source/smbd/pipes.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Pipe SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Luke Kenneth Casson Leighton 1996-1998
   6    Copyright (C) Paul Ashton  1997-1998.
   7    Copyright (C) Jeremy Allison 2005.
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles reply_ calls on named pipes that the server
  24    makes to handle specific protocols
  25 */
  26
  27
  28 #include "includes.h"
  29
  30 #define PIPE            "\\PIPE\\"
  31 #define PIPELEN         strlen(PIPE)
  32
  33 #define MAX_PIPE_NAME_LEN       24
  34
  35 /* PIPE/<name>/<pid>/<pnum> */
  36 #define PIPEDB_KEY_FORMAT "PIPE/%s/%u/%d"
  37
  38 struct pipe_dbrec {
  39         struct server_id pid;
  40         int pnum;
  41         uid_t uid;
  42
  43         char name[MAX_PIPE_NAME_LEN];
  44         fstring user;
  45 };
  46
  47
  48 extern struct pipe_id_info pipe_names[];
  49
  50 /****************************************************************************
  51  Reply to an open and X on a named pipe.
  52  This code is basically stolen from reply_open_and_X with some
  53  wrinkles to handle pipes.
  54 ****************************************************************************/
  55
  56 void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req)
  57 {
  58         const char *fname = NULL;
  59         char *pipe_name = NULL;
  60         smb_np_struct *p;
  61         int size=0,fmode=0,mtime=0,rmode=0;
  62         int i;
  63         TALLOC_CTX *ctx = talloc_tos();
  64
  65         /* XXXX we need to handle passed times, sattr and flags */
  66         srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &pipe_name,
  67                         smb_buf(req->inbuf), STR_TERMINATE);
  68         if (!pipe_name) {
  69                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
  70                                 ERRDOS, ERRbadpipe);
  71                 return;
  72         }
  73
  74         /* If the name doesn't start \PIPE\ then this is directed */
  75         /* at a mailslot or something we really, really don't understand, */
  76         /* not just something we really don't understand. */
  77         if ( strncmp(pipe_name,PIPE,PIPELEN) != 0 ) {
  78                 reply_doserror(req, ERRSRV, ERRaccess);
  79                 return;
  80         }
  81
  82         DEBUG(4,("Opening pipe %s.\n", pipe_name));
  83
  84         /* See if it is one we want to handle. */
  85         for( i = 0; pipe_names[i].client_pipe ; i++ ) {
  86                 if( strequal(pipe_name,pipe_names[i].client_pipe)) {
  87                         break;
  88                 }
  89         }
  90
  91         if (pipe_names[i].client_pipe == NULL) {
  92                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
  93                                 ERRDOS, ERRbadpipe);
  94                 return;
  95         }
  96
  97         /* Strip \PIPE\ off the name. */
  98         fname = pipe_name + PIPELEN;
  99
 100 #if 0
 101         /*
 102          * Hack for NT printers... JRA.
 103          */
 104         if(should_fail_next_srvsvc_open(fname)) {
 105                 reply_doserror(req, ERRSRV, ERRaccess);
 106                 return;
 107         }
 108 #endif
 109
 110         /* Known pipes arrive with DIR attribs. Remove it so a regular file */
 111         /* can be opened and add it in after the open. */
 112         DEBUG(3,("Known pipe %s opening.\n",fname));
 113
 114         p = open_rpc_pipe_p(fname, conn, req->vuid);
 115         if (!p) {
 116                 reply_doserror(req, ERRSRV, ERRnofids);
 117                 return;
 118         }
 119
 120         /* Prepare the reply */
 121         reply_outbuf(req, 15, 0);
 122
 123         /* Mark the opened file as an existing named pipe in message mode. */
 124         SSVAL(req->outbuf,smb_vwv9,2);
 125         SSVAL(req->outbuf,smb_vwv10,0xc700);
 126
 127         if (rmode == 2) {
 128                 DEBUG(4,("Resetting open result to open from create.\n"));
 129                 rmode = 1;
 130         }
 131
 132         SSVAL(req->outbuf,smb_vwv2, p->pnum);
 133         SSVAL(req->outbuf,smb_vwv3,fmode);
 134         srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
 135         SIVAL(req->outbuf,smb_vwv6,size);
 136         SSVAL(req->outbuf,smb_vwv8,rmode);
 137         SSVAL(req->outbuf,smb_vwv11,0x0001);
 138
 139         chain_reply(req);
 140         return;
 141 }
 142
 143 /****************************************************************************
 144  Reply to a write on a pipe.
 145 ****************************************************************************/
 146
 147 void reply_pipe_write(struct smb_request *req)
 148 {
 149         smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0));
 150         size_t numtowrite = SVAL(req->inbuf,smb_vwv1);
 151         int nwritten;
 152         char *data;
 153
 154         if (!p) {
 155                 reply_doserror(req, ERRDOS, ERRbadfid);
 156                 return;
 157         }
 158
 159         if (p->vuid != req->vuid) {
 160                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 161                 return;
 162         }
 163
 164         data = smb_buf(req->inbuf) + 3;
 165
 166         if (numtowrite == 0) {
 167                 nwritten = 0;
 168         } else {
 169                 nwritten = write_to_pipe(p, data, numtowrite);
 170         }
 171
 172         if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) {
 173                 reply_unixerror(req, ERRDOS, ERRnoaccess);
 174                 return;
 175         }
 176
 177         reply_outbuf(req, 1, 0);
 178
 179         SSVAL(req->outbuf,smb_vwv0,nwritten);
 180
 181         DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten));
 182
 183         return;
 184 }
 185
 186 /****************************************************************************
 187  Reply to a write and X.
 188
 189  This code is basically stolen from reply_write_and_X with some
 190  wrinkles to handle pipes.
 191 ****************************************************************************/
 192
 193 void reply_pipe_write_and_X(struct smb_request *req)
 194 {
 195         smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2));
 196         size_t numtowrite = SVAL(req->inbuf,smb_vwv10);
 197         int nwritten = -1;
 198         int smb_doff = SVAL(req->inbuf, smb_vwv11);
 199         bool pipe_start_message_raw =
 200                 ((SVAL(req->inbuf, smb_vwv7)
 201                   & (PIPE_START_MESSAGE|PIPE_RAW_MODE))
 202                  == (PIPE_START_MESSAGE|PIPE_RAW_MODE));
 203         char *data;
 204
 205         if (!p) {
 206                 reply_doserror(req, ERRDOS, ERRbadfid);
 207                 return;
 208         }
 209
 210         if (p->vuid != req->vuid) {
 211                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 212                 return;
 213         }
 214
 215         data = smb_base(req->inbuf) + smb_doff;
 216
 217         if (numtowrite == 0) {
 218                 nwritten = 0;
 219         } else {
 220                 if(pipe_start_message_raw) {
 221                         /*
 222                          * For the start of a message in named pipe byte mode,
 223                          * the first two bytes are a length-of-pdu field. Ignore
 224                          * them (we don't trust the client). JRA.
 225                          */
 226                        if(numtowrite < 2) {
 227                                 DEBUG(0,("reply_pipe_write_and_X: start of "
 228                                          "message set and not enough data "
 229                                          "sent.(%u)\n",
 230                                          (unsigned int)numtowrite ));
 231                                 reply_unixerror(req, ERRDOS, ERRnoaccess);
 232                                 return;
 233                         }
 234
 235                         data += 2;
 236                         numtowrite -= 2;
 237                 }
 238                 nwritten = write_to_pipe(p, data, numtowrite);
 239         }
 240
 241         if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) {
 242                 reply_unixerror(req, ERRDOS,ERRnoaccess);
 243                 return;
 244         }
 245
 246         reply_outbuf(req, 6, 0);
 247
 248         nwritten = (pipe_start_message_raw ? nwritten + 2 : nwritten);
 249         SSVAL(req->outbuf,smb_vwv2,nwritten);
 250
 251         DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten));
 252
 253         chain_reply(req);
 254 }
 255
 256 /****************************************************************************
 257  Reply to a read and X.
 258  This code is basically stolen from reply_read_and_X with some
 259  wrinkles to handle pipes.
 260 ****************************************************************************/
 261
 262 void reply_pipe_read_and_X(struct smb_request *req)
 263 {
 264         smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2));
 265         int smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
 266         int smb_mincnt = SVAL(req->inbuf,smb_vwv6);
 267         int nread = -1;
 268         char *data;
 269         bool unused;
 270
 271         /* we don't use the offset given to use for pipe reads. This
 272            is deliberate, instead we always return the next lump of
 273            data on the pipe */
 274 #if 0
 275         uint32 smb_offs = IVAL(req->inbuf,smb_vwv3);
 276 #endif
 277
 278         if (!p) {
 279                 reply_doserror(req, ERRDOS, ERRbadfid);
 280                 return;
 281         }
 282
 283         reply_outbuf(req, 12, smb_maxcnt);
 284
 285         data = smb_buf(req->outbuf);
 286
 287         nread = read_from_pipe(p, data, smb_maxcnt, &unused);
 288
 289         if (nread < 0) {
 290                 reply_doserror(req, ERRDOS, ERRnoaccess);
 291                 return;
 292         }
 293
 294         srv_set_message((char *)req->outbuf, 12, nread, False);
 295
 296         SSVAL(req->outbuf,smb_vwv5,nread);
 297         SSVAL(req->outbuf,smb_vwv6,smb_offset(data,req->outbuf));
 298         SSVAL(smb_buf(req->outbuf),-2,nread);
 299
 300         DEBUG(3,("readX-IPC pnum=%04x min=%d max=%d nread=%d\n",
 301                  p->pnum, smb_mincnt, smb_maxcnt, nread));
 302
 303         chain_reply(req);
 304 }
 305
 306 /****************************************************************************
 307  Reply to a close.
 308 ****************************************************************************/
 309
 310 void reply_pipe_close(connection_struct *conn, struct smb_request *req)
 311 {
 312         smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0));
 313
 314         if (!p) {
 315                 reply_doserror(req, ERRDOS, ERRbadfid);
 316                 return;
 317         }
 318
 319         DEBUG(5,("reply_pipe_close: pnum:%x\n", p->pnum));
 320
 321         if (!close_rpc_pipe_hnd(p)) {
 322                 reply_doserror(req, ERRDOS, ERRbadfid);
 323                 return;
 324         }
 325
 326         /* TODO: REMOVE PIPE FROM DB */
 327
 328         reply_outbuf(req, 0, 0);
 329         return;
 330 }