/**************************************************************************** reply to a read and X This code is basically stolen from reply_read_and_X with some wrinkles to handle pipes. ****************************************************************************/ int reply_pipe_read_and_X(char *inbuf,char *outbuf,int length,int bufsize) { pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2); int smb_maxcnt = SVAL(inbuf,smb_vwv5); int smb_mincnt = SVAL(inbuf,smb_vwv6); int nread = -1; char *data; /* we don't use the offset given to use for pipe reads. This is deliberate, instead we always return the next lump of data on the pipe */ #if 0 uint32 smb_offs = IVAL(inbuf,smb_vwv3); #endif if (!p) return(ERROR(ERRDOS,ERRbadfid)); set_message(outbuf,12,0,True); data = smb_buf(outbuf); nread = (int)read_from_pipe(p, data, (size_t)smb_maxcnt); if (nread < 0) return(UNIXERROR(ERRDOS,ERRnoaccess)); SSVAL(outbuf,smb_vwv5,nread); SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf)); SSVAL(smb_buf(outbuf),-2,nread); DEBUG(3,("readX-IPC pnum=%04x min=%d max=%d nread=%d\n", p->pnum, smb_mincnt, smb_maxcnt, nread)); return chain_reply(inbuf,outbuf,length,bufsize); }
/**************************************************************************** reply to a write on a pipe ****************************************************************************/ int reply_pipe_write(char *inbuf,char *outbuf,int length,int dum_bufsize, int threadid) { pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0, threadid); uint32 numtowrite = SVAL(inbuf,smb_vwv1); int nwritten; int outsize; char *data; if (!p) return(ERROR(ERRDOS,ERRbadfid)); data = smb_buf(inbuf) + 3; if (numtowrite == 0) nwritten = 0; else nwritten = write_to_pipe(p, data, numtowrite); if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) //0507 return (UNIXERROR(ERRDOS,ERRnoaccess)); return 0; outsize = set_message(outbuf,1,0,True); SSVAL(outbuf,smb_vwv0,nwritten); //0507 DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n", //0507 p->pnum, nwritten)); return(outsize); }
int reply_pipe_write_and_X(char *inbuf,char *outbuf,int length,int bufsize) { smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2); uint16 vuid = SVAL(inbuf,smb_uid); size_t numtowrite = SVAL(inbuf,smb_vwv10); int nwritten = -1; int smb_doff = SVAL(inbuf, smb_vwv11); BOOL pipe_start_message_raw = ((SVAL(inbuf, smb_vwv7) & (PIPE_START_MESSAGE|PIPE_RAW_MODE)) == (PIPE_START_MESSAGE|PIPE_RAW_MODE)); char *data; if (!p) { return(ERROR_DOS(ERRDOS,ERRbadfid)); } if (p->vuid != vuid) { return ERROR_NT(NT_STATUS_INVALID_HANDLE); } data = smb_base(inbuf) + smb_doff; if (numtowrite == 0) { nwritten = 0; } else { if(pipe_start_message_raw) { /* * For the start of a message in named pipe byte mode, * the first two bytes are a length-of-pdu field. Ignore * them (we don't trust the client). JRA. */ if(numtowrite < 2) { DEBUG(0,("reply_pipe_write_and_X: start of message set and not enough data sent.(%u)\n", (unsigned int)numtowrite )); return (UNIXERROR(ERRDOS,ERRnoaccess)); } data += 2; numtowrite -= 2; } nwritten = write_to_pipe(p, data, numtowrite); } if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) { return (UNIXERROR(ERRDOS,ERRnoaccess)); } set_message(outbuf,6,0,True); nwritten = (pipe_start_message_raw ? nwritten + 2 : nwritten); SSVAL(outbuf,smb_vwv2,nwritten); DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten)); return chain_reply(inbuf,outbuf,length,bufsize); }
/**************************************************************************** reply to a close ****************************************************************************/ int reply_pipe_close(char *inbuf,char *outbuf, int threadid) { pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0, threadid); int outsize = set_message(outbuf,0,0,True); if (!p) return(ERROR(ERRDOS,ERRbadfid)); //0507 DEBUG(5,("reply_pipe_close: pnum:%x\n", p->pnum)); if (!close_rpc_pipe_hnd(p, threadid)) return(ERROR(ERRDOS,ERRbadfid)); return(outsize); }
//#if 0 int reply_pipe_write_and_X(char *inbuf,char *outbuf,int length,int bufsize, int ProcSockID, int threadid) { pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2, threadid); uint32 numtowrite = SVAL(inbuf,smb_vwv10); int nwritten = -1; int smb_doff = SVAL(inbuf, smb_vwv11); int pipe_start_message_raw = ((SVAL(inbuf, smb_vwv7) & (PIPE_START_MESSAGE|PIPE_RAW_MODE)) == (PIPE_START_MESSAGE|PIPE_RAW_MODE)); char *data; if (!p) return(ERROR(ERRDOS,ERRbadfid)); data = smb_base(inbuf) + smb_doff; if (numtowrite == 0) nwritten = 0; else { if(pipe_start_message_raw) { /* * For the start of a message in named pipe byte mode, * the first two bytes are a length-of-pdu field. Ignore * them (we don't trust the client. JRA. */ if(numtowrite < 2) { //0507 DEBUG(0,("reply_pipe_write_and_X: start of message set and not enough data sent.(%u)\n", //0507 (unsigned int)numtowrite )); //0507 return (UNIXERROR(ERRDOS,ERRnoaccess)); return 0; } data += 2; numtowrite -= 2; } nwritten = write_to_pipe(p, data, numtowrite); } if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) //0507 return (UNIXERROR(ERRDOS,ERRnoaccess)); return 0; set_message(outbuf,6,0,True); nwritten = (pipe_start_message_raw ? nwritten + 2 : nwritten); SSVAL(outbuf,smb_vwv2,nwritten); //0507 DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", //0507 p->pnum, nwritten)); return chain_reply(inbuf,outbuf,length,bufsize, ProcSockID, threadid); }
/**************************************************************************** reply to a close ****************************************************************************/ int reply_pipe_close(connection_struct *conn, char *inbuf,char *outbuf) { pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0); int outsize = set_message(outbuf,0,0,True); if (!p) return(ERROR(ERRDOS,ERRbadfid)); DEBUG(5,("reply_pipe_close: pnum:%x\n", p->pnum)); if (!close_rpc_pipe_hnd(p, conn)) return(ERROR(ERRDOS,ERRbadfid)); return(outsize); }
void reply_pipe_read_and_X(struct smb_request *req) { smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2)); int smb_maxcnt = SVAL(req->inbuf,smb_vwv5); int smb_mincnt = SVAL(req->inbuf,smb_vwv6); int nread = -1; char *data; bool unused; /* we don't use the offset given to use for pipe reads. This is deliberate, instead we always return the next lump of data on the pipe */ #if 0 uint32 smb_offs = IVAL(req->inbuf,smb_vwv3); #endif if (!p) { reply_doserror(req, ERRDOS, ERRbadfid); return; } reply_outbuf(req, 12, smb_maxcnt); data = smb_buf(req->outbuf); nread = read_from_pipe(p, data, smb_maxcnt, &unused); if (nread < 0) { reply_doserror(req, ERRDOS, ERRnoaccess); return; } srv_set_message((char *)req->outbuf, 12, nread, False); SSVAL(req->outbuf,smb_vwv5,nread); SSVAL(req->outbuf,smb_vwv6,smb_offset(data,req->outbuf)); SSVAL(smb_buf(req->outbuf),-2,nread); DEBUG(3,("readX-IPC pnum=%04x min=%d max=%d nread=%d\n", p->pnum, smb_mincnt, smb_maxcnt, nread)); chain_reply(req); }
void reply_pipe_close(connection_struct *conn, struct smb_request *req) { smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0)); if (!p) { reply_doserror(req, ERRDOS, ERRbadfid); return; } DEBUG(5,("reply_pipe_close: pnum:%x\n", p->pnum)); if (!close_rpc_pipe_hnd(p)) { reply_doserror(req, ERRDOS, ERRbadfid); return; } /* TODO: REMOVE PIPE FROM DB */ reply_outbuf(req, 0, 0); return; }
void reply_pipe_write(struct smb_request *req) { smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv0)); size_t numtowrite = SVAL(req->inbuf,smb_vwv1); int nwritten; char *data; if (!p) { reply_doserror(req, ERRDOS, ERRbadfid); return; } if (p->vuid != req->vuid) { reply_nterror(req, NT_STATUS_INVALID_HANDLE); return; } data = smb_buf(req->inbuf) + 3; if (numtowrite == 0) { nwritten = 0; } else { nwritten = write_to_pipe(p, data, numtowrite); } if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) { reply_unixerror(req, ERRDOS, ERRnoaccess); return; } reply_outbuf(req, 1, 0); SSVAL(req->outbuf,smb_vwv0,nwritten); DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten)); return; }
int reply_pipe_write(char *inbuf,char *outbuf,int length,int dum_bufsize) { smb_np_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0); uint16 vuid = SVAL(inbuf,smb_uid); size_t numtowrite = SVAL(inbuf,smb_vwv1); int nwritten; int outsize; char *data; if (!p) { return(ERROR_DOS(ERRDOS,ERRbadfid)); } if (p->vuid != vuid) { return ERROR_NT(NT_STATUS_INVALID_HANDLE); } data = smb_buf(inbuf) + 3; if (numtowrite == 0) { nwritten = 0; } else { nwritten = write_to_pipe(p, data, numtowrite); } if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) { return (UNIXERROR(ERRDOS,ERRnoaccess)); } outsize = set_message(outbuf,1,0,True); SSVAL(outbuf,smb_vwv0,nwritten); DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten)); return(outsize); }
void reply_pipe_write_and_X(struct smb_request *req) { smb_np_struct *p = get_rpc_pipe_p(SVAL(req->inbuf,smb_vwv2)); size_t numtowrite = SVAL(req->inbuf,smb_vwv10); int nwritten = -1; int smb_doff = SVAL(req->inbuf, smb_vwv11); bool pipe_start_message_raw = ((SVAL(req->inbuf, smb_vwv7) & (PIPE_START_MESSAGE|PIPE_RAW_MODE)) == (PIPE_START_MESSAGE|PIPE_RAW_MODE)); char *data; if (!p) { reply_doserror(req, ERRDOS, ERRbadfid); return; } if (p->vuid != req->vuid) { reply_nterror(req, NT_STATUS_INVALID_HANDLE); return; } data = smb_base(req->inbuf) + smb_doff; if (numtowrite == 0) { nwritten = 0; } else { if(pipe_start_message_raw) { /* * For the start of a message in named pipe byte mode, * the first two bytes are a length-of-pdu field. Ignore * them (we don't trust the client). JRA. */ if(numtowrite < 2) { DEBUG(0,("reply_pipe_write_and_X: start of " "message set and not enough data " "sent.(%u)\n", (unsigned int)numtowrite )); reply_unixerror(req, ERRDOS, ERRnoaccess); return; } data += 2; numtowrite -= 2; } nwritten = write_to_pipe(p, data, numtowrite); } if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) { reply_unixerror(req, ERRDOS,ERRnoaccess); return; } reply_outbuf(req, 6, 0); nwritten = (pipe_start_message_raw ? nwritten + 2 : nwritten); SSVAL(req->outbuf,smb_vwv2,nwritten); DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", p->pnum, nwritten)); chain_reply(req); }