source3/smbd/pipes.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Pipe SMB reply routines
   4    Copyright (C) Andrew Tridgell 1992-1998
   5    Copyright (C) Luke Kenneth Casson Leighton 1996-1998
   6    Copyright (C) Paul Ashton  1997-1998.
   7    Copyright (C) Jeremy Allison 2005.
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22 /*
  23    This file handles reply_ calls on named pipes that the server
  24    makes to handle specific protocols
  25 */
  26
  27
  28 #include "includes.h"
  29
  30 #define PIPE            "\\PIPE\\"
  31 #define PIPELEN         strlen(PIPE)
  32
  33 #define MAX_PIPE_NAME_LEN       24
  34
  35 /* PIPE/<name>/<pid>/<pnum> */
  36 #define PIPEDB_KEY_FORMAT "PIPE/%s/%u/%d"
  37
  38 struct pipe_dbrec {
  39         struct server_id pid;
  40         int pnum;
  41         uid_t uid;
  42
  43         char name[MAX_PIPE_NAME_LEN];
  44         fstring user;
  45 };
  46
  47 /****************************************************************************
  48  Reply to an open and X on a named pipe.
  49  This code is basically stolen from reply_open_and_X with some
  50  wrinkles to handle pipes.
  51 ****************************************************************************/
  52
  53 void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req)
  54 {
  55         const char *fname = NULL;
  56         char *pipe_name = NULL;
  57         files_struct *fsp;
  58         int size=0,fmode=0,mtime=0,rmode=0;
  59         TALLOC_CTX *ctx = talloc_tos();
  60         NTSTATUS status;
  61
  62         /* XXXX we need to handle passed times, sattr and flags */
  63         srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &pipe_name,
  64                         smb_buf(req->inbuf), STR_TERMINATE);
  65         if (!pipe_name) {
  66                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
  67                                 ERRDOS, ERRbadpipe);
  68                 return;
  69         }
  70
  71         /* If the name doesn't start \PIPE\ then this is directed */
  72         /* at a mailslot or something we really, really don't understand, */
  73         /* not just something we really don't understand. */
  74         if ( strncmp(pipe_name,PIPE,PIPELEN) != 0 ) {
  75                 reply_doserror(req, ERRSRV, ERRaccess);
  76                 return;
  77         }
  78
  79         DEBUG(4,("Opening pipe %s.\n", pipe_name));
  80
  81         /* See if it is one we want to handle. */
  82         if (!is_known_pipename(pipe_name)) {
  83                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
  84                                 ERRDOS, ERRbadpipe);
  85                 return;
  86         }
  87
  88         /* Strip \PIPE\ off the name. */
  89         fname = pipe_name + PIPELEN;
  90
  91 #if 0
  92         /*
  93          * Hack for NT printers... JRA.
  94          */
  95         if(should_fail_next_srvsvc_open(fname)) {
  96                 reply_doserror(req, ERRSRV, ERRaccess);
  97                 return;
  98         }
  99 #endif
 100
 101         /* Known pipes arrive with DIR attribs. Remove it so a regular file */
 102         /* can be opened and add it in after the open. */
 103         DEBUG(3,("Known pipe %s opening.\n",fname));
 104
 105         status = np_open(req, conn, fname, &fsp);
 106         if (!NT_STATUS_IS_OK(status)) {
 107                 reply_nterror(req, status);
 108                 return;
 109         }
 110
 111         /* Prepare the reply */
 112         reply_outbuf(req, 15, 0);
 113
 114         /* Mark the opened file as an existing named pipe in message mode. */
 115         SSVAL(req->outbuf,smb_vwv9,2);
 116         SSVAL(req->outbuf,smb_vwv10,0xc700);
 117
 118         if (rmode == 2) {
 119                 DEBUG(4,("Resetting open result to open from create.\n"));
 120                 rmode = 1;
 121         }
 122
 123         SSVAL(req->outbuf,smb_vwv2, fsp->fnum);
 124         SSVAL(req->outbuf,smb_vwv3,fmode);
 125         srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
 126         SIVAL(req->outbuf,smb_vwv6,size);
 127         SSVAL(req->outbuf,smb_vwv8,rmode);
 128         SSVAL(req->outbuf,smb_vwv11,0x0001);
 129
 130         chain_reply(req);
 131         return;
 132 }
 133
 134 /****************************************************************************
 135  Reply to a write on a pipe.
 136 ****************************************************************************/
 137
 138 void reply_pipe_write(struct smb_request *req)
 139 {
 140         files_struct *fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
 141         size_t numtowrite = SVAL(req->inbuf,smb_vwv1);
 142         ssize_t nwritten;
 143         uint8_t *data;
 144
 145         if (!fsp_is_np(fsp)) {
 146                 reply_doserror(req, ERRDOS, ERRbadfid);
 147                 return;
 148         }
 149
 150         if (fsp->vuid != req->vuid) {
 151                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 152                 return;
 153         }
 154
 155         data = (uint8_t *)smb_buf(req->inbuf) + 3;
 156
 157         if (numtowrite == 0) {
 158                 nwritten = 0;
 159         } else {
 160                 NTSTATUS status;
 161                 status = np_write(fsp, data, numtowrite, &nwritten);
 162                 if (!NT_STATUS_IS_OK(status)) {
 163                         reply_nterror(req, status);
 164                         return;
 165                 }
 166         }
 167
 168         if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) {
 169                 reply_unixerror(req, ERRDOS, ERRnoaccess);
 170                 return;
 171         }
 172
 173         reply_outbuf(req, 1, 0);
 174
 175         SSVAL(req->outbuf,smb_vwv0,nwritten);
 176
 177         DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n", fsp->fnum,
 178                  (int)nwritten));
 179
 180         return;
 181 }
 182
 183 /****************************************************************************
 184  Reply to a write and X.
 185
 186  This code is basically stolen from reply_write_and_X with some
 187  wrinkles to handle pipes.
 188 ****************************************************************************/
 189
 190 void reply_pipe_write_and_X(struct smb_request *req)
 191 {
 192         files_struct *fsp = file_fsp(req, SVAL(req->inbuf, smb_vwv2));
 193         size_t numtowrite = SVAL(req->inbuf,smb_vwv10);
 194         ssize_t nwritten;
 195         int smb_doff = SVAL(req->inbuf, smb_vwv11);
 196         bool pipe_start_message_raw =
 197                 ((SVAL(req->inbuf, smb_vwv7)
 198                   & (PIPE_START_MESSAGE|PIPE_RAW_MODE))
 199                  == (PIPE_START_MESSAGE|PIPE_RAW_MODE));
 200         uint8_t *data;
 201
 202         if (!fsp_is_np(fsp)) {
 203                 reply_doserror(req, ERRDOS, ERRbadfid);
 204                 return;
 205         }
 206
 207         if (fsp->vuid != req->vuid) {
 208                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 209                 return;
 210         }
 211
 212         data = (uint8_t *)smb_base(req->inbuf) + smb_doff;
 213
 214         if (numtowrite == 0) {
 215                 nwritten = 0;
 216         } else {
 217                 NTSTATUS status;
 218
 219                 if(pipe_start_message_raw) {
 220                         /*
 221                          * For the start of a message in named pipe byte mode,
 222                          * the first two bytes are a length-of-pdu field. Ignore
 223                          * them (we don't trust the client). JRA.
 224                          */
 225                        if(numtowrite < 2) {
 226                                 DEBUG(0,("reply_pipe_write_and_X: start of "
 227                                          "message set and not enough data "
 228                                          "sent.(%u)\n",
 229                                          (unsigned int)numtowrite ));
 230                                 reply_unixerror(req, ERRDOS, ERRnoaccess);
 231                                 return;
 232                         }
 233
 234                         data += 2;
 235                         numtowrite -= 2;
 236                 }
 237                 status = np_write(fsp, data, numtowrite, &nwritten);
 238                 if (!NT_STATUS_IS_OK(status)) {
 239                         reply_nterror(req, status);
 240                         return;
 241                 }
 242         }
 243
 244         if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) {
 245                 reply_unixerror(req, ERRDOS,ERRnoaccess);
 246                 return;
 247         }
 248
 249         reply_outbuf(req, 6, 0);
 250
 251         nwritten = (pipe_start_message_raw ? nwritten + 2 : nwritten);
 252         SSVAL(req->outbuf,smb_vwv2,nwritten);
 253
 254         DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", fsp->fnum,
 255                  (int)nwritten));
 256
 257         chain_reply(req);
 258 }
 259
 260 /****************************************************************************
 261  Reply to a read and X.
 262  This code is basically stolen from reply_read_and_X with some
 263  wrinkles to handle pipes.
 264 ****************************************************************************/
 265
 266 void reply_pipe_read_and_X(struct smb_request *req)
 267 {
 268         files_struct *fsp = file_fsp(req, SVAL(req->inbuf,smb_vwv0));
 269         int smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
 270         int smb_mincnt = SVAL(req->inbuf,smb_vwv6);
 271         ssize_t nread;
 272         uint8_t *data;
 273         bool unused;
 274         NTSTATUS status;
 275
 276         /* we don't use the offset given to use for pipe reads. This
 277            is deliberate, instead we always return the next lump of
 278            data on the pipe */
 279 #if 0
 280         uint32 smb_offs = IVAL(req->inbuf,smb_vwv3);
 281 #endif
 282
 283         if (!fsp_is_np(fsp)) {
 284                 reply_doserror(req, ERRDOS, ERRbadfid);
 285                 return;
 286         }
 287
 288         if (fsp->vuid != req->vuid) {
 289                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
 290                 return;
 291         }
 292
 293         reply_outbuf(req, 12, smb_maxcnt);
 294
 295         data = (uint8_t *)smb_buf(req->outbuf);
 296
 297         status = np_read(fsp, data, smb_maxcnt, &nread, &unused);
 298
 299         if (!NT_STATUS_IS_OK(status)) {
 300                 reply_doserror(req, ERRDOS, ERRnoaccess);
 301                 return;
 302         }
 303
 304         srv_set_message((char *)req->outbuf, 12, nread, False);
 305
 306         SSVAL(req->outbuf,smb_vwv5,nread);
 307         SSVAL(req->outbuf,smb_vwv6,smb_offset(data,req->outbuf));
 308         SSVAL(smb_buf(req->outbuf),-2,nread);
 309
 310         DEBUG(3,("readX-IPC pnum=%04x min=%d max=%d nread=%d\n",
 311                  fsp->fnum, smb_mincnt, smb_maxcnt, (int)nread));
 312
 313         chain_reply(req);
 314 }