dfe8756a19cfecdf97023ecfbf99fe9df84446a7
[kai/samba.git] / source3 / smbd / pipes.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Pipe SMB reply routines
4    Copyright (C) Andrew Tridgell 1992-1998
5    Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6    Copyright (C) Paul Ashton  1997-1998.
7    Copyright (C) Jeremy Allison 2005.
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23    This file handles reply_ calls on named pipes that the server
24    makes to handle specific protocols
25 */
26
27
28 #include "includes.h"
29 #include "smbd/globals.h"
30
31 #define PIPE            "\\PIPE\\"
32 #define PIPELEN         strlen(PIPE)
33
34 #define MAX_PIPE_NAME_LEN       24
35
36 NTSTATUS open_np_file(struct smb_request *smb_req, const char *name,
37                       struct files_struct **pfsp)
38 {
39         struct connection_struct *conn = smb_req->conn;
40         struct files_struct *fsp;
41         struct smb_filename *smb_fname = NULL;
42         NTSTATUS status;
43
44         status = file_new(smb_req, conn, &fsp);
45         if (!NT_STATUS_IS_OK(status)) {
46                 DEBUG(0, ("file_new failed: %s\n", nt_errstr(status)));
47                 return status;
48         }
49
50         fsp->conn = conn;
51         fsp->fh->fd = -1;
52         fsp->vuid = smb_req->vuid;
53         fsp->can_lock = false;
54         fsp->access_mask = FILE_READ_DATA | FILE_WRITE_DATA;
55
56         status = create_synthetic_smb_fname(talloc_tos(), name, NULL, NULL,
57                                             &smb_fname);
58                 if (!NT_STATUS_IS_OK(status)) {
59                 file_free(smb_req, fsp);
60                 return status;
61         }
62         status = fsp_set_smb_fname(fsp, smb_fname);
63         TALLOC_FREE(smb_fname);
64         if (!NT_STATUS_IS_OK(status)) {
65                 file_free(smb_req, fsp);
66                 return status;
67         }
68
69         status = np_open(fsp, name,
70                          conn->sconn->local_address,
71                          conn->sconn->remote_address,
72                          &conn->sconn->client_id,
73                          conn->server_info,
74                          conn->sconn->msg_ctx,
75                          &fsp->fake_file_handle);
76         if (!NT_STATUS_IS_OK(status)) {
77                 DEBUG(10, ("np_open(%s) returned %s\n", name,
78                            nt_errstr(status)));
79                 file_free(smb_req, fsp);
80                 return status;
81         }
82
83         *pfsp = fsp;
84
85         return NT_STATUS_OK;
86 }
87
88 /****************************************************************************
89  Reply to an open and X on a named pipe.
90  This code is basically stolen from reply_open_and_X with some
91  wrinkles to handle pipes.
92 ****************************************************************************/
93
94 void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req)
95 {
96         const char *fname = NULL;
97         char *pipe_name = NULL;
98         files_struct *fsp;
99         TALLOC_CTX *ctx = talloc_tos();
100         NTSTATUS status;
101
102         /* XXXX we need to handle passed times, sattr and flags */
103         srvstr_pull_req_talloc(ctx, req, &pipe_name, req->buf, STR_TERMINATE);
104         if (!pipe_name) {
105                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
106                                 ERRDOS, ERRbadpipe);
107                 return;
108         }
109
110         /* If the name doesn't start \PIPE\ then this is directed */
111         /* at a mailslot or something we really, really don't understand, */
112         /* not just something we really don't understand. */
113         if ( strncmp(pipe_name,PIPE,PIPELEN) != 0 ) {
114                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
115                 return;
116         }
117
118         DEBUG(4,("Opening pipe %s.\n", pipe_name));
119
120         /* Strip \PIPE\ off the name. */
121         fname = pipe_name + PIPELEN;
122
123 #if 0
124         /*
125          * Hack for NT printers... JRA.
126          */
127         if(should_fail_next_srvsvc_open(fname)) {
128                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
129                 return;
130         }
131 #endif
132
133         status = open_np_file(req, fname, &fsp);
134         if (!NT_STATUS_IS_OK(status)) {
135                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
136                         reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
137                                         ERRDOS, ERRbadpipe);
138                         return;
139                 }
140                 reply_nterror(req, status);
141                 return;
142         }
143
144         /* Prepare the reply */
145         reply_outbuf(req, 15, 0);
146
147         /* Mark the opened file as an existing named pipe in message mode. */
148         SSVAL(req->outbuf,smb_vwv9,2);
149         SSVAL(req->outbuf,smb_vwv10,0xc700);
150
151         SSVAL(req->outbuf, smb_vwv2, fsp->fnum);
152         SSVAL(req->outbuf, smb_vwv3, 0);        /* fmode */
153         srv_put_dos_date3((char *)req->outbuf, smb_vwv4, 0);    /* mtime */
154         SIVAL(req->outbuf, smb_vwv6, 0);        /* size */
155         SSVAL(req->outbuf, smb_vwv8, 0);        /* rmode */
156         SSVAL(req->outbuf, smb_vwv11, 0x0001);
157
158         chain_reply(req);
159         return;
160 }
161
162 /****************************************************************************
163  Reply to a write on a pipe.
164 ****************************************************************************/
165
166 struct pipe_write_state {
167         size_t numtowrite;
168 };
169
170 static void pipe_write_done(struct tevent_req *subreq);
171
172 void reply_pipe_write(struct smb_request *req)
173 {
174         files_struct *fsp = file_fsp(req, SVAL(req->vwv+0, 0));
175         const uint8_t *data;
176         struct pipe_write_state *state;
177         struct tevent_req *subreq;
178
179         if (!fsp_is_np(fsp)) {
180                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
181                 return;
182         }
183
184         if (fsp->vuid != req->vuid) {
185                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
186                 return;
187         }
188
189         state = talloc(req, struct pipe_write_state);
190         if (state == NULL) {
191                 reply_nterror(req, NT_STATUS_NO_MEMORY);
192                 return;
193         }
194         req->async_priv = state;
195
196         state->numtowrite = SVAL(req->vwv+1, 0);
197
198         data = req->buf + 3;
199
200         DEBUG(6, ("reply_pipe_write: %x name: %s len: %d\n", (int)fsp->fnum,
201                   fsp_str_dbg(fsp), (int)state->numtowrite));
202
203         subreq = np_write_send(state, smbd_event_context(),
204                                fsp->fake_file_handle, data, state->numtowrite);
205         if (subreq == NULL) {
206                 TALLOC_FREE(state);
207                 reply_nterror(req, NT_STATUS_NO_MEMORY);
208                 return;
209         }
210         tevent_req_set_callback(subreq, pipe_write_done,
211                                 talloc_move(req->conn, &req));
212 }
213
214 static void pipe_write_done(struct tevent_req *subreq)
215 {
216         struct smb_request *req = tevent_req_callback_data(
217                 subreq, struct smb_request);
218         struct pipe_write_state *state = talloc_get_type_abort(
219                 req->async_priv, struct pipe_write_state);
220         NTSTATUS status;
221         ssize_t nwritten = -1;
222
223         status = np_write_recv(subreq, &nwritten);
224         TALLOC_FREE(subreq);
225         if (nwritten < 0) {
226                 reply_nterror(req, status);
227                 goto send;
228         }
229
230         /* Looks bogus to me now. Needs to be removed ? JRA. */
231         if ((nwritten == 0 && state->numtowrite != 0)) {
232                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
233                 goto send;
234         }
235
236         reply_outbuf(req, 1, 0);
237
238         SSVAL(req->outbuf,smb_vwv0,nwritten);
239
240         DEBUG(3,("write-IPC nwritten=%d\n", (int)nwritten));
241
242  send:
243         if (!srv_send_smb(req->sconn, (char *)req->outbuf,
244                           true, req->seqnum+1,
245                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
246                           &req->pcd)) {
247                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
248         }
249         TALLOC_FREE(req);
250 }
251
252 /****************************************************************************
253  Reply to a write and X.
254
255  This code is basically stolen from reply_write_and_X with some
256  wrinkles to handle pipes.
257 ****************************************************************************/
258
259 struct pipe_write_andx_state {
260         bool pipe_start_message_raw;
261         size_t numtowrite;
262 };
263
264 static void pipe_write_andx_done(struct tevent_req *subreq);
265
266 void reply_pipe_write_and_X(struct smb_request *req)
267 {
268         files_struct *fsp = file_fsp(req, SVAL(req->vwv+2, 0));
269         int smb_doff = SVAL(req->vwv+11, 0);
270         uint8_t *data;
271         struct pipe_write_andx_state *state;
272         struct tevent_req *subreq;
273
274         if (!fsp_is_np(fsp)) {
275                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
276                 return;
277         }
278
279         if (fsp->vuid != req->vuid) {
280                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
281                 return;
282         }
283
284         state = talloc(req, struct pipe_write_andx_state);
285         if (state == NULL) {
286                 reply_nterror(req, NT_STATUS_NO_MEMORY);
287                 return;
288         }
289         req->async_priv = state;
290
291         state->numtowrite = SVAL(req->vwv+10, 0);
292         state->pipe_start_message_raw =
293                 ((SVAL(req->vwv+7, 0) & (PIPE_START_MESSAGE|PIPE_RAW_MODE))
294                  == (PIPE_START_MESSAGE|PIPE_RAW_MODE));
295
296         DEBUG(6, ("reply_pipe_write_and_X: %x name: %s len: %d\n",
297                   (int)fsp->fnum, fsp_str_dbg(fsp), (int)state->numtowrite));
298
299         data = (uint8_t *)smb_base(req->inbuf) + smb_doff;
300
301         if (state->pipe_start_message_raw) {
302                 /*
303                  * For the start of a message in named pipe byte mode,
304                  * the first two bytes are a length-of-pdu field. Ignore
305                  * them (we don't trust the client). JRA.
306                  */
307                 if (state->numtowrite < 2) {
308                         DEBUG(0,("reply_pipe_write_and_X: start of message "
309                                  "set and not enough data sent.(%u)\n",
310                                  (unsigned int)state->numtowrite ));
311                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
312                         return;
313                 }
314
315                 data += 2;
316                 state->numtowrite -= 2;
317         }
318
319         subreq = np_write_send(state, smbd_event_context(),
320                                fsp->fake_file_handle, data, state->numtowrite);
321         if (subreq == NULL) {
322                 TALLOC_FREE(state);
323                 reply_nterror(req, NT_STATUS_NO_MEMORY);
324                 return;
325         }
326         tevent_req_set_callback(subreq, pipe_write_andx_done,
327                                 talloc_move(req->conn, &req));
328 }
329
330 static void pipe_write_andx_done(struct tevent_req *subreq)
331 {
332         struct smb_request *req = tevent_req_callback_data(
333                 subreq, struct smb_request);
334         struct pipe_write_andx_state *state = talloc_get_type_abort(
335                 req->async_priv, struct pipe_write_andx_state);
336         NTSTATUS status;
337         ssize_t nwritten = -1;
338
339         status = np_write_recv(subreq, &nwritten);
340         TALLOC_FREE(subreq);
341
342         if (!NT_STATUS_IS_OK(status)) {
343                 reply_nterror(req, status);
344                 goto done;
345         }
346
347         /* Looks bogus to me now. Is this error message correct ? JRA. */
348         if (nwritten != state->numtowrite) {
349                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
350                 goto done;
351         }
352
353         reply_outbuf(req, 6, 0);
354
355         nwritten = (state->pipe_start_message_raw ? nwritten + 2 : nwritten);
356         SSVAL(req->outbuf,smb_vwv2,nwritten);
357
358         DEBUG(3,("writeX-IPC nwritten=%d\n", (int)nwritten));
359
360  done:
361         chain_reply(req);
362         /*
363          * We must free here as the ownership of req was
364          * moved to the connection struct in reply_pipe_write_and_X().
365          */
366         TALLOC_FREE(req);
367 }
368
369 /****************************************************************************
370  Reply to a read and X.
371  This code is basically stolen from reply_read_and_X with some
372  wrinkles to handle pipes.
373 ****************************************************************************/
374
375 struct pipe_read_andx_state {
376         uint8_t *outbuf;
377         int smb_mincnt;
378         int smb_maxcnt;
379 };
380
381 static void pipe_read_andx_done(struct tevent_req *subreq);
382
383 void reply_pipe_read_and_X(struct smb_request *req)
384 {
385         files_struct *fsp = file_fsp(req, SVAL(req->vwv+0, 0));
386         uint8_t *data;
387         struct pipe_read_andx_state *state;
388         struct tevent_req *subreq;
389
390         /* we don't use the offset given to use for pipe reads. This
391            is deliberate, instead we always return the next lump of
392            data on the pipe */
393 #if 0
394         uint32 smb_offs = IVAL(req->vwv+3, 0);
395 #endif
396
397         if (!fsp_is_np(fsp)) {
398                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
399                 return;
400         }
401
402         if (fsp->vuid != req->vuid) {
403                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
404                 return;
405         }
406
407         state = talloc(req, struct pipe_read_andx_state);
408         if (state == NULL) {
409                 reply_nterror(req, NT_STATUS_NO_MEMORY);
410                 return;
411         }
412         req->async_priv = state;
413
414         state->smb_maxcnt = SVAL(req->vwv+5, 0);
415         state->smb_mincnt = SVAL(req->vwv+6, 0);
416
417         reply_outbuf(req, 12, state->smb_maxcnt);
418         data = (uint8_t *)smb_buf(req->outbuf);
419
420         /*
421          * We have to tell the upper layers that we're async.
422          */
423         state->outbuf = req->outbuf;
424         req->outbuf = NULL;
425
426         subreq = np_read_send(state, smbd_event_context(),
427                               fsp->fake_file_handle, data,
428                               state->smb_maxcnt);
429         if (subreq == NULL) {
430                 reply_nterror(req, NT_STATUS_NO_MEMORY);
431                 return;
432         }
433         tevent_req_set_callback(subreq, pipe_read_andx_done,
434                                 talloc_move(req->conn, &req));
435 }
436
437 static void pipe_read_andx_done(struct tevent_req *subreq)
438 {
439         struct smb_request *req = tevent_req_callback_data(
440                 subreq, struct smb_request);
441         struct pipe_read_andx_state *state = talloc_get_type_abort(
442                 req->async_priv, struct pipe_read_andx_state);
443         NTSTATUS status;
444         ssize_t nread;
445         bool is_data_outstanding;
446
447         status = np_read_recv(subreq, &nread, &is_data_outstanding);
448         TALLOC_FREE(subreq);
449         if (!NT_STATUS_IS_OK(status)) {
450                 reply_nterror(req, status);
451                 goto done;
452         }
453
454         req->outbuf = state->outbuf;
455         state->outbuf = NULL;
456
457         srv_set_message((char *)req->outbuf, 12, nread, False);
458
459 #if 0
460         /*
461          * we should return STATUS_BUFFER_OVERFLOW if there's
462          * out standing data.
463          *
464          * But we can't enable it yet, as it has bad interactions
465          * with fixup_chain_error_packet() in chain_reply().
466          */
467         if (is_data_outstanding) {
468                 error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
469                                  STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
470         }
471 #endif
472
473         SSVAL(req->outbuf,smb_vwv5,nread);
474         SSVAL(req->outbuf,smb_vwv6,
475               req_wct_ofs(req)
476               + 1               /* the wct field */
477               + 12 * sizeof(uint16_t) /* vwv */
478               + 2);             /* the buflen field */
479         SSVAL(req->outbuf,smb_vwv11,state->smb_maxcnt);
480   
481         DEBUG(3,("readX-IPC min=%d max=%d nread=%d\n",
482                  state->smb_mincnt, state->smb_maxcnt, (int)nread));
483
484  done:
485         chain_reply(req);
486         /*
487          * We must free here as the ownership of req was
488          * moved to the connection struct in reply_pipe_read_and_X().
489          */
490         TALLOC_FREE(req);
491 }