negoex.idl: use DATA_BLOB for negoex_BYTE_VECTOR
[Samba.git] / source3 / smbd / pipes.c
blob455dbf0cf4965b3197665cd7313ab57ceca0304a
1 /*
2 Unix SMB/CIFS implementation.
3 Pipe SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6 Copyright (C) Paul Ashton 1997-1998.
7 Copyright (C) Jeremy Allison 2005.
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 This file handles reply_ calls on named pipes that the server
24 makes to handle specific protocols
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "smbd/globals.h"
31 #include "libcli/security/security.h"
32 #include "rpc_server/srv_pipe_hnd.h"
34 NTSTATUS open_np_file(struct smb_request *smb_req, const char *name,
35 struct files_struct **pfsp)
37 struct connection_struct *conn = smb_req->conn;
38 struct files_struct *fsp;
39 struct smb_filename *smb_fname = NULL;
40 NTSTATUS status;
42 status = file_new(smb_req, conn, &fsp);
43 if (!NT_STATUS_IS_OK(status)) {
44 DEBUG(0, ("file_new failed: %s\n", nt_errstr(status)));
45 return status;
48 fsp->conn = conn;
49 fsp->fh->fd = -1;
50 fsp->vuid = smb_req->vuid;
51 fsp->can_lock = false;
52 fsp->access_mask = FILE_READ_DATA | FILE_WRITE_DATA;
54 smb_fname = synthetic_smb_fname(talloc_tos(), name, NULL, NULL);
55 if (smb_fname == NULL) {
56 file_free(smb_req, fsp);
57 return NT_STATUS_NO_MEMORY;
59 status = fsp_set_smb_fname(fsp, smb_fname);
60 TALLOC_FREE(smb_fname);
61 if (!NT_STATUS_IS_OK(status)) {
62 file_free(smb_req, fsp);
63 return status;
66 status = np_open(fsp, name,
67 conn->sconn->local_address,
68 conn->sconn->remote_address,
69 conn->session_info,
70 conn->sconn->ev_ctx,
71 conn->sconn->msg_ctx,
72 &fsp->fake_file_handle);
73 if (!NT_STATUS_IS_OK(status)) {
74 DEBUG(10, ("np_open(%s) returned %s\n", name,
75 nt_errstr(status)));
76 file_free(smb_req, fsp);
77 return status;
80 *pfsp = fsp;
82 return NT_STATUS_OK;
85 /****************************************************************************
86 Reply to an open and X on a named pipe.
87 This code is basically stolen from reply_open_and_X with some
88 wrinkles to handle pipes.
89 ****************************************************************************/
91 void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req)
93 const char *fname = NULL;
94 char *pipe_name = NULL;
95 files_struct *fsp;
96 TALLOC_CTX *ctx = talloc_tos();
97 NTSTATUS status;
99 /* XXXX we need to handle passed times, sattr and flags */
100 srvstr_pull_req_talloc(ctx, req, &pipe_name, req->buf, STR_TERMINATE);
101 if (!pipe_name) {
102 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
103 ERRDOS, ERRbadpipe);
104 return;
107 /* If the name doesn't start \PIPE\ then this is directed */
108 /* at a mailslot or something we really, really don't understand, */
109 /* not just something we really don't understand. */
111 #define PIPE "PIPE\\"
112 #define PIPELEN strlen(PIPE)
114 fname = pipe_name;
115 while (fname[0] == '\\') {
116 fname++;
118 if (!strnequal(fname, PIPE, PIPELEN)) {
119 reply_nterror(req, NT_STATUS_OBJECT_PATH_SYNTAX_BAD);
120 return;
122 fname += PIPELEN;
123 while (fname[0] == '\\') {
124 fname++;
127 DEBUG(4,("Opening pipe %s => %s.\n", pipe_name, fname));
129 #if 0
131 * Hack for NT printers... JRA.
133 if(should_fail_next_srvsvc_open(fname)) {
134 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
135 return;
137 #endif
139 status = open_np_file(req, fname, &fsp);
140 if (!NT_STATUS_IS_OK(status)) {
141 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
142 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
143 ERRDOS, ERRbadpipe);
144 return;
146 reply_nterror(req, status);
147 return;
150 /* Prepare the reply */
151 reply_outbuf(req, 15, 0);
153 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
154 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
156 /* Mark the opened file as an existing named pipe in message mode. */
157 SSVAL(req->outbuf,smb_vwv9,2);
158 SSVAL(req->outbuf,smb_vwv10,0xc700);
160 SSVAL(req->outbuf, smb_vwv2, fsp->fnum);
161 SSVAL(req->outbuf, smb_vwv3, 0); /* fmode */
162 srv_put_dos_date3((char *)req->outbuf, smb_vwv4, 0); /* mtime */
163 SIVAL(req->outbuf, smb_vwv6, 0); /* size */
164 SSVAL(req->outbuf, smb_vwv8, 0); /* rmode */
165 SSVAL(req->outbuf, smb_vwv11, 0x0001);
168 /****************************************************************************
169 Reply to a write on a pipe.
170 ****************************************************************************/
172 struct pipe_write_state {
173 size_t numtowrite;
176 static void pipe_write_done(struct tevent_req *subreq);
178 void reply_pipe_write(struct smb_request *req)
180 files_struct *fsp = file_fsp(req, SVAL(req->vwv+0, 0));
181 const uint8_t *data;
182 struct pipe_write_state *state;
183 struct tevent_req *subreq;
185 if (!fsp_is_np(fsp)) {
186 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
187 return;
190 if (fsp->vuid != req->vuid) {
191 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
192 return;
195 state = talloc(req, struct pipe_write_state);
196 if (state == NULL) {
197 reply_nterror(req, NT_STATUS_NO_MEMORY);
198 return;
200 req->async_priv = state;
202 state->numtowrite = SVAL(req->vwv+1, 0);
204 data = req->buf + 3;
206 DEBUG(6, ("reply_pipe_write: %s, name: %s len: %d\n", fsp_fnum_dbg(fsp),
207 fsp_str_dbg(fsp), (int)state->numtowrite));
209 subreq = np_write_send(state, req->sconn->ev_ctx,
210 fsp->fake_file_handle, data, state->numtowrite);
211 if (subreq == NULL) {
212 TALLOC_FREE(state);
213 reply_nterror(req, NT_STATUS_NO_MEMORY);
214 return;
216 tevent_req_set_callback(subreq, pipe_write_done,
217 talloc_move(req->conn, &req));
220 static void pipe_write_done(struct tevent_req *subreq)
222 struct smb_request *req = tevent_req_callback_data(
223 subreq, struct smb_request);
224 struct pipe_write_state *state = talloc_get_type_abort(
225 req->async_priv, struct pipe_write_state);
226 NTSTATUS status;
227 ssize_t nwritten = -1;
229 status = np_write_recv(subreq, &nwritten);
230 TALLOC_FREE(subreq);
231 if (nwritten < 0) {
232 reply_nterror(req, status);
233 goto send;
236 /* Looks bogus to me now. Needs to be removed ? JRA. */
237 if ((nwritten == 0 && state->numtowrite != 0)) {
238 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
239 goto send;
242 reply_outbuf(req, 1, 0);
244 SSVAL(req->outbuf,smb_vwv0,nwritten);
246 DEBUG(3,("write-IPC nwritten=%d\n", (int)nwritten));
248 send:
249 if (!srv_send_smb(req->xconn, (char *)req->outbuf,
250 true, req->seqnum+1,
251 IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
252 &req->pcd)) {
253 exit_server_cleanly("construct_reply: srv_send_smb failed.");
255 TALLOC_FREE(req);
258 /****************************************************************************
259 Reply to a write and X.
261 This code is basically stolen from reply_write_and_X with some
262 wrinkles to handle pipes.
263 ****************************************************************************/
265 struct pipe_write_andx_state {
266 bool pipe_start_message_raw;
267 size_t numtowrite;
270 static void pipe_write_andx_done(struct tevent_req *subreq);
272 void reply_pipe_write_and_X(struct smb_request *req)
274 files_struct *fsp = file_fsp(req, SVAL(req->vwv+2, 0));
275 int smb_doff = SVAL(req->vwv+11, 0);
276 const uint8_t *data;
277 struct pipe_write_andx_state *state;
278 struct tevent_req *subreq;
280 if (!fsp_is_np(fsp)) {
281 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
282 return;
285 if (fsp->vuid != req->vuid) {
286 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
287 return;
290 state = talloc(req, struct pipe_write_andx_state);
291 if (state == NULL) {
292 reply_nterror(req, NT_STATUS_NO_MEMORY);
293 return;
295 req->async_priv = state;
297 state->numtowrite = SVAL(req->vwv+10, 0);
298 state->pipe_start_message_raw =
299 ((SVAL(req->vwv+7, 0) & (PIPE_START_MESSAGE|PIPE_RAW_MODE))
300 == (PIPE_START_MESSAGE|PIPE_RAW_MODE));
302 DEBUG(6, ("reply_pipe_write_and_X: %s, name: %s len: %d\n",
303 fsp_fnum_dbg(fsp), fsp_str_dbg(fsp), (int)state->numtowrite));
305 data = (const uint8_t *)smb_base(req->inbuf) + smb_doff;
307 if (state->pipe_start_message_raw) {
309 * For the start of a message in named pipe byte mode,
310 * the first two bytes are a length-of-pdu field. Ignore
311 * them (we don't trust the client). JRA.
313 if (state->numtowrite < 2) {
314 DEBUG(0,("reply_pipe_write_and_X: start of message "
315 "set and not enough data sent.(%u)\n",
316 (unsigned int)state->numtowrite ));
317 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
318 return;
321 data += 2;
322 state->numtowrite -= 2;
325 subreq = np_write_send(state, req->sconn->ev_ctx,
326 fsp->fake_file_handle, data, state->numtowrite);
327 if (subreq == NULL) {
328 TALLOC_FREE(state);
329 reply_nterror(req, NT_STATUS_NO_MEMORY);
330 return;
332 tevent_req_set_callback(subreq, pipe_write_andx_done,
333 talloc_move(req->conn, &req));
336 static void pipe_write_andx_done(struct tevent_req *subreq)
338 struct smb_request *req = tevent_req_callback_data(
339 subreq, struct smb_request);
340 struct pipe_write_andx_state *state = talloc_get_type_abort(
341 req->async_priv, struct pipe_write_andx_state);
342 NTSTATUS status;
343 ssize_t nwritten = -1;
345 status = np_write_recv(subreq, &nwritten);
346 TALLOC_FREE(subreq);
348 if (!NT_STATUS_IS_OK(status)) {
349 reply_nterror(req, status);
350 goto done;
353 /* Looks bogus to me now. Is this error message correct ? JRA. */
354 if (nwritten != state->numtowrite) {
355 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
356 goto done;
359 reply_outbuf(req, 6, 0);
361 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
362 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
364 nwritten = (state->pipe_start_message_raw ? nwritten + 2 : nwritten);
365 SSVAL(req->outbuf,smb_vwv2,nwritten);
367 DEBUG(3,("writeX-IPC nwritten=%d\n", (int)nwritten));
369 done:
371 * We must free here as the ownership of req was
372 * moved to the connection struct in reply_pipe_write_and_X().
374 smb_request_done(req);
377 /****************************************************************************
378 Reply to a read and X.
379 This code is basically stolen from reply_read_and_X with some
380 wrinkles to handle pipes.
381 ****************************************************************************/
383 struct pipe_read_andx_state {
384 uint8_t *outbuf;
385 int smb_mincnt;
386 int smb_maxcnt;
389 static void pipe_read_andx_done(struct tevent_req *subreq);
391 void reply_pipe_read_and_X(struct smb_request *req)
393 files_struct *fsp = file_fsp(req, SVAL(req->vwv+0, 0));
394 uint8_t *data;
395 struct pipe_read_andx_state *state;
396 struct tevent_req *subreq;
398 /* we don't use the offset given to use for pipe reads. This
399 is deliberate, instead we always return the next lump of
400 data on the pipe */
401 #if 0
402 uint32_t smb_offs = IVAL(req->vwv+3, 0);
403 #endif
405 if (!fsp_is_np(fsp)) {
406 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
407 return;
410 if (fsp->vuid != req->vuid) {
411 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
412 return;
415 state = talloc(req, struct pipe_read_andx_state);
416 if (state == NULL) {
417 reply_nterror(req, NT_STATUS_NO_MEMORY);
418 return;
420 req->async_priv = state;
422 state->smb_maxcnt = SVAL(req->vwv+5, 0);
423 state->smb_mincnt = SVAL(req->vwv+6, 0);
425 reply_outbuf(req, 12, state->smb_maxcnt + 1 /* padding byte */);
426 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
427 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
428 SCVAL(smb_buf(req->outbuf), 0, 0); /* padding byte */
430 data = (uint8_t *)smb_buf(req->outbuf) + 1 /* padding byte */;
433 * We have to tell the upper layers that we're async.
435 state->outbuf = req->outbuf;
436 req->outbuf = NULL;
438 subreq = np_read_send(state, req->sconn->ev_ctx,
439 fsp->fake_file_handle, data,
440 state->smb_maxcnt);
441 if (subreq == NULL) {
442 reply_nterror(req, NT_STATUS_NO_MEMORY);
443 return;
445 tevent_req_set_callback(subreq, pipe_read_andx_done,
446 talloc_move(req->conn, &req));
449 static void pipe_read_andx_done(struct tevent_req *subreq)
451 struct smb_request *req = tevent_req_callback_data(
452 subreq, struct smb_request);
453 struct pipe_read_andx_state *state = talloc_get_type_abort(
454 req->async_priv, struct pipe_read_andx_state);
455 NTSTATUS status;
456 ssize_t nread;
457 bool is_data_outstanding;
459 status = np_read_recv(subreq, &nread, &is_data_outstanding);
460 TALLOC_FREE(subreq);
461 if (!NT_STATUS_IS_OK(status)) {
462 NTSTATUS old = status;
463 status = nt_status_np_pipe(old);
464 reply_nterror(req, status);
465 goto done;
468 req->outbuf = state->outbuf;
469 state->outbuf = NULL;
471 srv_set_message((char *)req->outbuf, 12, nread + 1 /* padding byte */,
472 false);
474 #if 0
476 * we should return STATUS_BUFFER_OVERFLOW if there's
477 * out standing data.
479 * But we can't enable it yet, as it has bad interactions
480 * with fixup_chain_error_packet() in chain_reply().
482 if (is_data_outstanding) {
483 error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
484 STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
486 #endif
488 SSVAL(req->outbuf,smb_vwv5,nread);
489 SSVAL(req->outbuf,smb_vwv6,
490 (smb_wct - 4) /* offset from smb header to wct */
491 + 1 /* the wct field */
492 + 12 * sizeof(uint16_t) /* vwv */
493 + 2 /* the buflen field */
494 + 1); /* padding byte */
495 SSVAL(req->outbuf,smb_vwv11,state->smb_maxcnt);
497 DEBUG(3,("readX-IPC min=%d max=%d nread=%d\n",
498 state->smb_mincnt, state->smb_maxcnt, (int)nread));
500 done:
502 * We must free here as the ownership of req was
503 * moved to the connection struct in reply_pipe_read_and_X().
505 smb_request_done(req);