able/windows-nt
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
windows-nt/Source/XPSP1/NT/base/fs/rdr2/bowser/mailslot.c

1731 lines
44 KiB
C
Raw Normal View History

Add source files
2020-09-26 03:20:57 -05:00
/*++
Copyright (c) 1991 Microsoft Corporation
Module Name:
mailslot.c
Abstract:
This module implements the routines needed to process incoming mailslot
requests.
Author:
Larry Osterman (larryo) 18-Oct-1991
Revision History:
18-Oct-1991 larryo
Created
--*/
#include "precomp.h"
#pragma hdrstop
#include <netlogon.h>
#define _INC_WINDOWS 1
#include <winsock2.h>
// Free list of 512-byte buffers.
LIST_ENTRY
BowserMailslotBufferList = {0};
KSPIN_LOCK
BowserMailslotSpinLock = {0};
// Largest "typical" datagram size
#define BOWSER_MAX_DATAGRAM_SIZE 512
// Total number of mailslot buffers currently allocated.
LONG
BowserNumberOfMailslotBuffers = {0};
// Number of 512-byte buffers currently allocated.
LONG
BowserNumberOfMaxSizeMailslotBuffers = {0};
// Number of 512-byte buffers currently in the free list.
LONG
BowserNumberOfFreeMailslotBuffers = {0};
#if DBG
ULONG
BowserMailslotCacheHitCount = 0;
ULONG
BowserMailslotCacheMissCount = 0;
#endif // DBG
//
// Variables describing bowser support for handling netlogon mailslot messages and
// PNP messages to Netlogon service or BrowserService.
typedef struct _BROWSER_PNP_STATE {
// Queue of mailslot messages.
LIST_ENTRY MailslotMessageQueue;
// Maximum queue length
ULONG MaxMessageCount;
// Current queue length
ULONG CurrentMessageCount;
// Queue of IRPs used to read the queues
IRP_QUEUE IrpQueue;
// Queue of PNP events
LIST_ENTRY PnpQueue;
} BROWSER_PNP_STATE, *PBROWSER_PNP_STATE;
//
// There is one BROWSER_PNP_STATE for the Netlogon service and one for the
// Browser service.
//
BROWSER_PNP_STATE BowserPnp[BOWSER_PNP_COUNT];
//
// Queue of PNP notifications to netlogon or browser service
//
typedef struct _BR_PNP_MESSAGE {
LIST_ENTRY Next; // List of all queued entries.
NETLOGON_PNP_OPCODE NlPnpOpcode; // Operation to be notified
ULONG TransportFlags; // Flags describing transport
UNICODE_STRING TransportName; // Transport operation happened on
UNICODE_STRING HostedDomainName; // Hosted domain operation happened on
} BR_PNP_MESSAGE, *PBR_PNP_MESSAGE;
//
// Forwards for the alloc_text
//
NTSTATUS
BowserNetlogonCopyMessage(
IN PIRP Irp,
IN PMAILSLOT_BUFFER MailslotBuffer
);
NTSTATUS
BowserCopyPnp(
IN PIRP Irp,
IN NETLOGON_PNP_OPCODE NlPnpOpcode,
IN PUNICODE_STRING HostedDomainName,
IN PUNICODE_STRING TransportName,
IN ULONG TransportFlags
);
VOID
BowserTrimMessageQueue (
PBROWSER_PNP_STATE BrPnp
);
BOOLEAN
BowserProcessNetlogonMailslotWrite(
IN PMAILSLOT_BUFFER MailslotBuffer
);
#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE5NETLOGON, BowserNetlogonCopyMessage)
#pragma alloc_text(PAGE4BROW, BowserCopyPnp)
#pragma alloc_text(PAGE4BROW, BowserTrimMessageQueue)
#pragma alloc_text(PAGE5NETLOGON, BowserNetlogonDeleteTransportFromMessageQueue )
#pragma alloc_text(PAGE5NETLOGON, BowserProcessNetlogonMailslotWrite)
#pragma alloc_text(PAGE4BROW, BowserSendPnp)
#pragma alloc_text(PAGE4BROW, BowserEnablePnp )
#pragma alloc_text(PAGE4BROW, BowserReadPnp )
#pragma alloc_text(PAGE, BowserProcessMailslotWrite)
#pragma alloc_text(PAGE4BROW, BowserFreeMailslotBuffer)
#pragma alloc_text(INIT, BowserpInitializeMailslot)
#pragma alloc_text(PAGE, BowserpUninitializeMailslot)
#endif
NTSTATUS
BowserNetlogonCopyMessage(
IN PIRP Irp,
IN PMAILSLOT_BUFFER MailslotBuffer
)
/*++
Routine Description:
This routine copies the data from the specified MailslotBuffer into the
IRP for the netlogon request.
This routine unconditionally frees the passed in Mailslot Buffer.
Arguments:
Irp - IRP for the IOCTL from the netlogon service.
MailslotBuffer - Buffer describing the mailslot message.
Return Value:
Status of the operation.
The caller should complete the I/O operation with this status code.
--*/
{
NTSTATUS Status;
PSMB_HEADER SmbHeader;
PSMB_TRANSACT_MAILSLOT MailslotSmb;
PUCHAR MailslotData;
OEM_STRING MailslotNameA;
UNICODE_STRING MailslotNameU;
UNICODE_STRING TransportName;
UNICODE_STRING DestinationName;
USHORT DataCount;
PNETLOGON_MAILSLOT NetlogonMailslot;
PUCHAR Where;
PIO_STACK_LOCATION IrpSp;
BowserReferenceDiscardableCode( BowserNetlogonDiscardableCodeSection );
DISCARDABLE_CODE( BowserNetlogonDiscardableCodeSection );
//
// Extract the name of the mailslot and address/size of mailslot message
// from SMB.
//
SmbHeader = (PSMB_HEADER )MailslotBuffer->Buffer;
MailslotSmb = (PSMB_TRANSACT_MAILSLOT)(SmbHeader+1);
MailslotData = (((PCHAR )SmbHeader) + SmbGetUshort(&MailslotSmb->DataOffset));
RtlInitString(&MailslotNameA, MailslotSmb->Buffer );
DataCount = SmbGetUshort(&MailslotSmb->DataCount);
//
// Get the name of the transport and netbios name the mailslot message arrived on.
//
TransportName =
MailslotBuffer->TransportName->Transport->PagedTransport->TransportName;
DestinationName =
MailslotBuffer->TransportName->PagedTransportName->Name->Name;
IrpSp = IoGetCurrentIrpStackLocation(Irp);
try {
//
// Convert mailslot name to unicode for return.
//
Status = RtlOemStringToUnicodeString(&MailslotNameU, &MailslotNameA, TRUE);
if (!NT_SUCCESS(Status)) {
BowserLogIllegalName( Status, MailslotNameA.Buffer, MailslotNameA.Length );
MailslotNameU.Buffer = NULL;
try_return( NOTHING );
}
//
// Ensure the data fits in the user's output buffer.
//
if ( IrpSp->Parameters.DeviceIoControl.OutputBufferLength <
sizeof(NETLOGON_MAILSLOT) + // Header structure
DataCount + // Actual mailslot message
sizeof(DWORD) + // alignment for socket address
sizeof(SOCKADDR_IN) + // Client Socket Address
sizeof(WCHAR) + // alignment of unicode strings
TransportName.Length + // TransportName
sizeof(WCHAR) + // zero terminator
MailslotNameU.Length + // Mailslot name
sizeof(WCHAR) + // zero terminator
DestinationName.Length + // Destination name
sizeof(WCHAR) ) { // zero terminator
try_return( Status = STATUS_BUFFER_TOO_SMALL );
}
//
// Get the address of Netlogon's buffer and fill in common portion.
//
NetlogonMailslot = MmGetSystemAddressForMdl( Irp->MdlAddress );
if ( NULL == NetlogonMailslot ) {
try_return( Status = STATUS_NO_MEMORY );
}
if (!POINTER_IS_ALIGNED( NetlogonMailslot, ALIGN_DWORD) ) {
try_return( Status = STATUS_INVALID_PARAMETER );
}
Where = (PUCHAR) (NetlogonMailslot+1);
NetlogonMailslot->TimeReceived = MailslotBuffer->TimeReceived;
//
// Copy the datagram to the buffer
//
NetlogonMailslot->MailslotMessageSize = DataCount;
NetlogonMailslot->MailslotMessageOffset = (ULONG)(Where - (PUCHAR)NetlogonMailslot);
RtlCopyMemory( Where, MailslotData, DataCount );
Where += DataCount;
//
// Copy Client IpAddress to buffer.
//
if ( MailslotBuffer->ClientIpAddress != 0 ) {
PSOCKADDR_IN SockAddrIn;
*Where = 0;
*(Where+1) = 0;
*(Where+2) = 0;
Where = ROUND_UP_POINTER( Where, ALIGN_DWORD );
NetlogonMailslot->ClientSockAddrSize = sizeof(SOCKADDR_IN);
NetlogonMailslot->ClientSockAddrOffset = (ULONG)(Where - (PUCHAR)NetlogonMailslot);
SockAddrIn = (PSOCKADDR_IN) Where;
RtlZeroMemory( SockAddrIn, sizeof(SOCKADDR_IN) );
SockAddrIn->sin_family = AF_INET;
SockAddrIn->sin_addr.S_un.S_addr = MailslotBuffer->ClientIpAddress;
Where += sizeof(SOCKADDR_IN);
} else {
NetlogonMailslot->ClientSockAddrSize = 0;
NetlogonMailslot->ClientSockAddrOffset = 0;
}
//
// Copy the transport name to the buffer
//
*Where = 0;
Where = ROUND_UP_POINTER( Where, ALIGN_WCHAR );
NetlogonMailslot->TransportNameSize = TransportName.Length;
NetlogonMailslot->TransportNameOffset = (ULONG)(Where - (PUCHAR)NetlogonMailslot);
RtlCopyMemory( Where, TransportName.Buffer, TransportName.Length );
Where += TransportName.Length;
*((PWCH)Where) = L'\0';
Where += sizeof(WCHAR);
//
// Copy the mailslot name to the buffer
//
NetlogonMailslot->MailslotNameSize = MailslotNameU.Length;
NetlogonMailslot->MailslotNameOffset = (ULONG)(Where - (PUCHAR)NetlogonMailslot);
RtlCopyMemory( Where, MailslotNameU.Buffer, MailslotNameU.Length );
Where += MailslotNameU.Length;
*((PWCH)Where) = L'\0';
Where += sizeof(WCHAR);
//
// Copy the destination netbios name to the buffer
//
NetlogonMailslot->DestinationNameSize = DestinationName.Length;
NetlogonMailslot->DestinationNameOffset = (ULONG)(Where - (PUCHAR)NetlogonMailslot);
RtlCopyMemory( Where, DestinationName.Buffer, DestinationName.Length );
Where += DestinationName.Length;
*((PWCH)Where) = L'\0';
Where += sizeof(WCHAR);
Status = STATUS_SUCCESS;
try_exit:NOTHING;
} finally {
//
// Free Locally allocated buffers
//
RtlFreeUnicodeString(&MailslotNameU);
//
// Always free the incoming mailslot message
//
BowserFreeMailslotBuffer( MailslotBuffer );
}
BowserDereferenceDiscardableCode( BowserNetlogonDiscardableCodeSection );
return Status;
}
NTSTATUS
BowserCopyPnp(
IN PIRP Irp,
IN NETLOGON_PNP_OPCODE NlPnpOpcode,
IN PUNICODE_STRING HostedDomainName,
IN PUNICODE_STRING TransportName,
IN ULONG TransportFlags
)
/*++
Routine Description:
This routine copies the data for a PNP notification into the
IRP for the I/O request.
Arguments:
Irp - IRP for the IOCTL from the service.
NlPnpOpcode - Opcode describing the event being notified.
HostedDomainName - Name of the hosted domain this event applies to
TransportName - Name of transport being affected.
TransportFlags - Flags describing the transport
Return Value:
Status of the operation.
The caller should complete the I/O operation with this status code.
--*/
{
NTSTATUS Status;
PNETLOGON_MAILSLOT NetlogonMailslot;
PUCHAR Where;
PIO_STACK_LOCATION IrpSp;
BowserReferenceDiscardableCode( BowserDiscardableCodeSection );
DISCARDABLE_CODE( BowserDiscardableCodeSection );
IrpSp = IoGetCurrentIrpStackLocation(Irp);
try {
//
// Ensure the data fits in the user's output buffer.
//
if ( IrpSp->Parameters.DeviceIoControl.OutputBufferLength <
sizeof(NETLOGON_MAILSLOT) + // Header structure
TransportName->Length + sizeof(WCHAR) + // TransportName
HostedDomainName->Length + sizeof(WCHAR) + // DomainName
1 ) { // possible rounding requirement
try_return( Status = STATUS_BUFFER_TOO_SMALL );
}
//
// Get the address of service's buffer and fill in common portion.
//
NetlogonMailslot = MmGetSystemAddressForMdl( Irp->MdlAddress );
if ( NULL == NetlogonMailslot ) {
try_return( Status = STATUS_NO_MEMORY );
}
if (!POINTER_IS_ALIGNED( NetlogonMailslot, ALIGN_DWORD) ) {
try_return( Status = STATUS_INVALID_PARAMETER );
}
RtlZeroMemory( NetlogonMailslot, sizeof(NETLOGON_MAILSLOT));
//
// Copy the opcode
//
NetlogonMailslot->MailslotNameOffset = NlPnpOpcode;
//
// Copy the transport flags.
//
NetlogonMailslot->MailslotMessageOffset = TransportFlags;
//
// Copy the transport name to the buffer
//
Where = (PUCHAR) (NetlogonMailslot+1);
*Where = 0;
Where = ROUND_UP_POINTER( Where, ALIGN_WCHAR );
NetlogonMailslot->TransportNameSize = TransportName->Length;
NetlogonMailslot->TransportNameOffset = (ULONG)(Where - (PUCHAR)NetlogonMailslot);
RtlCopyMemory( Where, TransportName->Buffer, TransportName->Length );
Where += TransportName->Length;
*((PWCH)Where) = L'\0';
Where += sizeof(WCHAR);
//
// Copy the hosted domain name to the buffer
//
NetlogonMailslot->DestinationNameSize = HostedDomainName->Length;
NetlogonMailslot->DestinationNameOffset = (ULONG)(Where - (PUCHAR)NetlogonMailslot);
RtlCopyMemory( Where, HostedDomainName->Buffer, HostedDomainName->Length );
Where += HostedDomainName->Length;
*((PWCH)Where) = L'\0';
Where += sizeof(WCHAR);
Status = STATUS_SUCCESS;
try_exit:NOTHING;
} finally {
BowserDereferenceDiscardableCode( BowserDiscardableCodeSection );
}
return Status;
}
VOID
BowserTrimMessageQueue (
PBROWSER_PNP_STATE BrPnp
)
/*++
Routine Description:
This routines ensures there are not too many mailslot messages in
the message queue. Any excess messages are deleted.
Arguments:
BrPnp - Indicates which message queue to trim
Return Value:
None.
--*/
{
KIRQL OldIrql;
dprintf(DPRT_NETLOGON, ("Bowser: trim message queue to %ld\n", BrPnp->MaxMessageCount ));
//
//
BowserReferenceDiscardableCode( BowserDiscardableCodeSection );
DISCARDABLE_CODE( BowserDiscardableCodeSection );
//
// If too many messages are queued,
// delete the oldest messages.
//
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
while ( BrPnp->CurrentMessageCount > BrPnp->MaxMessageCount){
PLIST_ENTRY Entry;
PMAILSLOT_BUFFER MailslotBuffer;
Entry = RemoveHeadList(&BrPnp->MailslotMessageQueue);
BrPnp->CurrentMessageCount--;
MailslotBuffer = CONTAINING_RECORD(Entry, MAILSLOT_BUFFER, Overlay.NextBuffer);
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
BowserFreeMailslotBuffer( MailslotBuffer );
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
}
//
// If absolutely no queued messages are allowed,
// delete the queued PNP messages, too.
// (Either netlogon or the bowser is shutting down.)
//
if ( BrPnp->MaxMessageCount == 0 ) {
while ( !IsListEmpty(&BrPnp->PnpQueue) ) {
PLIST_ENTRY ListEntry;
PBR_PNP_MESSAGE PnpMessage;
ListEntry = RemoveHeadList(&BrPnp->PnpQueue);
PnpMessage = CONTAINING_RECORD(ListEntry, BR_PNP_MESSAGE, Next);
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
FREE_POOL(PnpMessage);
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
}
}
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
BowserDereferenceDiscardableCode( BowserDiscardableCodeSection );
}
VOID
BowserNetlogonDeleteTransportFromMessageQueue (
PTRANSPORT Transport
)
/*++
Routine Description:
This routines removes queued mailslot messages that arrived on the specified
transport.
Arguments:
Transport - Transport who's mailslot messages are to be deleted.
Return Value:
None.
--*/
{
KIRQL OldIrql;
PLIST_ENTRY ListEntry;
PBROWSER_PNP_STATE BrPnp=&BowserPnp[NETLOGON_PNP];
dprintf(DPRT_NETLOGON, ("Bowser: remove messages queued by transport %lx\n", Transport ));
//
//
BowserReferenceDiscardableCode( BowserNetlogonDiscardableCodeSection );
DISCARDABLE_CODE( BowserNetlogonDiscardableCodeSection );
//
// Loop through all of the queued messages.
//
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
for ( ListEntry = BrPnp->MailslotMessageQueue.Flink;
ListEntry != &BrPnp->MailslotMessageQueue;
) {
PMAILSLOT_BUFFER MailslotBuffer;
//
// If the message wasn't queued by this transport,
// go on to the next entry.
//
MailslotBuffer = CONTAINING_RECORD(ListEntry, MAILSLOT_BUFFER, Overlay.NextBuffer);
if ( MailslotBuffer->TransportName->Transport != Transport ) {
ListEntry = ListEntry->Flink;
//
// Otherwise,
// delete the entry.
//
} else {
dprintf(DPRT_ALWAYS, ("Bowser: removing message %lx queued by transport %lx\n", MailslotBuffer, Transport ));
RemoveEntryList( ListEntry );
BrPnp->CurrentMessageCount--;
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
BowserFreeMailslotBuffer( MailslotBuffer );
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
//
// Start over at the beginning of the list since we dropped the spinlock.
//
ListEntry = BrPnp->MailslotMessageQueue.Flink;
}
}
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
BowserDereferenceDiscardableCode( BowserNetlogonDiscardableCodeSection );
}
BOOLEAN
BowserProcessNetlogonMailslotWrite(
IN PMAILSLOT_BUFFER MailslotBuffer
)
/*++
Routine Description:
This routine checks to see if the described mailslot message is destined
to the Netlogon service and if the Bowser is currently handling such
messages
Arguments:
MailslotBuffer - Buffer describing the mailslot message.
Return Value:
TRUE - iff the mailslot message was successfully queued to the netlogon
service.
--*/
{
KIRQL OldIrql;
NTSTATUS Status;
PSMB_HEADER SmbHeader;
PSMB_TRANSACT_MAILSLOT MailslotSmb;
BOOLEAN TrimIt;
BOOLEAN ReturnValue;
PBROWSER_PNP_STATE BrPnp=&BowserPnp[NETLOGON_PNP];
PIRP Irp;
BowserReferenceDiscardableCode( BowserNetlogonDiscardableCodeSection );
DISCARDABLE_CODE( BowserNetlogonDiscardableCodeSection );
//
// If this message isn't destined to the Netlogon service,
// just return.
//
SmbHeader = (PSMB_HEADER )MailslotBuffer->Buffer;
MailslotSmb = (PSMB_TRANSACT_MAILSLOT)(SmbHeader+1);
if ( _stricmp( MailslotSmb->Buffer, NETLOGON_LM_MAILSLOT_A ) != 0 &&
_stricmp( MailslotSmb->Buffer, NETLOGON_NT_MAILSLOT_A ) != 0 ) {
ReturnValue = FALSE;
//
// The mailslot message is destined to netlogon.
//
} else {
//
// Check to ensure we're queuing messages to Netlogon
//
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
if ( BrPnp->MaxMessageCount == 0 ) {
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
ReturnValue = FALSE;
//
// Queueing to netlogon is enabled.
//
} else {
//
// If there already is an IRP from netlogon queued,
// return this mailslot message to netlogon now.
//
// This routine locks BowserIrpQueueSpinLock so watch the spin lock
// locking order.
//
ReturnValue = TRUE;
Irp = BowserDequeueQueuedIrp( &BrPnp->IrpQueue );
if ( Irp != NULL ) {
ASSERT( IsListEmpty( &BrPnp->MailslotMessageQueue ) );
dprintf(DPRT_NETLOGON, ("Bowser: found already queued netlogon IRP\n"));
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
Status = BowserNetlogonCopyMessage( Irp, MailslotBuffer );
BowserCompleteRequest( Irp, Status );
} else {
//
// Queue the mailslot message for netlogon to pick up later.
//
InsertTailList( &BrPnp->MailslotMessageQueue,
&MailslotBuffer->Overlay.NextBuffer);
BrPnp->CurrentMessageCount++;
TrimIt =
(BrPnp->CurrentMessageCount > BrPnp->MaxMessageCount);
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
//
// If there are too many messages queued,
// trim entries from the front.
//
if ( TrimIt ) {
BowserTrimMessageQueue(BrPnp);
}
}
}
}
BowserDereferenceDiscardableCode( BowserNetlogonDiscardableCodeSection );
return ReturnValue;
}
VOID
BowserSendPnp(
IN NETLOGON_PNP_OPCODE NlPnpOpcode,
IN PUNICODE_STRING HostedDomainName OPTIONAL,
IN PUNICODE_STRING TransportName OPTIONAL,
IN ULONG TransportFlags
)
/*++
Routine Description:
This routine sends a PNP notification to the Netlogon service.
Arguments:
NlPnpOpcode - Opcode describing the event being notified.
HostedDomainName - Hosted domain name
NULL - if the operation affects all hosted domains
TransportName - Name of transport being affected.
NULL - if the operation affects all transports
TransportFlags - Flags describing the transport
Return Value:
None.
--*/
{
KIRQL OldIrql;
NTSTATUS Status;
PIRP Irp;
PBR_PNP_MESSAGE PnpMessage = NULL;
PBROWSER_PNP_STATE BrPnp;
UNICODE_STRING NullUnicodeString = { 0, 0, NULL };
BowserReferenceDiscardableCode( BowserDiscardableCodeSection );
DISCARDABLE_CODE( BowserDiscardableCodeSection );
//
// Initialization.
//
if ( TransportName == NULL ) {
TransportName = &NullUnicodeString;
}
if ( HostedDomainName == NULL ) {
HostedDomainName = &NullUnicodeString;
}
//
// Send the PNP message to each service that wants it.
//
for ( BrPnp=&BowserPnp[0];
BrPnp<&BowserPnp[BOWSER_PNP_COUNT];
BrPnp++) {
//
// If this service doesn't want notification,
// skip it.
//
if ( BrPnp->MaxMessageCount == 0 ) {
continue;
}
//
// Preallocate the buffer since we can't do it under the spinlock.
//
if ( PnpMessage == NULL ) {
PnpMessage = ALLOCATE_POOL( NonPagedPool,
sizeof(BR_PNP_MESSAGE) +
TransportName->Length +
HostedDomainName->Length,
POOL_NETLOGON_BUFFER);
//
// Copy the parameters into the newly allocated buffer.
//
if ( PnpMessage != NULL ) {
LPBYTE Where;
PnpMessage->NlPnpOpcode = NlPnpOpcode;
PnpMessage->TransportFlags = TransportFlags;
Where = (LPBYTE)(PnpMessage + 1);
// Copy the TransportName
PnpMessage->TransportName.MaximumLength =
PnpMessage->TransportName.Length = TransportName->Length;
PnpMessage->TransportName.Buffer = (LPWSTR) Where;
RtlCopyMemory( Where,
TransportName->Buffer,
TransportName->Length );
Where += TransportName->Length;
// Copy the HostedDomainName
PnpMessage->HostedDomainName.MaximumLength =
PnpMessage->HostedDomainName.Length = HostedDomainName->Length;
PnpMessage->HostedDomainName.Buffer = (LPWSTR) Where;
RtlCopyMemory( Where,
HostedDomainName->Buffer,
HostedDomainName->Length );
Where += HostedDomainName->Length;
}
}
//
// Check to ensure we're queuing messages to this service.
//
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
if ( BrPnp->MaxMessageCount == 0 ) {
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
//
// Queueing to service is enabled.
//
} else {
//
// If there already is an IRP from the service queued,
// return this PNP message to the service now.
//
// This routine locks BowserIrpQueueSpinLock so watch the spin lock
// locking order.
//
Irp = BowserDequeueQueuedIrp( &BrPnp->IrpQueue );
if ( Irp != NULL ) {
ASSERT( IsListEmpty( &BrPnp->MailslotMessageQueue ) );
dprintf(DPRT_NETLOGON, ("Bowser: found already queued netlogon IRP\n"));
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
Status = BowserCopyPnp( Irp, NlPnpOpcode, HostedDomainName, TransportName, TransportFlags );
BowserCompleteRequest( Irp, Status );
} else {
//
// Queue the mailslot message for the service to pick up later.
// (Drop notification on the floor if there is no memory.)
//
if ( PnpMessage != NULL ) {
InsertTailList( &BrPnp->PnpQueue, &PnpMessage->Next );
PnpMessage = NULL;
}
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
}
}
}
//
// Free the PnpMessage buffer if we didn't need it.
//
if ( PnpMessage != NULL ) {
FREE_POOL(PnpMessage);
}
BowserDereferenceDiscardableCode( BowserDiscardableCodeSection );
return;
}
NTSTATUS
BowserEnablePnp (
IN PLMDR_REQUEST_PACKET InputBuffer,
IN ULONG ServiceIndex
)
/*++
Routine Description:
This routine processes an IOCTL from the netlogon service to enable or
disable the queueing of netlogon mailslot messages.
Arguments:
InputBuffer - Specifies the number of mailslot messages to queue.
Zero disables queuing.
ServiceIndex - Index of service to set queue size for.
Return Value:
Status of operation.
Please note that this IRP is cancelable.
--*/
{
KIRQL OldIrql;
NTSTATUS Status;
ULONG MaxMessageCount;
PBROWSER_PNP_STATE BrPnp=&BowserPnp[ServiceIndex];
BowserReferenceDiscardableCode( BowserDiscardableCodeSection );
DISCARDABLE_CODE( BowserDiscardableCodeSection );
try {
MaxMessageCount = InputBuffer->Parameters.NetlogonMailslotEnable.MaxMessageCount;
dprintf(DPRT_NETLOGON,
("NtDeviceIoControlFile: Netlogon enable %ld\n",
MaxMessageCount ));
//
// Set the new size of the message queue
//
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
BrPnp->MaxMessageCount = MaxMessageCount;
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
//
// Trim the message queue to the new size.
//
BowserTrimMessageQueue(BrPnp);
try_return(Status = STATUS_SUCCESS);
try_exit:NOTHING;
} finally {
BowserDereferenceDiscardableCode( BowserDiscardableCodeSection );
}
return Status;
}
NTSTATUS
BowserReadPnp (
IN PIRP Irp,
IN ULONG OutputBufferLength,
IN ULONG ServiceIndex
)
/*++
Routine Description:
This routine processes an IOCTL from the netlogon service to get the next
mailslot message.
Arguments:
Irp - I/O request packet describing request.
ServiceIndex - Index of service to set queue size for.
Return Value:
Status of operation.
Please note that this IRP is cancelable.
--*/
{
KIRQL OldIrql;
NTSTATUS Status;
PBROWSER_PNP_STATE BrPnp=&BowserPnp[ServiceIndex];
//
// If this is Netlogon,
// page in BowserNetlogonCopyMessage.
//
if ( ServiceIndex == NETLOGON_PNP ) {
BowserReferenceDiscardableCode( BowserNetlogonDiscardableCodeSection );
DISCARDABLE_CODE( BowserNetlogonDiscardableCodeSection );
}
//
// Reference the discardable code of this routine and
// BowserQueueNonBufferRequestReferenced()
//
BowserReferenceDiscardableCode( BowserDiscardableCodeSection );
DISCARDABLE_CODE( BowserDiscardableCodeSection );
//
// Ensure service has asked the browser to queue messages
//
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
if ( BrPnp->MaxMessageCount == 0 ) {
dprintf(DPRT_NETLOGON, ("Bowser called from Netlogon when not enabled\n"));
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
Status = STATUS_NOT_SUPPORTED;
//
// If there already is a PNP message queued,
// just return it to netlogon immediately.
//
} else if ( !IsListEmpty( &BrPnp->PnpQueue )) {
PBR_PNP_MESSAGE PnpMessage;
PLIST_ENTRY ListEntry;
dprintf(DPRT_NETLOGON, ("Bowser found netlogon PNP message already queued\n"));
ListEntry = RemoveHeadList(&BrPnp->PnpQueue);
PnpMessage = CONTAINING_RECORD(ListEntry, BR_PNP_MESSAGE, Next);
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
Status = BowserCopyPnp( Irp,
PnpMessage->NlPnpOpcode,
&PnpMessage->HostedDomainName,
&PnpMessage->TransportName,
PnpMessage->TransportFlags );
FREE_POOL(PnpMessage);
//
// If there already is a mailslot message queued,
// just return it to netlogon immediately.
//
} else if ( ServiceIndex == NETLOGON_PNP &&
!IsListEmpty( &BrPnp->MailslotMessageQueue )) {
PMAILSLOT_BUFFER MailslotBuffer;
PLIST_ENTRY ListEntry;
dprintf(DPRT_NETLOGON, ("Bowser found netlogon mailslot message already queued\n"));
ListEntry = RemoveHeadList(&BrPnp->MailslotMessageQueue);
BrPnp->CurrentMessageCount--;
MailslotBuffer = CONTAINING_RECORD(ListEntry, MAILSLOT_BUFFER, Overlay.NextBuffer);
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
Status = BowserNetlogonCopyMessage( Irp, MailslotBuffer );
//
// Otherwise, save this IRP until a mailslot message arrives.
// This routine locks BowserIrpQueueSpinLock so watch the spin lock
// locking order.
//
} else {
dprintf(DPRT_NETLOGON, ("Bowser: queue netlogon mailslot irp\n"));
Status = BowserQueueNonBufferRequestReferenced(
Irp,
&BrPnp->IrpQueue,
BowserCancelQueuedRequest );
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
}
if ( ServiceIndex == NETLOGON_PNP ) {
BowserDereferenceDiscardableCode( BowserNetlogonDiscardableCodeSection );
}
BowserDereferenceDiscardableCode( BowserDiscardableCodeSection );
return Status;
}
VOID
BowserProcessMailslotWrite(
IN PVOID Context
)
/*++
Routine Description:
This routine performs all the task time operations to perform a mailslot
write.
It will open the mailslot, write the specified data into the mailslot,
and close the mailslot.
Arguments:
IN PWORK_HEADER WorkHeader - Specifies the mailslot buffer holding the
mailslot write
Return Value:
None.
--*/
{
PSMB_HEADER SmbHeader;
PSMB_TRANSACT_MAILSLOT MailslotSmb;
PMAILSLOT_BUFFER MailslotBuffer = Context;
PUCHAR MailslotData;
HANDLE MailslotHandle = NULL;
OBJECT_ATTRIBUTES ObjAttr;
OEM_STRING MailslotNameA;
UNICODE_STRING MailslotNameU;
IO_STATUS_BLOCK IoStatusBlock;
CHAR MailslotName[MAXIMUM_FILENAME_LENGTH+1];
NTSTATUS Status;
ULONG DataCount;
ULONG TotalDataCount;
PAGED_CODE();
ASSERT (MailslotBuffer->Signature == STRUCTURE_SIGNATURE_MAILSLOT_BUFFER);
SmbHeader = (PSMB_HEADER )MailslotBuffer->Buffer;
ASSERT (SmbHeader->Command == SMB_COM_TRANSACTION);
MailslotSmb = (PSMB_TRANSACT_MAILSLOT)(SmbHeader+1);
ASSERT (MailslotSmb->WordCount == 17);
ASSERT (MailslotSmb->Class == 2);
MailslotData = (((PCHAR )SmbHeader) + SmbGetUshort(&MailslotSmb->DataOffset));
DataCount = (ULONG)SmbGetUshort(&MailslotSmb->DataCount);
TotalDataCount = (ULONG)SmbGetUshort(&MailslotSmb->TotalDataCount);
//
// Verify that all of the data was received and that the indicated data doesn't
// overflow the received buffer.
//
if (TotalDataCount != DataCount ||
(MailslotData > MailslotBuffer->Buffer + MailslotBuffer->ReceiveLength) ||
(DataCount + SmbGetUshort(&MailslotSmb->DataOffset) > MailslotBuffer->ReceiveLength )) {
BowserLogIllegalDatagram(MailslotBuffer->TransportName,
SmbHeader,
(USHORT)MailslotBuffer->ReceiveLength,
MailslotBuffer->ClientAddress,
0);
BowserFreeMailslotBuffer(MailslotBuffer);
return;
}
MailslotNameU.MaximumLength = MAXIMUM_FILENAME_LENGTH*sizeof(WCHAR)+sizeof(WCHAR);
#define DEVICE_PREFIX_LENGTH 7
strcpy(MailslotName, "\\Device");
strncpy( MailslotName+DEVICE_PREFIX_LENGTH,
MailslotSmb->Buffer,
sizeof(MailslotName)-DEVICE_PREFIX_LENGTH);
MailslotName[sizeof(MailslotName)-1] = '\0';
RtlInitString(&MailslotNameA, MailslotName);
//
// Handle netlogon mailslot messages specially.
// Don't call the discardable code at all if netlogon isn't running
//
if ( BowserPnp[NETLOGON_PNP].MaxMessageCount != 0 &&
BowserProcessNetlogonMailslotWrite( MailslotBuffer ) ) {
return;
}
//
// Write the mailslot message to the mailslot
//
try {
Status = RtlOemStringToUnicodeString(&MailslotNameU, &MailslotNameA, TRUE);
if (!NT_SUCCESS(Status)) {
BowserLogIllegalName( Status, MailslotNameA.Buffer, MailslotNameA.Length );
try_return(NOTHING);
}
InitializeObjectAttributes(&ObjAttr,
&MailslotNameU,
OBJ_CASE_INSENSITIVE,
NULL,
NULL);
Status = NtCreateFile(&MailslotHandle, // Handle
GENERIC_WRITE | SYNCHRONIZE,
&ObjAttr, // Object Attributes
&IoStatusBlock, // Final I/O status block
NULL, // Allocation Size
FILE_ATTRIBUTE_NORMAL, // Normal attributes
FILE_SHARE_READ|FILE_SHARE_WRITE,// Sharing attributes
FILE_OPEN, // Create disposition
0, // CreateOptions
NULL, // EA Buffer
0); // EA Length
RtlFreeUnicodeString(&MailslotNameU);
//
// If the mailslot doesn't exist, ditch the request -
//
if (!NT_SUCCESS(Status)) {
BowserStatistics.NumberOfFailedMailslotOpens += 1;
try_return(NOTHING);
}
//
// Now that the mailslot is opened, write the mailslot data into
// the mailslot.
//
Status = NtWriteFile(MailslotHandle,
NULL,
NULL,
NULL,
&IoStatusBlock,
MailslotData,
DataCount,
NULL,
NULL);
if (!NT_SUCCESS(Status)) {
BowserStatistics.NumberOfFailedMailslotWrites += 1;
} else {
BowserStatistics.NumberOfMailslotWrites += 1;
}
try_exit:NOTHING;
} finally {
//
// If we opened the mailslot, close it.
//
if (MailslotHandle != NULL) {
ZwClose(MailslotHandle);
}
//
// Free the mailslot buffer holding this mailslot.
//
BowserFreeMailslotBuffer(MailslotBuffer);
}
}
PMAILSLOT_BUFFER
BowserAllocateMailslotBuffer(
IN PTRANSPORT_NAME TransportName,
IN ULONG RequestedBufferSize
)
/*++
Routine Description:
This routine will allocate a mailslot buffer from the mailslot buffer pool.
If it is unable to allocate a buffer, it will allocate the buffer from
non-paged pool (up to the maximum configured by the user).
Arguments:
TransportName - The transport name for this request.
RequestedBufferSize - Minimum size of buffer to allocate.
Return Value:
MAILSLOT_BUFFER - The allocated buffer.
--*/
{
KIRQL OldIrql;
PMAILSLOT_BUFFER Buffer = NULL;
ULONG BufferSize;
BOOLEAN AllocatingMaxBuffer = FALSE;
//
// If the request fits into a cached buffer,
// and there is a cache buffer available,
// use it.
//
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
if ( RequestedBufferSize <= BOWSER_MAX_DATAGRAM_SIZE &&
!IsListEmpty(&BowserMailslotBufferList)) {
PMAILSLOT_BUFFER Buffer;
PLIST_ENTRY Entry;
Entry = RemoveHeadList(&BowserMailslotBufferList);
BowserNumberOfFreeMailslotBuffers --;
Buffer = CONTAINING_RECORD(Entry, MAILSLOT_BUFFER, Overlay.NextBuffer);
#if DBG
BowserMailslotCacheHitCount++;
#endif // DBG
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
Buffer->TransportName = TransportName;
BowserReferenceTransportName(TransportName);
BowserReferenceTransport( TransportName->Transport );
return Buffer;
}
//
// If we've got too many buffers allocated,
// don't allocate any more.
//
// BowserData.NumberOfMailslotBuffers is the maximum number we're allowed to have
// in the cache at once. It defaults to 3.
//
// BrPnp[NETLOGON].MaxMessageCount is the number of buffers the netlogon service may
// have queued at any one point in time. It may be zero when netlogon isn't
// running or if we're running on a non-DC. On DC's it defaults to 500.
//
// Add 50, to ensure we don't limit it by too much.
//
if ( (ULONG)BowserNumberOfMailslotBuffers >=
max( (ULONG)BowserData.NumberOfMailslotBuffers, BowserPnp[NETLOGON_PNP].MaxMessageCount+50 )) {
BowserStatistics.NumberOfMissedMailslotDatagrams += 1;
BowserNumberOfMissedMailslotDatagrams += 1;
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
return NULL;
}
//
// The first few buffers we allocate should be maximum size so we can keep a preallocated
// cache of huge buffers.
//
if ( BowserNumberOfMaxSizeMailslotBuffers < BowserData.NumberOfMailslotBuffers &&
RequestedBufferSize <= BOWSER_MAX_DATAGRAM_SIZE ) {
BufferSize = FIELD_OFFSET(MAILSLOT_BUFFER, Buffer) + BOWSER_MAX_DATAGRAM_SIZE;
AllocatingMaxBuffer = TRUE;
BowserNumberOfMaxSizeMailslotBuffers += 1;
} else {
BufferSize = FIELD_OFFSET(MAILSLOT_BUFFER, Buffer) + RequestedBufferSize;
}
BowserNumberOfMailslotBuffers += 1;
ASSERT ( (BufferSize - FIELD_OFFSET(MAILSLOT_BUFFER, Buffer)) <= 0xffff);
#if DBG
BowserMailslotCacheMissCount++;
#endif // DBG
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
Buffer = ALLOCATE_POOL(NonPagedPool, BufferSize, POOL_MAILSLOT_BUFFER);
//
// If we couldn't allocate the buffer from non paged pool, give up.
//
if (Buffer == NULL) {
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
ASSERT (BowserNumberOfMailslotBuffers);
BowserNumberOfMailslotBuffers -= 1;
if ( AllocatingMaxBuffer ) {
BowserNumberOfMaxSizeMailslotBuffers -= 1;
}
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
BowserStatistics.NumberOfFailedMailslotAllocations += 1;
//
// Since we couldn't allocate this buffer, we've effectively missed
// this mailslot request.
//
BowserStatistics.NumberOfMissedMailslotDatagrams += 1;
BowserNumberOfMissedMailslotDatagrams += 1;
return NULL;
}
Buffer->Signature = STRUCTURE_SIGNATURE_MAILSLOT_BUFFER;
Buffer->Size = FIELD_OFFSET(MAILSLOT_BUFFER, Buffer);
Buffer->BufferSize = BufferSize - FIELD_OFFSET(MAILSLOT_BUFFER, Buffer);
Buffer->TransportName = TransportName;
BowserReferenceTransportName(TransportName);
BowserReferenceTransport( TransportName->Transport );
return Buffer;
}
VOID
BowserFreeMailslotBuffer(
IN PMAILSLOT_BUFFER Buffer
)
/*++
Routine Description:
This routine will return a mailslot buffer to the view buffer pool.
If the buffer was allocated from must-succeed pool, it is freed back
to pool. In addition, if the buffer is smaller than the current
max view buffer size, we free it.
Arguments:
IN PVIEW_BUFFER Buffer - Supplies the buffer to free
Return Value:
None.
--*/
{
KIRQL OldIrql;
PTRANSPORT Transport;
BowserReferenceDiscardableCode( BowserDiscardableCodeSection );
DISCARDABLE_CODE( BowserDiscardableCodeSection );
Transport = Buffer->TransportName->Transport;
(VOID) BowserDereferenceTransportName( Buffer->TransportName );
BowserDereferenceTransport( Transport);
ACQUIRE_SPIN_LOCK(&BowserMailslotSpinLock, &OldIrql);
//
// Also, if a new transport was added that is larger than this buffer,
// we want to free the buffer.
//
//
// If we have more mailslot buffers than the size of our lookaside list,
// free it, don't stick it on our lookaside list.
//
if (Buffer->BufferSize != BOWSER_MAX_DATAGRAM_SIZE ||
BowserNumberOfFreeMailslotBuffers > BowserData.NumberOfMailslotBuffers) {
//
// Since we're returning this buffer to pool, we shouldn't count it
// against our total number of mailslot buffers.
//
BowserNumberOfMailslotBuffers -= 1;
ASSERT (BowserNumberOfMailslotBuffers >= 0);
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
FREE_POOL(Buffer);
BowserDereferenceDiscardableCode( BowserDiscardableCodeSection );
return;
}
InsertTailList(&BowserMailslotBufferList, &Buffer->Overlay.NextBuffer);
BowserNumberOfFreeMailslotBuffers ++;
RELEASE_SPIN_LOCK(&BowserMailslotSpinLock, OldIrql);
BowserDereferenceDiscardableCode( BowserDiscardableCodeSection );
}
VOID
BowserFreeMailslotBufferHighIrql(
IN PMAILSLOT_BUFFER Buffer
)
/*++
Routine Description:
This routine will return a mailslot buffer to the view buffer pool if the
caller is at raised irql.
Arguments:
Buffer - Supplies the buffer to free
Return Value:
None.
--*/
{
//
// Queue the request to a worker routine.
//
ExInitializeWorkItem(&Buffer->Overlay.WorkHeader,
(PWORKER_THREAD_ROUTINE) BowserFreeMailslotBuffer,
Buffer);
BowserQueueDelayedWorkItem( &Buffer->Overlay.WorkHeader );
}
VOID
BowserpInitializeMailslot (
VOID
)
/*++
Routine Description:
This routine will allocate a transport descriptor and bind the bowser
to the transport.
Arguments:
None
Return Value:
None
--*/
{
PBROWSER_PNP_STATE BrPnp;
KeInitializeSpinLock(&BowserMailslotSpinLock);
InitializeListHead(&BowserMailslotBufferList);
for ( BrPnp=&BowserPnp[0];
BrPnp<&BowserPnp[BOWSER_PNP_COUNT];
BrPnp++) {
InitializeListHead(&BrPnp->MailslotMessageQueue);
InitializeListHead(&BrPnp->PnpQueue);
BowserInitializeIrpQueue( &BrPnp->IrpQueue );
}
}
VOID
BowserpUninitializeMailslot (
VOID
)
/*++
Routine Description:
Arguments:
None
Return Value:
None
--*/
{
PBROWSER_PNP_STATE BrPnp;
PAGED_CODE();
//
// Trim the netlogon message queue to zero entries.
//
for ( BrPnp=&BowserPnp[0];
BrPnp<&BowserPnp[BOWSER_PNP_COUNT];
BrPnp++) {
BrPnp->MaxMessageCount = 0;
BowserTrimMessageQueue(BrPnp);
BowserUninitializeIrpQueue( &BrPnp->IrpQueue );
}
//
// Free the mailslot buffers.
while (!IsListEmpty(&BowserMailslotBufferList)) {
PLIST_ENTRY Entry;
PMAILSLOT_BUFFER Buffer;
Entry = RemoveHeadList(&BowserMailslotBufferList);
Buffer = CONTAINING_RECORD(Entry, MAILSLOT_BUFFER, Overlay.NextBuffer);
FREE_POOL(Buffer);
}
}
Reference in a new issue Copy permalink