[GLUE] Rsync SAMBA_3_2_0 SVN r25598 in order to create the v3-2-test branch.

[samba.git] / source / smbd / pipes.c

diff --git a/source/smbd/pipes.c b/source/smbd/pipes.c
index 35f8d684ebe2f3afa52be7e82fe06c66cf432ad1..da43a2976773f3dcb00162f300e58f27a19ab96f 100644 (file)
--- a/source/smbd/pipes.c
+++ b/source/smbd/pipes.c
@@ -1,12 +1,14 @@
 /* 
 /* 

-   Unix SMB/Netbios implementation.
-   Version 1.9.
+   Unix SMB/CIFS implementation.

    Pipe SMB reply routines
    Pipe SMB reply routines

-   Copyright (C) Andrew Tridgell 1992-1995
+   Copyright (C) Andrew Tridgell 1992-1998
+   Copyright (C) Luke Kenneth Casson Leighton 1996-1998
+   Copyright (C) Paul Ashton  1997-1998.
+   Copyright (C) Jeremy Allison 2005.

    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by

-   the Free Software Foundation; either version 2 of the License, or
+   the Free Software Foundation; either version 3 of the License, or

    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,
    (at your option) any later version.
    
    This program is distributed in the hope that it will be useful,


@@ -15,8 +17,7 @@
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License

-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.

 */
 /*
    This file handles reply_ calls on named pipes that the server
 */
 /*
    This file handles reply_ calls on named pipes that the server


@@ -25,337 +26,305 @@
 
 
 #include "includes.h"
 
 
 #include "includes.h"

-#include "trans2.h"

 
 #define        PIPE            "\\PIPE\\"
 #define        PIPELEN         strlen(PIPE)
 
 
 #define        PIPE            "\\PIPE\\"
 #define        PIPELEN         strlen(PIPE)
 

-#define REALLOC(ptr,size) Realloc(ptr,MAX((size),4*1024))
+#define MAX_PIPE_NAME_LEN      24

 
 

-/* look in server.c for some explanation of these variables */
-extern int Protocol;
-extern int DEBUGLEVEL;
-extern int maxxmit;
-extern int chain_fnum;
-extern char magic_char;
-extern connection_struct Connections[];
-extern files_struct Files[];
-extern BOOL case_sensitive;
-extern pstring sesssetup_user;
-extern int Client;
+/* PIPE/<name>/<pid>/<pnum> */
+#define PIPEDB_KEY_FORMAT "PIPE/%s/%u/%d"

 
 

-extern pstring local_machine;
+struct pipe_dbrec {
+       struct server_id pid;
+       int pnum;
+       uid_t uid;

 
 

-/* this macro should always be used to extract an fnum (smb_fid) from
-a packet to ensure chaining works correctly */
-#define GETFNUM(buf,where) (chain_fnum!= -1?chain_fnum:SVAL(buf,where))
-
-char * known_pipes [] =
-{
-  "lsarpc",
-  NULL
+       char name[MAX_PIPE_NAME_LEN];
+       fstring user;

 };
 
 };
 

-/****************************************************************************
-  reply to an open and X on a named pipe

 
 

-  In fact what we do is to open a regular file with the same name in
-  /tmp. This can then be closed as normal. Reading and writing won't
-  make much sense, but will do *something*. The real reason for this
-  support is to be able to do transactions on them (well, on lsarpc
-  for domain login purposes...).
+extern struct pipe_id_info pipe_names[];

 
 

-  This code is basically stolen from reply_open_and_X with some
-  wrinkles to handle pipes.
+/****************************************************************************
+ Reply to an open and X on a named pipe.
+ This code is basically stolen from reply_open_and_X with some
+ wrinkles to handle pipes.

 ****************************************************************************/
 ****************************************************************************/

-int reply_open_pipe_and_X(char *inbuf,char *outbuf,int length,int bufsize)
+
+void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req)

 {
 {

-  pstring fname;
-  int cnum = SVAL(inbuf,smb_tid);
-  int fnum = -1;
-  int smb_mode = SVAL(inbuf,smb_vwv3);
-  int smb_attr = SVAL(inbuf,smb_vwv5);
+       const char *fname = NULL;
+       char *pipe_name = NULL;
+       smb_np_struct *p;
+       int size=0,fmode=0,mtime=0,rmode=0;
+       int i;
+       TALLOC_CTX *ctx = talloc_tos();
+
+       /* XXXX we need to handle passed times, sattr and flags */
+       srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &pipe_name,
+                       smb_buf(req->inbuf), STR_TERMINATE);
+       if (!pipe_name) {
+               reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
+                               ERRDOS, ERRbadpipe);
+               return;
+       }
+
+       /* If the name doesn't start \PIPE\ then this is directed */
+       /* at a mailslot or something we really, really don't understand, */
+       /* not just something we really don't understand. */
+       if ( strncmp(pipe_name,PIPE,PIPELEN) != 0 ) {
+               reply_doserror(req, ERRSRV, ERRaccess);
+               return;
+       }
+
+       DEBUG(4,("Opening pipe %s.\n", pipe_name));
+
+       /* See if it is one we want to handle. */
+       for( i = 0; pipe_names[i].client_pipe ; i++ ) {
+               if( strequal(pipe_name,pipe_names[i].client_pipe)) {
+                       break;
+               }
+       }
+
+       if (pipe_names[i].client_pipe == NULL) {
+               reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
+                               ERRDOS, ERRbadpipe);
+               return;
+       }
+
+       /* Strip \PIPE\ off the name. */
+       fname = pipe_name + PIPELEN;
+

 #if 0
 #if 0

-  int open_flags = SVAL(inbuf,smb_vwv2);
-  int smb_sattr = SVAL(inbuf,smb_vwv4); 
-  uint32 smb_time = make_unix_date3(inbuf+smb_vwv6);
+       /*
+        * Hack for NT printers... JRA.
+        */
+       if(should_fail_next_srvsvc_open(fname)) {
+               reply_doserror(req, ERRSRV, ERRaccess);
+               return;
+       }

 #endif
 #endif

-  int smb_ofun = SVAL(inbuf,smb_vwv8);
-  int unixmode;
-  int size=0,fmode=0,mtime=0,rmode=0;
-  struct stat sbuf;
-  int smb_action = 0;
-  int i;
-
-  /* XXXX we need to handle passed times, sattr and flags */
-  strcpy(fname,smb_buf(inbuf));
-
-  /* If the name doesn't start \PIPE\ then this is directed */
-  /* at a mailslot or something we really, really don't understand, */
-  /* not just something we really don't understand. */
-  if ( strncmp(fname,PIPE,PIPELEN) != 0 )
-    return(ERROR(ERRSRV,ERRaccess));
-
-  DEBUG(4,("Opening pipe %s.\n", fname));
-
-  /* Strip \PIPE\ off the name. */
-  strcpy(fname,smb_buf(inbuf) + PIPELEN);
-
-  /* See if it is one we want to handle. */
-  for( i = 0; known_pipes[i] ; i++ )
-    if( strcmp(fname,known_pipes[i]) == 0 )
-      break;
-
-  if ( known_pipes[i] == NULL )
-    return(ERROR(ERRSRV,ERRaccess));
-
-  /* Known pipes arrive with DIR attribs. Remove it so a regular file */
-  /* can be opened and add it in after the open. */
-  DEBUG(3,("Known pipe %s opening.\n",fname));
-  smb_attr &= ~aDIR;
-  Connections[cnum].read_only = 0;
-  smb_ofun |= 0x10;            /* Add Create it not exists flag */
-
-  unix_convert(fname,cnum);
-    
-  fnum = find_free_file();
-  if (fnum < 0)
-    return(ERROR(ERRSRV,ERRnofids));
-
-  if (!check_name(fname,cnum))
-    return(UNIXERROR(ERRDOS,ERRnoaccess));
-
-  unixmode = unix_mode(cnum,smb_attr);
-      
-  open_file_shared(fnum,cnum,fname,smb_mode,smb_ofun,unixmode,
-                  &rmode,&smb_action);
-      
-  if (!Files[fnum].open)
-    return(UNIXERROR(ERRDOS,ERRnoaccess));
-
-  if (fstat(Files[fnum].fd,&sbuf) != 0) {
-    close_file(fnum);
-    return(ERROR(ERRDOS,ERRnoaccess));
-  }
-
-  size = sbuf.st_size;
-  fmode = dos_mode(cnum,fname,&sbuf);
-  mtime = sbuf.st_mtime;
-  if (fmode & aDIR) {
-    close_file(fnum);
-    return(ERROR(ERRDOS,ERRnoaccess));
-  }
-
-  /* Prepare the reply */
-  set_message(outbuf,15,0,True);
-
-  /* Put things back the way they were. */
-  Connections[cnum].read_only = 1;
-
-  /* Mark the opened file as an existing named pipe in message mode. */
-  SSVAL(outbuf,smb_vwv9,2);
-  SSVAL(outbuf,smb_vwv10,0xc700);
-  if (rmode == 2)
-  {
-    DEBUG(4,("Resetting open result to open from create.\n"));
-    rmode = 1;
-  }
-
-  SSVAL(outbuf,smb_vwv2,fnum);
-  SSVAL(outbuf,smb_vwv3,fmode);
-  put_dos_date3(outbuf,smb_vwv4,mtime);
-  SIVAL(outbuf,smb_vwv6,size);
-  SSVAL(outbuf,smb_vwv8,rmode);
-  SSVAL(outbuf,smb_vwv11,smb_action);
-
-  chain_fnum = fnum;
-
-  DEBUG(4,("Opened pipe %s with handle %d, saved name %s.\n",
-          fname, fnum, Files[fnum].name));
-  
-  return chain_reply(inbuf,outbuf,length,bufsize);
-}

 
 

+       /* Known pipes arrive with DIR attribs. Remove it so a regular file */
+       /* can be opened and add it in after the open. */
+       DEBUG(3,("Known pipe %s opening.\n",fname));
+
+       p = open_rpc_pipe_p(fname, conn, req->vuid);
+       if (!p) {
+               reply_doserror(req, ERRSRV, ERRnofids);
+               return;
+       }
+
+       /* Prepare the reply */
+       reply_outbuf(req, 15, 0);
+
+       /* Mark the opened file as an existing named pipe in message mode. */
+       SSVAL(req->outbuf,smb_vwv9,2);
+       SSVAL(req->outbuf,smb_vwv10,0xc700);
+
+       if (rmode == 2) {
+               DEBUG(4,("Resetting open result to open from create.\n"));
+               rmode = 1;
+       }
+
+       SSVAL(req->outbuf,smb_vwv2, p->pnum);
+       SSVAL(req->outbuf,smb_vwv3,fmode);
+       srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime);
+       SIVAL(req->outbuf,smb_vwv6,size);
+       SSVAL(req->outbuf,smb_vwv8,rmode);
+       SSVAL(req->outbuf,smb_vwv11,0x0001);
+
+       chain_reply(req);
+       return;
+}

 
 /****************************************************************************
 
 /****************************************************************************

- api_LsarpcSNPHS
-
- SetNamedPipeHandleState on \PIPE\lsarpc. We can't really do much here,
- so just blithely return True. This is really only for NT domain stuff,
- we we're only handling that - don't assume Samba now does complete
- named pipe handling.
+ Reply to a write on a pipe.

 ****************************************************************************/
 ****************************************************************************/

-BOOL api_LsarpcSNPHS(int cnum,int uid, char *param,char *data,
-                    int mdrcnt,int mprcnt,
-                    char **rdata,char **rparam,
-                    int *rdata_len,int *rparam_len)
+
+void reply_pipe_write(struct smb_request *req)

 {
 {

-  uint16 id;
+       smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0));
+       size_t numtowrite = SVAL(req->inbuf,smb_vwv1);
+       int nwritten;
+       char *data;

 
 

-  id = param[0] + (param[1] << 8);
-  DEBUG(4,("lsarpc SetNamedPipeHandleState to code %x\n",id));
-  return(True);
-}
+       if (!p) {
+               reply_doserror(req, ERRDOS, ERRbadfid);
+               return;
+       }

 
 

+       if (p->vuid != req->vuid) {
+               reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+               return;
+       }

 
 

-/****************************************************************************
- api_LsarpcTNP
+       data = smb_buf(req->inbuf) + 3;

 
 

- TransactNamedPipe on \PIPE\lsarpc.
-****************************************************************************/
-static void LsarpcTNP1(char *data,char **rdata, int *rdata_len)
-{
-  uint32 dword1, dword2;
-  char pname[] = "\\PIPE\\lsass";
+       if (numtowrite == 0) {
+               nwritten = 0;
+       } else {
+               nwritten = write_to_pipe(p, data, numtowrite);
+       }

 
 

-  /* All kinds of mysterious numbers here */
-  *rdata_len = 68;
-  *rdata = REALLOC(*rdata,*rdata_len);
+       if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) {
+               reply_unixerror(req, ERRDOS, ERRnoaccess);
+               return;
+       }

 
 

-  dword1 = IVAL(data,0xC);
-  dword2 = IVAL(data,0x10);
+       reply_outbuf(req, 1, 0);

 
 

-  SIVAL(*rdata,0,0xc0005);
-  SIVAL(*rdata,4,0x10);
-  SIVAL(*rdata,8,0x44);
-  SIVAL(*rdata,0xC,dword1);
+       SSVAL(req->outbuf,smb_vwv0,nwritten);

   
   

-  SIVAL(*rdata,0x10,dword2);
-  SIVAL(*rdata,0x14,0x15);
-  SSVAL(*rdata,0x18,sizeof(pname));
-  strcpy(*rdata + 0x1a,pname);
-  SIVAL(*rdata,0x28,1);
-  memcpy(*rdata + 0x30, data + 0x34, 0x14);
-}
+       DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten));

 
 

-static void LsarpcTNP2(char *data,char **rdata, int *rdata_len)
-{
-  uint32 dword1;
-
-  /* All kinds of mysterious numbers here */
-  *rdata_len = 48;
-  *rdata = REALLOC(*rdata,*rdata_len);
-
-  dword1 = IVAL(data,0xC);
-
-  SIVAL(*rdata,0,0x03020005);
-  SIVAL(*rdata,4,0x10);
-  SIVAL(*rdata,8,0x30);
-  SIVAL(*rdata,0xC,dword1);
-  SIVAL(*rdata,0x10,0x18);
-  SIVAL(*rdata,0x1c,0x44332211);
-  SIVAL(*rdata,0x20,0x88776655);
-  SIVAL(*rdata,0x24,0xCCBBAA99);
-  SIVAL(*rdata,0x28,0x11FFEEDD);
+       return;

 }
 
 }
 

-static void LsarpcTNP3(char *data,char **rdata, int *rdata_len)
+/****************************************************************************
+ Reply to a write and X.
+
+ This code is basically stolen from reply_write_and_X with some
+ wrinkles to handle pipes.
+****************************************************************************/
+
+void reply_pipe_write_and_X(struct smb_request *req)

 {
 {

-  uint32 dword1;
-  uint16 word1;
-  int wglen;
-  int i;
-  char domain[17];
-
-  char *work_alias = conf_alias_to_workgroup(local_machine); /* look-up */
-
-  if (work_alias)
-      StrnCpy(domain, work_alias, 16);
-  else
-      StrnCpy(domain, lp_workgroup(), 16);
-
-  wglen = strlen(domain);
-
-  /* All kinds of mysterious numbers here */
-  *rdata_len = 90 + 2 * wglen;
-  *rdata = REALLOC(*rdata,*rdata_len);
-
-  dword1 = IVAL(data,0xC);
-  word1 = SVAL(data,0x2C);
-
-  SIVAL(*rdata,0,0x03020005);
-  SIVAL(*rdata,4,0x10);
-  SIVAL(*rdata,8,0x60);
-  SIVAL(*rdata,0xC,dword1);
-  SIVAL(*rdata,0x10,0x48);
-  SSVAL(*rdata,0x18,0x5988);   /* This changes */
-  SSVAL(*rdata,0x1A,0x15);
-  SSVAL(*rdata,0x1C,word1);
-  SSVAL(*rdata,0x20,6);
-  SSVAL(*rdata,0x22,8);
-  SSVAL(*rdata,0x24,0x8E8);    /* So does this */
-  SSVAL(*rdata,0x26,0x15);
-  SSVAL(*rdata,0x28,0x4D48);   /* And this */
-  SSVAL(*rdata,0x2A,0x15);
-  SIVAL(*rdata,0x2C,4);
-  SIVAL(*rdata,0x34,wglen);
-  for ( i = 0 ; i < wglen ; i++ )
-    (*rdata)[0x38 + i * 2] = domain[i];
-   
-  /* Now fill in the rest */
-  i = 0x38 + wglen * 2;
-  SSVAL(*rdata,i,0x648);
-  SIVAL(*rdata,i+2,4);
-  SIVAL(*rdata,i+6,0x401);
-  SSVAL(*rdata,i+0xC,0x500);
-  SIVAL(*rdata,i+0xE,0x15);
-  SIVAL(*rdata,i+0x12,0x2372FE1);
-  SIVAL(*rdata,i+0x16,0x7E831BEF);
-  SIVAL(*rdata,i+0x1A,0x4B454B2);
+       smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2));
+       size_t numtowrite = SVAL(req->inbuf,smb_vwv10);
+       int nwritten = -1;
+       int smb_doff = SVAL(req->inbuf, smb_vwv11);
+       BOOL pipe_start_message_raw =
+               ((SVAL(req->inbuf, smb_vwv7)
+                 & (PIPE_START_MESSAGE|PIPE_RAW_MODE))
+                == (PIPE_START_MESSAGE|PIPE_RAW_MODE));
+       char *data;
+
+       if (!p) {
+               reply_doserror(req, ERRDOS, ERRbadfid);
+               return;
+       }
+
+       if (p->vuid != req->vuid) {
+               reply_nterror(req, NT_STATUS_INVALID_HANDLE);
+               return;
+       }
+
+       data = smb_base(req->inbuf) + smb_doff;
+
+       if (numtowrite == 0) {
+               nwritten = 0;
+       } else {
+               if(pipe_start_message_raw) {
+                       /*
+                        * For the start of a message in named pipe byte mode,
+                        * the first two bytes are a length-of-pdu field. Ignore
+                        * them (we don't trust the client). JRA.
+                        */
+                      if(numtowrite < 2) {
+                               DEBUG(0,("reply_pipe_write_and_X: start of "
+                                        "message set and not enough data "
+                                        "sent.(%u)\n",
+                                        (unsigned int)numtowrite ));
+                               reply_unixerror(req, ERRDOS, ERRnoaccess);
+                               return;
+                       }
+
+                       data += 2;
+                       numtowrite -= 2;
+               }                        
+               nwritten = write_to_pipe(p, data, numtowrite);
+       }
+
+       if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) {
+               reply_unixerror(req, ERRDOS,ERRnoaccess);
+               return;
+       }
+
+       reply_outbuf(req, 6, 0);
+
+       nwritten = (pipe_start_message_raw ? nwritten + 2 : nwritten);
+       SSVAL(req->outbuf,smb_vwv2,nwritten);
+  
+       DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten));
+
+       chain_reply(req);

 }
 
 }
 

-static void LsarpcTNP4(char *data,char **rdata, int *rdata_len)
+/****************************************************************************
+ Reply to a read and X.
+ This code is basically stolen from reply_read_and_X with some
+ wrinkles to handle pipes.
+****************************************************************************/
+
+void reply_pipe_read_and_X(struct smb_request *req)

 {
 {

-  uint32 dword1;
+       smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2));
+       int smb_maxcnt = SVAL(req->inbuf,smb_vwv5);
+       int smb_mincnt = SVAL(req->inbuf,smb_vwv6);
+       int nread = -1;
+       char *data;
+       BOOL unused;
+
+       /* we don't use the offset given to use for pipe reads. This
+           is deliberate, instead we always return the next lump of
+           data on the pipe */
+#if 0
+       uint32 smb_offs = IVAL(req->inbuf,smb_vwv3);
+#endif
+
+       if (!p) {
+               reply_doserror(req, ERRDOS, ERRbadfid);
+               return;
+       }
+
+       reply_outbuf(req, 12, smb_maxcnt);

 
 

-  /* All kinds of mysterious numbers here */
-  *rdata_len = 48;
-  *rdata = REALLOC(*rdata,*rdata_len);
+       data = smb_buf(req->outbuf);

 
 

-  dword1 = IVAL(data,0xC);
+       nread = read_from_pipe(p, data, smb_maxcnt, &unused);

 
 

-  SIVAL(*rdata,0,0x03020005);
-  SIVAL(*rdata,4,0x10);
-  SIVAL(*rdata,8,0x30);
-  SIVAL(*rdata,0xC,dword1);
-  SIVAL(*rdata,0x10,0x18);
+       if (nread < 0) {
+               reply_doserror(req, ERRDOS, ERRnoaccess);
+               return;
+       }
+
+       set_message((char *)req->outbuf, 12, nread, False);
+  
+       SSVAL(req->outbuf,smb_vwv5,nread);
+       SSVAL(req->outbuf,smb_vwv6,smb_offset(data,req->outbuf));
+       SSVAL(smb_buf(req->outbuf),-2,nread);
+  
+       DEBUG(3,("readX-IPC pnum=%04x min=%d max=%d nread=%d\n",
+                p->pnum, smb_mincnt, smb_maxcnt, nread));
+
+       chain_reply(req);

 }
 
 }
 

+/****************************************************************************
+ Reply to a close.
+****************************************************************************/

 
 

-BOOL api_LsarpcTNP(int cnum,int uid, char *param,char *data,
-                    int mdrcnt,int mprcnt,
-                    char **rdata,char **rparam,
-                    int *rdata_len,int *rparam_len)
+void reply_pipe_close(connection_struct *conn, struct smb_request *req)

 {
 {

-  uint32 id,id2;
-
-  id = IVAL(data,0);
-
-  DEBUG(4,("lsarpc TransactNamedPipe id %lx\n",id));
-  switch (id)
-  {
-    case 0xb0005:
-      LsarpcTNP1(data,rdata,rdata_len);
-      break;
-
-    case 0x03000005:
-      id2 = IVAL(data,8);
-      DEBUG(4,("\t- Suboperation %lx\n",id2));
-      switch (id2 & 0xF)
-      {
-        case 8:
-          LsarpcTNP2(data,rdata,rdata_len);
-          break;
-
-        case 0xC:
-          LsarpcTNP4(data,rdata,rdata_len);
-          break;
-
-        case 0xE:
-          LsarpcTNP3(data,rdata,rdata_len);
-          break;
-      }
-      break;
-  }
-  return(True);
+       smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0));
+
+       if (!p) {
+               reply_doserror(req, ERRDOS, ERRbadfid);
+               return;
+       }
+
+       DEBUG(5,("reply_pipe_close: pnum:%x\n", p->pnum));
+
+       if (!close_rpc_pipe_hnd(p)) {
+               reply_doserror(req, ERRDOS, ERRbadfid);
+               return;
+       }
+       
+       /* TODO: REMOVE PIPE FROM DB */
+
+       reply_outbuf(req, 0, 0);
+       return;

 }
 }