[SCM] Samba Shared Repository - branch master updated
Stefan Metzmacher
metze at samba.org
Wed Dec 11 14:25:04 MST 2013
The branch, master has been updated
via 646d8c2 s3/rpc_server: don't unmarshall PDUs twice
from 27baff0 shadow_copy2: add a comment explaining why we don't talloc_zero_array().
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 646d8c26f82ce3a70b189f618979f63448658c4c
Author: David Disseldorp <ddiss at samba.org>
Date: Tue Dec 10 13:59:06 2013 +0100
s3/rpc_server: don't unmarshall PDUs twice
DCE/RPC PDUs are currently unmarshalled firstly by the generic librpc
dcerpc_read_ncacn_packet_[send/recv] functions, and subsequently a
second time by the source3 rpc_server, which ignores the unmarshalled
packet and re-parses the receive buffer.
Signed-off-by: David Disseldorp <ddiss at samba.org>
Reviewed-by: Stefan Metzmacher <metze at samba.org>
Autobuild-User(master): Stefan Metzmacher <metze at samba.org>
Autobuild-Date(master): Wed Dec 11 22:24:31 CET 2013 on sn-devel-104
-----------------------------------------------------------------------
Summary of changes:
source3/rpc_server/rpc_server.c | 59 +++----
source3/rpc_server/rpc_server.h | 2 +-
source3/rpc_server/srv_pipe.c | 52 +-----
source3/rpc_server/srv_pipe_hnd.c | 366 -------------------------------------
source3/rpc_server/srv_pipe_hnd.h | 2 -
5 files changed, 28 insertions(+), 453 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/rpc_server/rpc_server.c b/source3/rpc_server/rpc_server.c
index f283559..d10d3ac 100644
--- a/source3/rpc_server/rpc_server.c
+++ b/source3/rpc_server/rpc_server.c
@@ -432,9 +432,6 @@ void named_pipe_packet_process(struct tevent_req *subreq)
DATA_BLOB recv_buffer = data_blob_null;
struct ncacn_packet *pkt;
NTSTATUS status;
- ssize_t data_left;
- ssize_t data_used;
- char *data;
uint32_t to_send;
size_t i;
bool ok;
@@ -445,23 +442,20 @@ void named_pipe_packet_process(struct tevent_req *subreq)
goto fail;
}
- data_left = recv_buffer.length;
- data = (char *)recv_buffer.data;
-
- while (data_left) {
-
- data_used = process_incoming_data(npc->p, data, data_left);
- if (data_used < 0) {
- DEBUG(3, ("Failed to process dceprc request!\n"));
- status = NT_STATUS_UNEXPECTED_IO_ERROR;
- goto fail;
- }
-
- data_left -= data_used;
- data += data_used;
+ /* dcerpc_read_ncacn_packet_recv() returns a full PDU */
+ npc->p->in_data.pdu_needed_len = 0;
+ npc->p->in_data.pdu = recv_buffer;
+ if (dcerpc_get_endian_flag(&recv_buffer) & DCERPC_DREP_LE) {
+ npc->p->endian = RPC_LITTLE_ENDIAN;
+ } else {
+ npc->p->endian = RPC_BIG_ENDIAN;
}
+ DEBUG(10, ("PDU is in %s Endian format!\n",
+ npc->p->endian ? "Big" : "Little"));
+ process_complete_pdu(npc->p, pkt);
- /* Do not leak this buffer, npc is a long lived context */
+ /* reset pipe state and free PDU */
+ npc->p->in_data.pdu.length = 0;
talloc_free(recv_buffer.data);
talloc_free(pkt);
@@ -1134,10 +1128,7 @@ static void dcerpc_ncacn_packet_process(struct tevent_req *subreq)
struct _output_data *out = &ncacn_conn->p->out_data;
DATA_BLOB recv_buffer = data_blob_null;
struct ncacn_packet *pkt;
- ssize_t data_left;
- ssize_t data_used;
uint32_t to_send;
- char *data;
NTSTATUS status;
bool ok;
@@ -1153,22 +1144,20 @@ static void dcerpc_ncacn_packet_process(struct tevent_req *subreq)
goto fail;
}
- data_left = recv_buffer.length;
- data = (char *) recv_buffer.data;
-
- while (data_left) {
- data_used = process_incoming_data(ncacn_conn->p, data, data_left);
- if (data_used < 0) {
- DEBUG(3, ("Failed to process dcerpc request!\n"));
- status = NT_STATUS_UNEXPECTED_IO_ERROR;
- goto fail;
- }
-
- data_left -= data_used;
- data += data_used;
+ /* dcerpc_read_ncacn_packet_recv() returns a full PDU */
+ ncacn_conn->p->in_data.pdu_needed_len = 0;
+ ncacn_conn->p->in_data.pdu = recv_buffer;
+ if (dcerpc_get_endian_flag(&recv_buffer) & DCERPC_DREP_LE) {
+ ncacn_conn->p->endian = RPC_LITTLE_ENDIAN;
+ } else {
+ ncacn_conn->p->endian = RPC_BIG_ENDIAN;
}
+ DEBUG(10, ("PDU is in %s Endian format!\n",
+ ncacn_conn->p->endian ? "Big" : "Little"));
+ process_complete_pdu(ncacn_conn->p, pkt);
- /* Do not leak this buffer */
+ /* reset pipe state and free PDU */
+ ncacn_conn->p->in_data.pdu.length = 0;
talloc_free(recv_buffer.data);
talloc_free(pkt);
diff --git a/source3/rpc_server/rpc_server.h b/source3/rpc_server/rpc_server.h
index d204a8b..0d7bdb5 100644
--- a/source3/rpc_server/rpc_server.h
+++ b/source3/rpc_server/rpc_server.h
@@ -77,7 +77,7 @@ int make_server_pipes_struct(TALLOC_CTX *mem_ctx,
int *perrno);
void set_incoming_fault(struct pipes_struct *p);
-void process_complete_pdu(struct pipes_struct *p);
+void process_complete_pdu(struct pipes_struct *p, struct ncacn_packet *pkt);
int create_named_pipe_socket(const char *pipe_name);
bool setup_named_pipe_socket(const char *pipe_name,
struct tevent_context *ev_ctx,
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index f92de3b..8f30386 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -1486,45 +1486,9 @@ static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt
return True;
}
-/****************************************************************************
- Processes a finished PDU stored in p->in_data.pdu.
-****************************************************************************/
-
-void process_complete_pdu(struct pipes_struct *p)
+void process_complete_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
{
- struct ncacn_packet *pkt = NULL;
- NTSTATUS status;
- bool reply = False;
-
- if(p->fault_state) {
- DEBUG(10,("RPC connection in fault state.\n"));
- goto done;
- }
-
- pkt = talloc(p->mem_ctx, struct ncacn_packet);
- if (!pkt) {
- DEBUG(0, ("Out of memory!\n"));
- goto done;
- }
-
- /*
- * Ensure we're using the corrent endianness for both the
- * RPC header flags and the raw data we will be reading from.
- */
- if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
- p->endian = RPC_LITTLE_ENDIAN;
- } else {
- p->endian = RPC_BIG_ENDIAN;
- }
- DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
-
- status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
- pkt, p->endian);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
- nt_errstr(status)));
- goto done;
- }
+ bool reply = false;
/* Store the call_id */
p->call_id = pkt->call_id;
@@ -1644,21 +1608,11 @@ void process_complete_pdu(struct pipes_struct *p)
break;
}
-done:
if (!reply) {
DEBUG(3,("DCE/RPC fault sent!"));
set_incoming_fault(p);
setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
- TALLOC_FREE(pkt);
- } else {
- /*
- * Reset the lengths. We're ready for a new pdu.
- */
- TALLOC_FREE(p->in_data.pdu.data);
- p->in_data.pdu_needed_len = 0;
- p->in_data.pdu.length = 0;
}
-
- TALLOC_FREE(pkt);
+ /* pkt and p->in_data.pdu.data freed by caller */
}
diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c
index a95aa06..a05fafd 100644
--- a/source3/rpc_server/srv_pipe_hnd.c
+++ b/source3/rpc_server/srv_pipe_hnd.c
@@ -35,372 +35,6 @@
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_RPC_SRV
-/****************************************************************************
- Ensures we have at least RPC_HEADER_LEN amount of data in the incoming buffer.
-****************************************************************************/
-
-static ssize_t fill_rpc_header(struct pipes_struct *p, const char *data, size_t data_to_copy)
-{
- size_t len_needed_to_complete_hdr =
- MIN(data_to_copy, RPC_HEADER_LEN - p->in_data.pdu.length);
-
- DEBUG(10, ("fill_rpc_header: data_to_copy = %u, "
- "len_needed_to_complete_hdr = %u, "
- "receive_len = %u\n",
- (unsigned int)data_to_copy,
- (unsigned int)len_needed_to_complete_hdr,
- (unsigned int)p->in_data.pdu.length ));
-
- if (p->in_data.pdu.data == NULL) {
- p->in_data.pdu.data = talloc_array(p, uint8_t, RPC_HEADER_LEN);
- }
- if (p->in_data.pdu.data == NULL) {
- DEBUG(0, ("talloc failed\n"));
- return -1;
- }
-
- memcpy((char *)&p->in_data.pdu.data[p->in_data.pdu.length],
- data, len_needed_to_complete_hdr);
- p->in_data.pdu.length += len_needed_to_complete_hdr;
-
- return (ssize_t)len_needed_to_complete_hdr;
-}
-
-static bool get_pdu_size(struct pipes_struct *p)
-{
- uint16_t frag_len;
- /* the fill_rpc_header() call insures we copy only
- * RPC_HEADER_LEN bytes. If this doesn't match then
- * somethign is very wrong and we can only abort */
- if (p->in_data.pdu.length != RPC_HEADER_LEN) {
- DEBUG(0, ("Unexpected RPC Header size! "
- "got %d, expected %d)\n",
- (int)p->in_data.pdu.length,
- RPC_HEADER_LEN));
- set_incoming_fault(p);
- return false;
- }
-
- frag_len = dcerpc_get_frag_length(&p->in_data.pdu);
-
- /* verify it is a reasonable value */
- if ((frag_len < RPC_HEADER_LEN) ||
- (frag_len > RPC_MAX_PDU_FRAG_LEN)) {
- DEBUG(0, ("Unexpected RPC Fragment size! (%d)\n",
- frag_len));
- set_incoming_fault(p);
- return false;
- }
-
- p->in_data.pdu_needed_len = frag_len - RPC_HEADER_LEN;
-
- /* allocate the space needed to fill the pdu */
- p->in_data.pdu.data = talloc_realloc(p, p->in_data.pdu.data,
- uint8_t, frag_len);
- if (p->in_data.pdu.data == NULL) {
- DEBUG(0, ("talloc_realloc failed\n"));
- set_incoming_fault(p);
- return false;
- }
-
- return true;
-}
-
-/****************************************************************************
- Call this to free any talloc'ed memory. Do this after processing
- a complete incoming and outgoing request (multiple incoming/outgoing
- PDU's).
-****************************************************************************/
-
-static void free_pipe_context(struct pipes_struct *p)
-{
- data_blob_free(&p->out_data.frag);
- data_blob_free(&p->out_data.rdata);
- data_blob_free(&p->in_data.data);
-
- DEBUG(3, ("free_pipe_context: "
- "destroying talloc pool of size %lu\n",
- (unsigned long)talloc_total_size(p->mem_ctx)));
- talloc_free_children(p->mem_ctx);
-}
-
-/****************************************************************************
- Accepts incoming data on an rpc pipe. Processes the data in pdu sized units.
-****************************************************************************/
-
-ssize_t process_incoming_data(struct pipes_struct *p, const char *data, size_t n)
-{
- size_t data_to_copy = MIN(n, RPC_MAX_PDU_FRAG_LEN
- - p->in_data.pdu.length);
-
- DEBUG(10, ("process_incoming_data: Start: pdu.length = %u, "
- "pdu_needed_len = %u, incoming data = %u\n",
- (unsigned int)p->in_data.pdu.length,
- (unsigned int)p->in_data.pdu_needed_len,
- (unsigned int)n ));
-
- if(data_to_copy == 0) {
- /*
- * This is an error - data is being received and there is no
- * space in the PDU. Free the received data and go into the
- * fault state.
- */
- DEBUG(0, ("process_incoming_data: "
- "No space in incoming pdu buffer. "
- "Current size = %u incoming data size = %u\n",
- (unsigned int)p->in_data.pdu.length,
- (unsigned int)n));
- set_incoming_fault(p);
- return -1;
- }
-
- /*
- * If we have no data already, wait until we get at least
- * a RPC_HEADER_LEN * number of bytes before we can do anything.
- */
-
- if ((p->in_data.pdu_needed_len == 0) &&
- (p->in_data.pdu.length < RPC_HEADER_LEN)) {
- /*
- * Always return here. If we have more data then the RPC_HEADER
- * will be processed the next time around the loop.
- */
- return fill_rpc_header(p, data, data_to_copy);
- }
-
- /*
- * At this point we know we have at least an RPC_HEADER_LEN amount of
- * data stored in p->in_data.pdu.
- */
-
- /*
- * If pdu_needed_len is zero this is a new pdu.
- * Check how much more data we need, then loop again.
- */
- if (p->in_data.pdu_needed_len == 0) {
-
- bool ok = get_pdu_size(p);
- if (!ok) {
- return -1;
- }
- if (p->in_data.pdu_needed_len > 0) {
- return 0;
- }
-
- /* If rret == 0 and pdu_needed_len == 0 here we have a PDU
- * that consists of an RPC_HEADER only. This is a
- * DCERPC_PKT_SHUTDOWN, DCERPC_PKT_CO_CANCEL or
- * DCERPC_PKT_ORPHANED pdu type.
- * Deal with this in process_complete_pdu(). */
- }
-
- /*
- * Ok - at this point we have a valid RPC_HEADER.
- * Keep reading until we have a full pdu.
- */
-
- data_to_copy = MIN(data_to_copy, p->in_data.pdu_needed_len);
-
- /*
- * Copy as much of the data as we need into the p->in_data.pdu buffer.
- * pdu_needed_len becomes zero when we have a complete pdu.
- */
-
- memcpy((char *)&p->in_data.pdu.data[p->in_data.pdu.length],
- data, data_to_copy);
- p->in_data.pdu.length += data_to_copy;
- p->in_data.pdu_needed_len -= data_to_copy;
-
- /*
- * Do we have a complete PDU ?
- * (return the number of bytes handled in the call)
- */
-
- if(p->in_data.pdu_needed_len == 0) {
- process_complete_pdu(p);
- return data_to_copy;
- }
-
- DEBUG(10, ("process_incoming_data: not a complete PDU yet. "
- "pdu.length = %u, pdu_needed_len = %u\n",
- (unsigned int)p->in_data.pdu.length,
- (unsigned int)p->in_data.pdu_needed_len));
-
- return (ssize_t)data_to_copy;
-}
-
-/****************************************************************************
- Accepts incoming data on an internal rpc pipe.
-****************************************************************************/
-
-static ssize_t write_to_internal_pipe(struct pipes_struct *p, const char *data, size_t n)
-{
- size_t data_left = n;
-
- while(data_left) {
- ssize_t data_used;
-
- DEBUG(10, ("write_to_pipe: data_left = %u\n",
- (unsigned int)data_left));
-
- data_used = process_incoming_data(p, data, data_left);
-
- DEBUG(10, ("write_to_pipe: data_used = %d\n",
- (int)data_used));
-
- if(data_used < 0) {
- return -1;
- }
-
- data_left -= data_used;
- data += data_used;
- }
-
- return n;
-}
-
-/****************************************************************************
- Replies to a request to read data from a pipe.
-
- Headers are interspersed with the data at PDU intervals. By the time
- this function is called, the start of the data could possibly have been
- read by an SMBtrans (file_offset != 0).
-
- Calling create_rpc_reply() here is a hack. The data should already
- have been prepared into arrays of headers + data stream sections.
-****************************************************************************/
-
-static ssize_t read_from_internal_pipe(struct pipes_struct *p, char *data,
- size_t n, bool *is_data_outstanding)
-{
- uint32 pdu_remaining = 0;
- ssize_t data_returned = 0;
-
- if (!p) {
- DEBUG(0,("read_from_pipe: pipe not open\n"));
- return -1;
- }
-
- DEBUG(6,(" name: %s len: %u\n",
- ndr_interface_name(&p->contexts->syntax.uuid,
- p->contexts->syntax.if_version),
- (unsigned int)n));
-
- /*
- * We cannot return more than one PDU length per
- * read request.
- */
-
- /*
- * This condition should result in the connection being closed.
- * Netapp filers seem to set it to 0xffff which results in domain
- * authentications failing. Just ignore it so things work.
- */
-
- if(n > RPC_MAX_PDU_FRAG_LEN) {
- DEBUG(5,("read_from_pipe: too large read (%u) requested on "
- "pipe %s. We can only service %d sized reads.\n",
- (unsigned int)n,
- ndr_interface_name(&p->contexts->syntax.uuid,
- p->contexts->syntax.if_version),
- RPC_MAX_PDU_FRAG_LEN ));
- n = RPC_MAX_PDU_FRAG_LEN;
- }
-
- /*
- * Determine if there is still data to send in the
- * pipe PDU buffer. Always send this first. Never
- * send more than is left in the current PDU. The
- * client should send a new read request for a new
- * PDU.
- */
-
- pdu_remaining = p->out_data.frag.length
- - p->out_data.current_pdu_sent;
-
- if (pdu_remaining > 0) {
- data_returned = (ssize_t)MIN(n, pdu_remaining);
-
- DEBUG(10,("read_from_pipe: %s: current_pdu_len = %u, "
- "current_pdu_sent = %u returning %d bytes.\n",
- ndr_interface_name(&p->contexts->syntax.uuid,
- p->contexts->syntax.if_version),
- (unsigned int)p->out_data.frag.length,
- (unsigned int)p->out_data.current_pdu_sent,
- (int)data_returned));
-
- memcpy(data,
- p->out_data.frag.data
- + p->out_data.current_pdu_sent,
- data_returned);
-
- p->out_data.current_pdu_sent += (uint32)data_returned;
- goto out;
- }
-
- /*
- * At this point p->current_pdu_len == p->current_pdu_sent (which
- * may of course be zero if this is the first return fragment.
- */
-
--
Samba Shared Repository
More information about the samba-cvs
mailing list