source/rpc_server/srv_pipe_hnd.c

   1
   2 /*
   3  *  Unix SMB/Netbios implementation.
   4  *  Version 1.9.
   5  *  RPC Pipe client / server routines
   6  *  Copyright (C) Andrew Tridgell              1992-1998,
   7  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24
  25 #include "includes.h"
  26
  27
  28 #define PIPE            "\\PIPE\\"
  29 #define PIPELEN         strlen(PIPE)
  30
  31 extern int DEBUGLEVEL;
  32 static pipes_struct *chain_p;
  33 static int pipes_open;
  34
  35 #ifndef MAX_OPEN_PIPES
  36 #define MAX_OPEN_PIPES 64
  37 #endif
  38
  39 static pipes_struct *Pipes;
  40 static struct bitmap *bmap;
  41
  42 /* this must be larger than the sum of the open files and directories */
  43 static int pipe_handle_offset;
  44
  45 /****************************************************************************
  46  Set the pipe_handle_offset. Called from smbd/files.c
  47 ****************************************************************************/
  48
  49 void set_pipe_handle_offset(int max_open_files)
  50 {
  51   if(max_open_files < 0x7000)
  52     pipe_handle_offset = 0x7000;
  53   else
  54     pipe_handle_offset = max_open_files + 10; /* For safety. :-) */
  55 }
  56
  57 /****************************************************************************
  58   reset pipe chain handle number
  59 ****************************************************************************/
  60 void reset_chain_p(void)
  61 {
  62         chain_p = NULL;
  63 }
  64
  65 /****************************************************************************
  66   initialise pipe handle states...
  67 ****************************************************************************/
  68 void init_rpc_pipe_hnd(void)
  69 {
  70         bmap = bitmap_allocate(MAX_OPEN_PIPES);
  71         if (!bmap) {
  72                 exit_server("out of memory in init_rpc_pipe_hnd\n");
  73         }
  74 }
  75
  76
  77 /****************************************************************************
  78   find first available file slot
  79 ****************************************************************************/
  80 pipes_struct *open_rpc_pipe_p(char *pipe_name,
  81                               connection_struct *conn, uint16 vuid)
  82 {
  83         int i;
  84         pipes_struct *p;
  85         static int next_pipe;
  86         struct msrpc_state *m = NULL;
  87         struct rpcsrv_struct *l = NULL;
  88         user_struct *vuser = get_valid_user_struct(vuid);
  89         struct user_creds usr;
  90
  91         ZERO_STRUCT(usr);
  92
  93         DEBUG(4,("Open pipe requested %s (pipes_open=%d)\n",
  94                  pipe_name, pipes_open));
  95
  96         if (vuser == NULL)
  97         {
  98                 DEBUG(4,("invalid vuid %d\n", vuid));
  99                 return NULL;
 100         }
 101
 102         /* set up unix credentials from the smb side, to feed over the pipe */
 103         make_creds_unix(&usr.uxc, vuser->name, vuser->requested_name,
 104                                       vuser->real_name, vuser->guest);
 105         usr.ptr_uxc = 1;
 106         make_creds_unix_sec(&usr.uxs, vuser->uid, vuser->gid,
 107                                       vuser->n_groups, vuser->groups);
 108         usr.ptr_uxs = 1;
 109
 110         /* set up nt credentials from the smb side, to feed over the pipe */
 111         /* lkclXXXX todo!
 112         make_creds_nt(&usr.ntc);
 113         make_creds_nt_sec(&usr.nts);
 114         */
 115
 116         /* not repeating pipe numbers makes it easier to track things in
 117            log files and prevents client bugs where pipe numbers are reused
 118            over connection restarts */
 119         if (next_pipe == 0)
 120         {
 121                 next_pipe = (getpid() ^ time(NULL)) % MAX_OPEN_PIPES;
 122         }
 123
 124         i = bitmap_find(bmap, next_pipe);
 125
 126         if (i == -1) {
 127                 DEBUG(0,("ERROR! Out of pipe structures\n"));
 128                 return NULL;
 129         }
 130
 131         next_pipe = (i+1) % MAX_OPEN_PIPES;
 132
 133         for (p = Pipes; p; p = p->next)
 134         {
 135                 DEBUG(5,("open pipes: name %s pnum=%x\n", p->name, p->pnum));
 136         }
 137
 138         become_root(False); /* to connect to pipe */
 139         m = msrpc_use_add(pipe_name, &usr, False);
 140         unbecome_root(False);
 141
 142         if (m == NULL)
 143         {
 144                 DEBUG(5,("open pipes: msrpc redirect failed\n"));
 145                 return NULL;
 146         }
 147 #if 0
 148         }
 149         else
 150         {
 151                 l = malloc(sizeof(*l));
 152                 if (l == NULL)
 153                 {
 154                         DEBUG(5,("open pipes: local msrpc malloc failed\n"));
 155                         return NULL;
 156                 }
 157                 ZERO_STRUCTP(l);
 158                 l->rhdr.data  = NULL;
 159                 l->rdata.data = NULL;
 160                 l->rhdr.offset  = 0;
 161                 l->rdata.offset = 0;
 162
 163                 l->ntlmssp_validated = False;
 164                 l->ntlmssp_auth      = False;
 165
 166                 memcpy(l->user_sess_key, vuser->user_sess_key,
 167                        sizeof(l->user_sess_key));
 168         }
 169 #endif
 170
 171         p = (pipes_struct *)malloc(sizeof(*p));
 172         if (!p) return NULL;
 173
 174         ZERO_STRUCTP(p);
 175         DLIST_ADD(Pipes, p);
 176
 177         bitmap_set(bmap, i);
 178         i += pipe_handle_offset;
 179
 180         pipes_open++;
 181
 182         p->pnum = i;
 183         p->m = m;
 184         p->l = l;
 185
 186         p->open = True;
 187         p->device_state = 0;
 188         p->priority = 0;
 189         p->conn = conn;
 190         p->vuid  = vuid;
 191
 192         p->file_offset     = 0;
 193         p->prev_pdu_file_offset = 0;
 194         p->hdr_offsets     = 0;
 195
 196         fstrcpy(p->name, pipe_name);
 197
 198         prs_init(&p->smb_pdu, 0, 4, True);
 199         prs_init(&p->rsmb_pdu, 0, 4, False);
 200
 201         DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n",
 202                  pipe_name, i, pipes_open));
 203
 204         chain_p = p;
 205
 206         /* OVERWRITE p as a temp variable, to display all open pipes */
 207         for (p = Pipes; p; p = p->next)
 208         {
 209                 DEBUG(5,("open pipes: name %s pnum=%x\n", p->name, p->pnum));
 210         }
 211
 212         return chain_p;
 213 }
 214
 215
 216
 217 /****************************************************************************
 218   wait device state on a pipe.  exactly what this is for is unknown...
 219 ****************************************************************************/
 220 BOOL wait_rpc_pipe_hnd_state(pipes_struct *p, uint16 priority)
 221 {
 222         if (p == NULL) return False;
 223
 224         if (p->open)
 225         {
 226                 DEBUG(3,("%s Setting pipe wait state priority=%x on pipe (name=%s)\n",
 227                          timestring(), priority, p->name));
 228
 229                 p->priority = priority;
 230
 231                 return True;
 232         }
 233
 234         DEBUG(3,("%s Error setting pipe wait state priority=%x (name=%s)\n",
 235                  timestring(), priority, p->name));
 236         return False;
 237 }
 238
 239
 240 /****************************************************************************
 241   set device state on a pipe.  exactly what this is for is unknown...
 242 ****************************************************************************/
 243 BOOL set_rpc_pipe_hnd_state(pipes_struct *p, uint16 device_state)
 244 {
 245         if (p == NULL) return False;
 246
 247         if (p->open) {
 248                 DEBUG(3,("%s Setting pipe device state=%x on pipe (name=%s)\n",
 249                          timestring(), device_state, p->name));
 250
 251                 p->device_state = device_state;
 252
 253                 return True;
 254         }
 255
 256         DEBUG(3,("%s Error setting pipe device state=%x (name=%s)\n",
 257                  timestring(), device_state, p->name));
 258         return False;
 259 }
 260
 261 /*******************************************************************
 262  frees all temporary data used in construction of pdu
 263  ********************************************************************/
 264 void rpcsrv_free_temp(rpcsrv_struct *l)
 265 {
 266         prs_free_data(&l->data_i);
 267
 268         prs_free_data(&l->rhdr );
 269         prs_free_data(&l->rfault );
 270         prs_free_data(&l->rdata_i);
 271         prs_free_data(&l->rauth  );
 272         prs_free_data(&l->rverf  );
 273         prs_free_data(&l->rntlm  );
 274 }
 275
 276 /****************************************************************************
 277   close an rpc pipe
 278 ****************************************************************************/
 279 BOOL close_rpc_pipe_hnd(pipes_struct *p, connection_struct *conn)
 280 {
 281         if (!p) {
 282                 DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n"));
 283                 return False;
 284         }
 285
 286         prs_free_data(&p->smb_pdu );
 287         prs_free_data(&p->rsmb_pdu);
 288
 289         bitmap_clear(bmap, p->pnum - pipe_handle_offset);
 290
 291         pipes_open--;
 292
 293         DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n",
 294                  p->name, p->pnum, pipes_open));
 295
 296         DLIST_REMOVE(Pipes, p);
 297
 298         if (p->m != NULL)
 299         {
 300                 DEBUG(4,("closed msrpc redirect: "));
 301                 if (msrpc_use_del(p->m->pipe_name, &p->m->usr, False, NULL))
 302                 {
 303                         DEBUG(4,("OK\n"));
 304                 }
 305                 else
 306                 {
 307                         DEBUG(4,("FAILED\n"));
 308                 }
 309         }
 310
 311         if (p->l != NULL)
 312         {
 313                 DEBUG(4,("closed msrpc local: OK\n"));
 314
 315                 prs_free_data(&p->l->rdata);
 316                 rpcsrv_free_temp(p->l);
 317
 318                 free(p->l);
 319         }
 320
 321         ZERO_STRUCTP(p);
 322         free(p);
 323
 324         return True;
 325 }
 326
 327 /****************************************************************************
 328   close an rpc pipe
 329 ****************************************************************************/
 330 pipes_struct *get_rpc_pipe_p(char *buf, int where)
 331 {
 332         int pnum = SVAL(buf,where);
 333
 334         if (chain_p) return chain_p;
 335
 336         return get_rpc_pipe(pnum);
 337 }
 338
 339 /****************************************************************************
 340   close an rpc pipe
 341 ****************************************************************************/
 342 pipes_struct *get_rpc_pipe(int pnum)
 343 {
 344         pipes_struct *p;
 345
 346         DEBUG(4,("search for pipe pnum=%x\n", pnum));
 347
 348         for (p=Pipes;p;p=p->next)
 349         {
 350                 DEBUG(5,("pipe name %s pnum=%x (pipes_open=%d)\n",
 351                           p->name, p->pnum, pipes_open));
 352         }
 353
 354         for (p=Pipes;p;p=p->next)
 355         {
 356                 if (p->pnum == pnum)
 357                 {
 358                         chain_p = p;
 359                         return p;
 360                 }
 361         }
 362
 363         return NULL;
 364 }
 365