1/* 2 * Unix SMB/CIFS implementation. 3 * RPC Pipe client / server routines 4 * Copyright (C) Andrew Tridgell 1992-1998, 5 * Largely re-written : 2005 6 * Copyright (C) Jeremy Allison 1998 - 2005 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 21 */ 22 23#include "includes.h" 24 25#undef DBGC_CLASS 26#define DBGC_CLASS DBGC_RPC_SRV 27 28#define PIPE "\\PIPE\\" 29#define PIPELEN strlen(PIPE) 30 31static smb_np_struct *chain_p; 32static int pipes_open; 33 34/* 35 * Sometimes I can't decide if I hate Windows printer driver 36 * writers more than I hate the Windows spooler service driver 37 * writers. This gets around a combination of bugs in the spooler 38 * and the HP 8500 PCL driver that causes a spooler spin. JRA. 39 * 40 * bumped up from 20 -> 64 after viewing traffic from WordPerfect 41 * 2002 running on NT 4.- SP6 42 * bumped up from 64 -> 256 after viewing traffic from con2prt 43 * for lots of printers on a WinNT 4.x SP6 box. 44 */ 45 46#ifndef MAX_OPEN_SPOOLSS_PIPES 47#define MAX_OPEN_SPOOLSS_PIPES 256 48#endif 49static int current_spoolss_pipes_open; 50 51static smb_np_struct *Pipes; 52static pipes_struct *InternalPipes; 53static struct bitmap *bmap; 54 55/* TODO 56 * the following prototypes are declared here to avoid 57 * code being moved about too much for a patch to be 58 * disrupted / less obvious. 59 * 60 * these functions, and associated functions that they 61 * call, should be moved behind a .so module-loading 62 * system _anyway_. so that's the next step... 63 */ 64 65static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n, 66 BOOL *is_data_outstanding); 67static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n); 68static BOOL close_internal_rpc_pipe_hnd(void *np_conn); 69static void *make_internal_rpc_pipe_p(char *pipe_name, 70 connection_struct *conn, uint16 vuid); 71 72/**************************************************************************** 73 Pipe iterator functions. 74****************************************************************************/ 75 76smb_np_struct *get_first_pipe(void) 77{ 78 return Pipes; 79} 80 81smb_np_struct *get_next_pipe(smb_np_struct *p) 82{ 83 return p->next; 84} 85 86/**************************************************************************** 87 Internal Pipe iterator functions. 88****************************************************************************/ 89 90pipes_struct *get_first_internal_pipe(void) 91{ 92 return InternalPipes; 93} 94 95pipes_struct *get_next_internal_pipe(pipes_struct *p) 96{ 97 return p->next; 98} 99 100/* this must be larger than the sum of the open files and directories */ 101static int pipe_handle_offset; 102 103/**************************************************************************** 104 Set the pipe_handle_offset. Called from smbd/files.c 105****************************************************************************/ 106 107void set_pipe_handle_offset(int max_open_files) 108{ 109 if(max_open_files < 0x7000) { 110 pipe_handle_offset = 0x7000; 111 } else { 112 pipe_handle_offset = max_open_files + 10; /* For safety. :-) */ 113 } 114} 115 116/**************************************************************************** 117 Reset pipe chain handle number. 118****************************************************************************/ 119 120void reset_chain_p(void) 121{ 122 chain_p = NULL; 123} 124 125/**************************************************************************** 126 Initialise pipe handle states. 127****************************************************************************/ 128 129void init_rpc_pipe_hnd(void) 130{ 131 bmap = bitmap_allocate(MAX_OPEN_PIPES); 132 if (!bmap) { 133 exit_server("out of memory in init_rpc_pipe_hnd"); 134 } 135} 136 137/**************************************************************************** 138 Initialise an outgoing packet. 139****************************************************************************/ 140 141static BOOL pipe_init_outgoing_data(pipes_struct *p) 142{ 143 output_data *o_data = &p->out_data; 144 145 /* Reset the offset counters. */ 146 o_data->data_sent_length = 0; 147 o_data->current_pdu_len = 0; 148 o_data->current_pdu_sent = 0; 149 150 memset(o_data->current_pdu, '\0', sizeof(o_data->current_pdu)); 151 152 /* Free any memory in the current return data buffer. */ 153 prs_mem_free(&o_data->rdata); 154 155 /* 156 * Initialize the outgoing RPC data buffer. 157 * we will use this as the raw data area for replying to rpc requests. 158 */ 159 if(!prs_init(&o_data->rdata, RPC_MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) { 160 DEBUG(0,("pipe_init_outgoing_data: malloc fail.\n")); 161 return False; 162 } 163 164 return True; 165} 166 167/**************************************************************************** 168 Find first available pipe slot. 169****************************************************************************/ 170 171smb_np_struct *open_rpc_pipe_p(char *pipe_name, 172 connection_struct *conn, uint16 vuid) 173{ 174 int i; 175 smb_np_struct *p, *p_it; 176 static int next_pipe; 177 BOOL is_spoolss_pipe = False; 178 179 DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n", 180 pipe_name, pipes_open)); 181 182 if (strstr(pipe_name, "spoolss")) { 183 is_spoolss_pipe = True; 184 } 185 186 if (is_spoolss_pipe && current_spoolss_pipes_open >= MAX_OPEN_SPOOLSS_PIPES) { 187 DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n", 188 pipe_name )); 189 return NULL; 190 } 191 192 /* not repeating pipe numbers makes it easier to track things in 193 log files and prevents client bugs where pipe numbers are reused 194 over connection restarts */ 195 196 if (next_pipe == 0) { 197 next_pipe = (sys_getpid() ^ time(NULL)) % MAX_OPEN_PIPES; 198 } 199 200 i = bitmap_find(bmap, next_pipe); 201 202 if (i == -1) { 203 DEBUG(0,("ERROR! Out of pipe structures\n")); 204 return NULL; 205 } 206 207 next_pipe = (i+1) % MAX_OPEN_PIPES; 208 209 for (p = Pipes; p; p = p->next) { 210 DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum)); 211 } 212 213 p = SMB_MALLOC_P(smb_np_struct); 214 if (!p) { 215 DEBUG(0,("ERROR! no memory for pipes_struct!\n")); 216 return NULL; 217 } 218 219 ZERO_STRUCTP(p); 220 221 /* add a dso mechanism instead of this, here */ 222 223 p->namedpipe_create = make_internal_rpc_pipe_p; 224 p->namedpipe_read = read_from_internal_pipe; 225 p->namedpipe_write = write_to_internal_pipe; 226 p->namedpipe_close = close_internal_rpc_pipe_hnd; 227 228 p->np_state = p->namedpipe_create(pipe_name, conn, vuid); 229 230 if (p->np_state == NULL) { 231 DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n")); 232 SAFE_FREE(p); 233 return NULL; 234 } 235 236 DLIST_ADD(Pipes, p); 237 238 /* 239 * Initialize the incoming RPC data buffer with one PDU worth of memory. 240 * We cheat here and say we're marshalling, as we intend to add incoming 241 * data directly into the prs_struct and we want it to auto grow. We will 242 * change the type to UNMARSALLING before processing the stream. 243 */ 244 245 bitmap_set(bmap, i); 246 i += pipe_handle_offset; 247 248 pipes_open++; 249 250 p->pnum = i; 251 252 p->open = True; 253 p->device_state = 0; 254 p->priority = 0; 255 p->conn = conn; 256 p->vuid = vuid; 257 258 p->max_trans_reply = 0; 259 260 fstrcpy(p->name, pipe_name); 261 262 DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n", 263 pipe_name, i, pipes_open)); 264 265 chain_p = p; 266 267 /* Iterate over p_it as a temp variable, to display all open pipes */ 268 for (p_it = Pipes; p_it; p_it = p_it->next) { 269 DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum)); 270 } 271 272 return chain_p; 273} 274 275/**************************************************************************** 276 Make an internal namedpipes structure 277****************************************************************************/ 278 279static void *make_internal_rpc_pipe_p(char *pipe_name, 280 connection_struct *conn, uint16 vuid) 281{ 282 pipes_struct *p; 283 user_struct *vuser = get_valid_user_struct(vuid); 284 285 DEBUG(4,("Create pipe requested %s\n", pipe_name)); 286 287 if (!vuser && vuid != UID_FIELD_INVALID) { 288 DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid)); 289 return NULL; 290 } 291 292 p = SMB_MALLOC_P(pipes_struct); 293 294 if (!p) { 295 DEBUG(0,("ERROR! no memory for pipes_struct!\n")); 296 return NULL; 297 } 298 299 ZERO_STRUCTP(p); 300 301 if ((p->mem_ctx = talloc_init("pipe %s %p", pipe_name, p)) == NULL) { 302 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n")); 303 SAFE_FREE(p); 304 return NULL; 305 } 306 307 if ((p->pipe_state_mem_ctx = talloc_init("pipe_state %s %p", pipe_name, p)) == NULL) { 308 DEBUG(0,("open_rpc_pipe_p: talloc_init failed.\n")); 309 talloc_destroy(p->mem_ctx); 310 SAFE_FREE(p); 311 return NULL; 312 } 313 314 if (!init_pipe_handle_list(p, pipe_name)) { 315 DEBUG(0,("open_rpc_pipe_p: init_pipe_handles failed.\n")); 316 talloc_destroy(p->mem_ctx); 317 talloc_destroy(p->pipe_state_mem_ctx); 318 SAFE_FREE(p); 319 return NULL; 320 } 321 322 /* 323 * Initialize the incoming RPC data buffer with one PDU worth of memory. 324 * We cheat here and say we're marshalling, as we intend to add incoming 325 * data directly into the prs_struct and we want it to auto grow. We will 326 * change the type to UNMARSALLING before processing the stream. 327 */ 328 329 if(!prs_init(&p->in_data.data, RPC_MAX_PDU_FRAG_LEN, p->mem_ctx, MARSHALL)) { 330 DEBUG(0,("open_rpc_pipe_p: malloc fail for in_data struct.\n")); 331 talloc_destroy(p->mem_ctx); 332 talloc_destroy(p->pipe_state_mem_ctx); 333 close_policy_by_pipe(p); 334 SAFE_FREE(p); 335 return NULL; 336 } 337 338 DLIST_ADD(InternalPipes, p); 339 340 p->conn = conn; 341 342 p->vuid = vuid; 343 344 p->endian = RPC_LITTLE_ENDIAN; 345 346 ZERO_STRUCT(p->pipe_user); 347 348 p->pipe_user.ut.uid = (uid_t)-1; 349 p->pipe_user.ut.gid = (gid_t)-1; 350 351 /* Store the session key and NT_TOKEN */ 352 if (vuser) { 353 p->session_key = data_blob(vuser->session_key.data, vuser->session_key.length); 354 p->pipe_user.nt_user_token = dup_nt_token( 355 NULL, vuser->nt_user_token); 356 } 357 358 /* 359 * Initialize the outgoing RPC data buffer with no memory. 360 */ 361 prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL); 362 363 fstrcpy(p->name, pipe_name); 364 365 DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n", 366 pipe_name, pipes_open)); 367 368 return (void*)p; 369} 370 371/**************************************************************************** 372 Sets the fault state on incoming packets. 373****************************************************************************/ 374 375static void set_incoming_fault(pipes_struct *p) 376{ 377 prs_mem_free(&p->in_data.data); 378 p->in_data.pdu_needed_len = 0; 379 p->in_data.pdu_received_len = 0; 380 p->fault_state = True; 381 DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n", 382 p->name, p->vuid )); 383} 384 385/**************************************************************************** 386 Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer. 387****************************************************************************/ 388 389static ssize_t fill_rpc_header(pipes_struct *p, char *data, size_t data_to_copy) 390{ 391 size_t len_needed_to_complete_hdr = MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu_received_len); 392 393 DEBUG(10,("fill_rpc_header: data_to_copy = %u, len_needed_to_complete_hdr = %u, receive_len = %u\n", 394 (unsigned int)data_to_copy, (unsigned int)len_needed_to_complete_hdr, 395 (unsigned int)p->in_data.pdu_received_len )); 396 397 memcpy((char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, len_needed_to_complete_hdr); 398 p->in_data.pdu_received_len += len_needed_to_complete_hdr; 399 400 return (ssize_t)len_needed_to_complete_hdr; 401} 402 403/**************************************************************************** 404 Unmarshalls a new PDU header. Assumes the raw header data is in current_in_pdu. 405****************************************************************************/ 406 407static ssize_t unmarshall_rpc_header(pipes_struct *p) 408{ 409 /* 410 * Unmarshall the header to determine the needed length. 411 */ 412 413 prs_struct rpc_in; 414 415 if(p->in_data.pdu_received_len != RPC_HEADER_LEN) { 416 DEBUG(0,("unmarshall_rpc_header: assert on rpc header length failed.\n")); 417 set_incoming_fault(p); 418 return -1; 419 } 420 421 prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL); 422 prs_set_endian_data( &rpc_in, p->endian); 423 424 prs_give_memory( &rpc_in, (char *)&p->in_data.current_in_pdu[0], 425 p->in_data.pdu_received_len, False); 426 427 /* 428 * Unmarshall the header as this will tell us how much 429 * data we need to read to get the complete pdu. 430 * This also sets the endian flag in rpc_in. 431 */ 432 433 if(!smb_io_rpc_hdr("", &p->hdr, &rpc_in, 0)) { 434 DEBUG(0,("unmarshall_rpc_header: failed to unmarshall RPC_HDR.\n")); 435 set_incoming_fault(p); 436 prs_mem_free(&rpc_in); 437 return -1; 438 } 439 440 /* 441 * Validate the RPC header. 442 */ 443 444 if(p->hdr.major != 5 && p->hdr.minor != 0) { 445 DEBUG(0,("unmarshall_rpc_header: invalid major/minor numbers in RPC_HDR.\n")); 446 set_incoming_fault(p); 447 prs_mem_free(&rpc_in); 448 return -1; 449 } 450 451 /* 452 * If there's not data in the incoming buffer this should be the start of a new RPC. 453 */ 454 455 if(prs_offset(&p->in_data.data) == 0) { 456 457 /* 458 * AS/U doesn't set FIRST flag in a BIND packet it seems. 459 */ 460 461 if ((p->hdr.pkt_type == RPC_REQUEST) && !(p->hdr.flags & RPC_FLG_FIRST)) { 462 /* 463 * Ensure that the FIRST flag is set. If not then we have 464 * a stream missmatch. 465 */ 466 467 DEBUG(0,("unmarshall_rpc_header: FIRST flag not set in first PDU !\n")); 468 set_incoming_fault(p); 469 prs_mem_free(&rpc_in); 470 return -1; 471 } 472 473 /* 474 * If this is the first PDU then set the endianness 475 * flag in the pipe. We will need this when parsing all 476 * data in this RPC. 477 */ 478 479 p->endian = rpc_in.bigendian_data; 480 481 DEBUG(5,("unmarshall_rpc_header: using %sendian RPC\n", 482 p->endian == RPC_LITTLE_ENDIAN ? "little-" : "big-" )); 483 484 } else { 485 486 /* 487 * If this is *NOT* the first PDU then check the endianness 488 * flag in the pipe is the same as that in the PDU. 489 */ 490 491 if (p->endian != rpc_in.bigendian_data) { 492 DEBUG(0,("unmarshall_rpc_header: FIRST endianness flag (%d) different in next PDU !\n", (int)p->endian)); 493 set_incoming_fault(p); 494 prs_mem_free(&rpc_in); 495 return -1; 496 } 497 } 498 499 /* 500 * Ensure that the pdu length is sane. 501 */ 502 503 if((p->hdr.frag_len < RPC_HEADER_LEN) || (p->hdr.frag_len > RPC_MAX_PDU_FRAG_LEN)) { 504 DEBUG(0,("unmarshall_rpc_header: assert on frag length failed.\n")); 505 set_incoming_fault(p); 506 prs_mem_free(&rpc_in); 507 return -1; 508 } 509 510 DEBUG(10,("unmarshall_rpc_header: type = %u, flags = %u\n", (unsigned int)p->hdr.pkt_type, 511 (unsigned int)p->hdr.flags )); 512 513 p->in_data.pdu_needed_len = (uint32)p->hdr.frag_len - RPC_HEADER_LEN; 514 515 prs_mem_free(&rpc_in); 516 517 return 0; /* No extra data processed. */ 518} 519 520/**************************************************************************** 521 Call this to free any talloc'ed memory. Do this before and after processing 522 a complete PDU. 523****************************************************************************/ 524 525static void free_pipe_context(pipes_struct *p) 526{ 527 if (p->mem_ctx) { 528 DEBUG(3,("free_pipe_context: destroying talloc pool of size " 529 "%lu\n", (unsigned long)talloc_total_size(p->mem_ctx) )); 530 talloc_free_children(p->mem_ctx); 531 } else { 532 p->mem_ctx = talloc_init("pipe %s %p", p->name, p); 533 if (p->mem_ctx == NULL) { 534 p->fault_state = True; 535 } 536 } 537} 538 539/**************************************************************************** 540 Processes a request pdu. This will do auth processing if needed, and 541 appends the data into the complete stream if the LAST flag is not set. 542****************************************************************************/ 543 544static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p) 545{ 546 uint32 ss_padding_len = 0; 547 size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - 548 (p->hdr.auth_len ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len; 549 550 if(!p->pipe_bound) { 551 DEBUG(0,("process_request_pdu: rpc request with no bind.\n")); 552 set_incoming_fault(p); 553 return False; 554 } 555 556 /* 557 * Check if we need to do authentication processing. 558 * This is only done on requests, not binds. 559 */ 560 561 /* 562 * Read the RPC request header. 563 */ 564 565 if(!smb_io_rpc_hdr_req("req", &p->hdr_req, rpc_in_p, 0)) { 566 DEBUG(0,("process_request_pdu: failed to unmarshall RPC_HDR_REQ.\n")); 567 set_incoming_fault(p); 568 return False; 569 } 570 571 switch(p->auth.auth_type) { 572 case PIPE_AUTH_TYPE_NONE: 573 break; 574 575 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP: 576 case PIPE_AUTH_TYPE_NTLMSSP: 577 { 578 NTSTATUS status; 579 if(!api_pipe_ntlmssp_auth_process(p, rpc_in_p, &ss_padding_len, &status)) { 580 DEBUG(0,("process_request_pdu: failed to do auth processing.\n")); 581 DEBUG(0,("process_request_pdu: error was %s.\n", nt_errstr(status) )); 582 set_incoming_fault(p); 583 return False; 584 } 585 break; 586 } 587 588 case PIPE_AUTH_TYPE_SCHANNEL: 589 if (!api_pipe_schannel_process(p, rpc_in_p, &ss_padding_len)) { 590 DEBUG(3,("process_request_pdu: failed to do schannel processing.\n")); 591 set_incoming_fault(p); 592 return False; 593 } 594 break; 595 596 default: 597 DEBUG(0,("process_request_pdu: unknown auth type %u set.\n", (unsigned int)p->auth.auth_type )); 598 set_incoming_fault(p); 599 return False; 600 } 601 602 /* Now we've done the sign/seal we can remove any padding data. */ 603 if (data_len > ss_padding_len) { 604 data_len -= ss_padding_len; 605 } 606 607 /* 608 * Check the data length doesn't go over the 15Mb limit. 609 * increased after observing a bug in the Windows NT 4.0 SP6a 610 * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC 611 * will not fit in the initial buffer of size 0x1068 --jerry 22/01/2002 612 */ 613 614 if(prs_offset(&p->in_data.data) + data_len > 15*1024*1024) { 615 DEBUG(0,("process_request_pdu: rpc data buffer too large (%u) + (%u)\n", 616 (unsigned int)prs_data_size(&p->in_data.data), (unsigned int)data_len )); 617 set_incoming_fault(p); 618 return False; 619 } 620 621 /* 622 * Append the data portion into the buffer and return. 623 */ 624 625 if(!prs_append_some_prs_data(&p->in_data.data, rpc_in_p, prs_offset(rpc_in_p), data_len)) { 626 DEBUG(0,("process_request_pdu: Unable to append data size %u to parse buffer of size %u.\n", 627 (unsigned int)data_len, (unsigned int)prs_data_size(&p->in_data.data) )); 628 set_incoming_fault(p); 629 return False; 630 } 631 632 if(p->hdr.flags & RPC_FLG_LAST) { 633 BOOL ret = False; 634 /* 635 * Ok - we finally have a complete RPC stream. 636 * Call the rpc command to process it. 637 */ 638 639 /* 640 * Ensure the internal prs buffer size is *exactly* the same 641 * size as the current offset. 642 */ 643 644 if(!prs_set_buffer_size(&p->in_data.data, prs_offset(&p->in_data.data))) { 645 DEBUG(0,("process_request_pdu: Call to prs_set_buffer_size failed!\n")); 646 set_incoming_fault(p); 647 return False; 648 } 649 650 /* 651 * Set the parse offset to the start of the data and set the 652 * prs_struct to UNMARSHALL. 653 */ 654 655 prs_set_offset(&p->in_data.data, 0); 656 prs_switch_type(&p->in_data.data, UNMARSHALL); 657 658 /* 659 * Process the complete data stream here. 660 */ 661 662 free_pipe_context(p); 663 664 if(pipe_init_outgoing_data(p)) { 665 ret = api_pipe_request(p); 666 } 667 668 free_pipe_context(p); 669 670 /* 671 * We have consumed the whole data stream. Set back to 672 * marshalling and set the offset back to the start of 673 * the buffer to re-use it (we could also do a prs_mem_free() 674 * and then re_init on the next start of PDU. Not sure which 675 * is best here.... JRA. 676 */ 677 678 prs_switch_type(&p->in_data.data, MARSHALL); 679 prs_set_offset(&p->in_data.data, 0); 680 return ret; 681 } 682 683 return True; 684} 685 686/**************************************************************************** 687 Processes a finished PDU stored in current_in_pdu. The RPC_HEADER has 688 already been parsed and stored in p->hdr. 689****************************************************************************/ 690 691static void process_complete_pdu(pipes_struct *p) 692{ 693 prs_struct rpc_in; 694 size_t data_len = p->in_data.pdu_received_len - RPC_HEADER_LEN; 695 char *data_p = (char *)&p->in_data.current_in_pdu[RPC_HEADER_LEN]; 696 BOOL reply = False; 697 698 if(p->fault_state) { 699 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n", 700 p->name )); 701 set_incoming_fault(p); 702 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR)); 703 return; 704 } 705 706 prs_init( &rpc_in, 0, p->mem_ctx, UNMARSHALL); 707 708 /* 709 * Ensure we're using the corrent endianness for both the 710 * RPC header flags and the raw data we will be reading from. 711 */ 712 713 prs_set_endian_data( &rpc_in, p->endian); 714 prs_set_endian_data( &p->in_data.data, p->endian); 715 716 prs_give_memory( &rpc_in, data_p, (uint32)data_len, False); 717 718 DEBUG(10,("process_complete_pdu: processing packet type %u\n", 719 (unsigned int)p->hdr.pkt_type )); 720 721 switch (p->hdr.pkt_type) { 722 case RPC_REQUEST: 723 reply = process_request_pdu(p, &rpc_in); 724 break; 725 726 case RPC_PING: /* CL request - ignore... */ 727 DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n", 728 (unsigned int)p->hdr.pkt_type, p->name)); 729 break; 730 731 case RPC_RESPONSE: /* No responses here. */ 732 DEBUG(0,("process_complete_pdu: Error. RPC_RESPONSE received from client on pipe %s.\n", 733 p->name )); 734 break; 735 736 case RPC_FAULT: 737 case RPC_WORKING: /* CL request - reply to a ping when a call in process. */ 738 case RPC_NOCALL: /* CL - server reply to a ping call. */ 739 case RPC_REJECT: 740 case RPC_ACK: 741 case RPC_CL_CANCEL: 742 case RPC_FACK: 743 case RPC_CANCEL_ACK: 744 DEBUG(0,("process_complete_pdu: Error. Connectionless packet type %u received on pipe %s.\n", 745 (unsigned int)p->hdr.pkt_type, p->name)); 746 break; 747 748 case RPC_BIND: 749 /* 750 * We assume that a pipe bind is only in one pdu. 751 */ 752 if(pipe_init_outgoing_data(p)) { 753 reply = api_pipe_bind_req(p, &rpc_in); 754 } 755 break; 756 757 case RPC_BINDACK: 758 case RPC_BINDNACK: 759 DEBUG(0,("process_complete_pdu: Error. RPC_BINDACK/RPC_BINDNACK packet type %u received on pipe %s.\n", 760 (unsigned int)p->hdr.pkt_type, p->name)); 761 break; 762 763 764 case RPC_ALTCONT: 765 /* 766 * We assume that a pipe bind is only in one pdu. 767 */ 768 if(pipe_init_outgoing_data(p)) { 769 reply = api_pipe_alter_context(p, &rpc_in); 770 } 771 break; 772 773 case RPC_ALTCONTRESP: 774 DEBUG(0,("process_complete_pdu: Error. RPC_ALTCONTRESP on pipe %s: Should only be server -> client.\n", 775 p->name)); 776 break; 777 778 case RPC_AUTH3: 779 /* 780 * The third packet in an NTLMSSP auth exchange. 781 */ 782 if(pipe_init_outgoing_data(p)) { 783 reply = api_pipe_bind_auth3(p, &rpc_in); 784 } 785 break; 786 787 case RPC_SHUTDOWN: 788 DEBUG(0,("process_complete_pdu: Error. RPC_SHUTDOWN on pipe %s: Should only be server -> client.\n", 789 p->name)); 790 break; 791 792 case RPC_CO_CANCEL: 793 /* For now just free all client data and continue processing. */ 794 DEBUG(3,("process_complete_pdu: RPC_ORPHANED. Abandoning rpc call.\n")); 795 /* As we never do asynchronous RPC serving, we can never cancel a 796 call (as far as I know). If we ever did we'd have to send a cancel_ack 797 reply. For now, just free all client data and continue processing. */ 798 reply = True; 799 break; 800#if 0 801 /* Enable this if we're doing async rpc. */ 802 /* We must check the call-id matches the outstanding callid. */ 803 if(pipe_init_outgoing_data(p)) { 804 /* Send a cancel_ack PDU reply. */ 805 /* We should probably check the auth-verifier here. */ 806 reply = setup_cancel_ack_reply(p, &rpc_in); 807 } 808 break; 809#endif 810 811 case RPC_ORPHANED: 812 /* We should probably check the auth-verifier here. 813 For now just free all client data and continue processing. */ 814 DEBUG(3,("process_complete_pdu: RPC_ORPHANED. Abandoning rpc call.\n")); 815 reply = True; 816 break; 817 818 default: 819 DEBUG(0,("process_complete_pdu: Unknown rpc type = %u received.\n", (unsigned int)p->hdr.pkt_type )); 820 break; 821 } 822 823 /* Reset to little endian. Probably don't need this but it won't hurt. */ 824 prs_set_endian_data( &p->in_data.data, RPC_LITTLE_ENDIAN); 825 826 if (!reply) { 827 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on pipe %s\n", p->pipe_srv_name)); 828 set_incoming_fault(p); 829 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR)); 830 prs_mem_free(&rpc_in); 831 } else { 832 /* 833 * Reset the lengths. We're ready for a new pdu. 834 */ 835 p->in_data.pdu_needed_len = 0; 836 p->in_data.pdu_received_len = 0; 837 } 838 839 prs_mem_free(&rpc_in); 840} 841 842/**************************************************************************** 843 Accepts incoming data on an rpc pipe. Processes the data in pdu sized units. 844****************************************************************************/ 845 846static ssize_t process_incoming_data(pipes_struct *p, char *data, size_t n) 847{ 848 size_t data_to_copy = MIN(n, RPC_MAX_PDU_FRAG_LEN - p->in_data.pdu_received_len); 849 850 DEBUG(10,("process_incoming_data: Start: pdu_received_len = %u, pdu_needed_len = %u, incoming data = %u\n", 851 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len, 852 (unsigned int)n )); 853 854 if(data_to_copy == 0) { 855 /* 856 * This is an error - data is being received and there is no 857 * space in the PDU. Free the received data and go into the fault state. 858 */ 859 DEBUG(0,("process_incoming_data: No space in incoming pdu buffer. Current size = %u \ 860incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned int)n )); 861 set_incoming_fault(p); 862 return -1; 863 } 864 865 /* 866 * If we have no data already, wait until we get at least a RPC_HEADER_LEN 867 * number of bytes before we can do anything. 868 */ 869 870 if((p->in_data.pdu_needed_len == 0) && (p->in_data.pdu_received_len < RPC_HEADER_LEN)) { 871 /* 872 * Always return here. If we have more data then the RPC_HEADER 873 * will be processed the next time around the loop. 874 */ 875 return fill_rpc_header(p, data, data_to_copy); 876 } 877 878 /* 879 * At this point we know we have at least an RPC_HEADER_LEN amount of data 880 * stored in current_in_pdu. 881 */ 882 883 /* 884 * If pdu_needed_len is zero this is a new pdu. 885 * Unmarshall the header so we know how much more 886 * data we need, then loop again. 887 */ 888 889 if(p->in_data.pdu_needed_len == 0) { 890 ssize_t rret = unmarshall_rpc_header(p); 891 if (rret == -1 || p->in_data.pdu_needed_len > 0) { 892 return rret; 893 } 894 /* If rret == 0 and pdu_needed_len == 0 here we have a PDU that consists 895 of an RPC_HEADER only. This is a RPC_SHUTDOWN, RPC_CO_CANCEL or RPC_ORPHANED 896 pdu type. Deal with this in process_complete_pdu(). */ 897 } 898 899 /* 900 * Ok - at this point we have a valid RPC_HEADER in p->hdr. 901 * Keep reading until we have a full pdu. 902 */ 903 904 data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len); 905 906 /* 907 * Copy as much of the data as we need into the current_in_pdu buffer. 908 * pdu_needed_len becomes zero when we have a complete pdu. 909 */ 910 911 memcpy( (char *)&p->in_data.current_in_pdu[p->in_data.pdu_received_len], data, data_to_copy); 912 p->in_data.pdu_received_len += data_to_copy; 913 p->in_data.pdu_needed_len -= data_to_copy; 914 915 /* 916 * Do we have a complete PDU ? 917 * (return the number of bytes handled in the call) 918 */ 919 920 if(p->in_data.pdu_needed_len == 0) { 921 process_complete_pdu(p); 922 return data_to_copy; 923 } 924 925 DEBUG(10,("process_incoming_data: not a complete PDU yet. pdu_received_len = %u, pdu_needed_len = %u\n", 926 (unsigned int)p->in_data.pdu_received_len, (unsigned int)p->in_data.pdu_needed_len )); 927 928 return (ssize_t)data_to_copy; 929} 930 931/**************************************************************************** 932 Accepts incoming data on an rpc pipe. 933****************************************************************************/ 934 935ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n) 936{ 937 DEBUG(6,("write_to_pipe: %x", p->pnum)); 938 939 DEBUG(6,(" name: %s open: %s len: %d\n", 940 p->name, BOOLSTR(p->open), (int)n)); 941 942 dump_data(50, data, n); 943 944 return p->namedpipe_write(p->np_state, data, n); 945} 946 947/**************************************************************************** 948 Accepts incoming data on an internal rpc pipe. 949****************************************************************************/ 950 951static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n) 952{ 953 pipes_struct *p = (pipes_struct*)np_conn; 954 size_t data_left = n; 955 956 while(data_left) { 957 ssize_t data_used; 958 959 DEBUG(10,("write_to_pipe: data_left = %u\n", (unsigned int)data_left )); 960 961 data_used = process_incoming_data(p, data, data_left); 962 963 DEBUG(10,("write_to_pipe: data_used = %d\n", (int)data_used )); 964 965 if(data_used < 0) { 966 return -1; 967 } 968 969 data_left -= data_used; 970 data += data_used; 971 } 972 973 return n; 974} 975 976/**************************************************************************** 977 Replies to a request to read data from a pipe. 978 979 Headers are interspersed with the data at PDU intervals. By the time 980 this function is called, the start of the data could possibly have been 981 read by an SMBtrans (file_offset != 0). 982 983 Calling create_rpc_reply() here is a hack. The data should already 984 have been prepared into arrays of headers + data stream sections. 985****************************************************************************/ 986 987ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n, 988 BOOL *is_data_outstanding) 989{ 990 if (!p || !p->open) { 991 DEBUG(0,("read_from_pipe: pipe not open\n")); 992 return -1; 993 } 994 995 DEBUG(6,("read_from_pipe: %x", p->pnum)); 996 997 return p->namedpipe_read(p->np_state, data, n, is_data_outstanding); 998} 999 1000/**************************************************************************** 1001 Replies to a request to read data from a pipe. 1002 1003 Headers are interspersed with the data at PDU intervals. By the time 1004 this function is called, the start of the data could possibly have been 1005 read by an SMBtrans (file_offset != 0). 1006 1007 Calling create_rpc_reply() here is a hack. The data should already 1008 have been prepared into arrays of headers + data stream sections. 1009****************************************************************************/ 1010 1011static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n, 1012 BOOL *is_data_outstanding) 1013{ 1014 pipes_struct *p = (pipes_struct*)np_conn; 1015 uint32 pdu_remaining = 0; 1016 ssize_t data_returned = 0; 1017 1018 if (!p) { 1019 DEBUG(0,("read_from_pipe: pipe not open\n")); 1020 return -1; 1021 } 1022 1023 DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n)); 1024 1025 /* 1026 * We cannot return more than one PDU length per 1027 * read request. 1028 */ 1029 1030 /* 1031 * This condition should result in the connection being closed. 1032 * Netapp filers seem to set it to 0xffff which results in domain 1033 * authentications failing. Just ignore it so things work. 1034 */ 1035 1036 if(n > RPC_MAX_PDU_FRAG_LEN) { 1037 DEBUG(5,("read_from_pipe: too large read (%u) requested on \ 1038pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, RPC_MAX_PDU_FRAG_LEN )); 1039 } 1040 1041 /* 1042 * Determine if there is still data to send in the 1043 * pipe PDU buffer. Always send this first. Never 1044 * send more than is left in the current PDU. The 1045 * client should send a new read request for a new 1046 * PDU. 1047 */ 1048 1049 if((pdu_remaining = p->out_data.current_pdu_len - p->out_data.current_pdu_sent) > 0) { 1050 data_returned = (ssize_t)MIN(n, pdu_remaining); 1051 1052 DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, current_pdu_sent = %u \ 1053returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len, 1054 (unsigned int)p->out_data.current_pdu_sent, (int)data_returned)); 1055 1056 memcpy( data, &p->out_data.current_pdu[p->out_data.current_pdu_sent], (size_t)data_returned); 1057 p->out_data.current_pdu_sent += (uint32)data_returned; 1058 goto out; 1059 } 1060 1061 /* 1062 * At this point p->current_pdu_len == p->current_pdu_sent (which 1063 * may of course be zero if this is the first return fragment. 1064 */ 1065 1066 DEBUG(10,("read_from_pipe: %s: fault_state = %d : data_sent_length \ 1067= %u, prs_offset(&p->out_data.rdata) = %u.\n", 1068 p->name, (int)p->fault_state, (unsigned int)p->out_data.data_sent_length, (unsigned int)prs_offset(&p->out_data.rdata) )); 1069 1070 if(p->out_data.data_sent_length >= prs_offset(&p->out_data.rdata)) { 1071 /* 1072 * We have sent all possible data, return 0. 1073 */ 1074 data_returned = 0; 1075 goto out; 1076 } 1077 1078 /* 1079 * We need to create a new PDU from the data left in p->rdata. 1080 * Create the header/data/footers. This also sets up the fields 1081 * p->current_pdu_len, p->current_pdu_sent, p->data_sent_length 1082 * and stores the outgoing PDU in p->current_pdu. 1083 */ 1084 1085 if(!create_next_pdu(p)) { 1086 DEBUG(0,("read_from_pipe: %s: create_next_pdu failed.\n", p->name)); 1087 return -1; 1088 } 1089 1090 data_returned = MIN(n, p->out_data.current_pdu_len); 1091 1092 memcpy( data, p->out_data.current_pdu, (size_t)data_returned); 1093 p->out_data.current_pdu_sent += (uint32)data_returned; 1094 1095 out: 1096 1097 (*is_data_outstanding) = p->out_data.current_pdu_len > n; 1098 return data_returned; 1099} 1100 1101/**************************************************************************** 1102 Wait device state on a pipe. Exactly what this is for is unknown... 1103****************************************************************************/ 1104 1105BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority) 1106{ 1107 if (p == NULL) { 1108 return False; 1109 } 1110 1111 if (p->open) { 1112 DEBUG(3,("wait_rpc_pipe_hnd_state: Setting pipe wait state priority=%x on pipe (name=%s)\n", 1113 priority, p->name)); 1114 1115 p->priority = priority; 1116 1117 return True; 1118 } 1119 1120 DEBUG(3,("wait_rpc_pipe_hnd_state: Error setting pipe wait state priority=%x (name=%s)\n", 1121 priority, p->name)); 1122 return False; 1123} 1124 1125 1126/**************************************************************************** 1127 Set device state on a pipe. Exactly what this is for is unknown... 1128****************************************************************************/ 1129 1130BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state) 1131{ 1132 if (p == NULL) { 1133 return False; 1134 } 1135 1136 if (p->open) { 1137 DEBUG(3,("set_rpc_pipe_hnd_state: Setting pipe device state=%x on pipe (name=%s)\n", 1138 device_state, p->name)); 1139 1140 p->device_state = device_state; 1141 1142 return True; 1143 } 1144 1145 DEBUG(3,("set_rpc_pipe_hnd_state: Error setting pipe device state=%x (name=%s)\n", 1146 device_state, p->name)); 1147 return False; 1148} 1149 1150 1151/**************************************************************************** 1152 Close an rpc pipe. 1153****************************************************************************/ 1154 1155BOOL close_rpc_pipe_hnd(smb_np_struct *p) 1156{ 1157 if (!p) { 1158 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n")); 1159 return False; 1160 } 1161 1162 p->namedpipe_close(p->np_state); 1163 1164 bitmap_clear(bmap, p->pnum - pipe_handle_offset); 1165 1166 pipes_open--; 1167 1168 DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n", 1169 p->name, p->pnum, pipes_open)); 1170 1171 DLIST_REMOVE(Pipes, p); 1172 1173 /* Remove from pipe open db */ 1174 1175 if ( !delete_pipe_opendb( p ) ) { 1176 DEBUG(3,("close_rpc_pipe_hnd: failed to delete %s " 1177 "pipe from open db.\n", p->name)); 1178 } 1179 1180 ZERO_STRUCTP(p); 1181 1182 SAFE_FREE(p); 1183 1184 return True; 1185} 1186 1187/**************************************************************************** 1188 Close all pipes on a connection. 1189****************************************************************************/ 1190 1191void pipe_close_conn(connection_struct *conn) 1192{ 1193 smb_np_struct *p, *next; 1194 1195 for (p=Pipes;p;p=next) { 1196 next = p->next; 1197 if (p->conn == conn) { 1198 close_rpc_pipe_hnd(p); 1199 } 1200 } 1201} 1202 1203/**************************************************************************** 1204 Close an rpc pipe. 1205****************************************************************************/ 1206 1207static BOOL close_internal_rpc_pipe_hnd(void *np_conn) 1208{ 1209 pipes_struct *p = (pipes_struct *)np_conn; 1210 if (!p) { 1211 DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n")); 1212 return False; 1213 } 1214 1215 prs_mem_free(&p->out_data.rdata); 1216 prs_mem_free(&p->in_data.data); 1217 1218 if (p->auth.auth_data_free_func) { 1219 (*p->auth.auth_data_free_func)(&p->auth); 1220 } 1221 1222 if (p->mem_ctx) { 1223 talloc_destroy(p->mem_ctx); 1224 } 1225 1226 if (p->pipe_state_mem_ctx) { 1227 talloc_destroy(p->pipe_state_mem_ctx); 1228 } 1229 1230 free_pipe_rpc_context( p->contexts ); 1231 1232 /* Free the handles database. */ 1233 close_policy_by_pipe(p); 1234 1235 TALLOC_FREE(p->pipe_user.nt_user_token); 1236 data_blob_free(&p->session_key); 1237 SAFE_FREE(p->pipe_user.ut.groups); 1238 1239 DLIST_REMOVE(InternalPipes, p); 1240 1241 ZERO_STRUCTP(p); 1242 1243 SAFE_FREE(p); 1244 1245 return True; 1246} 1247 1248/**************************************************************************** 1249 Find an rpc pipe given a pipe handle in a buffer and an offset. 1250****************************************************************************/ 1251 1252smb_np_struct *get_rpc_pipe_p(char *buf, int where) 1253{ 1254 int pnum = SVAL(buf,where); 1255 1256 if (chain_p) { 1257 return chain_p; 1258 } 1259 1260 return get_rpc_pipe(pnum); 1261} 1262 1263/**************************************************************************** 1264 Find an rpc pipe given a pipe handle. 1265****************************************************************************/ 1266 1267smb_np_struct *get_rpc_pipe(int pnum) 1268{ 1269 smb_np_struct *p; 1270 1271 DEBUG(4,("search for pipe pnum=%x\n", pnum)); 1272 1273 for (p=Pipes;p;p=p->next) { 1274 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n", 1275 p->name, p->pnum, pipes_open)); 1276 } 1277 1278 for (p=Pipes;p;p=p->next) { 1279 if (p->pnum == pnum) { 1280 chain_p = p; 1281 return p; 1282 } 1283 } 1284 1285 return NULL; 1286} 1287