diff options
Diffstat (limited to 'source/rpc_server/srv_pipe_hnd.c')
| -rw-r--r-- | source/rpc_server/srv_pipe_hnd.c | 309 |
1 files changed, 76 insertions, 233 deletions
diff --git a/source/rpc_server/srv_pipe_hnd.c b/source/rpc_server/srv_pipe_hnd.c index cc6e4b95f9e..f1d26095fa3 100644 --- a/source/rpc_server/srv_pipe_hnd.c +++ b/source/rpc_server/srv_pipe_hnd.c @@ -1,5 +1,6 @@ /* - * Unix SMB/CIFS implementation. + * Unix SMB/Netbios implementation. + * Version 1.9. * RPC Pipe client / server routines * Copyright (C) Andrew Tridgell 1992-1998, * Copyright (C) Luke Kenneth Casson Leighton 1996-1998, @@ -20,15 +21,14 @@ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */ + #include "includes.h" -#undef DBGC_CLASS -#define DBGC_CLASS DBGC_RPC_SRV #define PIPE "\\PIPE\\" #define PIPELEN strlen(PIPE) -static smb_np_struct *chain_p; +static pipes_struct *chain_p; static int pipes_open; #ifndef MAX_OPEN_PIPES @@ -41,62 +41,28 @@ static int pipes_open; * writers. This gets around a combination of bugs in the spooler * and the HP 8500 PCL driver that causes a spooler spin. JRA. * - * bumped up from 20 -> 64 after viewing traffic from WordPerfect + * bumped up from 20 -> 64 after viewing traffic from WordPerfect * 2002 running on NT 4.- SP6 - * bumped up from 64 -> 256 after viewing traffic from con2prt - * for lots of printers on a WinNT 4.x SP6 box. */ - + #ifndef MAX_OPEN_SPOOLSS_PIPES #define MAX_OPEN_SPOOLSS_PIPES 256 #endif static int current_spoolss_pipes_open; -static smb_np_struct *Pipes; -static pipes_struct *InternalPipes; +static pipes_struct *Pipes; static struct bitmap *bmap; -/* TODO - * the following prototypes are declared here to avoid - * code being moved about too much for a patch to be - * disrupted / less obvious. - * - * these functions, and associated functions that they - * call, should be moved behind a .so module-loading - * system _anyway_. so that's the next step... - */ - -static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n, - BOOL *is_data_outstanding); -static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n); -static BOOL close_internal_rpc_pipe_hnd(void *np_conn); -static void *make_internal_rpc_pipe_p(char *pipe_name, - connection_struct *conn, uint16 vuid); - /**************************************************************************** Pipe iterator functions. ****************************************************************************/ -smb_np_struct *get_first_pipe(void) +pipes_struct *get_first_pipe(void) { return Pipes; } -smb_np_struct *get_next_pipe(smb_np_struct *p) -{ - return p->next; -} - -/**************************************************************************** - Internal Pipe iterator functions. -****************************************************************************/ - -pipes_struct *get_first_internal_pipe(void) -{ - return InternalPipes; -} - -pipes_struct *get_next_internal_pipe(pipes_struct *p) +pipes_struct *get_next_pipe(pipes_struct *p) { return p->next; } @@ -119,7 +85,6 @@ void set_pipe_handle_offset(int max_open_files) /**************************************************************************** Reset pipe chain handle number. ****************************************************************************/ - void reset_chain_p(void) { chain_p = NULL; @@ -170,11 +135,11 @@ static BOOL pipe_init_outgoing_data(pipes_struct *p) Find first available pipe slot. ****************************************************************************/ -smb_np_struct *open_rpc_pipe_p(char *pipe_name, +pipes_struct *open_rpc_pipe_p(char *pipe_name, connection_struct *conn, uint16 vuid) { int i; - smb_np_struct *p, *p_it; + pipes_struct *p; static int next_pipe; BOOL is_spoolss_pipe = False; @@ -183,7 +148,7 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name, if (strstr(pipe_name, "spoolss")) is_spoolss_pipe = True; - + if (is_spoolss_pipe && current_spoolss_pipes_open >= MAX_OPEN_SPOOLSS_PIPES) { DEBUG(10,("open_rpc_pipe_p: spooler bug workaround. Denying open on pipe %s\n", pipe_name )); @@ -208,92 +173,10 @@ smb_np_struct *open_rpc_pipe_p(char *pipe_name, for (p = Pipes; p; p = p->next) DEBUG(5,("open_rpc_pipe_p: name %s pnum=%x\n", p->name, p->pnum)); - p = (smb_np_struct *)malloc(sizeof(*p)); - - if (!p) { - DEBUG(0,("ERROR! no memory for pipes_struct!\n")); - return NULL; - } - - ZERO_STRUCTP(p); - - /* add a dso mechanism instead of this, here */ - - p->namedpipe_create = make_internal_rpc_pipe_p; - p->namedpipe_read = read_from_internal_pipe; - p->namedpipe_write = write_to_internal_pipe; - p->namedpipe_close = close_internal_rpc_pipe_hnd; - - p->np_state = p->namedpipe_create(pipe_name, conn, vuid); - - if (p->np_state == NULL) { - DEBUG(0,("open_rpc_pipe_p: make_internal_rpc_pipe_p failed.\n")); - SAFE_FREE(p); - return NULL; - } - - DLIST_ADD(Pipes, p); - - /* - * Initialize the incoming RPC data buffer with one PDU worth of memory. - * We cheat here and say we're marshalling, as we intend to add incoming - * data directly into the prs_struct and we want it to auto grow. We will - * change the type to UNMARSALLING before processing the stream. - */ - - bitmap_set(bmap, i); - i += pipe_handle_offset; - - pipes_open++; - - p->pnum = i; - - p->open = True; - p->device_state = 0; - p->priority = 0; - p->conn = conn; - p->vuid = vuid; - - p->max_trans_reply = 0; - - fstrcpy(p->name, pipe_name); - - DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n", - pipe_name, i, pipes_open)); - - chain_p = p; - - /* Iterate over p_it as a temp variable, to display all open pipes */ - for (p_it = Pipes; p_it; p_it = p_it->next) - DEBUG(5,("open pipes: name %s pnum=%x\n", p_it->name, p_it->pnum)); - - return chain_p; -} - -/**************************************************************************** - Make an internal namedpipes structure -****************************************************************************/ - -static void *make_internal_rpc_pipe_p(char *pipe_name, - connection_struct *conn, uint16 vuid) -{ - pipes_struct *p; - user_struct *vuser = get_valid_user_struct(vuid); - - DEBUG(4,("Create pipe requested %s\n", pipe_name)); - - if (!vuser && vuid != UID_FIELD_INVALID) { - DEBUG(0,("ERROR! vuid %d did not map to a valid vuser struct!\n", vuid)); - return NULL; - } - p = (pipes_struct *)malloc(sizeof(*p)); if (!p) - { - DEBUG(0,("ERROR! no memory for pipes_struct!\n")); return NULL; - } ZERO_STRUCTP(p); @@ -310,6 +193,9 @@ static void *make_internal_rpc_pipe_p(char *pipe_name, return NULL; } + + DLIST_ADD(Pipes, p); + /* * Initialize the incoming RPC data buffer with one PDU worth of memory. * We cheat here and say we're marshalling, as we intend to add incoming @@ -322,15 +208,21 @@ static void *make_internal_rpc_pipe_p(char *pipe_name, return NULL; } - DLIST_ADD(InternalPipes, p); + bitmap_set(bmap, i); + i += pipe_handle_offset; - p->conn = conn; + pipes_open++; - /* Ensure the connection isn't idled whilst this pipe is open. */ - p->conn->num_files_open++; + p->pnum = i; + p->open = True; + p->device_state = 0; + p->priority = 0; + p->conn = conn; p->vuid = vuid; + p->max_trans_reply = 0; + p->ntlmssp_chal_flags = 0; p->ntlmssp_auth_validated = False; p->ntlmssp_auth_requested = False; @@ -339,17 +231,6 @@ static void *make_internal_rpc_pipe_p(char *pipe_name, p->fault_state = False; p->endian = RPC_LITTLE_ENDIAN; - ZERO_STRUCT(p->pipe_user); - - p->pipe_user.uid = (uid_t)-1; - p->pipe_user.gid = (gid_t)-1; - - /* Store the session key and NT_TOKEN */ - if (vuser) { - memcpy(p->session_key, vuser->session_key, sizeof(p->session_key)); - p->pipe_user.nt_user_token = dup_nt_token(vuser->nt_user_token); - } - /* * Initialize the incoming RPC struct. */ @@ -370,12 +251,31 @@ static void *make_internal_rpc_pipe_p(char *pipe_name, */ prs_init(&p->out_data.rdata, 0, p->mem_ctx, MARSHALL); + ZERO_STRUCT(p->pipe_user); + + p->pipe_user.uid = (uid_t)-1; + p->pipe_user.gid = (gid_t)-1; + fstrcpy(p->name, pipe_name); - DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n", - pipe_name, pipes_open)); + DEBUG(4,("Opened pipe %s with handle %x (pipes_open=%d)\n", + pipe_name, i, pipes_open)); + + chain_p = p; + + /* OVERWRITE p as a temp variable, to display all open pipes */ + for (p = Pipes; p; p = p->next) + DEBUG(5,("open pipes: name %s pnum=%x\n", p->name, p->pnum)); - return (void*)p; + if (is_spoolss_pipe) + current_spoolss_pipes_open++; + + /* + * The connection can be idled whilst this pipe is open + * if there are no handles open. JRA. + */ + + return chain_p; } /**************************************************************************** @@ -388,8 +288,8 @@ static void set_incoming_fault(pipes_struct *p) p->in_data.pdu_needed_len = 0; p->in_data.pdu_received_len = 0; p->fault_state = True; - DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : vuid = 0x%x\n", - p->name, p->vuid )); + DEBUG(10,("set_incoming_fault: Setting fault state on pipe %s : pnum = 0x%x\n", + p->name, p->pnum )); } /**************************************************************************** @@ -849,8 +749,10 @@ incoming data size = %u\n", (unsigned int)p->in_data.pdu_received_len, (unsigned Accepts incoming data on an rpc pipe. ****************************************************************************/ -ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n) +ssize_t write_to_pipe(pipes_struct *p, char *data, size_t n) { + size_t data_left = n; + DEBUG(6,("write_to_pipe: %x", p->pnum)); DEBUG(6,(" name: %s open: %s len: %d\n", @@ -858,18 +760,6 @@ ssize_t write_to_pipe(smb_np_struct *p, char *data, size_t n) dump_data(50, data, n); - return p->namedpipe_write(p->np_state, data, n); -} - -/**************************************************************************** - Accepts incoming data on an internal rpc pipe. -****************************************************************************/ - -static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n) -{ - pipes_struct *p = (pipes_struct*)np_conn; - size_t data_left = n; - while(data_left) { ssize_t data_used; @@ -900,42 +790,18 @@ static ssize_t write_to_internal_pipe(void *np_conn, char *data, size_t n) have been prepared into arrays of headers + data stream sections. ****************************************************************************/ -ssize_t read_from_pipe(smb_np_struct *p, char *data, size_t n, - BOOL *is_data_outstanding) +ssize_t read_from_pipe(pipes_struct *p, char *data, size_t n) { - if (!p || !p->open) { - DEBUG(0,("read_from_pipe: pipe not open\n")); - return -1; - } - - DEBUG(6,("read_from_pipe: %x", p->pnum)); - - return p->namedpipe_read(p->np_state, data, n, is_data_outstanding); -} - -/**************************************************************************** - Replies to a request to read data from a pipe. - - Headers are interspersed with the data at PDU intervals. By the time - this function is called, the start of the data could possibly have been - read by an SMBtrans (file_offset != 0). - - Calling create_rpc_reply() here is a hack. The data should already - have been prepared into arrays of headers + data stream sections. -****************************************************************************/ - -static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n, - BOOL *is_data_outstanding) -{ - pipes_struct *p = (pipes_struct*)np_conn; uint32 pdu_remaining = 0; ssize_t data_returned = 0; - if (!p) { + if (!p || !p->open) { DEBUG(0,("read_from_pipe: pipe not open\n")); return -1; } + DEBUG(6,("read_from_pipe: %x", p->pnum)); + DEBUG(6,(" name: %s len: %u\n", p->name, (unsigned int)n)); /* @@ -944,13 +810,13 @@ static ssize_t read_from_internal_pipe(void *np_conn, char *data, size_t n, */ /* - * This condition should result in the connection being closed. + * This condition should result in the connection being closed. * Netapp filers seem to set it to 0xffff which results in domain * authentications failing. Just ignore it so things work. */ if(n > MAX_PDU_FRAG_LEN) { - DEBUG(5,("read_from_pipe: too large read (%u) requested on \ + DEBUG(5,("read_from_pipe: too large read (%u) requested on \ pipe %s. We can only service %d sized reads.\n", (unsigned int)n, p->name, MAX_PDU_FRAG_LEN )); } @@ -1010,7 +876,6 @@ returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len, out: - (*is_data_outstanding) = p->out_data.current_pdu_len > n; return data_returned; } @@ -1018,7 +883,7 @@ returning %d bytes.\n", p->name, (unsigned int)p->out_data.current_pdu_len, Wait device state on a pipe. Exactly what this is for is unknown... ****************************************************************************/ -BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority) +BOOL wait_rpc_pipe_hnd_state(pipes_struct *p, uint16 priority) { if (p == NULL) return False; @@ -1042,7 +907,7 @@ BOOL wait_rpc_pipe_hnd_state(smb_np_struct *p, uint16 priority) Set device state on a pipe. Exactly what this is for is unknown... ****************************************************************************/ -BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state) +BOOL set_rpc_pipe_hnd_state(pipes_struct *p, uint16 device_state) { if (p == NULL) return False; @@ -1066,42 +931,15 @@ BOOL set_rpc_pipe_hnd_state(smb_np_struct *p, uint16 device_state) Close an rpc pipe. ****************************************************************************/ -BOOL close_rpc_pipe_hnd(smb_np_struct *p) +BOOL close_rpc_pipe_hnd(pipes_struct *p, connection_struct *conn) { if (!p) { DEBUG(0,("Invalid pipe in close_rpc_pipe_hnd\n")); return False; } - p->namedpipe_close(p->np_state); - - bitmap_clear(bmap, p->pnum - pipe_handle_offset); - - pipes_open--; - - DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n", - p->name, p->pnum, pipes_open)); - - DLIST_REMOVE(Pipes, p); - - ZERO_STRUCTP(p); - - SAFE_FREE(p); - - return True; -} - -/**************************************************************************** - Close an rpc pipe. -****************************************************************************/ - -static BOOL close_internal_rpc_pipe_hnd(void *np_conn) -{ - pipes_struct *p = (pipes_struct *)np_conn; - if (!p) { - DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n")); - return False; - } + if (strstr(p->name, "spoolss")) + current_spoolss_pipes_open--; prs_mem_free(&p->out_data.rdata); prs_mem_free(&p->in_data.data); @@ -1112,17 +950,22 @@ static BOOL close_internal_rpc_pipe_hnd(void *np_conn) /* Free the handles database. */ close_policy_by_pipe(p); - delete_nt_token(&p->pipe_user.nt_user_token); - SAFE_FREE(p->pipe_user.groups); + bitmap_clear(bmap, p->pnum - pipe_handle_offset); + + pipes_open--; - DLIST_REMOVE(InternalPipes, p); + DEBUG(4,("closed pipe name %s pnum=%x (pipes_open=%d)\n", + p->name, p->pnum, pipes_open)); - p->conn->num_files_open--; + DLIST_REMOVE(Pipes, p); + + delete_nt_token(&p->pipe_user.nt_user_token); + safe_free(p->pipe_user.groups); ZERO_STRUCTP(p); SAFE_FREE(p); - + return True; } @@ -1130,7 +973,7 @@ static BOOL close_internal_rpc_pipe_hnd(void *np_conn) Find an rpc pipe given a pipe handle in a buffer and an offset. ****************************************************************************/ -smb_np_struct *get_rpc_pipe_p(char *buf, int where) +pipes_struct *get_rpc_pipe_p(char *buf, int where) { int pnum = SVAL(buf,where); @@ -1144,9 +987,9 @@ smb_np_struct *get_rpc_pipe_p(char *buf, int where) Find an rpc pipe given a pipe handle. ****************************************************************************/ -smb_np_struct *get_rpc_pipe(int pnum) +pipes_struct *get_rpc_pipe(int pnum) { - smb_np_struct *p; + pipes_struct *p; DEBUG(4,("search for pipe pnum=%x\n", pnum)); |