2 Unix SMB/Netbios implementation.
4 Pipe SMB reply routines
5 Copyright (C) Andrew Tridgell 1992-1998
6 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
7 Copyright (C) Paul Ashton 1997-1998.
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
24 This file handles reply_ calls on named pipes that the server
25 makes to handle specific protocols
32 #define PIPE "\\PIPE\\"
33 #define PIPELEN strlen(PIPE)
35 extern int DEBUGLEVEL
;
37 extern struct pipe_id_info pipe_names
[];
39 /****************************************************************************
40 reply to an open and X on a named pipe
42 This code is basically stolen from reply_open_and_X with some
43 wrinkles to handle pipes.
44 ****************************************************************************/
45 int reply_open_pipe_and_X(connection_struct
* conn
,
46 char *inbuf
, char *outbuf
, int length
, int bufsize
)
49 uint16 vuid
= SVAL(inbuf
, smb_uid
);
51 int smb_ofun
= SVAL(inbuf
, smb_vwv8
);
52 int size
= 0, fmode
= 0, mtime
= 0, rmode
= 0;
56 /* XXXX we need to handle passed times, sattr and flags */
57 pstrcpy(fname
, smb_buf(inbuf
));
59 /* If the name doesn't start \PIPE\ then this is directed */
60 /* at a mailslot or something we really, really don't understand, */
61 /* not just something we really don't understand. */
62 if (strncmp(fname
, PIPE
, PIPELEN
) != 0)
63 return (ERROR(ERRSRV
, ERRaccess
));
65 DEBUG(4, ("Opening pipe %s.\n", fname
));
67 /* See if it is one we want to handle. */
68 for (i
= 0; pipe_names
[i
].client_pipe
; i
++)
69 if (strequal(fname
, pipe_names
[i
].client_pipe
))
72 if (pipe_names
[i
].client_pipe
== NULL
)
73 return (ERROR(ERRSRV
, ERRaccess
));
75 /* Strip \PIPE\ off the name. */
76 pstrcpy(fname
, smb_buf(inbuf
) + PIPELEN
);
78 /* Known pipes arrive with DIR attribs. Remove it so a regular file */
79 /* can be opened and add it in after the open. */
80 DEBUG(3, ("Known pipe %s opening.\n", fname
));
81 smb_ofun
|= 0x10; /* Add Create it not exists flag */
85 p
= open_rpc_pipe_p(fname
, &key
, NULL
);
87 return (ERROR(ERRSRV
, ERRnofids
));
89 /* Prepare the reply */
90 set_message(outbuf
, 15, 0, True
);
92 /* Mark the opened file as an existing named pipe in message mode. */
93 SSVAL(outbuf
, smb_vwv9
, 2);
94 SSVAL(outbuf
, smb_vwv10
, 0xc700);
98 DEBUG(4, ("Resetting open result to open from create.\n"));
102 SSVAL(outbuf
, smb_vwv2
, p
->pnum
);
103 SSVAL(outbuf
, smb_vwv3
, fmode
);
104 put_dos_date3(outbuf
, smb_vwv4
, mtime
);
105 SIVAL(outbuf
, smb_vwv6
, size
);
106 SSVAL(outbuf
, smb_vwv8
, rmode
);
107 SSVAL(outbuf
, smb_vwv11
, 0x0001);
109 return chain_reply(inbuf
, outbuf
, length
, bufsize
);
112 /****************************************************************************
115 This code is basically stolen from reply_write with some
116 wrinkles to handle pipes.
117 ****************************************************************************/
118 int reply_pipe_write(char *inbuf
, char *outbuf
, int length
, int bufsize
)
120 pipes_struct
*p
= get_rpc_pipe_p(inbuf
, smb_vwv0
);
121 size_t numtowrite
= SVAL(inbuf
, smb_vwv1
);
127 return (ERROR(ERRDOS
, ERRbadfid
));
129 data
= smb_buf(inbuf
) + 3;
137 nwritten
= write_pipe(p
, data
, numtowrite
);
140 if ((nwritten
== 0 && numtowrite
!= 0) || (nwritten
< 0))
142 DEBUG(3, ("reply_write_pipe: nwritten: %d numtowrite:%d\n",
143 nwritten
, numtowrite
));
144 return (UNIXERROR(ERRDOS
, ERRnoaccess
));
147 outsize
= set_message(outbuf
, 1, 0, True
);
149 SSVAL(outbuf
, smb_vwv0
, nwritten
);
151 DEBUG(3, ("write-IPC pnum=%04x nwritten=%d\n", p
->pnum
, nwritten
));
156 /****************************************************************************
157 reply to a write and X
159 This code is basically stolen from reply_write_and_X with some
160 wrinkles to handle pipes.
161 ****************************************************************************/
162 int reply_pipe_write_and_X(char *inbuf
, char *outbuf
, int length
, int bufsize
)
164 pipes_struct
*p
= get_rpc_pipe_p(inbuf
, smb_vwv2
);
165 size_t numtowrite
= SVAL(inbuf
, smb_vwv10
);
167 int smb_doff
= SVAL(inbuf
, smb_vwv11
);
168 int write_mode
= SVAL(inbuf
, smb_vwv7
);
172 * start of message mode pipe: indicates start of dce/rpc pdu.
176 msg
= IS_BITS_SET_ALL(write_mode
, PIPE_START_MESSAGE
| PIPE_RAW_MODE
);
179 return (ERROR(ERRDOS
, ERRbadfid
));
181 data
= smb_base(inbuf
) + smb_doff
;
192 * skip the length-of-pdu, the client could be
193 * a nasty bitch and lie to us, e.g
194 * an nt-smb-writepipe-DoS attack.
201 nwritten
= write_pipe(p
, data
, numtowrite
);
203 if (msg
&& nwritten
!= 0)
209 if ((nwritten
== 0 && numtowrite
!= 0) || (nwritten
< 0))
211 return (UNIXERROR(ERRDOS
, ERRnoaccess
));
214 set_message(outbuf
, 6, 0, True
);
215 SSVAL(outbuf
, smb_vwv2
, nwritten
);
217 DEBUG(3, ("writeX-IPC pnum=%04x nwritten=%d\n", p
->pnum
, nwritten
));
219 return chain_reply(inbuf
, outbuf
, length
, bufsize
);
222 /****************************************************************************
223 reply to a read and X
225 This code is basically stolen from reply_read_and_X with some
226 wrinkles to handle pipes.
227 ****************************************************************************/
228 int reply_pipe_read_and_X(char *inbuf
, char *outbuf
, int length
, int bufsize
)
230 pipes_struct
*p
= get_rpc_pipe_p(inbuf
, smb_vwv2
);
231 int smb_maxcnt
= SVAL(inbuf
, smb_vwv5
);
232 int smb_mincnt
= SVAL(inbuf
, smb_vwv6
);
237 return (ERROR(ERRDOS
, ERRbadfid
));
239 set_message(outbuf
, 12, 0, True
);
240 data
= smb_buf(outbuf
);
242 nread
= read_pipe(p
, data
, 1, smb_maxcnt
);
245 return (UNIXERROR(ERRDOS
, ERRnoaccess
));
247 SSVAL(outbuf
, smb_vwv5
, nread
);
248 SSVAL(outbuf
, smb_vwv6
, smb_offset(data
, outbuf
));
249 SSVAL(smb_buf(outbuf
), -2, nread
);
251 DEBUG(3, ("readX-IPC pnum=%04x min=%d max=%d nread=%d\n",
252 p
->pnum
, smb_mincnt
, smb_maxcnt
, nread
));
254 return chain_reply(inbuf
, outbuf
, length
, bufsize
);
257 /****************************************************************************
259 ****************************************************************************/
260 int reply_pipe_close(connection_struct
* conn
, char *inbuf
, char *outbuf
)
262 pipes_struct
*p
= get_rpc_pipe_p(inbuf
, smb_vwv0
);
263 int outsize
= set_message(outbuf
, 0, 0, True
);
266 return (ERROR(ERRDOS
, ERRbadfid
));
268 DEBUG(5, ("reply_pipe_close: pnum:%x\n", p
->pnum
));
270 if (!close_rpc_pipe_hnd(p
))
271 return (ERROR(ERRDOS
, ERRbadfid
));