35dd9a74b905665906c946103fca27059671f1aa
[nivanova/samba-autobuild/.git] / source3 / smbd / pipes.c
1 /* 
2    Unix SMB/CIFS implementation.
3    Pipe SMB reply routines
4    Copyright (C) Andrew Tridgell 1992-1998
5    Copyright (C) Luke Kenneth Casson Leighton 1996-1998
6    Copyright (C) Paul Ashton  1997-1998.
7    Copyright (C) Jeremy Allison 2005.
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22 /*
23    This file handles reply_ calls on named pipes that the server
24    makes to handle specific protocols
25 */
26
27
28 #include "includes.h"
29 #include "smbd/smbd.h"
30 #include "smbd/globals.h"
31 #include "libcli/security/security.h"
32 #include "rpc_server/srv_pipe_hnd.h"
33
34 #define PIPE            "\\PIPE\\"
35 #define PIPELEN         strlen(PIPE)
36
37 #define MAX_PIPE_NAME_LEN       24
38
39 NTSTATUS open_np_file(struct smb_request *smb_req, const char *name,
40                       struct files_struct **pfsp)
41 {
42         struct connection_struct *conn = smb_req->conn;
43         struct files_struct *fsp;
44         struct smb_filename *smb_fname = NULL;
45         NTSTATUS status;
46
47         status = file_new(smb_req, conn, &fsp);
48         if (!NT_STATUS_IS_OK(status)) {
49                 DEBUG(0, ("file_new failed: %s\n", nt_errstr(status)));
50                 return status;
51         }
52
53         fsp->conn = conn;
54         fsp->fh->fd = -1;
55         fsp->vuid = smb_req->vuid;
56         fsp->can_lock = false;
57         fsp->access_mask = FILE_READ_DATA | FILE_WRITE_DATA;
58
59         status = create_synthetic_smb_fname(talloc_tos(), name, NULL, NULL,
60                                             &smb_fname);
61                 if (!NT_STATUS_IS_OK(status)) {
62                 file_free(smb_req, fsp);
63                 return status;
64         }
65         status = fsp_set_smb_fname(fsp, smb_fname);
66         TALLOC_FREE(smb_fname);
67         if (!NT_STATUS_IS_OK(status)) {
68                 file_free(smb_req, fsp);
69                 return status;
70         }
71
72         status = np_open(fsp, name,
73                          conn->sconn->local_address,
74                          conn->sconn->remote_address,
75                          &conn->sconn->client_id,
76                          conn->session_info,
77                          conn->sconn->msg_ctx,
78                          &fsp->fake_file_handle);
79         if (!NT_STATUS_IS_OK(status)) {
80                 DEBUG(10, ("np_open(%s) returned %s\n", name,
81                            nt_errstr(status)));
82                 file_free(smb_req, fsp);
83                 return status;
84         }
85
86         *pfsp = fsp;
87
88         return NT_STATUS_OK;
89 }
90
91 /****************************************************************************
92  Reply to an open and X on a named pipe.
93  This code is basically stolen from reply_open_and_X with some
94  wrinkles to handle pipes.
95 ****************************************************************************/
96
97 void reply_open_pipe_and_X(connection_struct *conn, struct smb_request *req)
98 {
99         const char *fname = NULL;
100         char *pipe_name = NULL;
101         files_struct *fsp;
102         TALLOC_CTX *ctx = talloc_tos();
103         NTSTATUS status;
104
105         /* XXXX we need to handle passed times, sattr and flags */
106         srvstr_pull_req_talloc(ctx, req, &pipe_name, req->buf, STR_TERMINATE);
107         if (!pipe_name) {
108                 reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
109                                 ERRDOS, ERRbadpipe);
110                 return;
111         }
112
113         /* If the name doesn't start \PIPE\ then this is directed */
114         /* at a mailslot or something we really, really don't understand, */
115         /* not just something we really don't understand. */
116         if ( strncmp(pipe_name,PIPE,PIPELEN) != 0 ) {
117                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
118                 return;
119         }
120
121         DEBUG(4,("Opening pipe %s.\n", pipe_name));
122
123         /* Strip \PIPE\ off the name. */
124         fname = pipe_name + PIPELEN;
125
126 #if 0
127         /*
128          * Hack for NT printers... JRA.
129          */
130         if(should_fail_next_srvsvc_open(fname)) {
131                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
132                 return;
133         }
134 #endif
135
136         status = open_np_file(req, fname, &fsp);
137         if (!NT_STATUS_IS_OK(status)) {
138                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
139                         reply_botherror(req, NT_STATUS_OBJECT_NAME_NOT_FOUND,
140                                         ERRDOS, ERRbadpipe);
141                         return;
142                 }
143                 reply_nterror(req, status);
144                 return;
145         }
146
147         /* Prepare the reply */
148         reply_outbuf(req, 15, 0);
149
150         /* Mark the opened file as an existing named pipe in message mode. */
151         SSVAL(req->outbuf,smb_vwv9,2);
152         SSVAL(req->outbuf,smb_vwv10,0xc700);
153
154         SSVAL(req->outbuf, smb_vwv2, fsp->fnum);
155         SSVAL(req->outbuf, smb_vwv3, 0);        /* fmode */
156         srv_put_dos_date3((char *)req->outbuf, smb_vwv4, 0);    /* mtime */
157         SIVAL(req->outbuf, smb_vwv6, 0);        /* size */
158         SSVAL(req->outbuf, smb_vwv8, 0);        /* rmode */
159         SSVAL(req->outbuf, smb_vwv11, 0x0001);
160
161         chain_reply(req);
162         return;
163 }
164
165 /****************************************************************************
166  Reply to a write on a pipe.
167 ****************************************************************************/
168
169 struct pipe_write_state {
170         size_t numtowrite;
171 };
172
173 static void pipe_write_done(struct tevent_req *subreq);
174
175 void reply_pipe_write(struct smb_request *req)
176 {
177         files_struct *fsp = file_fsp(req, SVAL(req->vwv+0, 0));
178         const uint8_t *data;
179         struct pipe_write_state *state;
180         struct tevent_req *subreq;
181
182         if (!fsp_is_np(fsp)) {
183                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
184                 return;
185         }
186
187         if (fsp->vuid != req->vuid) {
188                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
189                 return;
190         }
191
192         state = talloc(req, struct pipe_write_state);
193         if (state == NULL) {
194                 reply_nterror(req, NT_STATUS_NO_MEMORY);
195                 return;
196         }
197         req->async_priv = state;
198
199         state->numtowrite = SVAL(req->vwv+1, 0);
200
201         data = req->buf + 3;
202
203         DEBUG(6, ("reply_pipe_write: %x name: %s len: %d\n", (int)fsp->fnum,
204                   fsp_str_dbg(fsp), (int)state->numtowrite));
205
206         subreq = np_write_send(state, smbd_event_context(),
207                                fsp->fake_file_handle, data, state->numtowrite);
208         if (subreq == NULL) {
209                 TALLOC_FREE(state);
210                 reply_nterror(req, NT_STATUS_NO_MEMORY);
211                 return;
212         }
213         tevent_req_set_callback(subreq, pipe_write_done,
214                                 talloc_move(req->conn, &req));
215 }
216
217 static void pipe_write_done(struct tevent_req *subreq)
218 {
219         struct smb_request *req = tevent_req_callback_data(
220                 subreq, struct smb_request);
221         struct pipe_write_state *state = talloc_get_type_abort(
222                 req->async_priv, struct pipe_write_state);
223         NTSTATUS status;
224         ssize_t nwritten = -1;
225
226         status = np_write_recv(subreq, &nwritten);
227         TALLOC_FREE(subreq);
228         if (nwritten < 0) {
229                 reply_nterror(req, status);
230                 goto send;
231         }
232
233         /* Looks bogus to me now. Needs to be removed ? JRA. */
234         if ((nwritten == 0 && state->numtowrite != 0)) {
235                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
236                 goto send;
237         }
238
239         reply_outbuf(req, 1, 0);
240
241         SSVAL(req->outbuf,smb_vwv0,nwritten);
242
243         DEBUG(3,("write-IPC nwritten=%d\n", (int)nwritten));
244
245  send:
246         if (!srv_send_smb(req->sconn, (char *)req->outbuf,
247                           true, req->seqnum+1,
248                           IS_CONN_ENCRYPTED(req->conn)||req->encrypted,
249                           &req->pcd)) {
250                 exit_server_cleanly("construct_reply: srv_send_smb failed.");
251         }
252         TALLOC_FREE(req);
253 }
254
255 /****************************************************************************
256  Reply to a write and X.
257
258  This code is basically stolen from reply_write_and_X with some
259  wrinkles to handle pipes.
260 ****************************************************************************/
261
262 struct pipe_write_andx_state {
263         bool pipe_start_message_raw;
264         size_t numtowrite;
265 };
266
267 static void pipe_write_andx_done(struct tevent_req *subreq);
268
269 void reply_pipe_write_and_X(struct smb_request *req)
270 {
271         files_struct *fsp = file_fsp(req, SVAL(req->vwv+2, 0));
272         int smb_doff = SVAL(req->vwv+11, 0);
273         uint8_t *data;
274         struct pipe_write_andx_state *state;
275         struct tevent_req *subreq;
276
277         if (!fsp_is_np(fsp)) {
278                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
279                 return;
280         }
281
282         if (fsp->vuid != req->vuid) {
283                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
284                 return;
285         }
286
287         state = talloc(req, struct pipe_write_andx_state);
288         if (state == NULL) {
289                 reply_nterror(req, NT_STATUS_NO_MEMORY);
290                 return;
291         }
292         req->async_priv = state;
293
294         state->numtowrite = SVAL(req->vwv+10, 0);
295         state->pipe_start_message_raw =
296                 ((SVAL(req->vwv+7, 0) & (PIPE_START_MESSAGE|PIPE_RAW_MODE))
297                  == (PIPE_START_MESSAGE|PIPE_RAW_MODE));
298
299         DEBUG(6, ("reply_pipe_write_and_X: %x name: %s len: %d\n",
300                   (int)fsp->fnum, fsp_str_dbg(fsp), (int)state->numtowrite));
301
302         data = (uint8_t *)smb_base(req->inbuf) + smb_doff;
303
304         if (state->pipe_start_message_raw) {
305                 /*
306                  * For the start of a message in named pipe byte mode,
307                  * the first two bytes are a length-of-pdu field. Ignore
308                  * them (we don't trust the client). JRA.
309                  */
310                 if (state->numtowrite < 2) {
311                         DEBUG(0,("reply_pipe_write_and_X: start of message "
312                                  "set and not enough data sent.(%u)\n",
313                                  (unsigned int)state->numtowrite ));
314                         reply_nterror(req, NT_STATUS_INVALID_PARAMETER);
315                         return;
316                 }
317
318                 data += 2;
319                 state->numtowrite -= 2;
320         }
321
322         subreq = np_write_send(state, smbd_event_context(),
323                                fsp->fake_file_handle, data, state->numtowrite);
324         if (subreq == NULL) {
325                 TALLOC_FREE(state);
326                 reply_nterror(req, NT_STATUS_NO_MEMORY);
327                 return;
328         }
329         tevent_req_set_callback(subreq, pipe_write_andx_done,
330                                 talloc_move(req->conn, &req));
331 }
332
333 static void pipe_write_andx_done(struct tevent_req *subreq)
334 {
335         struct smb_request *req = tevent_req_callback_data(
336                 subreq, struct smb_request);
337         struct pipe_write_andx_state *state = talloc_get_type_abort(
338                 req->async_priv, struct pipe_write_andx_state);
339         NTSTATUS status;
340         ssize_t nwritten = -1;
341
342         status = np_write_recv(subreq, &nwritten);
343         TALLOC_FREE(subreq);
344
345         if (!NT_STATUS_IS_OK(status)) {
346                 reply_nterror(req, status);
347                 goto done;
348         }
349
350         /* Looks bogus to me now. Is this error message correct ? JRA. */
351         if (nwritten != state->numtowrite) {
352                 reply_nterror(req, NT_STATUS_ACCESS_DENIED);
353                 goto done;
354         }
355
356         reply_outbuf(req, 6, 0);
357
358         nwritten = (state->pipe_start_message_raw ? nwritten + 2 : nwritten);
359         SSVAL(req->outbuf,smb_vwv2,nwritten);
360
361         DEBUG(3,("writeX-IPC nwritten=%d\n", (int)nwritten));
362
363  done:
364         chain_reply(req);
365         /*
366          * We must free here as the ownership of req was
367          * moved to the connection struct in reply_pipe_write_and_X().
368          */
369         TALLOC_FREE(req);
370 }
371
372 /****************************************************************************
373  Reply to a read and X.
374  This code is basically stolen from reply_read_and_X with some
375  wrinkles to handle pipes.
376 ****************************************************************************/
377
378 struct pipe_read_andx_state {
379         uint8_t *outbuf;
380         int smb_mincnt;
381         int smb_maxcnt;
382 };
383
384 static void pipe_read_andx_done(struct tevent_req *subreq);
385
386 void reply_pipe_read_and_X(struct smb_request *req)
387 {
388         files_struct *fsp = file_fsp(req, SVAL(req->vwv+0, 0));
389         uint8_t *data;
390         struct pipe_read_andx_state *state;
391         struct tevent_req *subreq;
392
393         /* we don't use the offset given to use for pipe reads. This
394            is deliberate, instead we always return the next lump of
395            data on the pipe */
396 #if 0
397         uint32 smb_offs = IVAL(req->vwv+3, 0);
398 #endif
399
400         if (!fsp_is_np(fsp)) {
401                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
402                 return;
403         }
404
405         if (fsp->vuid != req->vuid) {
406                 reply_nterror(req, NT_STATUS_INVALID_HANDLE);
407                 return;
408         }
409
410         state = talloc(req, struct pipe_read_andx_state);
411         if (state == NULL) {
412                 reply_nterror(req, NT_STATUS_NO_MEMORY);
413                 return;
414         }
415         req->async_priv = state;
416
417         state->smb_maxcnt = SVAL(req->vwv+5, 0);
418         state->smb_mincnt = SVAL(req->vwv+6, 0);
419
420         reply_outbuf(req, 12, state->smb_maxcnt);
421         data = (uint8_t *)smb_buf(req->outbuf);
422
423         /*
424          * We have to tell the upper layers that we're async.
425          */
426         state->outbuf = req->outbuf;
427         req->outbuf = NULL;
428
429         subreq = np_read_send(state, smbd_event_context(),
430                               fsp->fake_file_handle, data,
431                               state->smb_maxcnt);
432         if (subreq == NULL) {
433                 reply_nterror(req, NT_STATUS_NO_MEMORY);
434                 return;
435         }
436         tevent_req_set_callback(subreq, pipe_read_andx_done,
437                                 talloc_move(req->conn, &req));
438 }
439
440 static void pipe_read_andx_done(struct tevent_req *subreq)
441 {
442         struct smb_request *req = tevent_req_callback_data(
443                 subreq, struct smb_request);
444         struct pipe_read_andx_state *state = talloc_get_type_abort(
445                 req->async_priv, struct pipe_read_andx_state);
446         NTSTATUS status;
447         ssize_t nread;
448         bool is_data_outstanding;
449
450         status = np_read_recv(subreq, &nread, &is_data_outstanding);
451         TALLOC_FREE(subreq);
452         if (!NT_STATUS_IS_OK(status)) {
453                 reply_nterror(req, status);
454                 goto done;
455         }
456
457         req->outbuf = state->outbuf;
458         state->outbuf = NULL;
459
460         srv_set_message((char *)req->outbuf, 12, nread, False);
461
462 #if 0
463         /*
464          * we should return STATUS_BUFFER_OVERFLOW if there's
465          * out standing data.
466          *
467          * But we can't enable it yet, as it has bad interactions
468          * with fixup_chain_error_packet() in chain_reply().
469          */
470         if (is_data_outstanding) {
471                 error_packet_set((char *)req->outbuf, ERRDOS, ERRmoredata,
472                                  STATUS_BUFFER_OVERFLOW, __LINE__, __FILE__);
473         }
474 #endif
475
476         SSVAL(req->outbuf,smb_vwv5,nread);
477         SSVAL(req->outbuf,smb_vwv6,
478               req_wct_ofs(req)
479               + 1               /* the wct field */
480               + 12 * sizeof(uint16_t) /* vwv */
481               + 2);             /* the buflen field */
482         SSVAL(req->outbuf,smb_vwv11,state->smb_maxcnt);
483   
484         DEBUG(3,("readX-IPC min=%d max=%d nread=%d\n",
485                  state->smb_mincnt, state->smb_maxcnt, (int)nread));
486
487  done:
488         chain_reply(req);
489         /*
490          * We must free here as the ownership of req was
491          * moved to the connection struct in reply_pipe_read_and_X().
492          */
493         TALLOC_FREE(req);
494 }