X-Git-Url: http://git.samba.org/?a=blobdiff_plain;f=source%2Fsmbd%2Fpipes.c;h=da43a2976773f3dcb00162f300e58f27a19ab96f;hb=5c6c8e1fe93;hp=634d7af7f42b82c68c5229ece52333d73f93012d;hpb=cf23a155a1315f50d488794a2caf88402bf3e3e6;p=samba.git diff --git a/source/smbd/pipes.c b/source/smbd/pipes.c index 634d7af7f42..da43a297677 100644 --- a/source/smbd/pipes.c +++ b/source/smbd/pipes.c @@ -1,12 +1,14 @@ /* - Unix SMB/Netbios implementation. - Version 1.9. + Unix SMB/CIFS implementation. Pipe SMB reply routines - Copyright (C) Andrew Tridgell 1992-1997 + Copyright (C) Andrew Tridgell 1992-1998 + Copyright (C) Luke Kenneth Casson Leighton 1996-1998 + Copyright (C) Paul Ashton 1997-1998. + Copyright (C) Jeremy Allison 2005. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or + the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, @@ -15,8 +17,7 @@ GNU General Public License for more details. You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + along with this program. If not, see . */ /* This file handles reply_ calls on named pipes that the server @@ -25,325 +26,305 @@ #include "includes.h" -#include "trans2.h" #define PIPE "\\PIPE\\" #define PIPELEN strlen(PIPE) -#define REALLOC(ptr,size) Realloc(ptr,MAX((size),4*1024)) +#define MAX_PIPE_NAME_LEN 24 -/* look in server.c for some explanation of these variables */ -extern int Protocol; -extern int DEBUGLEVEL; -extern int chain_fnum; -extern char magic_char; -extern connection_struct Connections[]; -extern files_struct Files[]; -extern BOOL case_sensitive; -extern pstring sesssetup_user; -extern int Client; +/* PIPE/// */ +#define PIPEDB_KEY_FORMAT "PIPE/%s/%u/%d" -/* this macro should always be used to extract an fnum (smb_fid) from -a packet to ensure chaining works correctly */ -#define GETFNUM(buf,where) (chain_fnum!= -1?chain_fnum:SVAL(buf,where)) +struct pipe_dbrec { + struct server_id pid; + int pnum; + uid_t uid; -char * known_pipes [] = -{ - "lsarpc", - NULL + char name[MAX_PIPE_NAME_LEN]; + fstring user; }; -/**************************************************************************** - reply to an open and X on a named pipe - In fact what we do is to open a regular file with the same name in - /tmp. This can then be closed as normal. Reading and writing won't - make much sense, but will do *something*. The real reason for this - support is to be able to do transactions on them (well, on lsarpc - for domain login purposes...). +extern struct pipe_id_info pipe_names[]; - This code is basically stolen from reply_open_and_X with some - wrinkles to handle pipes. +/**************************************************************************** + Reply to an open and X on a named pipe. + This code is basically stolen from reply_open_and_X with some + wrinkles to handle pipes. ****************************************************************************/ -int reply_open_pipe_and_X(char *inbuf,char *outbuf,int length,int bufsize) + +void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req) { - pstring fname; - int cnum = SVAL(inbuf,smb_tid); - int fnum = -1; - int smb_mode = SVAL(inbuf,smb_vwv3); - int smb_attr = SVAL(inbuf,smb_vwv5); + const char *fname = NULL; + char *pipe_name = NULL; + smb_np_struct *p; + int size=0,fmode=0,mtime=0,rmode=0; + int i; + TALLOC_CTX *ctx = talloc_tos(); + + /* XXXX we need to handle passed times, sattr and flags */ + srvstr_pull_buf_talloc(ctx, req->inbuf, req->flags2, &pipe_name, + smb_buf(req->inbuf), STR_TERMINATE); + if (!pipe_name) { + reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND, + ERRDOS, ERRbadpipe); + return; + } + + /* If the name doesn't start \PIPE\ then this is directed */ + /* at a mailslot or something we really, really don't understand, */ + /* not just something we really don't understand. */ + if ( strncmp(pipe_name,PIPE,PIPELEN) != 0 ) { + reply_doserror(req, ERRSRV, ERRaccess); + return; + } + + DEBUG(4,("Opening pipe %s.\n", pipe_name)); + + /* See if it is one we want to handle. */ + for( i = 0; pipe_names[i].client_pipe ; i++ ) { + if( strequal(pipe_name,pipe_names[i].client_pipe)) { + break; + } + } + + if (pipe_names[i].client_pipe == NULL) { + reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND, + ERRDOS, ERRbadpipe); + return; + } + + /* Strip \PIPE\ off the name. */ + fname = pipe_name + PIPELEN; + #if 0 - int open_flags = SVAL(inbuf,smb_vwv2); - int smb_sattr = SVAL(inbuf,smb_vwv4); - uint32 smb_time = make_unix_date3(inbuf+smb_vwv6); + /* + * Hack for NT printers... JRA. + */ + if(should_fail_next_srvsvc_open(fname)) { + reply_doserror(req, ERRSRV, ERRaccess); + return; + } #endif - int smb_ofun = SVAL(inbuf,smb_vwv8); - int unixmode; - int size=0,fmode=0,mtime=0,rmode=0; - struct stat sbuf; - int smb_action = 0; - int i; - - /* XXXX we need to handle passed times, sattr and flags */ - strcpy(fname,smb_buf(inbuf)); - - /* If the name doesn't start \PIPE\ then this is directed */ - /* at a mailslot or something we really, really don't understand, */ - /* not just something we really don't understand. */ - if ( strncmp(fname,PIPE,PIPELEN) != 0 ) - return(ERROR(ERRSRV,ERRaccess)); - - DEBUG(4,("Opening pipe %s.\n", fname)); - - /* Strip \PIPE\ off the name. */ - strcpy(fname,smb_buf(inbuf) + PIPELEN); - - /* See if it is one we want to handle. */ - for( i = 0; known_pipes[i] ; i++ ) - if( strcmp(fname,known_pipes[i]) == 0 ) - break; - - if ( known_pipes[i] == NULL ) - return(ERROR(ERRSRV,ERRaccess)); - - /* Known pipes arrive with DIR attribs. Remove it so a regular file */ - /* can be opened and add it in after the open. */ - DEBUG(3,("Known pipe %s opening.\n",fname)); - smb_attr &= ~aDIR; - Connections[cnum].read_only = 0; - smb_ofun |= 0x10; /* Add Create it not exists flag */ - - unix_convert(fname,cnum,0); - - fnum = find_free_file(); - if (fnum < 0) - return(ERROR(ERRSRV,ERRnofids)); - - if (!check_name(fname,cnum)) - return(UNIXERROR(ERRDOS,ERRnoaccess)); - - unixmode = unix_mode(cnum,smb_attr); - - open_file_shared(fnum,cnum,fname,smb_mode,smb_ofun,unixmode, - &rmode,&smb_action); - - if (!Files[fnum].open) - return(UNIXERROR(ERRDOS,ERRnoaccess)); - - if (fstat(Files[fnum].fd_ptr->fd,&sbuf) != 0) { - close_file(fnum); - return(ERROR(ERRDOS,ERRnoaccess)); - } - - size = sbuf.st_size; - fmode = dos_mode(cnum,fname,&sbuf); - mtime = sbuf.st_mtime; - if (fmode & aDIR) { - close_file(fnum); - return(ERROR(ERRDOS,ERRnoaccess)); - } - - /* Prepare the reply */ - set_message(outbuf,15,0,True); - - /* Put things back the way they were. */ - Connections[cnum].read_only = 1; - - /* Mark the opened file as an existing named pipe in message mode. */ - SSVAL(outbuf,smb_vwv9,2); - SSVAL(outbuf,smb_vwv10,0xc700); - if (rmode == 2) - { - DEBUG(4,("Resetting open result to open from create.\n")); - rmode = 1; - } - - SSVAL(outbuf,smb_vwv2,fnum); - SSVAL(outbuf,smb_vwv3,fmode); - put_dos_date3(outbuf,smb_vwv4,mtime); - SIVAL(outbuf,smb_vwv6,size); - SSVAL(outbuf,smb_vwv8,rmode); - SSVAL(outbuf,smb_vwv11,smb_action); - - chain_fnum = fnum; - - DEBUG(4,("Opened pipe %s with handle %d, saved name %s.\n", - fname, fnum, Files[fnum].name)); - - return chain_reply(inbuf,outbuf,length,bufsize); -} + /* Known pipes arrive with DIR attribs. Remove it so a regular file */ + /* can be opened and add it in after the open. */ + DEBUG(3,("Known pipe %s opening.\n",fname)); + + p = open_rpc_pipe_p(fname, conn, req->vuid); + if (!p) { + reply_doserror(req, ERRSRV, ERRnofids); + return; + } + + /* Prepare the reply */ + reply_outbuf(req, 15, 0); + + /* Mark the opened file as an existing named pipe in message mode. */ + SSVAL(req->outbuf,smb_vwv9,2); + SSVAL(req->outbuf,smb_vwv10,0xc700); + + if (rmode == 2) { + DEBUG(4,("Resetting open result to open from create.\n")); + rmode = 1; + } + + SSVAL(req->outbuf,smb_vwv2, p->pnum); + SSVAL(req->outbuf,smb_vwv3,fmode); + srv_put_dos_date3((char *)req->outbuf,smb_vwv4,mtime); + SIVAL(req->outbuf,smb_vwv6,size); + SSVAL(req->outbuf,smb_vwv8,rmode); + SSVAL(req->outbuf,smb_vwv11,0x0001); + + chain_reply(req); + return; +} /**************************************************************************** - api_LsarpcSNPHS - - SetNamedPipeHandleState on \PIPE\lsarpc. We can't really do much here, - so just blithely return True. This is really only for NT domain stuff, - we we're only handling that - don't assume Samba now does complete - named pipe handling. + Reply to a write on a pipe. ****************************************************************************/ -BOOL api_LsarpcSNPHS(int cnum,int uid, char *param,char *data, - int mdrcnt,int mprcnt, - char **rdata,char **rparam, - int *rdata_len,int *rparam_len) + +void reply_pipe_write(struct smb_request *req) { - uint16 id; + smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0)); + size_t numtowrite = SVAL(req->inbuf,smb_vwv1); + int nwritten; + char *data; - id = param[0] + (param[1] << 8); - DEBUG(4,("lsarpc SetNamedPipeHandleState to code %x\n",id)); - return(True); -} + if (!p) { + reply_doserror(req, ERRDOS, ERRbadfid); + return; + } + if (p->vuid != req->vuid) { + reply_nterror(req, NT_STATUS_INVALID_HANDLE); + return; + } -/**************************************************************************** - api_LsarpcTNP + data = smb_buf(req->inbuf) + 3; - TransactNamedPipe on \PIPE\lsarpc. -****************************************************************************/ -static void LsarpcTNP1(char *data,char **rdata, int *rdata_len) -{ - uint32 dword1, dword2; - char pname[] = "\\PIPE\\lsass"; + if (numtowrite == 0) { + nwritten = 0; + } else { + nwritten = write_to_pipe(p, data, numtowrite); + } - /* All kinds of mysterious numbers here */ - *rdata_len = 68; - *rdata = REALLOC(*rdata,*rdata_len); + if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) { + reply_unixerror(req, ERRDOS, ERRnoaccess); + return; + } - dword1 = IVAL(data,0xC); - dword2 = IVAL(data,0x10); + reply_outbuf(req, 1, 0); - SIVAL(*rdata,0,0xc0005); - SIVAL(*rdata,4,0x10); - SIVAL(*rdata,8,0x44); - SIVAL(*rdata,0xC,dword1); + SSVAL(req->outbuf,smb_vwv0,nwritten); - SIVAL(*rdata,0x10,dword2); - SIVAL(*rdata,0x14,0x15); - SSVAL(*rdata,0x18,sizeof(pname)); - strcpy(*rdata + 0x1a,pname); - SIVAL(*rdata,0x28,1); - memcpy(*rdata + 0x30, data + 0x34, 0x14); -} + DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten)); -static void LsarpcTNP2(char *data,char **rdata, int *rdata_len) -{ - uint32 dword1; - - /* All kinds of mysterious numbers here */ - *rdata_len = 48; - *rdata = REALLOC(*rdata,*rdata_len); - - dword1 = IVAL(data,0xC); - - SIVAL(*rdata,0,0x03020005); - SIVAL(*rdata,4,0x10); - SIVAL(*rdata,8,0x30); - SIVAL(*rdata,0xC,dword1); - SIVAL(*rdata,0x10,0x18); - SIVAL(*rdata,0x1c,0x44332211); - SIVAL(*rdata,0x20,0x88776655); - SIVAL(*rdata,0x24,0xCCBBAA99); - SIVAL(*rdata,0x28,0x11FFEEDD); + return; } -static void LsarpcTNP3(char *data,char **rdata, int *rdata_len) +/**************************************************************************** + Reply to a write and X. + + This code is basically stolen from reply_write_and_X with some + wrinkles to handle pipes. +****************************************************************************/ + +void reply_pipe_write_and_X(struct smb_request *req) { - uint32 dword1; - uint16 word1; - char * workgroup = lp_workgroup(); - int wglen = strlen(workgroup); - int i; - - /* All kinds of mysterious numbers here */ - *rdata_len = 90 + 2 * wglen; - *rdata = REALLOC(*rdata,*rdata_len); - - dword1 = IVAL(data,0xC); - word1 = SVAL(data,0x2C); - - SIVAL(*rdata,0,0x03020005); - SIVAL(*rdata,4,0x10); - SIVAL(*rdata,8,0x60); - SIVAL(*rdata,0xC,dword1); - SIVAL(*rdata,0x10,0x48); - SSVAL(*rdata,0x18,0x5988); /* This changes */ - SSVAL(*rdata,0x1A,0x15); - SSVAL(*rdata,0x1C,word1); - SSVAL(*rdata,0x20,6); - SSVAL(*rdata,0x22,8); - SSVAL(*rdata,0x24,0x8E8); /* So does this */ - SSVAL(*rdata,0x26,0x15); - SSVAL(*rdata,0x28,0x4D48); /* And this */ - SSVAL(*rdata,0x2A,0x15); - SIVAL(*rdata,0x2C,4); - SIVAL(*rdata,0x34,wglen); - for ( i = 0 ; i < wglen ; i++ ) - (*rdata)[0x38 + i * 2] = workgroup[i]; - - /* Now fill in the rest */ - i = 0x38 + wglen * 2; - SSVAL(*rdata,i,0x648); - SIVAL(*rdata,i+2,4); - SIVAL(*rdata,i+6,0x401); - SSVAL(*rdata,i+0xC,0x500); - SIVAL(*rdata,i+0xE,0x15); - SIVAL(*rdata,i+0x12,0x2372FE1); - SIVAL(*rdata,i+0x16,0x7E831BEF); - SIVAL(*rdata,i+0x1A,0x4B454B2); + smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2)); + size_t numtowrite = SVAL(req->inbuf,smb_vwv10); + int nwritten = -1; + int smb_doff = SVAL(req->inbuf, smb_vwv11); + BOOL pipe_start_message_raw = + ((SVAL(req->inbuf, smb_vwv7) + & (PIPE_START_MESSAGE|PIPE_RAW_MODE)) + == (PIPE_START_MESSAGE|PIPE_RAW_MODE)); + char *data; + + if (!p) { + reply_doserror(req, ERRDOS, ERRbadfid); + return; + } + + if (p->vuid != req->vuid) { + reply_nterror(req, NT_STATUS_INVALID_HANDLE); + return; + } + + data = smb_base(req->inbuf) + smb_doff; + + if (numtowrite == 0) { + nwritten = 0; + } else { + if(pipe_start_message_raw) { + /* + * For the start of a message in named pipe byte mode, + * the first two bytes are a length-of-pdu field. Ignore + * them (we don't trust the client). JRA. + */ + if(numtowrite < 2) { + DEBUG(0,("reply_pipe_write_and_X: start of " + "message set and not enough data " + "sent.(%u)\n", + (unsigned int)numtowrite )); + reply_unixerror(req, ERRDOS, ERRnoaccess); + return; + } + + data += 2; + numtowrite -= 2; + } + nwritten = write_to_pipe(p, data, numtowrite); + } + + if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) { + reply_unixerror(req, ERRDOS,ERRnoaccess); + return; + } + + reply_outbuf(req, 6, 0); + + nwritten = (pipe_start_message_raw ? nwritten + 2 : nwritten); + SSVAL(req->outbuf,smb_vwv2,nwritten); + + DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten)); + + chain_reply(req); } -static void LsarpcTNP4(char *data,char **rdata, int *rdata_len) +/**************************************************************************** + Reply to a read and X. + This code is basically stolen from reply_read_and_X with some + wrinkles to handle pipes. +****************************************************************************/ + +void reply_pipe_read_and_X(struct smb_request *req) { - uint32 dword1; + smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2)); + int smb_maxcnt = SVAL(req->inbuf,smb_vwv5); + int smb_mincnt = SVAL(req->inbuf,smb_vwv6); + int nread = -1; + char *data; + BOOL unused; + + /* we don't use the offset given to use for pipe reads. This + is deliberate, instead we always return the next lump of + data on the pipe */ +#if 0 + uint32 smb_offs = IVAL(req->inbuf,smb_vwv3); +#endif + + if (!p) { + reply_doserror(req, ERRDOS, ERRbadfid); + return; + } + + reply_outbuf(req, 12, smb_maxcnt); - /* All kinds of mysterious numbers here */ - *rdata_len = 48; - *rdata = REALLOC(*rdata,*rdata_len); + data = smb_buf(req->outbuf); - dword1 = IVAL(data,0xC); + nread = read_from_pipe(p, data, smb_maxcnt, &unused); - SIVAL(*rdata,0,0x03020005); - SIVAL(*rdata,4,0x10); - SIVAL(*rdata,8,0x30); - SIVAL(*rdata,0xC,dword1); - SIVAL(*rdata,0x10,0x18); + if (nread < 0) { + reply_doserror(req, ERRDOS, ERRnoaccess); + return; + } + + set_message((char *)req->outbuf, 12, nread, False); + + SSVAL(req->outbuf,smb_vwv5,nread); + SSVAL(req->outbuf,smb_vwv6,smb_offset(data,req->outbuf)); + SSVAL(smb_buf(req->outbuf),-2,nread); + + DEBUG(3,("readX-IPC pnum=%04x min=%d max=%d nread=%d\n", + p->pnum, smb_mincnt, smb_maxcnt, nread)); + + chain_reply(req); } +/**************************************************************************** + Reply to a close. +****************************************************************************/ -BOOL api_LsarpcTNP(int cnum,int uid, char *param,char *data, - int mdrcnt,int mprcnt, - char **rdata,char **rparam, - int *rdata_len,int *rparam_len) +void reply_pipe_close(connection_struct *conn, struct smb_request *req) { - uint32 id,id2; - - id = IVAL(data,0); - - DEBUG(4,("lsarpc TransactNamedPipe id %lx\n",id)); - switch (id) - { - case 0xb0005: - LsarpcTNP1(data,rdata,rdata_len); - break; - - case 0x03000005: - id2 = IVAL(data,8); - DEBUG(4,("\t- Suboperation %lx\n",id2)); - switch (id2 & 0xF) - { - case 8: - LsarpcTNP2(data,rdata,rdata_len); - break; - - case 0xC: - LsarpcTNP4(data,rdata,rdata_len); - break; - - case 0xE: - LsarpcTNP3(data,rdata,rdata_len); - break; - } - break; - } - return(True); + smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0)); + + if (!p) { + reply_doserror(req, ERRDOS, ERRbadfid); + return; + } + + DEBUG(5,("reply_pipe_close: pnum:%x\n", p->pnum)); + + if (!close_rpc_pipe_hnd(p)) { + reply_doserror(req, ERRDOS, ERRbadfid); + return; + } + + /* TODO: REMOVE PIPE FROM DB */ + + reply_outbuf(req, 0, 0); + return; }