2 Unix SMB/CIFS implementation.
3 Pipe SMB reply routines
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6 Copyright (C) Paul Ashton 1997-1998.
7 Copyright (C) Jeremy Allison 2005.
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 This file handles reply_ calls on named pipes that the server
24 makes to handle specific protocols
29 #include "smbd/smbd.h"
30 #include "smbd/globals.h"
31 #include "libcli/security/security.h"
32 #include "rpc_server/srv_pipe_hnd.h"
34 #define PIPE "\\PIPE\\"
35 #define PIPELEN strlen(PIPE)
37 #define MAX_PIPE_NAME_LEN 24
39 NTSTATUS open_np_file(struct smb_request *smb_req, const char *name,
40 struct files_struct **pfsp)
42 struct connection_struct *conn = smb_req->conn;
43 struct files_struct *fsp;
44 struct smb_filename *smb_fname = NULL;
47 status = file_new(smb_req, conn, &fsp);
48 if (!NT_STATUS_IS_OK(status)) {
49 DEBUG(0, ("file_new failed: %s\n", nt_errstr(status)));
55 fsp->vuid = smb_req->vuid;
56 fsp->can_lock = false;
57 fsp->access_mask = FILE_READ_DATA | FILE_WRITE_DATA;
59 status = create_synthetic_smb_fname(talloc_tos(), name, NULL, NULL,
61 if (!NT_STATUS_IS_OK(status)) {
62 file_free(smb_req, fsp);
65 status = fsp_set_smb_fname(fsp, smb_fname);
66 TALLOC_FREE(smb_fname);
67 if (!NT_STATUS_IS_OK(status)) {
68 file_free(smb_req, fsp);
72 status = np_open(fsp, name,
73 conn->sconn->local_address,
74 conn->sconn->remote_address,
77 &fsp->fake_file_handle);
78 if (!NT_STATUS_IS_OK(status)) {
79 DEBUG(10, ("np_open(%s) returned %s\n", name,
81 file_free(smb_req, fsp);
90 /****************************************************************************
91 Reply to an open and X on a named pipe.
92 This code is basically stolen from reply_open_and_X with some
93 wrinkles to handle pipes.
94 ****************************************************************************/
96 void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req)
98 const char *fname = NULL;
99 char *pipe_name = NULL;
101 TALLOC_CTX *ctx = talloc_tos();
104 /* XXXX we need to handle passed times, sattr and flags */
105 srvstr_pull_req_talloc(ctx, req, &pipe_name, req->buf, STR_TERMINATE);
107 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
112 /* If the name doesn't start \PIPE\ then this is directed */
113 /* at a mailslot or something we really, really don't understand, */
114 /* not just something we really don't understand. */
115 if ( strncmp(pipe_name,PIPE,PIPELEN) != 0 ) {
116 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
120 DEBUG(4,("Opening pipe %s.\n", pipe_name));
122 /* Strip \PIPE\ off the name. */
123 fname = pipe_name + PIPELEN;
127 * Hack for NT printers... JRA.
129 if(should_fail_next_srvsvc_open(fname)) {
130 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
135 status = open_np_file(req, fname, &fsp);
136 if (!NT_STATUS_IS_OK(status)) {
137 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
138 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
142 reply_nterror(req, status);
146 /* Prepare the reply */
147 reply_outbuf(req, 15, 0);
149 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
150 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
152 /* Mark the opened file as an existing named pipe in message mode. */
153 SSVAL(req->outbuf,smb_vwv9,2);
154 SSVAL(req->outbuf,smb_vwv10,0xc700);
156 SSVAL(req->outbuf, smb_vwv2, fsp->fnum);
157 SSVAL(req->outbuf, smb_vwv3, 0); /* fmode */
158 srv_put_dos_date3((char *)req->outbuf, smb_vwv4, 0); /* mtime */
159 SIVAL(req->outbuf, smb_vwv6, 0); /* size */
160 SSVAL(req->outbuf, smb_vwv8, 0); /* rmode */
161 SSVAL(req->outbuf, smb_vwv11, 0x0001);
167 /****************************************************************************
168 Reply to a write on a pipe.
169 ****************************************************************************/
171 struct pipe_write_state {
175 static void pipe_write_done(struct tevent_req *subreq);
177 void reply_pipe_write(struct smb_request *req)
179 files_struct *fsp = file_fsp(req, SVAL(req->vwv+0, 0));
181 struct pipe_write_state *state;
182 struct tevent_req *subreq;
184 if (!fsp_is_np(fsp)) {
185 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
189 if (fsp->vuid != req->vuid) {
190 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
194 state = talloc(req, struct pipe_write_state);
196 reply_nterror(req, NT_STATUS_NO_MEMORY);
199 req->async_priv = state;
201 state->numtowrite = SVAL(req->vwv+1, 0);
205 DEBUG(6, ("reply_pipe_write: %x name: %s len: %d\n", (int)fsp->fnum,
206 fsp_str_dbg(fsp), (int)state->numtowrite));
208 subreq = np_write_send(state, req->sconn->ev_ctx,
209 fsp->fake_file_handle, data, state->numtowrite);
210 if (subreq == NULL) {
212 reply_nterror(req, NT_STATUS_NO_MEMORY);
215 tevent_req_set_callback(subreq, pipe_write_done,
216 talloc_move(req->conn, &req));
219 static void pipe_write_done(struct tevent_req *subreq)
221 struct smb_request *req = tevent_req_callback_data(
222 subreq, struct smb_request);
223 struct pipe_write_state *state = talloc_get_type_abort(
224 req->async_priv, struct pipe_write_state);
226 ssize_t nwritten = -1;
228 status = np_write_recv(subreq, &nwritten);
231 reply_nterror(req, status);
235 /* Looks bogus to me now. Needs to be removed ? JRA. */
236 if ((nwritten == 0 && state->numtowrite != 0)) {
237 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
241 reply_outbuf(req, 1, 0);
243 SSVAL(req->outbuf,smb_vwv0,nwritten);
245 DEBUG(3,("write-IPC nwritten=%d\n", (int)nwritten));
248 if (!srv_send_smb(req->sconn, (char *)req->outbuf,
250 IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
252 exit_server_cleanly("construct_reply: srv_send_smb failed.");
257 /****************************************************************************
258 Reply to a write and X.
260 This code is basically stolen from reply_write_and_X with some
261 wrinkles to handle pipes.
262 ****************************************************************************/
264 struct pipe_write_andx_state {
265 bool pipe_start_message_raw;
269 static void pipe_write_andx_done(struct tevent_req *subreq);
271 void reply_pipe_write_and_X(struct smb_request *req)
273 files_struct *fsp = file_fsp(req, SVAL(req->vwv+2, 0));
274 int smb_doff = SVAL(req->vwv+11, 0);
276 struct pipe_write_andx_state *state;
277 struct tevent_req *subreq;
279 if (!fsp_is_np(fsp)) {
280 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
284 if (fsp->vuid != req->vuid) {
285 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
289 state = talloc(req, struct pipe_write_andx_state);
291 reply_nterror(req, NT_STATUS_NO_MEMORY);
294 req->async_priv = state;
296 state->numtowrite = SVAL(req->vwv+10, 0);
297 state->pipe_start_message_raw =
298 ((SVAL(req->vwv+7, 0) & (PIPE_START_MESSAGE|PIPE_RAW_MODE))
299 == (PIPE_START_MESSAGE|PIPE_RAW_MODE));
301 DEBUG(6, ("reply_pipe_write_and_X: %x name: %s len: %d\n",
302 (int)fsp->fnum, fsp_str_dbg(fsp), (int)state->numtowrite));
304 data = (const uint8_t *)smb_base(req->inbuf) + smb_doff;
306 if (state->pipe_start_message_raw) {
308 * For the start of a message in named pipe byte mode,
309 * the first two bytes are a length-of-pdu field. Ignore
310 * them (we don't trust the client). JRA.
312 if (state->numtowrite < 2) {
313 DEBUG(0,("reply_pipe_write_and_X: start of message "
314 "set and not enough data sent.(%u)\n",
315 (unsigned int)state->numtowrite ));
316 reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
321 state->numtowrite -= 2;
324 subreq = np_write_send(state, req->sconn->ev_ctx,
325 fsp->fake_file_handle, data, state->numtowrite);
326 if (subreq == NULL) {
328 reply_nterror(req, NT_STATUS_NO_MEMORY);
331 tevent_req_set_callback(subreq, pipe_write_andx_done,
332 talloc_move(req->conn, &req));
335 static void pipe_write_andx_done(struct tevent_req *subreq)
337 struct smb_request *req = tevent_req_callback_data(
338 subreq, struct smb_request);
339 struct pipe_write_andx_state *state = talloc_get_type_abort(
340 req->async_priv, struct pipe_write_andx_state);
342 ssize_t nwritten = -1;
344 status = np_write_recv(subreq, &nwritten);
347 if (!NT_STATUS_IS_OK(status)) {
348 reply_nterror(req, status);
352 /* Looks bogus to me now. Is this error message correct ? JRA. */
353 if (nwritten != state->numtowrite) {
354 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
358 reply_outbuf(req, 6, 0);
360 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
361 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
363 nwritten = (state->pipe_start_message_raw ? nwritten + 2 : nwritten);
364 SSVAL(req->outbuf,smb_vwv2,nwritten);
366 DEBUG(3,("writeX-IPC nwritten=%d\n", (int)nwritten));
371 * We must free here as the ownership of req was
372 * moved to the connection struct in reply_pipe_write_and_X().
377 /****************************************************************************
378 Reply to a read and X.
379 This code is basically stolen from reply_read_and_X with some
380 wrinkles to handle pipes.
381 ****************************************************************************/
383 struct pipe_read_andx_state {
389 static void pipe_read_andx_done(struct tevent_req *subreq);
391 void reply_pipe_read_and_X(struct smb_request *req)
393 files_struct *fsp = file_fsp(req, SVAL(req->vwv+0, 0));
395 struct pipe_read_andx_state *state;
396 struct tevent_req *subreq;
398 /* we don't use the offset given to use for pipe reads. This
399 is deliberate, instead we always return the next lump of
402 uint32 smb_offs = IVAL(req->vwv+3, 0);
405 if (!fsp_is_np(fsp)) {
406 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
410 if (fsp->vuid != req->vuid) {
411 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
415 state = talloc(req, struct pipe_read_andx_state);
417 reply_nterror(req, NT_STATUS_NO_MEMORY);
420 req->async_priv = state;
422 state->smb_maxcnt = SVAL(req->vwv+5, 0);
423 state->smb_mincnt = SVAL(req->vwv+6, 0);
425 reply_outbuf(req, 12, state->smb_maxcnt);
426 SSVAL(req->outbuf, smb_vwv0, 0xff); /* andx chain ends */
427 SSVAL(req->outbuf, smb_vwv1, 0); /* no andx offset */
429 data = (uint8_t *)smb_buf(req->outbuf);
432 * We have to tell the upper layers that we're async.
434 state->outbuf = req->outbuf;
437 subreq = np_read_send(state, req->sconn->ev_ctx,
438 fsp->fake_file_handle, data,
440 if (subreq == NULL) {
441 reply_nterror(req, NT_STATUS_NO_MEMORY);
444 tevent_req_set_callback(subreq, pipe_read_andx_done,
445 talloc_move(req->conn, &req));
448 static void pipe_read_andx_done(struct tevent_req *subreq)
450 struct smb_request *req = tevent_req_callback_data(
451 subreq, struct smb_request);
452 struct pipe_read_andx_state *state = talloc_get_type_abort(
453 req->async_priv, struct pipe_read_andx_state);
456 bool is_data_outstanding;
458 status = np_read_recv(subreq, &nread, &is_data_outstanding);
460 if (!NT_STATUS_IS_OK(status)) {
461 reply_nterror(req, status);
465 req->outbuf = state->outbuf;
466 state->outbuf = NULL;
468 srv_set_message((char *)req->outbuf, 12, nread, False);
472 * we should return STATUS_BUFFER_OVERFLOW if there's
475 * But we can't enable it yet, as it has bad interactions
476 * with fixup_chain_error_packet() in chain_reply().
478 if (is_data_outstanding) {
479 error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
480 STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
484 SSVAL(req->outbuf,smb_vwv5,nread);
485 SSVAL(req->outbuf,smb_vwv6,
487 + 1 /* the wct field */
488 + 12 * sizeof(uint16_t) /* vwv */
489 + 2); /* the buflen field */
490 SSVAL(req->outbuf,smb_vwv11,state->smb_maxcnt);
492 DEBUG(3,("readX-IPC min=%d max=%d nread=%d\n",
493 state->smb_mincnt, state->smb_maxcnt, (int)nread));
498 * We must free here as the ownership of req was
499 * moved to the connection struct in reply_pipe_read_and_X().