));
231 * Initialize the incoming RPC data buffer with one PDU worth of memory.
232 * We cheat here and say we're marshalling, as we intend to add incoming
233 * data directly into the prs_struct and we want it to auto grow. We will
234 * change the type to UNMARSALLING before processing the stream.
238 i
+= pipe_handle_offset
;
250 p
->max_trans_reply
= 0;
252 DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
253 pipe_name
, i
, pipes_open
));
257 /* Iterate over p_it as a temp variable, to display all open pipes */
258 for (p_it
= Pipes
; p_it
; p_it
= p_it
->next
) {
259 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it
->name
, p_it
->pnum
));
265 /****************************************************************************
266 Make an internal namedpipes structure
267 ****************************************************************************/
269 static void *make_internal_rpc_pipe_p(const char *pipe_name
,
270 connection_struct
*conn
, uint16 vuid
)
273 user_struct
*vuser
= get_valid_user_struct(vuid
);
275 DEBUG(4,("Create pipe requested %s\n", pipe_name
));
277 if (!vuser
&& vuid
!= UID_FIELD_INVALID
) {
278 DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid
));
282 p
= TALLOC_ZERO_P(NULL
, pipes_struct
);
285 DEBUG(0,("ERROR! no memory for pipes_struct!\n"));
289 if ((p
->mem_ctx
= talloc_init("pipe %s %p", pipe_name
, p
)) == NULL
) {
290 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n"));
295 if (!init_pipe_handle_list(p
, pipe_name
)) {
296 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n"));
297 talloc_destroy(p
->mem_ctx
);
303 * Initialize the incoming RPC data buffer with one PDU worth of memory.
304 * We cheat here and say we're marshalling, as we intend to add incoming
305 * data directly into the prs_struct and we want it to auto grow. We will
306 * change the type to UNMARSALLING before processing the stream.
309 if(!prs_init(&p
->in_data
.data
, RPC_MAX_PDU_FRAG_LEN
, p
->mem_ctx
, MARSHALL
)) {
310 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n"));
311 talloc_destroy(p
->mem_ctx
);
312 close_policy_by_pipe(p
);
317 p
->server_info
= copy_serverinfo(p
, conn
->server_info
);
318 if (p
->server_info
== NULL
) {
319 DEBUG(0, ("open_rpc_pipe_p: copy_serverinfo failed\n"));
320 talloc_destroy(p
->mem_ctx
);
321 close_policy_by_pipe(p
);
326 DLIST_ADD(InternalPipes
, p
);
328 memcpy(p
->client_address
, conn
->client_address
,
329 sizeof(p
->client_address
));
331 p
->endian
= RPC_LITTLE_ENDIAN
;
333 ZERO_STRUCT(p
->pipe_user
);
335 p
->pipe_user
.ut
.uid
= (uid_t
)-1;
336 p
->pipe_user
.ut
.gid
= (gid_t
)-1;
338 /* Store the session key and NT_TOKEN */
340 p
->pipe_user
.nt_user_token
= dup_nt_token(
341 NULL
, vuser
->server_info
->ptok
);
345 * Initialize the outgoing RPC data buffer with no memory.
347 prs_init_empty(&p
->out_data
.rdata
, p
->mem_ctx
, MARSHALL
);
349 fstrcpy(p
->name
, pipe_name
);
351 DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
352 pipe_name
, pipes_open
));
357 /****************************************************************************
358 Sets the fault state on incoming packets.
359 ****************************************************************************/
361 static void set_incoming_fault(pipes_struct
*p
)
363 prs_mem_free(&p
->in_data
.data
);
364 p
->in_data
.pdu_needed_len
= 0;
365 p
->in_data
.pdu_received_len
= 0;
366 p
->fault_state
= True
;
367 DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
371 /****************************************************************************
372 Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
373 ****************************************************************************/
375 static ssize_t
fill_rpc_header(pipes_struct
*p
, char *data
, size_t data_to_copy
)
377 size_t len_needed_to_complete_hdr
= MIN(data_to_copy
, RPC_HEADER_LEN
- p
->in_data
.pdu_received_len
);
379 DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n",
380 (unsigned int)data_to_copy
, (unsigned int)len_needed_to_complete_hdr
,
381 (unsigned int)p
->in_data
.pdu_received_len
));
383 memcpy((char *)&p
->in_data
.current_in_pdu
[p
->in_data
.pdu_received_len
], data
, len_needed_to_complete_hdr
);
384 p
->in_data
.pdu_received_len
+= len_needed_to_complete_hdr
;
386 return (ssize_t
)len_needed_to_complete_hdr
;
389 /****************************************************************************
390 Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu.
391 ****************************************************************************/
393 static ssize_t
unmarshall_rpc_header(pipes_struct
*p
)
396 * Unmarshall the header to determine the needed length.
401 if(p
->in_data
.pdu_received_len
!= RPC_HEADER_LEN
) {
402 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n"));
403 set_incoming_fault(p
);
407 prs_init_empty( &rpc_in
, p
->mem_ctx
, UNMARSHALL
);
408 prs_set_endian_data( &rpc_in
, p
->endian
);
410 prs_give_memory( &rpc_in
, (char *)&p
->in_data
.current_in_pdu
[0],
411 p
->in_data
.pdu_received_len
, False
);
414 * Unmarshall the header as this will tell us how much
415 * data we need to read to get the complete pdu.
416 * This also sets the endian flag in rpc_in.
419 if(!smb_io_rpc_hdr("", &p
->hdr
, &rpc_in
, 0)) {
420 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n"));
421 set_incoming_fault(p
);
422 prs_mem_free(&rpc_in
);
427 * Validate the RPC header.
430 if(p
->hdr
.major
!= 5 && p
->hdr
.minor
!= 0) {
431 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n"));
432 set_incoming_fault(p
);
433 prs_mem_free(&rpc_in
);
438 * If there's not data in the incoming buffer this should be the start of a new RPC.
441 if(prs_offset(&p
->in_data
.data
) == 0) {
444 * AS/U doesn't set FIRST flag in a BIND packet it seems.
447 if ((p
->hdr
.pkt_type
== RPC_REQUEST
) && !(p
->hdr
.flags
& RPC_FLG_FIRST
)) {
449 * Ensure that the FIRST flag is set. If not then we have
450 * a stream missmatch.
453 DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n"));
454 set_incoming_fault(p
);
455 prs_mem_free(&rpc_in
);
460 * If this is the first PDU then set the endianness
461 * flag in the pipe. We will need this when parsing all
465 p
->endian
= rpc_in
.bigendian_data
;
467 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n",
468 p
->endian
== RPC_LITTLE_ENDIAN
? "little-" : "big-" ));
473 * If this is *NOT* the first PDU then check the endianness
474 * flag in the pipe is the same as that in the PDU.
477 if (p
->endian
!= rpc_in
.bigendian_data
) {
478 DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p
->endian
));
479 set_incoming_fault(p
);
480 prs_mem_free(&rpc_in
);
486 * Ensure that the pdu length is sane.
489 if((p
->hdr
.frag_len
< RPC_HEADER_LEN
) || (p
->hdr
.frag_len
> RPC_MAX_PDU_FRAG_LEN
)) {
490 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n"));
491 set_incoming_fault(p
);
492 prs_mem_free(&rpc_in
);
496 DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p
->hdr
.pkt_type
,
497 (unsigned int)p
->hdr
.flags
));
499 p
->in_data
.pdu_needed_len
= (uint32
)p
->hdr
.frag_len
- RPC_HEADER_LEN
;
501 prs_mem_free(&rpc_in
);
503 return 0; /* No extra data processed. */
506 /****************************************************************************
507 Call this to free any talloc'ed memory. Do this before and after processing
509 ****************************************************************************/
511 static void free_pipe_context(pipes_struct
*p
)
514 DEBUG(3,("free_pipe_context: destroying talloc pool of size "
515 "%lu\n", (unsigned long)talloc_total_size(p
->mem_ctx
) ));
516 talloc_free_children(p
->mem_ctx
);
518 p
->mem_ctx
= talloc_init("pipe %s %p", p
->name
, p
);
519 if (p
->mem_ctx
== NULL
) {
520 p
->fault_state
= True
;
525 /****************************************************************************
526 Processes a request pdu. This will do auth processing if needed, and
527 appends the data into the complete stream if the LAST flag is not set.
528 ****************************************************************************/
530 static bool process_request_pdu(pipes_struct
*p
, prs_struct
*rpc_in_p
)
532 uint32 ss_padding_len
= 0;
533 size_t data_len
= p
->hdr
.frag_len
- RPC_HEADER_LEN
- RPC_HDR_REQ_LEN
-
534 (p
->hdr
.auth_len
? RPC_HDR_AUTH_LEN
: 0) - p
->hdr
.auth_len
;
537 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
538 set_incoming_fault(p
);
543 * Check if we need to do authentication processing.
544 * This is only done on requests, not binds.
548 * Read the RPC request header.
551 if(!smb_io_rpc_hdr_req("req", &p
->hdr_req
, rpc_in_p
, 0)) {
552 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n"));
553 set_incoming_fault(p
);
557 switch(p
->auth
.auth_type
) {
558 case PIPE_AUTH_TYPE_NONE
:
561 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP
:
562 case PIPE_AUTH_TYPE_NTLMSSP
:
565 if(!api_pipe_ntlmssp_auth_process(p
, rpc_in_p
, &ss_padding_len
, &status
)) {
566 DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
567 DEBUG(0,("process_request_pdu: error was %s.\n", nt_errstr(status
) ));
568 set_incoming_fault(p
);
574 case PIPE_AUTH_TYPE_SCHANNEL
:
575 if (!api_pipe_schannel_process(p
, rpc_in_p
, &ss_padding_len
)) {
576 DEBUG(3,("process_request_pdu: failed to do schannel processing.\n"));
577 set_incoming_fault(p
);
583 DEBUG(0,("process_request_pdu: unknown auth type %u set.\n", (unsigned int)p
->auth
.auth_type
));
584 set_incoming_fault(p
);
588 /* Now we've done the sign/seal we can remove any padding data. */
589 if (data_len
> ss_padding_len
) {
590 data_len
-= ss_padding_len
;
594 * Check the data length doesn't go over the 15Mb limit.
595 * increased after observing a bug in the Windows NT 4.0 SP6a
596 * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
597 * will not fit in the initial buffer of size 0x1068 --jerry 22/01/2002
600 if(prs_offset(&p
->in_data
.data
) + data_len
> 15*1024*1024) {
601 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n",
602 (unsigned int)prs_data_size(&p
->in_data
.data
), (unsigned int)data_len
));
603 set_incoming_fault(p
);
608 * Append the data portion into the buffer and return.
611 if(!prs_append_some_prs_data(&p
->in_data
.data
, rpc_in_p
, prs_offset(rpc_in_p
), data_len
)) {
612 DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n",
613 (unsigned int)data_len
, (unsigned int)prs_data_size(&p
->in_data
.data
) ));
614 set_incoming_fault(p
);
618 if(p
->hdr
.flags
& RPC_FLG_LAST
) {
621 * Ok - we finally have a complete RPC stream.
622 * Call the rpc command to process it.
626 * Ensure the internal prs buffer size is *exactly* the same
627 * size as the current offset.
630 if(!prs_set_buffer_size(&p
->in_data
.data
, prs_offset(&p
->in_data
.data
))) {
631 DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n"));
632 set_incoming_fault(p
);
637 * Set the parse offset to the start of the data and set the
638 * prs_struct to UNMARSHALL.
641 prs_set_offset(&p
->in_data
.data
, 0);
642 prs_switch_type(&p
->in_data
.data
, UNMARSHALL
);
645 * Process the complete data stream here.
648 free_pipe_context(p
);
650 if(pipe_init_outgoing_data(p
)) {
651 ret
= api_pipe_request(p
);
654 free_pipe_context(p
);
657 * We have consumed the whole data stream. Set back to
658 * marshalling and set the offset back to the start of
659 * the buffer to re-use it (we could also do a prs_mem_free()
660 * and then re_init on the next start of PDU. Not sure which
661 * is best here.... JRA.
664 prs_switch_type(&p
->in_data
.data
, MARSHALL
);
665 prs_set_offset(&p
->in_data
.data
, 0);
672 /****************************************************************************
673 Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has
674 already been parsed and stored in p->hdr.
675 ****************************************************************************/
677 static void process_complete_pdu(pipes_struct
*p
)
680 size_t data_len
= p
->in_data
.pdu_received_len
- RPC_HEADER_LEN
;
681 char *data_p
= (char *)&p
->in_data
.current_in_pdu
[RPC_HEADER_LEN
];
685 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
687 set_incoming_fault(p
);
688 setup_fault_pdu(p
, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR
));
692 prs_init_empty( &rpc_in
, p
->mem_ctx
, UNMARSHALL
);
695 * Ensure we're using the corrent endianness for both the
696 * RPC header flags and the raw data we will be reading from.
699 prs_set_endian_data( &rpc_in
, p
->endian
);
700 prs_set_endian_data( &p
->in_data
.data
, p
->endian
);
702 prs_give_memory( &rpc_in
, data_p
, (uint32
)data_len
, False
);
704 DEBUG(10,("process_complete_pdu: processing packet type %u\n",
705 (unsigned int)p
->hdr
.pkt_type
));
707 switch (p
->hdr
.pkt_type
) {
709 reply
= process_request_pdu(p
, &rpc_in
);
712 case RPC_PING
: /* CL request - ignore... */
713 DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n",
714 (unsigned int)p
->hdr
.pkt_type
, p
->name
));
717 case RPC_RESPONSE
: /* No responses here. */
718 DEBUG(0,("process_complete_pdu: Error. RPC_RESPONSE received from client on pipe %s.\n",
723 case RPC_WORKING
: /* CL request - reply to a ping when a call in process. */
724 case RPC_NOCALL
: /* CL - server reply to a ping call. */
730 DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n",
731 (unsigned int)p
->hdr
.pkt_type
, p
->name
));
736 * We assume that a pipe bind is only in one pdu.
738 if(pipe_init_outgoing_data(p
)) {
739 reply
= api_pipe_bind_req(p
, &rpc_in
);
745 DEBUG(0,("process_complete_pdu: Error. RPC_BINDACK/RPC_BINDNACK packet type %u received on pipe %s.\n",
746 (unsigned int)p
->hdr
.pkt_type
, p
->name
));
752 * We assume that a pipe bind is only in one pdu.
754 if(pipe_init_outgoing_data(p
)) {
755 reply
= api_pipe_alter_context(p
, &rpc_in
);
759 case RPC_ALTCONTRESP
:
760 DEBUG(0,("process_complete_pdu: Error. RPC_ALTCONTRESP on pipe %s: Should only be server -> client.\n",
766 * The third packet in an NTLMSSP auth exchange.
768 if(pipe_init_outgoing_data(p
)) {
769 reply
= api_pipe_bind_auth3(p
, &rpc_in
);
774 DEBUG(0,("process_complete_pdu: Error. RPC_SHUTDOWN on pipe %s: Should only be server -> client.\n",
779 /* For now just free all client data and continue processing. */
780 DEBUG(3,("process_complete_pdu: RPC_ORPHANED. Abandoning rpc call.\n"));
781 /* As we never do asynchronous RPC serving, we can never cancel a
782 call (as far as I know). If we ever did we'd have to send a cancel_ack
783 reply. For now, just free all client data and continue processing. */
787 /* Enable this if we're doing async rpc. */
788 /* We must check the call-id matches the outstanding callid. */
789 if(pipe_init_outgoing_data(p
)) {
790 /* Send a cancel_ack PDU reply. */
791 /* We should probably check the auth-verifier here. */
792 reply
= setup_cancel_ack_reply(p
, &rpc_in
);
798 /* We should probably check the auth-verifier here.
799 For now just free all client data and continue processing. */
800 DEBUG(3,("process_complete_pdu: RPC_ORPHANED. Abandoning rpc call.\n"));
805 DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p
->hdr
.pkt_type
));
809 /* Reset to little endian. Probably don't need this but it won't hurt. */
810 prs_set_endian_data( &p
->in_data
.data
, RPC_LITTLE_ENDIAN
);
813 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p
->pipe_srv_name
));
814 set_incoming_fault(p
);
815 setup_fault_pdu(p
, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR
));
816 prs_mem_free(&rpc_in
);
819 * Reset the lengths. We're ready for a new pdu.
821 p
->in_data
.pdu_needed_len
= 0;
822 p
->in_data
.pdu_received_len
= 0;
825 prs_mem_free(&rpc_in
);
828 /****************************************************************************
829 Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
830 ****************************************************************************/
832 static ssize_t
process_incoming_data(pipes_struct
*p
, char *data
, size_t n
)
834 size_t data_to_copy
= MIN(n
, RPC_MAX_PDU_FRAG_LEN
- p
->in_data
.pdu_received_len
);
836 DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n",
837 (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)p
->in_data
.pdu_needed_len
,
840 if(data_to_copy
== 0) {
842 * This is an error - data is being received and there is no
843 * space in the PDU. Free the received data and go into the fault state.
845 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \
846 incoming data size = %u\n", (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)n
));
847 set_incoming_fault(p
);
852 * If we have no data already, wait until we get at least a RPC_HEADER_LEN
853 * number of bytes before we can do anything.
856 if((p
->in_data
.pdu_needed_len
== 0) && (p
->in_data
.pdu_received_len
< RPC_HEADER_LEN
)) {
858 * Always return here. If we have more data then the RPC_HEADER
859 * will be processed the next time around the loop.
861 return fill_rpc_header(p
, data
, data_to_copy
);
865 * At this point we know we have at least an RPC_HEADER_LEN amount of data
866 * stored in current_in_pdu.
870 * If pdu_needed_len is zero this is a new pdu.
871 * Unmarshall the header so we know how much more
872 * data we need, then loop again.
875 if(p
->in_data
.pdu_needed_len
== 0) {
876 ssize_t rret
= unmarshall_rpc_header(p
);
877 if (rret
== -1 || p
->in_data
.pdu_needed_len
> 0) {
880 /* If rret == 0 and pdu_needed_len == 0 here we have a PDU that consists
881 of an RPC_HEADER only. This is a RPC_SHUTDOWN, RPC_CO_CANCEL or RPC_ORPHANED
882 pdu type. Deal with this in process_complete_pdu(). */
886 * Ok - at this point we have a valid RPC_HEADER in p->hdr.
887 * Keep reading until we have a full pdu.
890 data_to_copy
= MIN(data_to_copy
, p
->in_data
.pdu_needed_len
);
893 * Copy as much of the data as we need into the current_in_pdu buffer.
894 * pdu_needed_len becomes zero when we have a complete pdu.
897 memcpy( (char *)&p
->in_data
.current_in_pdu
[p
->in_data
.pdu_received_len
], data
, data_to_copy
);
898 p
->in_data
.pdu_received_len
+= data_to_copy
;
899 p
->in_data
.pdu_needed_len
-= data_to_copy
;
902 * Do we have a complete PDU ?
903 * (return the number of bytes handled in the call)
906 if(p
->in_data
.pdu_needed_len
== 0) {
907 process_complete_pdu(p
);
911 DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n",
912 (unsigned int)p
->in_data
.pdu_received_len
, (unsigned int)p
->in_data
.pdu_needed_len
));
914 return (ssize_t
)data_to_copy
;
917 /****************************************************************************
918 Accepts incoming data on an rpc pipe.
919 ****************************************************************************/
921 ssize_t
write_to_pipe(smb_np_struct
*p
, char *data
, size_t n
)
923 DEBUG(6,("write_to_pipe: %x", p
->pnum
));
925 DEBUG(6,(" name: %s open: %s len: %d\n",
926 p
->name
, BOOLSTR(p
->open
), (int)n
));
928 dump_data(50, (uint8
*)data
, n
);
930 return p
->namedpipe_write(p
->np_state
, data
, n
);
933 /****************************************************************************
934 Accepts incoming data on an internal rpc pipe.
935 ****************************************************************************/
937 static ssize_t
write_to_internal_pipe(void *np_conn
, char *data
, size_t n
)
939 pipes_struct
*p
= (pipes_struct
*)np_conn
;
940 size_t data_left
= n
;
945 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left
));
947 data_used
= process_incoming_data(p
, data
, data_left
);
949 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used
));
955 data_left
-= data_used
;
962 /****************************************************************************
963 Replies to a request to read data from a pipe.
965 Headers are interspersed with the data at PDU intervals. By the time
966 this function is called, the start of the data could possibly have been
967 read by an SMBtrans (file_offset != 0).
969 Calling create_rpc_reply() here is a hack. The data should already
970 have been prepared into arrays of headers + data stream sections.
971 ****************************************************************************/
973 ssize_t
read_from_pipe(smb_np_struct
*p
, char *data
, size_t n
,
974 bool *is_data_outstanding
)
976 if (!p
|| !p
->open
) {
977 DEBUG(0,("read_from_pipe: pipe not open\n"));
981 DEBUG(6,("read_from_pipe: %x", p
->pnum
));
983 return p
->namedpipe_read(p
->np_state
, data
, n
, is_data_outstanding
);
986 /****************************************************************************
987 Replies to a request to read data from a pipe.
989 Headers are interspersed with the data at PDU intervals. By the time
990 this function is called, the start of the data could possibly have been
991 read by an SMBtrans (file_offset != 0).
993 Calling create_rpc_reply() here is a hack. The data should already
994 have been prepared into arrays of headers + data stream sections.
995 ****************************************************************************/
997 static ssize_t
read_from_internal_pipe(void *np_conn
, char *data
, size_t n
,
998 bool *is_data_outstanding
)
1000 pipes_struct
*p
= (pipes_struct
*)np_conn
;
1001 uint32 pdu_remaining
= 0;
1002 ssize_t data_returned
= 0;
1005 DEBUG(0,("read_from_pipe: pipe not open\n"));
1009 DEBUG(6,(" name: %s len: %u\n", p
->name
, (unsigned int)n
));
1012 * We cannot return more than one PDU length per
1017 * This condition should result in the connection being closed.
1018 * Netapp filers seem to set it to 0xffff which results in domain
1019 * authentications failing. Just ignore it so things work.
1022 if(n
> RPC_MAX_PDU_FRAG_LEN
) {
1023 DEBUG(5,("read_from_pipe: too large read (%u) requested on \
1024 pipe %s. We can only service %d sized reads.\n", (unsigned int)n
, p
->name
, RPC_MAX_PDU_FRAG_LEN
));
1025 n
= RPC_MAX_PDU_FRAG_LEN
;
1029 * Determine if there is still data to send in the
1030 * pipe PDU buffer. Always send this first. Never
1031 * send more than is left in the current PDU. The
1032 * client should send a new read request for a new
1036 if((pdu_remaining
= p
->out_data
.current_pdu_len
- p
->out_data
.current_pdu_sent
) > 0) {
1037 data_returned
= (ssize_t
)MIN(n
, pdu_remaining
);
1039 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \
1040 returning %d bytes.\n", p
->name
, (unsigned int)p
->out_data
.current_pdu_len
,
1041 (unsigned int)p
->out_data
.current_pdu_sent
, (int)data_returned
));
1043 memcpy( data
, &p
->out_data
.current_pdu
[p
->out_data
.current_pdu_sent
], (size_t)data_returned
);
1044 p
->out_data
.current_pdu_sent
+= (uint32
)data_returned
;
1049 * At this point p->current_pdu_len == p->current_pdu_sent (which
1050 * may of course be zero if this is the first return fragment.
1053 DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \
1054 = %u, prs_offset(&p->out_data.rdata) = %u.\n",
1055 p
->name
, (int)p
->fault_state
, (unsigned int)p
->out_data
.data_sent_length
, (unsigned int)prs_offset(&p
->out_data
.rdata
) ));
1057 if(p
->out_data
.data_sent_length
>= prs_offset(&p
->out_data
.rdata
)) {
1059 * We have sent all possible data, return 0.
1066 * We need to create a new PDU from the data left in p->rdata.
1067 * Create the header/data/footers. This also sets up the fields
1068 * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length
1069 * and stores the outgoing PDU in p->current_pdu.
1072 if(!create_next_pdu(p
)) {
1073 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p
->name
));
1077 data_returned
= MIN(n
, p
->out_data
.current_pdu_len
);
1079 memcpy( data
, p
->out_data
.current_pdu
, (size_t)data_returned
);
1080 p
->out_data
.current_pdu_sent
+= (uint32
)data_returned
;
1084 (*is_data_outstanding
) = p
->out_data
.current_pdu_len
> n
;
1085 return data_returned
;
1088 /****************************************************************************
1089 Wait device state on a pipe. Exactly what this is for is unknown...
1090 ****************************************************************************/
1092 bool wait_rpc_pipe_hnd_state(smb_np_struct
*p
, uint16 priority
)
1099 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n",
1100 priority
, p
->name
));
1102 p
->priority
= priority
;
1107 DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n",
1108 priority
, p
->name
));
1113 /****************************************************************************
1114 Set device state on a pipe. Exactly what this is for is unknown...
1115 ****************************************************************************/
1117 bool set_rpc_pipe_hnd_state(smb_np_struct
*p
, uint16 device_state
)
1124 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n",
1125 device_state
, p
->name
));
1127 p
->device_state
= device_state
;
1132 DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n",
1133 device_state
, p
->name
));
1138 /****************************************************************************
1140 ****************************************************************************/
1142 bool close_rpc_pipe_hnd(smb_np_struct
*p
)
1145 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
1149 p
->namedpipe_close(p
->np_state
);
1151 bitmap_clear(bmap
, p
->pnum
- pipe_handle_offset
);
1155 DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
1156 p
->name
, p
->pnum
, pipes_open
));
1158 DLIST_REMOVE(Pipes
, p
);
1160 /* TODO: Remove from pipe open db */
1162 if ( !delete_pipe_opendb( p
) ) {
1163 DEBUG(3,("close_rpc_pipe_hnd: failed to delete %s "
1164 "pipe from open db.\n", p
->name
));
1172 /****************************************************************************
1173 Close all pipes on a connection.
1174 ****************************************************************************/
1176 void pipe_close_conn(connection_struct
*conn
)
1178 smb_np_struct
*p
, *next
;
1180 for (p
=Pipes
;p
;p
=next
) {
1182 if (p
->conn
== conn
) {
1183 close_rpc_pipe_hnd(p
);
1188 /****************************************************************************
1190 ****************************************************************************/
1192 static bool close_internal_rpc_pipe_hnd(void *np_conn
)
1194 pipes_struct
*p
= (pipes_struct
*)np_conn
;
1196 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
1200 prs_mem_free(&p
->out_data
.rdata
);
1201 prs_mem_free(&p
->in_data
.data
);
1203 if (p
->auth
.auth_data_free_func
) {
1204 (*p
->auth
.auth_data_free_func
)(&p
->auth
);
1208 talloc_destroy(p
->mem_ctx
);
1211 free_pipe_rpc_context( p
->contexts
);
1213 /* Free the handles database. */
1214 close_policy_by_pipe(p
);
1216 TALLOC_FREE(p
->pipe_user
.nt_user_token
);
1217 SAFE_FREE(p
->pipe_user
.ut
.groups
);
1219 DLIST_REMOVE(InternalPipes
, p
);
1228 /****************************************************************************
1229 Find an rpc pipe given a pipe handle in a buffer and an offset.
1230 ****************************************************************************/
1232 smb_np_struct
*get_rpc_pipe_p(uint16 pnum
)
1238 return get_rpc_pipe(pnum
);
1241 /****************************************************************************
1242 Find an rpc pipe given a pipe handle.
1243 ****************************************************************************/
1245 smb_np_struct
*get_rpc_pipe(int pnum
)
1249 DEBUG(4,("search for pipe pnum=%x\n", pnum
));
1251 for (p
=Pipes
;p
;p
=p
->next
) {
1252 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
1253 p
->name
, p
->pnum
, pipes_open
));
1256 for (p
=Pipes
;p
;p
=p
->next
) {
1257 if (p
->pnum
== pnum
) {