[206] | 1 | /*
|
---|
| 2 | Unix SMB/CIFS implementation.
|
---|
| 3 | Pipe SMB reply routines
|
---|
| 4 | Copyright (C) Andrew Tridgell 1992-1998
|
---|
| 5 | Copyright (C) Luke Kenneth Casson Leighton 1996-1998
|
---|
| 6 | Copyright (C) Paul Ashton 1997-1998.
|
---|
| 7 | Copyright (C) Jeremy Allison 2005.
|
---|
| 8 |
|
---|
| 9 | This program is free software; you can redistribute it and/or modify
|
---|
| 10 | it under the terms of the GNU General Public License as published by
|
---|
| 11 | the Free Software Foundation; either version 3 of the License, or
|
---|
| 12 | (at your option) any later version.
|
---|
| 13 |
|
---|
| 14 | This program is distributed in the hope that it will be useful,
|
---|
| 15 | but WITHOUT ANY WARRANTY; without even the implied warranty of
|
---|
| 16 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
---|
| 17 | GNU General Public License for more details.
|
---|
| 18 |
|
---|
| 19 | You should have received a copy of the GNU General Public License
|
---|
| 20 | along with this program. If not, see <http://www.gnu.org/licenses/>.
|
---|
| 21 | */
|
---|
| 22 | /*
|
---|
| 23 | This file handles reply_ calls on named pipes that the server
|
---|
| 24 | makes to handle specific protocols
|
---|
| 25 | */
|
---|
| 26 |
|
---|
| 27 |
|
---|
| 28 | #include "includes.h"
|
---|
| 29 |
|
---|
| 30 | #define PIPE "\\PIPE\\"
|
---|
| 31 | #define PIPELEN strlen(PIPE)
|
---|
| 32 |
|
---|
| 33 | #define MAX_PIPE_NAME_LEN 24
|
---|
| 34 |
|
---|
| 35 | /* PIPE/<name>/<pid>/<pnum> */
|
---|
| 36 | #define PIPEDB_KEY_FORMAT "PIPE/%s/%u/%d"
|
---|
| 37 |
|
---|
| 38 | struct pipe_dbrec {
|
---|
| 39 | struct server_id pid;
|
---|
| 40 | int pnum;
|
---|
| 41 | uid_t uid;
|
---|
| 42 |
|
---|
| 43 | char name[MAX_PIPE_NAME_LEN];
|
---|
| 44 | fstring user;
|
---|
| 45 | };
|
---|
| 46 |
|
---|
| 47 | /****************************************************************************
|
---|
| 48 | Reply to an open and X on a named pipe.
|
---|
| 49 | This code is basically stolen from reply_open_and_X with some
|
---|
| 50 | wrinkles to handle pipes.
|
---|
| 51 | ****************************************************************************/
|
---|
| 52 |
|
---|
| 53 | void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req)
|
---|
| 54 | {
|
---|
| 55 | const char *fname = NULL;
|
---|
| 56 | char *pipe_name = NULL;
|
---|
| 57 | smb_np_struct *p;
|
---|
| 58 | int size=0,fmode=0,mtime=0,rmode=0;
|
---|
| 59 | TALLOC_CTX *ctx = talloc_tos();
|
---|
| 60 |
|
---|
| 61 | /* XXXX we need to handle passed times, sattr and flags */
|
---|
| 62 | srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &pipe_name,
|
---|
| 63 | smb_buf(req->inbuf), STR_TERMINATE);
|
---|
| 64 | if (!pipe_name) {
|
---|
| 65 | reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
|
---|
| 66 | ERRDOS, ERRbadpipe);
|
---|
| 67 | return;
|
---|
| 68 | }
|
---|
| 69 |
|
---|
| 70 | /* If the name doesn't start \PIPE\ then this is directed */
|
---|
| 71 | /* at a mailslot or something we really, really don't understand, */
|
---|
| 72 | /* not just something we really don't understand. */
|
---|
| 73 | if ( strncmp(pipe_name,PIPE,PIPELEN) != 0 ) {
|
---|
| 74 | reply_doserror(req, ERRSRV, ERRaccess);
|
---|
| 75 | return;
|
---|
| 76 | }
|
---|
| 77 |
|
---|
| 78 | DEBUG(4,("Opening pipe %s.\n", pipe_name));
|
---|
| 79 |
|
---|
| 80 | /* See if it is one we want to handle. */
|
---|
| 81 | if (!is_known_pipename(pipe_name)) {
|
---|
| 82 | reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
|
---|
| 83 | ERRDOS, ERRbadpipe);
|
---|
| 84 | return;
|
---|
| 85 | }
|
---|
| 86 |
|
---|
| 87 | /* Strip \PIPE\ off the name. */
|
---|
| 88 | fname = pipe_name + PIPELEN;
|
---|
| 89 |
|
---|
| 90 | #if 0
|
---|
| 91 | /*
|
---|
| 92 | * Hack for NT printers... JRA.
|
---|
| 93 | */
|
---|
| 94 | if(should_fail_next_srvsvc_open(fname)) {
|
---|
| 95 | reply_doserror(req, ERRSRV, ERRaccess);
|
---|
| 96 | return;
|
---|
| 97 | }
|
---|
| 98 | #endif
|
---|
| 99 |
|
---|
| 100 | /* Known pipes arrive with DIR attribs. Remove it so a regular file */
|
---|
| 101 | /* can be opened and add it in after the open. */
|
---|
| 102 | DEBUG(3,("Known pipe %s opening.\n",fname));
|
---|
| 103 |
|
---|
| 104 | p = open_rpc_pipe_p(fname, conn, req->vuid);
|
---|
| 105 | if (!p) {
|
---|
| 106 | reply_doserror(req, ERRSRV, ERRnofids);
|
---|
| 107 | return;
|
---|
| 108 | }
|
---|
| 109 |
|
---|
| 110 | /* Prepare the reply */
|
---|
| 111 | reply_outbuf(req, 15, 0);
|
---|
| 112 |
|
---|
| 113 | /* Mark the opened file as an existing named pipe in message mode. */
|
---|
| 114 | SSVAL(req->outbuf,smb_vwv9,2);
|
---|
| 115 | SSVAL(req->outbuf,smb_vwv10,0xc700);
|
---|
| 116 |
|
---|
| 117 | if (rmode == 2) {
|
---|
| 118 | DEBUG(4,("Resetting open result to open from create.\n"));
|
---|
| 119 | rmode = 1;
|
---|
| 120 | }
|
---|
| 121 |
|
---|
| 122 | SSVAL(req->outbuf,smb_vwv2, p->pnum);
|
---|
| 123 | SSVAL(req->outbuf,smb_vwv3,fmode);
|
---|
| 124 | srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
|
---|
| 125 | SIVAL(req->outbuf,smb_vwv6,size);
|
---|
| 126 | SSVAL(req->outbuf,smb_vwv8,rmode);
|
---|
| 127 | SSVAL(req->outbuf,smb_vwv11,0x0001);
|
---|
| 128 |
|
---|
| 129 | chain_reply(req);
|
---|
| 130 | return;
|
---|
| 131 | }
|
---|
| 132 |
|
---|
| 133 | /****************************************************************************
|
---|
| 134 | Reply to a write on a pipe.
|
---|
| 135 | ****************************************************************************/
|
---|
| 136 |
|
---|
| 137 | void reply_pipe_write(struct smb_request *req)
|
---|
| 138 | {
|
---|
| 139 | smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0));
|
---|
| 140 | size_t numtowrite = SVAL(req->inbuf,smb_vwv1);
|
---|
| 141 | int nwritten;
|
---|
| 142 | char *data;
|
---|
| 143 |
|
---|
| 144 | if (!p) {
|
---|
| 145 | reply_doserror(req, ERRDOS, ERRbadfid);
|
---|
| 146 | return;
|
---|
| 147 | }
|
---|
| 148 |
|
---|
| 149 | if (p->vuid != req->vuid) {
|
---|
| 150 | reply_nterror(req, NT_STATUS_INVALID_HANDLE);
|
---|
| 151 | return;
|
---|
| 152 | }
|
---|
| 153 |
|
---|
| 154 | data = smb_buf(req->inbuf) + 3;
|
---|
| 155 |
|
---|
| 156 | if (numtowrite == 0) {
|
---|
| 157 | nwritten = 0;
|
---|
| 158 | } else {
|
---|
| 159 | nwritten = write_to_pipe(p, data, numtowrite);
|
---|
| 160 | }
|
---|
| 161 |
|
---|
| 162 | if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) {
|
---|
| 163 | reply_unixerror(req, ERRDOS, ERRnoaccess);
|
---|
| 164 | return;
|
---|
| 165 | }
|
---|
| 166 |
|
---|
| 167 | reply_outbuf(req, 1, 0);
|
---|
| 168 |
|
---|
| 169 | SSVAL(req->outbuf,smb_vwv0,nwritten);
|
---|
| 170 |
|
---|
| 171 | DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten));
|
---|
| 172 |
|
---|
| 173 | return;
|
---|
| 174 | }
|
---|
| 175 |
|
---|
| 176 | /****************************************************************************
|
---|
| 177 | Reply to a write and X.
|
---|
| 178 |
|
---|
| 179 | This code is basically stolen from reply_write_and_X with some
|
---|
| 180 | wrinkles to handle pipes.
|
---|
| 181 | ****************************************************************************/
|
---|
| 182 |
|
---|
| 183 | void reply_pipe_write_and_X(struct smb_request *req)
|
---|
| 184 | {
|
---|
| 185 | smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2));
|
---|
| 186 | size_t numtowrite = SVAL(req->inbuf,smb_vwv10);
|
---|
| 187 | int nwritten = -1;
|
---|
| 188 | int smb_doff = SVAL(req->inbuf, smb_vwv11);
|
---|
| 189 | bool pipe_start_message_raw =
|
---|
| 190 | ((SVAL(req->inbuf, smb_vwv7)
|
---|
| 191 | & (PIPE_START_MESSAGE|PIPE_RAW_MODE))
|
---|
| 192 | == (PIPE_START_MESSAGE|PIPE_RAW_MODE));
|
---|
| 193 | char *data;
|
---|
| 194 |
|
---|
| 195 | if (!p) {
|
---|
| 196 | reply_doserror(req, ERRDOS, ERRbadfid);
|
---|
| 197 | return;
|
---|
| 198 | }
|
---|
| 199 |
|
---|
| 200 | if (p->vuid != req->vuid) {
|
---|
| 201 | reply_nterror(req, NT_STATUS_INVALID_HANDLE);
|
---|
| 202 | return;
|
---|
| 203 | }
|
---|
| 204 |
|
---|
| 205 | data = smb_base(req->inbuf) + smb_doff;
|
---|
| 206 |
|
---|
| 207 | if (numtowrite == 0) {
|
---|
| 208 | nwritten = 0;
|
---|
| 209 | } else {
|
---|
| 210 | if(pipe_start_message_raw) {
|
---|
| 211 | /*
|
---|
| 212 | * For the start of a message in named pipe byte mode,
|
---|
| 213 | * the first two bytes are a length-of-pdu field. Ignore
|
---|
| 214 | * them (we don't trust the client). JRA.
|
---|
| 215 | */
|
---|
| 216 | if(numtowrite < 2) {
|
---|
| 217 | DEBUG(0,("reply_pipe_write_and_X: start of "
|
---|
| 218 | "message set and not enough data "
|
---|
| 219 | "sent.(%u)\n",
|
---|
| 220 | (unsigned int)numtowrite ));
|
---|
| 221 | reply_unixerror(req, ERRDOS, ERRnoaccess);
|
---|
| 222 | return;
|
---|
| 223 | }
|
---|
| 224 |
|
---|
| 225 | data += 2;
|
---|
| 226 | numtowrite -= 2;
|
---|
| 227 | }
|
---|
| 228 | nwritten = write_to_pipe(p, data, numtowrite);
|
---|
| 229 | }
|
---|
| 230 |
|
---|
| 231 | if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) {
|
---|
| 232 | reply_unixerror(req, ERRDOS,ERRnoaccess);
|
---|
| 233 | return;
|
---|
| 234 | }
|
---|
| 235 |
|
---|
| 236 | reply_outbuf(req, 6, 0);
|
---|
| 237 |
|
---|
| 238 | nwritten = (pipe_start_message_raw ? nwritten + 2 : nwritten);
|
---|
| 239 | SSVAL(req->outbuf,smb_vwv2,nwritten);
|
---|
| 240 |
|
---|
| 241 | DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten));
|
---|
| 242 |
|
---|
| 243 | chain_reply(req);
|
---|
| 244 | }
|
---|
| 245 |
|
---|
| 246 | /****************************************************************************
|
---|
| 247 | Reply to a read and X.
|
---|
| 248 | This code is basically stolen from reply_read_and_X with some
|
---|
| 249 | wrinkles to handle pipes.
|
---|
| 250 | ****************************************************************************/
|
---|
| 251 |
|
---|
| 252 | void reply_pipe_read_and_X(struct smb_request *req)
|
---|
| 253 | {
|
---|
| 254 | smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2));
|
---|
| 255 | int smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
|
---|
| 256 | int smb_mincnt = SVAL(req->inbuf,smb_vwv6);
|
---|
| 257 | int nread = -1;
|
---|
| 258 | char *data;
|
---|
| 259 | bool unused;
|
---|
| 260 |
|
---|
| 261 | /* we don't use the offset given to use for pipe reads. This
|
---|
| 262 | is deliberate, instead we always return the next lump of
|
---|
| 263 | data on the pipe */
|
---|
| 264 | #if 0
|
---|
| 265 | uint32 smb_offs = IVAL(req->inbuf,smb_vwv3);
|
---|
| 266 | #endif
|
---|
| 267 |
|
---|
| 268 | if (!p) {
|
---|
| 269 | reply_doserror(req, ERRDOS, ERRbadfid);
|
---|
| 270 | return;
|
---|
| 271 | }
|
---|
| 272 |
|
---|
| 273 | reply_outbuf(req, 12, smb_maxcnt);
|
---|
| 274 |
|
---|
| 275 | data = smb_buf(req->outbuf);
|
---|
| 276 |
|
---|
| 277 | nread = read_from_pipe(p, data, smb_maxcnt, &unused);
|
---|
| 278 |
|
---|
| 279 | if (nread < 0) {
|
---|
| 280 | reply_doserror(req, ERRDOS, ERRnoaccess);
|
---|
| 281 | return;
|
---|
| 282 | }
|
---|
| 283 |
|
---|
| 284 | srv_set_message((char *)req->outbuf, 12, nread, False);
|
---|
| 285 |
|
---|
| 286 | SSVAL(req->outbuf,smb_vwv5,nread);
|
---|
| 287 | SSVAL(req->outbuf,smb_vwv6,smb_offset(data,req->outbuf));
|
---|
| 288 | SSVAL(smb_buf(req->outbuf),-2,nread);
|
---|
| 289 |
|
---|
| 290 | DEBUG(3,("readX-IPC pnum=%04x min=%d max=%d nread=%d\n",
|
---|
| 291 | p->pnum, smb_mincnt, smb_maxcnt, nread));
|
---|
| 292 |
|
---|
| 293 | chain_reply(req);
|
---|
| 294 | }
|
---|
| 295 |
|
---|
| 296 | /****************************************************************************
|
---|
| 297 | Reply to a close.
|
---|
| 298 | ****************************************************************************/
|
---|
| 299 |
|
---|
| 300 | void reply_pipe_close(connection_struct *conn, struct smb_request *req)
|
---|
| 301 | {
|
---|
| 302 | smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0));
|
---|
| 303 |
|
---|
| 304 | if (!p) {
|
---|
| 305 | reply_doserror(req, ERRDOS, ERRbadfid);
|
---|
| 306 | return;
|
---|
| 307 | }
|
---|
| 308 |
|
---|
| 309 | DEBUG(5,("reply_pipe_close: pnum:%x\n", p->pnum));
|
---|
| 310 |
|
---|
| 311 | if (!close_rpc_pipe_hnd(p)) {
|
---|
| 312 | reply_doserror(req, ERRDOS, ERRbadfid);
|
---|
| 313 | return;
|
---|
| 314 | }
|
---|
| 315 |
|
---|
| 316 | /* TODO: REMOVE PIPE FROM DB */
|
---|
| 317 |
|
---|
| 318 | reply_outbuf(req, 0, 0);
|
---|
| 319 | return;
|
---|
| 320 | }
|
---|