1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2015 Nexenta Systems, Inc. All rights reserved. 24 * Copyright (c) 2018, Joyent, Inc. 25 */ 26 27 /* 28 * Server side RPC handler. 29 */ 30 31 #include <sys/byteorder.h> 32 #include <sys/uio.h> 33 #include <errno.h> 34 #include <synch.h> 35 #include <stdlib.h> 36 #include <strings.h> 37 #include <string.h> 38 #include <thread.h> 39 40 #include <libmlrpc.h> 41 42 #define NDR_PIPE_SEND(np, buf, len) \ 43 ((np)->np_send)((np), (buf), (len)) 44 #define NDR_PIPE_RECV(np, buf, len) \ 45 ((np)->np_recv)((np), (buf), (len)) 46 47 static int ndr_svc_process(ndr_xa_t *); 48 static int ndr_svc_bind(ndr_xa_t *); 49 static int ndr_svc_request(ndr_xa_t *); 50 static void ndr_reply_prepare_hdr(ndr_xa_t *); 51 static int ndr_svc_alter_context(ndr_xa_t *); 52 static void ndr_reply_fault(ndr_xa_t *, unsigned long); 53 54 static int ndr_recv_request(ndr_xa_t *mxa); 55 static int ndr_recv_frag(ndr_xa_t *mxa); 56 static int ndr_send_reply(ndr_xa_t *); 57 58 static int ndr_pipe_process(ndr_pipe_t *, ndr_xa_t *); 59 60 /* 61 * External entry point called by smbd. 62 */ 63 void 64 ndr_pipe_worker(ndr_pipe_t *np) 65 { 66 ndr_xa_t *mxa; 67 int rc; 68 69 ndr_svc_binding_pool_init(&np->np_binding, np->np_binding_pool, 70 NDR_N_BINDING_POOL); 71 72 if ((mxa = malloc(sizeof (*mxa))) == NULL) 73 return; 74 75 do { 76 bzero(mxa, sizeof (*mxa)); 77 rc = ndr_pipe_process(np, mxa); 78 } while (rc == 0); 79 80 free(mxa); 81 82 /* 83 * Ensure that there are no RPC service policy handles 84 * (associated with this fid) left around. 85 */ 86 ndr_hdclose(np); 87 } 88 89 /* 90 * Process one server-side RPC request. 91 */ 92 static int 93 ndr_pipe_process(ndr_pipe_t *np, ndr_xa_t *mxa) 94 { 95 ndr_stream_t *recv_nds; 96 ndr_stream_t *send_nds; 97 int rc = ENOMEM; 98 99 mxa->pipe = np; 100 mxa->binding_list = np->np_binding; 101 102 if ((mxa->heap = ndr_heap_create()) == NULL) 103 goto out1; 104 105 recv_nds = &mxa->recv_nds; 106 rc = nds_initialize(recv_nds, 0, NDR_MODE_CALL_RECV, mxa->heap); 107 if (rc != 0) 108 goto out2; 109 110 send_nds = &mxa->send_nds; 111 rc = nds_initialize(send_nds, 0, NDR_MODE_RETURN_SEND, mxa->heap); 112 if (rc != 0) 113 goto out3; 114 115 rc = ndr_recv_request(mxa); 116 if (rc != 0) 117 goto out4; 118 119 (void) ndr_svc_process(mxa); 120 (void) ndr_send_reply(mxa); 121 rc = 0; 122 123 out4: 124 nds_destruct(&mxa->send_nds); 125 out3: 126 nds_destruct(&mxa->recv_nds); 127 out2: 128 ndr_heap_destroy(mxa->heap); 129 out1: 130 return (rc); 131 } 132 133 /* 134 * Receive an entire RPC request (all fragments) 135 * Returns zero or an NDR fault code. 136 */ 137 static int 138 ndr_recv_request(ndr_xa_t *mxa) 139 { 140 ndr_common_header_t *hdr = &mxa->recv_hdr.common_hdr; 141 ndr_stream_t *nds = &mxa->recv_nds; 142 unsigned long saved_size; 143 int rc; 144 145 rc = ndr_recv_frag(mxa); 146 if (rc != 0) 147 return (rc); 148 if (!NDR_IS_FIRST_FRAG(hdr->pfc_flags)) 149 return (NDR_DRC_FAULT_DECODE_FAILED); 150 151 while (!NDR_IS_LAST_FRAG(hdr->pfc_flags)) { 152 rc = ndr_recv_frag(mxa); 153 if (rc != 0) 154 return (rc); 155 } 156 nds->pdu_scan_offset = 0; 157 158 /* 159 * This whacks nds->pdu_size, so save/restore. 160 * It leaves scan_offset after the header. 161 */ 162 saved_size = nds->pdu_size; 163 rc = ndr_decode_pdu_hdr(mxa); 164 nds->pdu_size = saved_size; 165 166 return (rc); 167 } 168 169 /* 170 * Read one fragment, leaving the decoded frag header in 171 * recv_hdr.common_hdr, and the data in the recv_nds. 172 * 173 * Returns zero or an NDR fault code. 174 * 175 * If a first frag, the header is included in the data 176 * placed in recv_nds (because it's not fully decoded 177 * until later - we only decode the common part here). 178 * Additional frags are placed in the recv_nds without 179 * the header, so that after the first frag header, 180 * the remaining data will be contiguous. We do this 181 * by simply not advancing the offset in recv_nds after 182 * reading and decoding these additional fragments, so 183 * the payload of such frags will overwrite what was 184 * (temporarily) the frag header. 185 */ 186 static int 187 ndr_recv_frag(ndr_xa_t *mxa) 188 { 189 ndr_common_header_t *hdr = &mxa->recv_hdr.common_hdr; 190 ndr_stream_t *nds = &mxa->recv_nds; 191 unsigned char *data; 192 unsigned long next_offset; 193 unsigned long pay_size; 194 int rc; 195 196 /* Make room for the frag header. */ 197 next_offset = nds->pdu_scan_offset + NDR_RSP_HDR_SIZE; 198 if (!NDS_GROW_PDU(nds, next_offset, 0)) 199 return (NDR_DRC_FAULT_OUT_OF_MEMORY); 200 201 /* Read the frag header. */ 202 data = nds->pdu_base_addr + nds->pdu_scan_offset; 203 rc = NDR_PIPE_RECV(mxa->pipe, data, NDR_RSP_HDR_SIZE); 204 if (rc != 0) 205 return (NDR_DRC_FAULT_RPCHDR_RECEIVED_RUNT); 206 207 /* 208 * Decode the frag header, get the length. 209 * NB: It uses nds->pdu_scan_offset 210 */ 211 ndr_decode_frag_hdr(nds, hdr); 212 ndr_show_hdr(hdr); 213 if (hdr->frag_length < NDR_RSP_HDR_SIZE || 214 hdr->frag_length > mxa->pipe->np_max_xmit_frag) 215 return (NDR_DRC_FAULT_DECODE_FAILED); 216 217 if (nds->pdu_scan_offset == 0) { 218 /* First frag: header stays in the data. */ 219 nds->pdu_scan_offset = next_offset; 220 } /* else overwrite with the payload */ 221 222 /* Make room for the payload. */ 223 pay_size = hdr->frag_length - NDR_RSP_HDR_SIZE; 224 next_offset = nds->pdu_scan_offset + pay_size; 225 if (!NDS_GROW_PDU(nds, next_offset, 0)) 226 return (NDR_DRC_FAULT_OUT_OF_MEMORY); 227 228 /* Read the payload. */ 229 data = nds->pdu_base_addr + nds->pdu_scan_offset; 230 rc = NDR_PIPE_RECV(mxa->pipe, data, pay_size); 231 if (rc != 0) 232 return (NDR_DRC_FAULT_RPCHDR_RECEIVED_RUNT); 233 nds->pdu_scan_offset = next_offset; 234 235 return (NDR_DRC_OK); 236 } 237 238 /* 239 * This is the entry point for all server-side RPC processing. 240 * It is assumed that the PDU has already been received. 241 */ 242 static int 243 ndr_svc_process(ndr_xa_t *mxa) 244 { 245 int rc; 246 247 (void) ndr_reply_prepare_hdr(mxa); 248 249 switch (mxa->ptype) { 250 case NDR_PTYPE_BIND: 251 rc = ndr_svc_bind(mxa); 252 break; 253 254 case NDR_PTYPE_REQUEST: 255 rc = ndr_svc_request(mxa); 256 break; 257 258 case NDR_PTYPE_ALTER_CONTEXT: 259 rc = ndr_svc_alter_context(mxa); 260 break; 261 262 default: 263 rc = NDR_DRC_FAULT_RPCHDR_PTYPE_INVALID; 264 break; 265 } 266 267 if (NDR_DRC_IS_FAULT(rc)) 268 ndr_reply_fault(mxa, rc); 269 270 return (rc); 271 } 272 273 /* 274 * Multiple p_cont_elem[]s, multiple transfer_syntaxes[] and multiple 275 * p_results[] not supported. 276 */ 277 static int 278 ndr_svc_bind(ndr_xa_t *mxa) 279 { 280 ndr_p_cont_list_t *cont_list; 281 ndr_p_result_list_t *result_list; 282 ndr_p_result_t *result; 283 unsigned p_cont_id; 284 ndr_binding_t *mbind; 285 ndr_uuid_t *as_uuid; 286 ndr_uuid_t *ts_uuid; 287 int as_vers; 288 int ts_vers; 289 ndr_service_t *msvc; 290 int rc; 291 ndr_port_any_t *sec_addr; 292 293 /* acquire targets */ 294 cont_list = &mxa->recv_hdr.bind_hdr.p_context_elem; 295 result_list = &mxa->send_hdr.bind_ack_hdr.p_result_list; 296 result = &result_list->p_results[0]; 297 298 /* 299 * Set up temporary secondary address port. 300 * We will correct this later (below). 301 */ 302 sec_addr = &mxa->send_hdr.bind_ack_hdr.sec_addr; 303 sec_addr->length = 13; 304 (void) strcpy((char *)sec_addr->port_spec, "\\PIPE\\ntsvcs"); 305 306 result_list->n_results = 1; 307 result_list->reserved = 0; 308 result_list->reserved2 = 0; 309 result->result = NDR_PCDR_ACCEPTANCE; 310 result->reason = 0; 311 bzero(&result->transfer_syntax, sizeof (result->transfer_syntax)); 312 313 /* sanity check */ 314 if (cont_list->n_context_elem != 1 || 315 cont_list->p_cont_elem[0].n_transfer_syn != 1) { 316 ndo_trace("ndr_svc_bind: warning: multiple p_cont_elem"); 317 } 318 319 p_cont_id = cont_list->p_cont_elem[0].p_cont_id; 320 321 if ((mbind = ndr_svc_find_binding(mxa, p_cont_id)) != NULL) { 322 /* 323 * Duplicate presentation context id. 324 */ 325 ndo_trace("ndr_svc_bind: duplicate binding"); 326 return (NDR_DRC_FAULT_BIND_PCONT_BUSY); 327 } 328 329 if ((mbind = ndr_svc_new_binding(mxa)) == NULL) { 330 /* 331 * No free binding slot 332 */ 333 result->result = NDR_PCDR_PROVIDER_REJECTION; 334 result->reason = NDR_PPR_LOCAL_LIMIT_EXCEEDED; 335 ndo_trace("ndr_svc_bind: no resources"); 336 return (NDR_DRC_OK); 337 } 338 339 as_uuid = &cont_list->p_cont_elem[0].abstract_syntax.if_uuid; 340 as_vers = cont_list->p_cont_elem[0].abstract_syntax.if_version; 341 342 ts_uuid = &cont_list->p_cont_elem[0].transfer_syntaxes[0].if_uuid; 343 ts_vers = cont_list->p_cont_elem[0].transfer_syntaxes[0].if_version; 344 345 msvc = ndr_svc_lookup_uuid(as_uuid, as_vers, ts_uuid, ts_vers); 346 if (msvc == NULL) { 347 result->result = NDR_PCDR_PROVIDER_REJECTION; 348 result->reason = NDR_PPR_ABSTRACT_SYNTAX_NOT_SUPPORTED; 349 return (NDR_DRC_OK); 350 } 351 352 /* 353 * We can now use the correct secondary address port. 354 */ 355 sec_addr = &mxa->send_hdr.bind_ack_hdr.sec_addr; 356 sec_addr->length = strlen(msvc->sec_addr_port) + 1; 357 (void) strlcpy((char *)sec_addr->port_spec, msvc->sec_addr_port, 358 NDR_PORT_ANY_MAX_PORT_SPEC); 359 360 mbind->p_cont_id = p_cont_id; 361 mbind->which_side = NDR_BIND_SIDE_SERVER; 362 /* mbind->context set by app */ 363 mbind->service = msvc; 364 mbind->instance_specific = 0; 365 366 mxa->binding = mbind; 367 368 if (msvc->bind_req) { 369 /* 370 * Call the service-specific bind() handler. If 371 * this fails, we shouild send a specific error 372 * on the bind ack. 373 */ 374 rc = (msvc->bind_req)(mxa); 375 if (NDR_DRC_IS_FAULT(rc)) { 376 mbind->service = 0; /* free binding slot */ 377 mbind->which_side = 0; 378 mbind->p_cont_id = 0; 379 mbind->instance_specific = 0; 380 return (rc); 381 } 382 } 383 384 result->transfer_syntax = 385 cont_list->p_cont_elem[0].transfer_syntaxes[0]; 386 387 return (NDR_DRC_BINDING_MADE); 388 } 389 390 /* 391 * ndr_svc_alter_context 392 * 393 * The alter context request is used to request additional presentation 394 * context for another interface and/or version. It is very similar to 395 * a bind request. 396 */ 397 static int 398 ndr_svc_alter_context(ndr_xa_t *mxa) 399 { 400 ndr_p_result_list_t *result_list; 401 ndr_p_result_t *result; 402 ndr_p_cont_list_t *cont_list; 403 ndr_binding_t *mbind; 404 ndr_service_t *msvc; 405 unsigned p_cont_id; 406 ndr_uuid_t *as_uuid; 407 ndr_uuid_t *ts_uuid; 408 int as_vers; 409 int ts_vers; 410 ndr_port_any_t *sec_addr; 411 412 result_list = &mxa->send_hdr.alter_context_rsp_hdr.p_result_list; 413 result_list->n_results = 1; 414 result_list->reserved = 0; 415 result_list->reserved2 = 0; 416 417 result = &result_list->p_results[0]; 418 result->result = NDR_PCDR_ACCEPTANCE; 419 result->reason = 0; 420 bzero(&result->transfer_syntax, sizeof (result->transfer_syntax)); 421 422 cont_list = &mxa->recv_hdr.alter_context_hdr.p_context_elem; 423 p_cont_id = cont_list->p_cont_elem[0].p_cont_id; 424 425 if (ndr_svc_find_binding(mxa, p_cont_id) != NULL) 426 return (NDR_DRC_FAULT_BIND_PCONT_BUSY); 427 428 if ((mbind = ndr_svc_new_binding(mxa)) == NULL) { 429 result->result = NDR_PCDR_PROVIDER_REJECTION; 430 result->reason = NDR_PPR_LOCAL_LIMIT_EXCEEDED; 431 return (NDR_DRC_OK); 432 } 433 434 as_uuid = &cont_list->p_cont_elem[0].abstract_syntax.if_uuid; 435 as_vers = cont_list->p_cont_elem[0].abstract_syntax.if_version; 436 437 ts_uuid = &cont_list->p_cont_elem[0].transfer_syntaxes[0].if_uuid; 438 ts_vers = cont_list->p_cont_elem[0].transfer_syntaxes[0].if_version; 439 440 msvc = ndr_svc_lookup_uuid(as_uuid, as_vers, ts_uuid, ts_vers); 441 if (msvc == NULL) { 442 result->result = NDR_PCDR_PROVIDER_REJECTION; 443 result->reason = NDR_PPR_ABSTRACT_SYNTAX_NOT_SUPPORTED; 444 return (NDR_DRC_OK); 445 } 446 447 mbind->p_cont_id = p_cont_id; 448 mbind->which_side = NDR_BIND_SIDE_SERVER; 449 /* mbind->context set by app */ 450 mbind->service = msvc; 451 mbind->instance_specific = 0; 452 mxa->binding = mbind; 453 454 sec_addr = &mxa->send_hdr.alter_context_rsp_hdr.sec_addr; 455 sec_addr->length = 0; 456 bzero(sec_addr->port_spec, NDR_PORT_ANY_MAX_PORT_SPEC); 457 458 result->transfer_syntax = 459 cont_list->p_cont_elem[0].transfer_syntaxes[0]; 460 461 return (NDR_DRC_BINDING_MADE); 462 } 463 464 static int 465 ndr_svc_request(ndr_xa_t *mxa) 466 { 467 ndr_binding_t *mbind; 468 ndr_service_t *msvc; 469 unsigned p_cont_id; 470 int rc; 471 472 mxa->opnum = mxa->recv_hdr.request_hdr.opnum; 473 p_cont_id = mxa->recv_hdr.request_hdr.p_cont_id; 474 475 if ((mbind = ndr_svc_find_binding(mxa, p_cont_id)) == NULL) 476 return (NDR_DRC_FAULT_REQUEST_PCONT_INVALID); 477 478 mxa->binding = mbind; 479 msvc = mbind->service; 480 481 /* 482 * Make room for the response hdr. 483 */ 484 mxa->send_nds.pdu_scan_offset = NDR_RSP_HDR_SIZE; 485 486 if (msvc->call_stub) 487 rc = (*msvc->call_stub)(mxa); 488 else 489 rc = ndr_generic_call_stub(mxa); 490 491 if (NDR_DRC_IS_FAULT(rc)) { 492 ndo_printf(0, 0, "%s[0x%02x]: 0x%04x", 493 msvc->name, mxa->opnum, rc); 494 } 495 496 return (rc); 497 } 498 499 /* 500 * The transaction and the two nds streams use the same heap, which 501 * should already exist at this point. The heap will also be available 502 * to the stub. 503 */ 504 int 505 ndr_generic_call_stub(ndr_xa_t *mxa) 506 { 507 ndr_binding_t *mbind = mxa->binding; 508 ndr_service_t *msvc = mbind->service; 509 ndr_typeinfo_t *intf_ti = msvc->interface_ti; 510 ndr_stub_table_t *ste; 511 int opnum = mxa->opnum; 512 unsigned p_len = intf_ti->c_size_fixed_part; 513 char *param; 514 int rc; 515 516 if (mxa->heap == NULL) { 517 ndo_printf(0, 0, "%s[0x%02x]: no heap", msvc->name, opnum); 518 return (NDR_DRC_FAULT_OUT_OF_MEMORY); 519 } 520 521 if ((ste = ndr_svc_find_stub(msvc, opnum)) == NULL) { 522 ndo_printf(0, 0, "%s[0x%02x]: invalid opnum", 523 msvc->name, opnum); 524 return (NDR_DRC_FAULT_REQUEST_OPNUM_INVALID); 525 } 526 527 if ((param = ndr_heap_malloc(mxa->heap, p_len)) == NULL) 528 return (NDR_DRC_FAULT_OUT_OF_MEMORY); 529 530 bzero(param, p_len); 531 532 rc = ndr_decode_call(mxa, param); 533 if (!NDR_DRC_IS_OK(rc)) 534 return (rc); 535 536 rc = (*ste->func)(param, mxa); 537 if (rc == NDR_DRC_OK) 538 rc = ndr_encode_return(mxa, param); 539 540 return (rc); 541 } 542 543 /* 544 * We can perform some initial setup of the response header here. 545 * We also need to cache some of the information from the bind 546 * negotiation for use during subsequent RPC calls. 547 */ 548 static void 549 ndr_reply_prepare_hdr(ndr_xa_t *mxa) 550 { 551 ndr_common_header_t *rhdr = &mxa->recv_hdr.common_hdr; 552 ndr_common_header_t *hdr = &mxa->send_hdr.common_hdr; 553 554 hdr->rpc_vers = 5; 555 hdr->rpc_vers_minor = 0; 556 hdr->pfc_flags = NDR_PFC_FIRST_FRAG + NDR_PFC_LAST_FRAG; 557 hdr->packed_drep = rhdr->packed_drep; 558 hdr->frag_length = 0; 559 hdr->auth_length = 0; 560 hdr->call_id = rhdr->call_id; 561 #ifdef _BIG_ENDIAN 562 hdr->packed_drep.intg_char_rep = NDR_REPLAB_CHAR_ASCII 563 | NDR_REPLAB_INTG_BIG_ENDIAN; 564 #else 565 hdr->packed_drep.intg_char_rep = NDR_REPLAB_CHAR_ASCII 566 | NDR_REPLAB_INTG_LITTLE_ENDIAN; 567 #endif 568 569 switch (mxa->ptype) { 570 case NDR_PTYPE_BIND: 571 /* 572 * Compute the maximum fragment sizes for xmit/recv 573 * and store in the pipe endpoint. Note "xmit" is 574 * client-to-server; "recv" is server-to-client. 575 */ 576 if (mxa->pipe->np_max_xmit_frag > 577 mxa->recv_hdr.bind_hdr.max_xmit_frag) 578 mxa->pipe->np_max_xmit_frag = 579 mxa->recv_hdr.bind_hdr.max_xmit_frag; 580 if (mxa->pipe->np_max_recv_frag > 581 mxa->recv_hdr.bind_hdr.max_recv_frag) 582 mxa->pipe->np_max_recv_frag = 583 mxa->recv_hdr.bind_hdr.max_recv_frag; 584 585 hdr->ptype = NDR_PTYPE_BIND_ACK; 586 mxa->send_hdr.bind_ack_hdr.max_xmit_frag = 587 mxa->pipe->np_max_xmit_frag; 588 mxa->send_hdr.bind_ack_hdr.max_recv_frag = 589 mxa->pipe->np_max_recv_frag; 590 591 /* 592 * We're supposed to assign a unique "assoc group" 593 * (identifies this connection for the client). 594 * Using the pipe address is adequate. 595 */ 596 mxa->send_hdr.bind_ack_hdr.assoc_group_id = 597 mxa->recv_hdr.bind_hdr.assoc_group_id; 598 if (mxa->send_hdr.bind_ack_hdr.assoc_group_id == 0) 599 mxa->send_hdr.bind_ack_hdr.assoc_group_id = 600 (DWORD)(uintptr_t)mxa->pipe; 601 602 break; 603 604 case NDR_PTYPE_REQUEST: 605 hdr->ptype = NDR_PTYPE_RESPONSE; 606 /* mxa->send_hdr.response_hdr.alloc_hint */ 607 mxa->send_hdr.response_hdr.p_cont_id = 608 mxa->recv_hdr.request_hdr.p_cont_id; 609 mxa->send_hdr.response_hdr.cancel_count = 0; 610 mxa->send_hdr.response_hdr.reserved = 0; 611 break; 612 613 case NDR_PTYPE_ALTER_CONTEXT: 614 hdr->ptype = NDR_PTYPE_ALTER_CONTEXT_RESP; 615 /* 616 * The max_xmit_frag, max_recv_frag and assoc_group_id are 617 * ignored by the client but it's useful to fill them in. 618 */ 619 mxa->send_hdr.alter_context_rsp_hdr.max_xmit_frag = 620 mxa->recv_hdr.alter_context_hdr.max_xmit_frag; 621 mxa->send_hdr.alter_context_rsp_hdr.max_recv_frag = 622 mxa->recv_hdr.alter_context_hdr.max_recv_frag; 623 mxa->send_hdr.alter_context_rsp_hdr.assoc_group_id = 624 mxa->recv_hdr.alter_context_hdr.assoc_group_id; 625 break; 626 627 default: 628 hdr->ptype = 0xFF; 629 } 630 } 631 632 /* 633 * Signal an RPC fault. The stream is reset and we overwrite whatever 634 * was in the response header with the fault information. 635 */ 636 static void 637 ndr_reply_fault(ndr_xa_t *mxa, unsigned long drc) 638 { 639 ndr_common_header_t *rhdr = &mxa->recv_hdr.common_hdr; 640 ndr_common_header_t *hdr = &mxa->send_hdr.common_hdr; 641 ndr_stream_t *nds = &mxa->send_nds; 642 unsigned long fault_status; 643 644 (void) NDS_RESET(nds); 645 646 hdr->rpc_vers = 5; 647 hdr->rpc_vers_minor = 0; 648 hdr->pfc_flags = NDR_PFC_FIRST_FRAG + NDR_PFC_LAST_FRAG; 649 hdr->packed_drep = rhdr->packed_drep; 650 hdr->frag_length = sizeof (mxa->send_hdr.fault_hdr); 651 hdr->auth_length = 0; 652 hdr->call_id = rhdr->call_id; 653 #ifdef _BIG_ENDIAN 654 hdr->packed_drep.intg_char_rep = NDR_REPLAB_CHAR_ASCII 655 | NDR_REPLAB_INTG_BIG_ENDIAN; 656 #else 657 hdr->packed_drep.intg_char_rep = NDR_REPLAB_CHAR_ASCII 658 | NDR_REPLAB_INTG_LITTLE_ENDIAN; 659 #endif 660 661 switch (drc & NDR_DRC_MASK_SPECIFIER) { 662 case NDR_DRC_FAULT_OUT_OF_MEMORY: 663 case NDR_DRC_FAULT_ENCODE_TOO_BIG: 664 fault_status = NDR_FAULT_NCA_OUT_ARGS_TOO_BIG; 665 break; 666 667 case NDR_DRC_FAULT_REQUEST_PCONT_INVALID: 668 fault_status = NDR_FAULT_NCA_INVALID_PRES_CONTEXT_ID; 669 break; 670 671 case NDR_DRC_FAULT_REQUEST_OPNUM_INVALID: 672 fault_status = NDR_FAULT_NCA_OP_RNG_ERROR; 673 break; 674 675 case NDR_DRC_FAULT_DECODE_FAILED: 676 case NDR_DRC_FAULT_ENCODE_FAILED: 677 fault_status = NDR_FAULT_NCA_PROTO_ERROR; 678 break; 679 680 default: 681 fault_status = NDR_FAULT_NCA_UNSPEC_REJECT; 682 break; 683 } 684 685 mxa->send_hdr.fault_hdr.common_hdr.ptype = NDR_PTYPE_FAULT; 686 mxa->send_hdr.fault_hdr.status = fault_status; 687 mxa->send_hdr.response_hdr.alloc_hint = hdr->frag_length; 688 } 689 690 /* 691 * Note that the frag_length for bind ack and alter context is 692 * non-standard. 693 */ 694 static int 695 ndr_send_reply(ndr_xa_t *mxa) 696 { 697 ndr_common_header_t *hdr = &mxa->send_hdr.common_hdr; 698 ndr_stream_t *nds = &mxa->send_nds; 699 uint8_t *pdu_buf; 700 unsigned long pdu_size; 701 unsigned long frag_size; 702 unsigned long pdu_data_size; 703 unsigned long frag_data_size; 704 705 frag_size = mxa->pipe->np_max_recv_frag; 706 pdu_size = nds->pdu_size; 707 pdu_buf = nds->pdu_base_addr; 708 709 if (pdu_size <= frag_size) { 710 /* 711 * Single fragment response. The PDU size may be zero 712 * here (i.e. bind or fault response). So don't make 713 * any assumptions about it until after the header is 714 * encoded. 715 */ 716 switch (hdr->ptype) { 717 case NDR_PTYPE_BIND_ACK: 718 hdr->frag_length = ndr_bind_ack_hdr_size(mxa); 719 break; 720 721 case NDR_PTYPE_FAULT: 722 /* already setup */ 723 break; 724 725 case NDR_PTYPE_RESPONSE: 726 hdr->frag_length = pdu_size; 727 mxa->send_hdr.response_hdr.alloc_hint = 728 hdr->frag_length; 729 break; 730 731 case NDR_PTYPE_ALTER_CONTEXT_RESP: 732 hdr->frag_length = ndr_alter_context_rsp_hdr_size(); 733 break; 734 735 default: 736 hdr->frag_length = pdu_size; 737 break; 738 } 739 740 nds->pdu_scan_offset = 0; 741 (void) ndr_encode_pdu_hdr(mxa); 742 pdu_size = nds->pdu_size; 743 (void) NDR_PIPE_SEND(mxa->pipe, pdu_buf, pdu_size); 744 return (0); 745 } 746 747 /* 748 * Multiple fragment response. 749 * 750 * We need to update the RPC header for every fragment. 751 * 752 * pdu_data_size: total data remaining to be handled 753 * frag_size: total fragment size including header 754 * frag_data_size: data in fragment 755 * (i.e. frag_size - NDR_RSP_HDR_SIZE) 756 */ 757 pdu_data_size = pdu_size - NDR_RSP_HDR_SIZE; 758 frag_data_size = frag_size - NDR_RSP_HDR_SIZE; 759 760 /* 761 * Send the first frag. 762 */ 763 hdr->pfc_flags = NDR_PFC_FIRST_FRAG; 764 hdr->frag_length = frag_size; 765 mxa->send_hdr.response_hdr.alloc_hint = pdu_data_size; 766 nds->pdu_scan_offset = 0; 767 (void) ndr_encode_pdu_hdr(mxa); 768 (void) NDR_PIPE_SEND(mxa->pipe, pdu_buf, frag_size); 769 pdu_data_size -= frag_data_size; 770 pdu_buf += frag_data_size; 771 772 /* 773 * Send "middle" (full-sized) fragments... 774 */ 775 hdr->pfc_flags = 0; 776 while (pdu_data_size > frag_data_size) { 777 778 hdr->frag_length = frag_size; 779 mxa->send_hdr.response_hdr.alloc_hint = pdu_data_size; 780 nds->pdu_scan_offset = 0; 781 (void) ndr_encode_pdu_hdr(mxa); 782 bcopy(nds->pdu_base_addr, pdu_buf, NDR_RSP_HDR_SIZE); 783 (void) NDR_PIPE_SEND(mxa->pipe, pdu_buf, frag_size); 784 pdu_data_size -= frag_data_size; 785 pdu_buf += frag_data_size; 786 } 787 788 /* 789 * Last frag (pdu_data_size <= frag_data_size) 790 */ 791 hdr->pfc_flags = NDR_PFC_LAST_FRAG; 792 frag_size = pdu_data_size + NDR_RSP_HDR_SIZE; 793 hdr->frag_length = frag_size; 794 mxa->send_hdr.response_hdr.alloc_hint = pdu_data_size; 795 nds->pdu_scan_offset = 0; 796 (void) ndr_encode_pdu_hdr(mxa); 797 bcopy(nds->pdu_base_addr, pdu_buf, NDR_RSP_HDR_SIZE); 798 (void) NDR_PIPE_SEND(mxa->pipe, pdu_buf, frag_size); 799 800 return (0); 801 } 802