1817 lines
54 KiB
C
1817 lines
54 KiB
C
/*++
|
||
|
||
Copyright (c) 1991 Microsoft Corporation
|
||
|
||
Module Name:
|
||
|
||
receive.c
|
||
|
||
Abstract:
|
||
|
||
This module implements the routines needed to process TDI receive
|
||
indication requests.
|
||
|
||
|
||
Author:
|
||
|
||
Larry Osterman (larryo) 6-May-1991
|
||
|
||
Revision History:
|
||
|
||
6-May-1991 LarryO
|
||
|
||
Created
|
||
|
||
--*/
|
||
#include "precomp.h"
|
||
#pragma hdrstop
|
||
|
||
//
|
||
// Keep track of the number of datagram queued to worker threads.
|
||
// Keep a separate count of critical versus non-critical to ensure non-critical
|
||
// datagrams don't starve critical ones.
|
||
//
|
||
|
||
LONG BowserPostedDatagramCount;
|
||
LONG BowserPostedCriticalDatagramCount;
|
||
#define BOWSER_MAX_POSTED_DATAGRAMS 100
|
||
|
||
#define INCLUDE_SMB_TRANSACTION
|
||
|
||
typedef struct _PROCESS_MASTER_ANNOUNCEMENT_CONTEXT {
|
||
WORK_QUEUE_ITEM WorkItem;
|
||
PTRANSPORT Transport;
|
||
ULONG ServerType;
|
||
ULONG ServerElectionVersion;
|
||
UCHAR MasterName[NETBIOS_NAME_LEN];
|
||
ULONG MasterAddressLength;
|
||
UCHAR Buffer[1];
|
||
} PROCESS_MASTER_ANNOUNCEMENT_CONTEXT, *PPROCESS_MASTER_ANNOUNCEMENT_CONTEXT;
|
||
|
||
typedef struct _ILLEGAL_DATAGRAM_CONTEXT {
|
||
WORK_QUEUE_ITEM WorkItem;
|
||
PTRANSPORT_NAME TransportName;
|
||
NTSTATUS EventStatus;
|
||
USHORT BufferSize;
|
||
UCHAR SenderName[max(NETBIOS_NAME_LEN, SMB_IPX_NAME_LENGTH)];
|
||
UCHAR Buffer[1];
|
||
} ILLEGAL_DATAGRAM_CONTEXT, *PILLEGAL_DATAGRAM_CONTEXT;
|
||
|
||
VOID
|
||
BowserLogIllegalDatagramWorker(
|
||
IN PVOID Ctx
|
||
);
|
||
|
||
VOID
|
||
BowserProcessMasterAnnouncement(
|
||
IN PVOID Ctx
|
||
);
|
||
|
||
|
||
DATAGRAM_HANDLER(
|
||
HandleLocalMasterAnnouncement
|
||
);
|
||
|
||
DATAGRAM_HANDLER(
|
||
HandleAnnounceRequest
|
||
);
|
||
|
||
NTSTATUS
|
||
CompleteReceiveMailslot (
|
||
IN PDEVICE_OBJECT TransportDevice,
|
||
IN PIRP Irp,
|
||
IN PVOID Context
|
||
);
|
||
|
||
NTSTATUS
|
||
CompleteShortBrowserPacket (
|
||
IN PDEVICE_OBJECT TransportDevice,
|
||
IN PIRP Irp,
|
||
IN PVOID Ctx
|
||
);
|
||
|
||
#ifdef ALLOC_PRAGMA
|
||
#pragma alloc_text(PAGE, BowserLogIllegalDatagramWorker)
|
||
#pragma alloc_text(PAGE, BowserProcessMasterAnnouncement)
|
||
#endif
|
||
|
||
|
||
PDATAGRAM_HANDLER
|
||
BowserDatagramHandlerTable[] = {
|
||
NULL, // 0 - Illegal (no opcode for this).
|
||
BowserHandleServerAnnouncement, // 1 - HostAnnouncement
|
||
HandleAnnounceRequest, // 2 - AnnouncementRequest
|
||
NULL, // 3 - InterrogateInfoRequest
|
||
NULL, // 4 - RelogonRequest
|
||
NULL, // 5
|
||
NULL, // 6
|
||
NULL, // 7
|
||
BowserHandleElection, // 8 - Election
|
||
BowserGetBackupListRequest, // 9 - GetBackupListReq
|
||
BowserGetBackupListResponse, // a - GetBackupListResp
|
||
BowserHandleBecomeBackup, // b - BecomeBackupServer
|
||
BowserHandleDomainAnnouncement, // c - WkGroupAnnouncement,
|
||
BowserMasterAnnouncement, // d - MasterAnnouncement,
|
||
BowserResetState, // e - ResetBrowserState
|
||
HandleLocalMasterAnnouncement // f - LocalMasterAnnouncement
|
||
};
|
||
|
||
NTSTATUS
|
||
BowserTdiReceiveDatagramHandler (
|
||
IN PVOID TdiEventContext, // the event context
|
||
IN LONG SourceAddressLength, // length of the originator of the datagram
|
||
IN PVOID SourceAddress, // string describing the originator of the datagram
|
||
IN LONG OptionsLength, // options for the receive
|
||
IN PVOID Options, //
|
||
IN ULONG ReceiveDatagramFlags, //
|
||
IN ULONG BytesIndicated, // number of bytes this indication
|
||
IN ULONG BytesAvailable, // number of bytes in complete Tsdu
|
||
OUT ULONG *BytesTaken, // number of bytes used
|
||
IN PVOID Tsdu, // pointer describing this TSDU, typically a lump of bytes
|
||
OUT PIRP *IoRequestPacket // TdiReceive IRP if MORE_PROCESSING_REQUIRED.
|
||
)
|
||
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine will process receive datagram indication messages, and
|
||
process them as appropriate.
|
||
|
||
Arguments:
|
||
|
||
IN PVOID TdiEventContext - the event context
|
||
IN int SourceAddressLength - length of the originator of the datagram
|
||
IN PVOID SourceAddress, - string describing the originator of the datagram
|
||
IN int OptionsLength, - options for the receive
|
||
IN PVOID Options, -
|
||
IN ULONG BytesIndicated, - number of bytes this indication
|
||
IN ULONG BytesAvailable, - number of bytes in complete Tsdu
|
||
OUT ULONG *BytesTaken, - number of bytes used
|
||
IN PVOID Tsdu, - pointer describing this TSDU, typically a lump of bytes
|
||
OUT PIRP *IoRequestPacket - TdiReceive IRP if MORE_PROCESSING_REQUIRED.
|
||
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
|
||
|
||
{
|
||
PVOID DatagramData;
|
||
PINTERNAL_TRANSACTION InternalTransaction = NULL;
|
||
ULONG DatagramDataSize;
|
||
PTRANSPORT_NAME TransportName = TdiEventContext;
|
||
MAILSLOTTYPE Opcode;
|
||
TA_NETBIOS_ADDRESS ClientNetbiosAddress;
|
||
ULONG ClientNetbiosAddressSize;
|
||
|
||
if (BytesAvailable > ((PTRANSPORT_NAME)TdiEventContext)->Transport->DatagramSize) {
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
if (NULL == TransportName->DeviceObject) {
|
||
//
|
||
// The transport isn't ready yet to process receives (probably
|
||
// we're still processing the transport bind call).
|
||
// Drop this receive.
|
||
//
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
//
|
||
// Make a copy of the SourceAddress that just has the netbios address
|
||
// (We could pass the second address along, but there are many
|
||
// places that expect just a single source address.)
|
||
//
|
||
|
||
if ( SourceAddressLength < sizeof(TA_NETBIOS_ADDRESS)) {
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
TdiCopyLookaheadData( &ClientNetbiosAddress, SourceAddress, sizeof(TA_NETBIOS_ADDRESS), ReceiveDatagramFlags);
|
||
|
||
if ( ClientNetbiosAddress.Address[0].AddressType != TDI_ADDRESS_TYPE_NETBIOS ) {
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
ClientNetbiosAddressSize = sizeof(TA_NETBIOS_ADDRESS);
|
||
|
||
ClientNetbiosAddress.TAAddressCount = 1;
|
||
|
||
|
||
//
|
||
// Classify the incoming packet according to it's type. Depending on
|
||
// the type, either process it as:
|
||
//
|
||
// 1) A server announcement
|
||
// 2) An incoming mailslot
|
||
//
|
||
|
||
Opcode = BowserClassifyIncomingDatagram(Tsdu, BytesIndicated,
|
||
&DatagramData,
|
||
&DatagramDataSize);
|
||
if (Opcode == MailslotTransaction) {
|
||
|
||
//
|
||
// Grab the IP address of the client.
|
||
//
|
||
PTA_NETBIOS_ADDRESS OrigNetbiosAddress = SourceAddress;
|
||
ULONG ClientIpAddress = 0;
|
||
if ( OrigNetbiosAddress->TAAddressCount > 1 ) {
|
||
TA_ADDRESS * TaAddress = (TA_ADDRESS *)
|
||
(((LPBYTE)&OrigNetbiosAddress->Address[0].Address[0]) +
|
||
OrigNetbiosAddress->Address[0].AddressLength);
|
||
|
||
if ( TaAddress->AddressLength >= sizeof(TDI_ADDRESS_IP) &&
|
||
TaAddress->AddressType == TDI_ADDRESS_TYPE_IP ) {
|
||
TDI_ADDRESS_IP UNALIGNED * TdiAddressIp = (TDI_ADDRESS_IP UNALIGNED *) (TaAddress->Address);
|
||
|
||
ClientIpAddress = TdiAddressIp->in_addr;
|
||
}
|
||
|
||
}
|
||
|
||
return BowserHandleMailslotTransaction(
|
||
TransportName,
|
||
ClientNetbiosAddress.Address[0].Address->NetbiosName,
|
||
ClientIpAddress,
|
||
0, // SMB offset into TSDU
|
||
ReceiveDatagramFlags,
|
||
BytesIndicated,
|
||
BytesAvailable,
|
||
BytesTaken,
|
||
Tsdu,
|
||
IoRequestPacket );
|
||
|
||
} else if (Opcode == Illegal) {
|
||
BowserLogIllegalDatagram(TdiEventContext,
|
||
Tsdu,
|
||
(USHORT)(BytesIndicated & 0xffff),
|
||
ClientNetbiosAddress.Address[0].Address->NetbiosName,
|
||
ReceiveDatagramFlags);
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
} else {
|
||
|
||
if (BowserDatagramHandlerTable[Opcode] == NULL) {
|
||
return STATUS_SUCCESS;
|
||
}
|
||
|
||
//
|
||
// If this isn't the full packet, post a receive for it and
|
||
// handle it when we finally complete the receive.
|
||
//
|
||
|
||
if (BytesIndicated < BytesAvailable) {
|
||
return BowserHandleShortBrowserPacket(TransportName,
|
||
TdiEventContext,
|
||
ClientNetbiosAddressSize,
|
||
&ClientNetbiosAddress,
|
||
OptionsLength,
|
||
Options,
|
||
ReceiveDatagramFlags,
|
||
BytesAvailable,
|
||
BytesTaken,
|
||
IoRequestPacket,
|
||
BowserTdiReceiveDatagramHandler
|
||
);
|
||
}
|
||
|
||
InternalTransaction = DatagramData;
|
||
|
||
if (((Opcode == WkGroupAnnouncement) ||
|
||
(Opcode == HostAnnouncement)) && !TransportName->ProcessHostAnnouncements) {
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
ASSERT (DatagramDataSize == (BytesIndicated - ((PCHAR)InternalTransaction - (PCHAR)Tsdu)));
|
||
|
||
ASSERT (FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement) == FIELD_OFFSET(INTERNAL_TRANSACTION, Union.BrowseAnnouncement));
|
||
ASSERT (FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement) == FIELD_OFFSET(INTERNAL_TRANSACTION, Union.RequestElection));
|
||
ASSERT (FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement) == FIELD_OFFSET(INTERNAL_TRANSACTION, Union.BecomeBackup));
|
||
ASSERT (FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement) == FIELD_OFFSET(INTERNAL_TRANSACTION, Union.GetBackupListRequest));
|
||
ASSERT (FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement) == FIELD_OFFSET(INTERNAL_TRANSACTION, Union.GetBackupListResp));
|
||
ASSERT (FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement) == FIELD_OFFSET(INTERNAL_TRANSACTION, Union.ResetState));
|
||
ASSERT (FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement) == FIELD_OFFSET(INTERNAL_TRANSACTION, Union.MasterAnnouncement));
|
||
|
||
return BowserDatagramHandlerTable[Opcode](TdiEventContext,
|
||
&InternalTransaction->Union.Announcement,
|
||
BytesIndicated-(ULONG)((PCHAR)&InternalTransaction->Union.Announcement - (PCHAR)Tsdu),
|
||
BytesTaken,
|
||
&ClientNetbiosAddress,
|
||
ClientNetbiosAddressSize,
|
||
ClientNetbiosAddress.Address[0].Address->NetbiosName,
|
||
NETBIOS_NAME_LEN,
|
||
ReceiveDatagramFlags);
|
||
}
|
||
|
||
return STATUS_SUCCESS;
|
||
|
||
UNREFERENCED_PARAMETER(OptionsLength);
|
||
UNREFERENCED_PARAMETER(Options);
|
||
UNREFERENCED_PARAMETER(ReceiveDatagramFlags);
|
||
}
|
||
|
||
VOID
|
||
BowserLogIllegalDatagram(
|
||
IN PTRANSPORT_NAME TransportName,
|
||
IN PVOID IncomingBuffer,
|
||
IN USHORT BufferSize,
|
||
IN PCHAR ClientName,
|
||
IN ULONG ReceiveFlags
|
||
)
|
||
{
|
||
KIRQL OldIrql;
|
||
NTSTATUS ErrorStatus = STATUS_SUCCESS;
|
||
|
||
ExInterlockedAddLargeStatistic(&BowserStatistics.NumberOfIllegalDatagrams, 1);
|
||
|
||
ACQUIRE_SPIN_LOCK(&BowserTimeSpinLock, &OldIrql);
|
||
|
||
if (BowserIllegalDatagramCount > 0) {
|
||
BowserIllegalDatagramCount -= 1;
|
||
|
||
ErrorStatus = EVENT_BOWSER_ILLEGAL_DATAGRAM;
|
||
|
||
} else if (!BowserIllegalDatagramThreshold) {
|
||
BowserIllegalDatagramThreshold = TRUE;
|
||
ErrorStatus = EVENT_BOWSER_ILLEGAL_DATAGRAM_THRESHOLD;
|
||
}
|
||
|
||
RELEASE_SPIN_LOCK(&BowserTimeSpinLock, OldIrql);
|
||
|
||
// if (!memcmp(TransportName->Transport->ComputerName->Name->NetbiosName.Address[0].Address->NetbiosName, ClientAddress->Address[0].Address->NetbiosName, CNLEN)) {
|
||
// DbgBreakPoint();
|
||
// }
|
||
|
||
if (ErrorStatus != STATUS_SUCCESS) {
|
||
PILLEGAL_DATAGRAM_CONTEXT Context = NULL;
|
||
|
||
Context = ALLOCATE_POOL(NonPagedPool, sizeof(ILLEGAL_DATAGRAM_CONTEXT)+BufferSize, POOL_ILLEGALDGRAM);
|
||
|
||
if (Context != NULL) {
|
||
Context->EventStatus = ErrorStatus;
|
||
Context->TransportName = TransportName;
|
||
Context->BufferSize = BufferSize;
|
||
|
||
TdiCopyLookaheadData(&Context->Buffer, IncomingBuffer, BufferSize, 0);
|
||
|
||
BowserCopyOemComputerName( Context->SenderName,
|
||
ClientName,
|
||
sizeof(Context->SenderName),
|
||
ReceiveFlags);
|
||
|
||
ExInitializeWorkItem(&Context->WorkItem, BowserLogIllegalDatagramWorker, Context);
|
||
|
||
BowserQueueDelayedWorkItem( &Context->WorkItem );
|
||
}
|
||
|
||
}
|
||
}
|
||
|
||
VOID
|
||
BowserCopyOemComputerName(
|
||
PCHAR OutputComputerName,
|
||
PCHAR NetbiosName,
|
||
ULONG NetbiosNameLength,
|
||
IN ULONG ReceiveFlags
|
||
)
|
||
{
|
||
ULONG i;
|
||
|
||
//
|
||
// Since this routine can be called at indication time, we need to use
|
||
// TdiCopyLookaheadData
|
||
//
|
||
|
||
TdiCopyLookaheadData(OutputComputerName, NetbiosName, NetbiosNameLength, ReceiveFlags);
|
||
|
||
for (i = NetbiosNameLength-2; i ; i -= 1) {
|
||
|
||
if ((OutputComputerName[i] != ' ') &&
|
||
(OutputComputerName[i] != '\0')) {
|
||
OutputComputerName[i+1] = '\0';
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
|
||
|
||
VOID
|
||
BowserLogIllegalDatagramWorker(
|
||
IN PVOID Ctx
|
||
)
|
||
{
|
||
PILLEGAL_DATAGRAM_CONTEXT Context = Ctx;
|
||
NTSTATUS EventContext = Context->EventStatus;
|
||
LPWSTR TransportNamePointer = &Context->TransportName->Transport->PagedTransport->TransportName.Buffer[(sizeof(L"\\Device\\") / sizeof(WCHAR))-1];
|
||
LPWSTR NamePointer = Context->TransportName->PagedTransportName->Name->Name.Buffer;
|
||
UNICODE_STRING ClientNameU;
|
||
OEM_STRING ClientNameO;
|
||
NTSTATUS Status;
|
||
|
||
PAGED_CODE();
|
||
|
||
RtlInitAnsiString(&ClientNameO, Context->SenderName);
|
||
|
||
Status = RtlOemStringToUnicodeString(&ClientNameU, &ClientNameO, TRUE);
|
||
|
||
if (!NT_SUCCESS(Status)) {
|
||
BowserLogIllegalName( Status, ClientNameO.Buffer, ClientNameO.Length );
|
||
}
|
||
else {
|
||
|
||
BowserWriteErrorLogEntry(EventContext, STATUS_REQUEST_NOT_ACCEPTED,
|
||
Context->Buffer,
|
||
Context->BufferSize,
|
||
3, ClientNameU.Buffer,
|
||
NamePointer,
|
||
TransportNamePointer);
|
||
RtlFreeUnicodeString(&ClientNameU);
|
||
}
|
||
|
||
FREE_POOL(Context);
|
||
|
||
}
|
||
|
||
|
||
CHAR BowserMinimumDatagramSize[] = {
|
||
(CHAR)0xff, // 0 - Illegal (no opcode for this).
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement.NameComment), // HostAnnouncement
|
||
(CHAR)0xff, // AnnouncementRequest
|
||
(CHAR)0xff, // InterrogateInfoRequest
|
||
(CHAR)0xff, // RelogonRequest
|
||
(CHAR)0xff, // 5
|
||
(CHAR)0xff, // 6
|
||
(CHAR)0xff, // 7
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.RequestElection.ServerName),// Election
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.GetBackupListRequest.Token),// GetBackupListReq
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.GetBackupListResp.Token), // GetBackupListResp
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.BecomeBackup.BrowserToPromote), // BecomeBackupServer
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.BrowseAnnouncement.Comment), // WkGroupAnnouncement,
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.ResetState.Options), // ResetBrowserState
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.MasterAnnouncement.MasterName), // MasterAnnouncement,
|
||
(CHAR)FIELD_OFFSET(INTERNAL_TRANSACTION, Union.Announcement.NameComment) // LocalMasterAnnouncement
|
||
};
|
||
|
||
MAILSLOTTYPE
|
||
BowserClassifyIncomingDatagram(
|
||
IN PVOID Buffer,
|
||
IN ULONG BufferLength,
|
||
OUT PVOID *DatagramData,
|
||
OUT PULONG DatagramDataSize
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine will classify an incoming datagram into its type - either
|
||
Illegal, ServerAnnouncement, or MailslotRequest.
|
||
|
||
Arguments:
|
||
|
||
IN PVOID Buffer, - pointer describing this TSDU, typically a lump of bytes
|
||
IN ULONG BufferLength - number of bytes in complete Tsdu
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
{
|
||
PSMB_HEADER Header = Buffer;
|
||
PSMB_TRANSACT_MAILSLOT Transaction = (PSMB_TRANSACT_MAILSLOT) (Header+1);
|
||
PSZ MailslotName = Transaction->Buffer;
|
||
PINTERNAL_TRANSACTION InternalTransaction;
|
||
BOOLEAN MailslotLanman = FALSE;
|
||
BOOLEAN MailslotBrowse = FALSE;
|
||
ULONG i;
|
||
ULONG MaxMailslotNameLength;
|
||
|
||
ASSERT (sizeof(BowserMinimumDatagramSize) == MaximumMailslotType);
|
||
|
||
//
|
||
// We only know things that start with an SMB header.
|
||
//
|
||
|
||
if ((BufferLength < sizeof(SMB_HEADER)) ||
|
||
|
||
(SmbGetUlong(((PULONG )Header->Protocol)) != (ULONG)SMB_HEADER_PROTOCOL) ||
|
||
|
||
//
|
||
// All mailslots and server announcements go via the transaction SMB
|
||
// protocol.
|
||
//
|
||
(Header->Command != SMB_COM_TRANSACTION) ||
|
||
|
||
//
|
||
// The buffer has to be big enough to hold a mailslot transaction.
|
||
//
|
||
|
||
(BufferLength <= (FIELD_OFFSET(SMB_TRANSACT_MAILSLOT, Buffer) + sizeof(SMB_HEADER)) + SMB_MAILSLOT_PREFIX_LENGTH) ||
|
||
|
||
//
|
||
// The word count for a transaction SMB is 17 (14+3 setup words).
|
||
//
|
||
|
||
(Transaction->WordCount != 17) ||
|
||
|
||
//
|
||
// There must be 3 setup words.
|
||
//
|
||
|
||
(Transaction->SetupWordCount != 3) ||
|
||
|
||
// //
|
||
// // Mailslot and server announcements expect no response.
|
||
// //
|
||
//
|
||
// (!(SmbGetUshort(&Transaction->Flags) & SMB_TRANSACTION_NO_RESPONSE)) ||
|
||
|
||
//
|
||
// There are no parameter bytes for a mailslot write.
|
||
//
|
||
|
||
(SmbGetUshort(&Transaction->TotalParameterCount) != 0) ||
|
||
|
||
//
|
||
// This must be a mailslot write command.
|
||
//
|
||
|
||
(SmbGetUshort(&Transaction->Opcode) != TRANS_MAILSLOT_WRITE) ||
|
||
|
||
//
|
||
// And it must be a second class mailslot write.
|
||
//
|
||
|
||
(SmbGetUshort(&Transaction->Class) != 2) ||
|
||
|
||
_strnicmp(MailslotName, SMB_MAILSLOT_PREFIX,
|
||
min(SMB_MAILSLOT_PREFIX_LENGTH,
|
||
BufferLength-(ULONG)((PCHAR)MailslotName-(PCHAR)Buffer)))) {
|
||
|
||
return Illegal;
|
||
}
|
||
|
||
|
||
//
|
||
// Ensure there's a zero byte in the mailslotname
|
||
//
|
||
|
||
MaxMailslotNameLength =
|
||
min( MAXIMUM_FILENAME_LENGTH-7, // \Device
|
||
BufferLength-(ULONG)((PCHAR)MailslotName-(PCHAR)Buffer));
|
||
|
||
for ( i = SMB_MAILSLOT_PREFIX_LENGTH; i < MaxMailslotNameLength; i++ ) {
|
||
if ( MailslotName[i] == '\0' ) {
|
||
break;
|
||
}
|
||
}
|
||
|
||
if ( i == MaxMailslotNameLength ) {
|
||
return Illegal;
|
||
}
|
||
|
||
|
||
//
|
||
// We now know this is a mailslot of some kind. Now check what type
|
||
// of mailslot it is.
|
||
//
|
||
//
|
||
// There are two special mailslot names we understand, \MAILSLOT\LANMAN,
|
||
// and \MAILSLOT\BROWSE
|
||
//
|
||
|
||
if (_strnicmp(MailslotName, MAILSLOT_LANMAN_NAME, min(sizeof(MAILSLOT_LANMAN_NAME)-1, BufferLength-(ULONG)((PCHAR)Buffer-(PCHAR)MailslotName)))) {
|
||
|
||
if (_strnicmp(MailslotName, MAILSLOT_BROWSER_NAME, min(sizeof(MAILSLOT_BROWSER_NAME)-1, BufferLength-(ULONG)((PCHAR)Buffer-(PCHAR)MailslotName)))) {
|
||
return MailslotTransaction;
|
||
}
|
||
}
|
||
|
||
//
|
||
// CLEANUP - Not necessary with code below commented out.
|
||
//
|
||
// else {
|
||
// MailslotBrowse = TRUE;
|
||
// }
|
||
//
|
||
// } else {
|
||
// MailslotLanman = TRUE;
|
||
// }
|
||
//
|
||
|
||
//
|
||
// This mailslot write is to the special mailslot \MAILSLOT\LANMAN (or \MAILSLOT\MSBROWSE).
|
||
//
|
||
|
||
//
|
||
// Check that the data is within the supplied buffer, and ensure that the one
|
||
// byte Type field is within the buffer since we need to dereference it below
|
||
// to do the overall size check (this is the reason for BufferLength - 1).
|
||
//
|
||
|
||
if (SmbGetUshort(&Transaction->DataOffset) > BufferLength - 1) {
|
||
return Illegal;
|
||
}
|
||
|
||
//
|
||
// Verify that the supplied data size exceeds the minimum for this type of
|
||
// transaction.
|
||
//
|
||
|
||
*DatagramData = (((PCHAR)Header) + SmbGetUshort(&Transaction->DataOffset));
|
||
InternalTransaction = *DatagramData;
|
||
*DatagramDataSize = (BufferLength - (ULONG)((PCHAR)InternalTransaction - (PCHAR)Buffer));
|
||
|
||
if (InternalTransaction->Type >= MaximumMailslotType) {
|
||
return Illegal;
|
||
}
|
||
|
||
if (((LONG)*DatagramDataSize) < BowserMinimumDatagramSize[InternalTransaction->Type]) {
|
||
return Illegal;
|
||
}
|
||
|
||
// //
|
||
// // Figure out what type of mailslot it is by looking at the
|
||
// // data in the message.
|
||
// //
|
||
//
|
||
//
|
||
// //
|
||
// // Depending on which special mailslot this is, certain types of requests
|
||
// // are illegal.
|
||
// //
|
||
// switch (InternalTransaction->Type) {
|
||
// case InterrogateInfoRequest:
|
||
// case RelogonRequest:
|
||
// if (MailslotBrowse) {
|
||
// return Illegal;
|
||
// }
|
||
// break;
|
||
//
|
||
// case GetBackupListReq:
|
||
// case GetBackupListResp:
|
||
// case BecomeBackupServer:
|
||
// case WkGroupAnnouncement:
|
||
// case MasterAnnouncement:
|
||
// case Election:
|
||
// if (MailslotLanman) {
|
||
// return Illegal;
|
||
// }
|
||
// break;
|
||
// }
|
||
//
|
||
|
||
//
|
||
// The type of this request is the first UCHAR inside the transaction
|
||
// data.
|
||
//
|
||
|
||
return (MAILSLOTTYPE )InternalTransaction->Type;
|
||
|
||
}
|
||
|
||
DATAGRAM_HANDLER(
|
||
HandleLocalMasterAnnouncement
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine will process receive datagram indication messages, and
|
||
process them as appropriate.
|
||
|
||
Arguments:
|
||
|
||
IN PTRANSPORT Transport - The transport provider for this request.
|
||
IN ULONG BytesAvailable - number of bytes in complete Tsdu
|
||
IN PHOST_ANNOUNCE_PACKET_1 HostAnnouncement - the server announcement.
|
||
IN ULONG BytesAvailable - The number of bytes in the announcement.
|
||
OUT ULONG *BytesTaken - number of bytes used
|
||
IN UCHAR Opcode - the mailslot write opcode.
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
{
|
||
PPROCESS_MASTER_ANNOUNCEMENT_CONTEXT Context = NULL;
|
||
PBROWSE_ANNOUNCE_PACKET_1 BrowseAnnouncement = Buffer;
|
||
|
||
if (BytesAvailable < FIELD_OFFSET(BROWSE_ANNOUNCE_PACKET_1, Comment)) {
|
||
return(STATUS_REQUEST_NOT_ACCEPTED);
|
||
}
|
||
|
||
//
|
||
// Ensure we've not consumed too much memory
|
||
//
|
||
|
||
InterlockedIncrement( &BowserPostedDatagramCount );
|
||
|
||
if ( BowserPostedDatagramCount > BOWSER_MAX_POSTED_DATAGRAMS ) {
|
||
InterlockedDecrement( &BowserPostedDatagramCount );
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
Context = ALLOCATE_POOL(NonPagedPool, sizeof(PROCESS_MASTER_ANNOUNCEMENT_CONTEXT) + SourceAddressLength, POOL_MASTERANNOUNCE);
|
||
|
||
//
|
||
// If we couldn't allocate the pool from non paged pool, just give up,
|
||
// the master will announce within 15 minutes anyway.
|
||
//
|
||
|
||
if (Context == NULL) {
|
||
InterlockedDecrement( &BowserPostedDatagramCount );
|
||
return STATUS_SUCCESS;
|
||
}
|
||
|
||
ExInitializeWorkItem(&Context->WorkItem, BowserProcessMasterAnnouncement, Context);
|
||
|
||
BowserReferenceTransport( TransportName->Transport );
|
||
Context->Transport = TransportName->Transport;
|
||
|
||
Context->ServerType = SmbGetUlong(&BrowseAnnouncement->Type);
|
||
Context->ServerElectionVersion = SmbGetUlong(&BrowseAnnouncement->CommentPointer);
|
||
|
||
RtlCopyMemory(Context->MasterName, BrowseAnnouncement->ServerName, sizeof(Context->MasterName)-1);
|
||
Context->MasterName[sizeof(Context->MasterName)-1] = '\0';
|
||
|
||
Context->MasterAddressLength = SourceAddressLength;
|
||
|
||
TdiCopyLookaheadData(Context->Buffer, SourceAddress, SourceAddressLength, ReceiveFlags);
|
||
|
||
BowserQueueDelayedWorkItem( &Context->WorkItem );
|
||
|
||
//
|
||
// If we are not processing host announcements for this
|
||
// transport, ignore this request.
|
||
//
|
||
|
||
if (!TransportName->ProcessHostAnnouncements) {
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
DISCARDABLE_CODE( BowserDiscardableCodeSection );
|
||
|
||
return BowserHandleServerAnnouncement(TransportName,
|
||
Buffer,
|
||
BytesAvailable,
|
||
BytesTaken,
|
||
SourceAddress,
|
||
SourceAddressLength,
|
||
SourceName,
|
||
SourceNameLength,
|
||
ReceiveFlags);
|
||
|
||
}
|
||
|
||
|
||
|
||
|
||
VOID
|
||
BowserProcessMasterAnnouncement(
|
||
IN PVOID Ctx
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine will process browser master announcements.
|
||
|
||
Arguments:
|
||
|
||
IN PVOID Context - Context block containing master name.
|
||
|
||
Return Value:
|
||
|
||
None.
|
||
|
||
--*/
|
||
{
|
||
PPROCESS_MASTER_ANNOUNCEMENT_CONTEXT Context = Ctx;
|
||
PTRANSPORT Transport = Context->Transport;
|
||
UNICODE_STRING MasterName;
|
||
OEM_STRING AnsiMasterName;
|
||
WCHAR MasterNameBuffer[LM20_CNLEN+1];
|
||
|
||
PAGED_CODE();
|
||
|
||
try {
|
||
NTSTATUS Status;
|
||
PPAGED_TRANSPORT PagedTransport = Transport->PagedTransport;
|
||
|
||
LOCK_TRANSPORT(Transport);
|
||
|
||
MasterName.Buffer = MasterNameBuffer;
|
||
MasterName.MaximumLength = sizeof(MasterNameBuffer);
|
||
|
||
//
|
||
// If we are currently running an election, ignore this announcement.
|
||
//
|
||
|
||
if (Transport->ElectionState == RunningElection) {
|
||
try_return(NOTHING);
|
||
}
|
||
|
||
RtlInitAnsiString(&AnsiMasterName, Context->MasterName);
|
||
|
||
Status = RtlOemStringToUnicodeString(&MasterName, &AnsiMasterName, FALSE);
|
||
|
||
if (!NT_SUCCESS(Status)) {
|
||
BowserLogIllegalName( Status, AnsiMasterName.Buffer, AnsiMasterName.Length );
|
||
try_return(NOTHING);
|
||
}
|
||
|
||
//
|
||
// We've found our master - stop our timers - there's a master,
|
||
// and any find masters we have outstanding will be completed.
|
||
//
|
||
|
||
PagedTransport->ElectionCount = 0;
|
||
|
||
Transport->ElectionState = Idle;
|
||
|
||
BowserStopTimer(&Transport->ElectionTimer);
|
||
|
||
BowserStopTimer(&Transport->FindMasterTimer);
|
||
|
||
//
|
||
// If this address doesn't match the address we have for the master,
|
||
// then use the new address.
|
||
//
|
||
|
||
if (Context->MasterAddressLength != PagedTransport->MasterBrowserAddress.Length ||
|
||
RtlCompareMemory(PagedTransport->MasterBrowserAddress.Buffer, Context->Buffer, Context->MasterAddressLength) != Context->MasterAddressLength) {
|
||
|
||
ASSERT (Context->MasterAddressLength <= PagedTransport->MasterBrowserAddress.MaximumLength);
|
||
|
||
if (Context->MasterAddressLength <= PagedTransport->MasterBrowserAddress.MaximumLength) {
|
||
PagedTransport->MasterBrowserAddress.Length = (USHORT)Context->MasterAddressLength;
|
||
RtlCopyMemory(PagedTransport->MasterBrowserAddress.Buffer, Context->Buffer, Context->MasterAddressLength);
|
||
}
|
||
|
||
}
|
||
|
||
//
|
||
// We got a master announcement from someone else. Remember the
|
||
// transport address of the master.
|
||
//
|
||
|
||
if (!RtlEqualUnicodeString(&Transport->DomainInfo->DomUnicodeComputerName, &MasterName, TRUE)) {
|
||
BOOLEAN sendElection = FALSE;
|
||
|
||
//
|
||
// If we're a master, and we receive this from someone else,
|
||
// stop being a master and force an election.
|
||
//
|
||
|
||
if (PagedTransport->Role == Master) {
|
||
|
||
BowserStatistics.NumberOfDuplicateMasterAnnouncements += 1;
|
||
|
||
|
||
//
|
||
// Log this event.
|
||
// But avoid logging another one on this transport for the next
|
||
// 60 seconds.
|
||
//
|
||
if ( PagedTransport->OtherMasterTime < BowserCurrentTime ) {
|
||
PagedTransport->OtherMasterTime = BowserCurrentTime + BowserData.EventLogResetFrequency;
|
||
|
||
BowserWriteErrorLogEntry(EVENT_BOWSER_OTHER_MASTER_ON_NET,
|
||
STATUS_SUCCESS,
|
||
NULL,
|
||
0,
|
||
2,
|
||
MasterName.Buffer,
|
||
&Transport->PagedTransport->TransportName.Buffer[(sizeof(L"\\Device\\") / sizeof(WCHAR))-1]);
|
||
}
|
||
|
||
if (!(PagedTransport->Flags & ELECT_LOST_LAST_ELECTION)) {
|
||
|
||
//
|
||
// If we're the PDC, and we didn't lose the last election (ie.
|
||
// we SHOULD be the browse master),then send a dummy election
|
||
// packet to get the other guy to shut up.
|
||
//
|
||
|
||
if (PagedTransport->IsPrimaryDomainController) {
|
||
|
||
sendElection = TRUE;
|
||
|
||
//
|
||
// If we're not an NTAS machine, or if we just lost the
|
||
// last election, or if the guy announcing is a DC of some
|
||
// kind, stop being the master and reset our state.
|
||
//
|
||
|
||
} else if (!BowserData.IsLanmanNt ||
|
||
(Context->ServerType & (SV_TYPE_DOMAIN_BAKCTRL | SV_TYPE_DOMAIN_CTRL))) {
|
||
|
||
//
|
||
// If we're not the PDC, then we want to simply inform
|
||
// the browser service that someone else is the master
|
||
// and let things sort themselves out when it's done.
|
||
//
|
||
|
||
BowserResetStateForTransport(Transport, RESET_STATE_STOP_MASTER);
|
||
}
|
||
|
||
} else {
|
||
|
||
//
|
||
// If we lost the last election, then we want to shut down
|
||
// the browser regardless of what state the other browser
|
||
// is in.
|
||
//
|
||
|
||
BowserResetStateForTransport(Transport, RESET_STATE_STOP_MASTER);
|
||
}
|
||
}
|
||
|
||
//
|
||
// If this guy is a WfW machine, we must force an election to move
|
||
// mastery off of the WfW machine.
|
||
//
|
||
|
||
if (Context->ServerType & SV_TYPE_WFW) {
|
||
sendElection = TRUE;
|
||
}
|
||
|
||
//
|
||
// If this guy is running an older version of the browser than we are,
|
||
// and we didn't lose last election,
|
||
// then force an election to try to become master.
|
||
//
|
||
// We check to see if we lost the last election to prevent us from
|
||
// constantly forcing an election when the older version is still
|
||
// a better browse master than we are.
|
||
//
|
||
|
||
if ((Context->ServerElectionVersion >> 16) == 0xaa55 &&
|
||
(Context->ServerElectionVersion & 0xffff) <
|
||
(BROWSER_VERSION_MAJOR << 8) + BROWSER_VERSION_MINOR &&
|
||
!(PagedTransport->Flags & ELECT_LOST_LAST_ELECTION)) {
|
||
|
||
sendElection = TRUE;
|
||
}
|
||
|
||
|
||
//
|
||
// if we're an NTAS server, and the guy announcing as a master
|
||
// isn't an NTAS server, and we won the last election, force an
|
||
// election. This will tend mastership towards DC's.
|
||
//
|
||
|
||
if (BowserData.IsLanmanNt &&
|
||
!(PagedTransport->Flags & ELECT_LOST_LAST_ELECTION)) {
|
||
|
||
if (PagedTransport->IsPrimaryDomainController) {
|
||
|
||
//
|
||
// If we're the PDC and we didn't send the announcement,
|
||
// force an election.
|
||
//
|
||
|
||
sendElection = TRUE;
|
||
|
||
} else if (!(Context->ServerType & (SV_TYPE_DOMAIN_BAKCTRL | SV_TYPE_DOMAIN_CTRL))) {
|
||
//
|
||
// Otherwise, if the guy who announced isn't a DC, and we
|
||
// are, force an election.
|
||
//
|
||
|
||
sendElection = TRUE;
|
||
}
|
||
}
|
||
|
||
if (sendElection) {
|
||
//
|
||
// Send a dummy election packet. This will cause the
|
||
// othe browser to stop being the master and will
|
||
// allow the correct machine to become the master.
|
||
//
|
||
|
||
BowserSendElection(&Transport->DomainInfo->DomUnicodeDomainName,
|
||
BrowserElection,
|
||
Transport,
|
||
FALSE);
|
||
|
||
}
|
||
|
||
//
|
||
// We know who the master is, complete any find master request
|
||
// outstanding now.
|
||
//
|
||
|
||
BowserCompleteFindMasterRequests(Transport, &MasterName, STATUS_SUCCESS);
|
||
|
||
} else {
|
||
|
||
if (PagedTransport->Role == Master) {
|
||
BowserCompleteFindMasterRequests(Transport, &MasterName, STATUS_MORE_PROCESSING_REQUIRED);
|
||
|
||
} else {
|
||
|
||
//
|
||
// If the transport is disabled,
|
||
// we know this transport isn't really the master,
|
||
// this datagram is probably just a datagram leaked from another
|
||
// enabled transport on the same wire.
|
||
//
|
||
if ( !PagedTransport->DisabledTransport ) {
|
||
BowserWriteErrorLogEntry(EVENT_BOWSER_NON_MASTER_MASTER_ANNOUNCE,
|
||
STATUS_SUCCESS,
|
||
NULL,
|
||
0,
|
||
1,
|
||
MasterName.Buffer);
|
||
//
|
||
// Make sure that the service realizes it is out of sync
|
||
// with the driver.
|
||
//
|
||
|
||
BowserResetStateForTransport(Transport, RESET_STATE_STOP_MASTER);
|
||
}
|
||
|
||
}
|
||
}
|
||
try_exit:NOTHING;
|
||
} finally {
|
||
|
||
UNLOCK_TRANSPORT(Transport);
|
||
BowserDereferenceTransport( Transport );
|
||
|
||
|
||
InterlockedDecrement( &BowserPostedDatagramCount );
|
||
FREE_POOL(Context);
|
||
|
||
}
|
||
}
|
||
|
||
|
||
|
||
NTSTATUS
|
||
BowserHandleMailslotTransaction (
|
||
IN PTRANSPORT_NAME TransportName,
|
||
IN PCHAR ClientName,
|
||
IN ULONG ClientIpAddress,
|
||
IN ULONG SmbOffset,
|
||
IN DWORD ReceiveFlags,
|
||
IN ULONG BytesIndicated,
|
||
IN ULONG BytesAvailable,
|
||
OUT ULONG *BytesTaken,
|
||
IN PVOID Tsdu,
|
||
OUT PIRP *Irp
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine will process receive datagram indication messages, and
|
||
process them as appropriate.
|
||
|
||
Arguments:
|
||
|
||
TransportName - The transport name for this request.
|
||
|
||
ClientIpAddress - IP Address of the client that sent the datagram.
|
||
0: Not an IP transport.
|
||
|
||
BytesAvailable - number of bytes in complete Tsdu
|
||
|
||
Irp - I/O request packet used to complete the request
|
||
|
||
SmbOffset - Offset from the beginning of the indicated data to the SMB
|
||
|
||
BytesIndicated - Number of bytes currently available in the TSDU
|
||
|
||
BytesTaken - Returns the number of bytes of TSDU already consumed
|
||
|
||
Tsdu - The datagram itself.
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
{
|
||
PMAILSLOT_BUFFER Buffer;
|
||
PDEVICE_OBJECT DeviceObject;
|
||
PFILE_OBJECT FileObject;
|
||
PTRANSPORT Transport = TransportName->Transport;
|
||
ULONG BytesToReceive = BytesAvailable - SmbOffset;
|
||
|
||
ASSERT (TransportName->Signature == STRUCTURE_SIGNATURE_TRANSPORTNAME);
|
||
|
||
ASSERT (BytesAvailable <= TransportName->Transport->DatagramSize);
|
||
|
||
//
|
||
// We must ignore all mailslot requests coming to any names domains
|
||
// other than the primary domain, the computer name, and the LanMan/NT
|
||
// domain name.
|
||
//
|
||
|
||
if ((TransportName->NameType != ComputerName) &&
|
||
(TransportName->NameType != AlternateComputerName) &&
|
||
(TransportName->NameType != DomainName) &&
|
||
(TransportName->NameType != PrimaryDomain) &&
|
||
(TransportName->NameType != PrimaryDomainBrowser) ) {
|
||
return STATUS_SUCCESS;
|
||
}
|
||
|
||
//
|
||
// Now allocate a buffer to hold the data.
|
||
//
|
||
|
||
Buffer = BowserAllocateMailslotBuffer( TransportName, BytesToReceive );
|
||
|
||
if (Buffer == NULL) {
|
||
|
||
//
|
||
// We couldn't allocate a buffer to hold the data - ditch the request.
|
||
//
|
||
|
||
return(STATUS_REQUEST_NOT_ACCEPTED);
|
||
}
|
||
|
||
ASSERT (Buffer->BufferSize >= BytesToReceive);
|
||
KeQuerySystemTime( &Buffer->TimeReceived );
|
||
Buffer->ClientIpAddress = ClientIpAddress;
|
||
|
||
//
|
||
// Save away the name of the client
|
||
// just in case the datagram turns out to be illegal.
|
||
//
|
||
|
||
TdiCopyLookaheadData(Buffer->ClientAddress, ClientName, max(NETBIOS_NAME_LEN, SMB_IPX_NAME_LENGTH), ReceiveFlags);
|
||
|
||
//
|
||
// If the entire datagram has been indicated (or already received as a short packet),
|
||
// just copy the data into the Mailslot buffer directly.
|
||
//
|
||
|
||
if ( BytesAvailable == BytesIndicated ) {
|
||
|
||
//
|
||
// Copy the data into the mailslot buffer
|
||
//
|
||
|
||
Buffer->ReceiveLength = BytesToReceive;
|
||
TdiCopyLookaheadData( Buffer->Buffer,
|
||
((LPBYTE)(Tsdu)) + SmbOffset,
|
||
BytesToReceive,
|
||
ReceiveFlags);
|
||
|
||
|
||
//
|
||
// Queue the request to the worker routine.
|
||
//
|
||
ExInitializeWorkItem(&Buffer->Overlay.WorkHeader,
|
||
BowserProcessMailslotWrite,
|
||
Buffer);
|
||
|
||
BowserQueueDelayedWorkItem( &Buffer->Overlay.WorkHeader );
|
||
|
||
return STATUS_SUCCESS;
|
||
}
|
||
|
||
//
|
||
// We rely on the fact that the device object is NULL for
|
||
// IPX transport names.
|
||
//
|
||
|
||
if (TransportName->DeviceObject == NULL) {
|
||
|
||
ASSERT (Transport->IpxSocketDeviceObject != NULL);
|
||
|
||
ASSERT (Transport->IpxSocketFileObject != NULL);
|
||
|
||
ASSERT (TransportName->FileObject == NULL);
|
||
|
||
DeviceObject = Transport->IpxSocketDeviceObject;
|
||
FileObject = Transport->IpxSocketFileObject;
|
||
} else {
|
||
ASSERT (Transport->IpxSocketDeviceObject == NULL);
|
||
|
||
ASSERT (Transport->IpxSocketFileObject == NULL);
|
||
|
||
DeviceObject = TransportName->DeviceObject;
|
||
FileObject = TransportName->FileObject;
|
||
}
|
||
|
||
//
|
||
// Now allocate an IRP to hold the incoming mailslot.
|
||
//
|
||
|
||
*Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);
|
||
|
||
if (*Irp == NULL) {
|
||
BowserFreeMailslotBufferHighIrql(Buffer);
|
||
|
||
BowserStatistics.NumberOfFailedMailslotReceives += 1;
|
||
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
(*Irp)->MdlAddress = IoAllocateMdl(Buffer->Buffer, BytesToReceive, FALSE, FALSE, NULL);
|
||
|
||
//
|
||
// If we were unable to allocate the MDL, ditch the datagram.
|
||
//
|
||
|
||
if ((*Irp)->MdlAddress == NULL) {
|
||
IoFreeIrp(*Irp);
|
||
|
||
BowserFreeMailslotBufferHighIrql(Buffer);
|
||
|
||
BowserStatistics.NumberOfFailedMailslotReceives += 1;
|
||
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
|
||
}
|
||
|
||
MmBuildMdlForNonPagedPool((*Irp)->MdlAddress);
|
||
|
||
//
|
||
// Build the receive datagram IRP.
|
||
//
|
||
|
||
TdiBuildReceiveDatagram((*Irp),
|
||
DeviceObject,
|
||
FileObject,
|
||
CompleteReceiveMailslot,
|
||
Buffer,
|
||
(*Irp)->MdlAddress,
|
||
BytesToReceive,
|
||
NULL,
|
||
NULL,
|
||
0);
|
||
|
||
|
||
|
||
//
|
||
// This gets kinda wierd.
|
||
//
|
||
// Since this IRP is going to be completed by the transport without
|
||
// ever going to IoCallDriver, we have to update the stack location
|
||
// to make the transports stack location the current stack location.
|
||
//
|
||
// Please note that this means that any transport provider that uses
|
||
// IoCallDriver to re-submit it's requests at indication time will
|
||
// break badly because of this code....
|
||
//
|
||
|
||
IoSetNextIrpStackLocation(*Irp);
|
||
|
||
//
|
||
// Indicate we've already handled everything before the SMB
|
||
//
|
||
|
||
*BytesTaken = SmbOffset;
|
||
|
||
//
|
||
// And return to the caller indicating we want to receive this stuff.
|
||
//
|
||
|
||
return STATUS_MORE_PROCESSING_REQUIRED;
|
||
}
|
||
|
||
|
||
NTSTATUS
|
||
CompleteReceiveMailslot (
|
||
IN PDEVICE_OBJECT TransportDevice,
|
||
IN PIRP Irp,
|
||
IN PVOID Context
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine handles completion of a mailslot write operation.
|
||
|
||
Arguments:
|
||
|
||
IN PDEVICE_OBJECT TransportDevice - Device object for transport.
|
||
IN PIRP Irp - I/O request packet to complete.
|
||
IN PVOID Context - Context for request (transport name).
|
||
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
{
|
||
PMAILSLOT_BUFFER Buffer = Context;
|
||
NTSTATUS Status = Irp->IoStatus.Status;
|
||
|
||
ASSERT (MmGetSystemAddressForMdl(Irp->MdlAddress) == Buffer->Buffer);
|
||
|
||
//
|
||
// Save away the number of bytes we received.
|
||
//
|
||
|
||
Buffer->ReceiveLength = (ULONG)Irp->IoStatus.Information;
|
||
|
||
//
|
||
// Release the MDL, we're done with it.
|
||
//
|
||
|
||
IoFreeMdl(Irp->MdlAddress);
|
||
|
||
//
|
||
// And free the IRP, we're done with it as well.
|
||
//
|
||
|
||
IoFreeIrp(Irp);
|
||
|
||
if (NT_SUCCESS(Status)) {
|
||
|
||
ExInitializeWorkItem(&Buffer->Overlay.WorkHeader,
|
||
BowserProcessMailslotWrite,
|
||
Buffer);
|
||
|
||
BowserQueueDelayedWorkItem( &Buffer->Overlay.WorkHeader );
|
||
|
||
} else {
|
||
|
||
BowserStatistics.NumberOfFailedMailslotReceives += 1;
|
||
BowserFreeMailslotBufferHighIrql(Buffer);
|
||
|
||
}
|
||
|
||
|
||
//
|
||
// Short circuit I/O completion for this request.
|
||
//
|
||
|
||
return STATUS_MORE_PROCESSING_REQUIRED;
|
||
|
||
UNREFERENCED_PARAMETER(TransportDevice);
|
||
|
||
}
|
||
|
||
typedef struct _SHORT_ANNOUNCEMENT_CONTEXT {
|
||
PVOID EventContext;
|
||
int SourceAddressLength;
|
||
PVOID SourceAddress;
|
||
int OptionsLength;
|
||
PVOID Options;
|
||
ULONG ReceiveDatagramFlags;
|
||
PVOID Buffer;
|
||
PTDI_IND_RECEIVE_DATAGRAM ReceiveDatagramHandler;
|
||
CHAR Data[1];
|
||
} SHORT_ANNOUNCEMENT_CONTEXT, *PSHORT_ANNOUNCEMENT_CONTEXT;
|
||
|
||
|
||
NTSTATUS
|
||
BowserHandleShortBrowserPacket(
|
||
IN PTRANSPORT_NAME TransportName,
|
||
IN PVOID EventContext,
|
||
IN int SourceAddressLength,
|
||
IN PVOID SourceAddress,
|
||
IN int OptionsLength,
|
||
IN PVOID Options,
|
||
IN ULONG ReceiveDatagramFlags,
|
||
IN ULONG BytesAvailable,
|
||
IN ULONG *BytesTaken,
|
||
IN PIRP *Irp,
|
||
PTDI_IND_RECEIVE_DATAGRAM Handler
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine will process receive datagram indication messages, and
|
||
process them as appropriate.
|
||
|
||
Arguments:
|
||
|
||
IN PTRANSPORT_NAME TransportName - The transport name for this request.
|
||
IN ULONG BytesAvailable - number of bytes in complete Tsdu
|
||
OUT PIRP *BytesTaken, - I/O request packet used to complete the request
|
||
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
{
|
||
PDEVICE_OBJECT DeviceObject;
|
||
PFILE_OBJECT FileObject;
|
||
PTRANSPORT Transport = TransportName->Transport;
|
||
PSHORT_ANNOUNCEMENT_CONTEXT Context;
|
||
|
||
|
||
ASSERT (TransportName->Signature == STRUCTURE_SIGNATURE_TRANSPORTNAME);
|
||
|
||
ASSERT (BytesAvailable <= TransportName->Transport->DatagramSize);
|
||
|
||
//
|
||
// Now allocate a buffer to hold the data.
|
||
//
|
||
|
||
Context = ALLOCATE_POOL(NonPagedPool, sizeof(SHORT_ANNOUNCEMENT_CONTEXT) + SourceAddressLength + OptionsLength + BytesAvailable, POOL_SHORT_CONTEXT);
|
||
|
||
if (Context == NULL) {
|
||
|
||
//
|
||
// We couldn't allocate a buffer to hold the data - ditch the request.
|
||
//
|
||
|
||
return(STATUS_REQUEST_NOT_ACCEPTED);
|
||
}
|
||
|
||
//
|
||
// Save away the name of the client and which transport this was received
|
||
// on just in case the datagram turns out to be illegal.
|
||
//
|
||
|
||
|
||
Context->SourceAddress = ((PCHAR)Context + FIELD_OFFSET(SHORT_ANNOUNCEMENT_CONTEXT, Data));
|
||
|
||
Context->Options = ((PCHAR)Context + FIELD_OFFSET(SHORT_ANNOUNCEMENT_CONTEXT, Data) + SourceAddressLength);
|
||
|
||
Context->Buffer = ((PCHAR)Context + FIELD_OFFSET(SHORT_ANNOUNCEMENT_CONTEXT, Data) + SourceAddressLength + OptionsLength);
|
||
|
||
TdiCopyLookaheadData(Context->SourceAddress, SourceAddress, SourceAddressLength, ReceiveDatagramFlags);
|
||
|
||
Context->SourceAddressLength = SourceAddressLength;
|
||
|
||
TdiCopyLookaheadData(Context->Options, Options, OptionsLength, ReceiveDatagramFlags);
|
||
|
||
Context->OptionsLength = OptionsLength;
|
||
|
||
Context->ReceiveDatagramFlags = ReceiveDatagramFlags;
|
||
|
||
Context->EventContext = EventContext;
|
||
|
||
Context->ReceiveDatagramHandler = Handler;
|
||
|
||
//
|
||
// We rely on the fact that the device object is NULL for
|
||
// IPX transport names.
|
||
//
|
||
|
||
if (TransportName->DeviceObject == NULL) {
|
||
|
||
ASSERT (Transport->IpxSocketDeviceObject != NULL);
|
||
|
||
ASSERT (Transport->IpxSocketFileObject != NULL);
|
||
|
||
ASSERT (TransportName->FileObject == NULL);
|
||
|
||
DeviceObject = Transport->IpxSocketDeviceObject;
|
||
|
||
FileObject = Transport->IpxSocketFileObject;
|
||
} else {
|
||
ASSERT (Transport->IpxSocketDeviceObject == NULL);
|
||
|
||
ASSERT (Transport->IpxSocketFileObject == NULL);
|
||
|
||
DeviceObject = TransportName->DeviceObject;
|
||
FileObject = TransportName->FileObject;
|
||
}
|
||
|
||
//
|
||
// Now allocate an IRP to hold the incoming mailslot.
|
||
//
|
||
|
||
*Irp = IoAllocateIrp(DeviceObject->StackSize, FALSE);
|
||
|
||
if (*Irp == NULL) {
|
||
FREE_POOL(Context);
|
||
|
||
BowserStatistics.NumberOfFailedMailslotReceives += 1;
|
||
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
(*Irp)->MdlAddress = IoAllocateMdl(Context->Buffer, BytesAvailable, FALSE, FALSE, NULL);
|
||
|
||
//
|
||
// If we were unable to allocate the MDL, ditch the datagram.
|
||
//
|
||
|
||
if ((*Irp)->MdlAddress == NULL) {
|
||
IoFreeIrp(*Irp);
|
||
|
||
FREE_POOL(Context);
|
||
|
||
BowserStatistics.NumberOfFailedMailslotReceives += 1;
|
||
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
|
||
}
|
||
|
||
MmBuildMdlForNonPagedPool((*Irp)->MdlAddress);
|
||
|
||
//
|
||
// Build the receive datagram IRP.
|
||
//
|
||
|
||
TdiBuildReceiveDatagram((*Irp),
|
||
DeviceObject,
|
||
FileObject,
|
||
CompleteShortBrowserPacket,
|
||
Context,
|
||
(*Irp)->MdlAddress,
|
||
BytesAvailable,
|
||
NULL,
|
||
NULL,
|
||
0);
|
||
|
||
|
||
|
||
//
|
||
// This gets kinda wierd.
|
||
//
|
||
// Since this IRP is going to be completed by the transport without
|
||
// ever going to IoCallDriver, we have to update the stack location
|
||
// to make the transports stack location the current stack location.
|
||
//
|
||
// Please note that this means that any transport provider that uses
|
||
// IoCallDriver to re-submit it's requests at indication time will
|
||
// break badly because of this code....
|
||
//
|
||
|
||
IoSetNextIrpStackLocation(*Irp);
|
||
|
||
*BytesTaken = 0;
|
||
|
||
//
|
||
// And return to the caller indicating we want to receive this stuff.
|
||
//
|
||
|
||
return STATUS_MORE_PROCESSING_REQUIRED;
|
||
|
||
}
|
||
|
||
NTSTATUS
|
||
CompleteShortBrowserPacket (
|
||
IN PDEVICE_OBJECT TransportDevice,
|
||
IN PIRP Irp,
|
||
IN PVOID Ctx
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine handles completion of a mailslot write operation.
|
||
|
||
Arguments:
|
||
|
||
IN PDEVICE_OBJECT TransportDevice - Device object for transport.
|
||
IN PIRP Irp - I/O request packet to complete.
|
||
IN PVOID Context - Context for request (transport name).
|
||
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
{
|
||
PSHORT_ANNOUNCEMENT_CONTEXT Context = Ctx;
|
||
NTSTATUS Status = Irp->IoStatus.Status;
|
||
ULONG ReceiveLength;
|
||
ULONG BytesTaken;
|
||
//
|
||
// Save away the number of bytes we received.
|
||
//
|
||
|
||
ReceiveLength = (ULONG)Irp->IoStatus.Information;
|
||
|
||
//
|
||
// Release the MDL, we're done with it.
|
||
//
|
||
|
||
IoFreeMdl(Irp->MdlAddress);
|
||
|
||
//
|
||
// And free the IRP, we're done with it as well.
|
||
//
|
||
|
||
IoFreeIrp(Irp);
|
||
|
||
if (NT_SUCCESS(Status)) {
|
||
|
||
Status = Context->ReceiveDatagramHandler(Context->EventContext,
|
||
Context->SourceAddressLength,
|
||
Context->SourceAddress,
|
||
Context->OptionsLength,
|
||
Context->Options,
|
||
Context->ReceiveDatagramFlags,
|
||
ReceiveLength,
|
||
ReceiveLength,
|
||
&BytesTaken,
|
||
Context->Buffer,
|
||
&Irp);
|
||
ASSERT (Status != STATUS_MORE_PROCESSING_REQUIRED);
|
||
|
||
}
|
||
|
||
FREE_POOL(Context);
|
||
|
||
//
|
||
// Short circuit I/O completion for this request.
|
||
//
|
||
|
||
return STATUS_MORE_PROCESSING_REQUIRED;
|
||
|
||
UNREFERENCED_PARAMETER(TransportDevice);
|
||
|
||
}
|
||
|
||
|
||
DATAGRAM_HANDLER(
|
||
HandleAnnounceRequest
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
This routine will process receive datagram indication messages for announce
|
||
requests.
|
||
|
||
|
||
Arguments:
|
||
|
||
None.
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
{
|
||
//
|
||
// If we're running an election, ignore announce requests.
|
||
//
|
||
|
||
if (TransportName->Transport->ElectionState != RunningElection) {
|
||
|
||
if ((TransportName->NameType == BrowserElection) ||
|
||
(TransportName->NameType == MasterBrowser) ||
|
||
(TransportName->NameType == PrimaryDomain)) {
|
||
|
||
//
|
||
// This one's easy - simply set the servers announcement event to the
|
||
// signalled state. If the server is running, this will force an
|
||
// announcement
|
||
//
|
||
|
||
KeSetEvent(BowserServerAnnouncementEvent, IO_NETWORK_INCREMENT, FALSE);
|
||
} else if (TransportName->NameType == DomainAnnouncement) {
|
||
//
|
||
// Old comment: NEED TO HANDLE REQUEST ANNOUNCEMENT OF DOMAIN REQUEST.
|
||
// PhaseOut: we did so wonderfully so far. we won't be handling anything else
|
||
// due to browser phase out.
|
||
// Announcement requests are handled by the srvsvc. It determines what to announce
|
||
// based on the server state.
|
||
//
|
||
}
|
||
|
||
}
|
||
|
||
return STATUS_SUCCESS;
|
||
}
|
||
|
||
NTSTATUS
|
||
BowserPostDatagramToWorkerThread(
|
||
IN PTRANSPORT_NAME TransportName,
|
||
IN PVOID Datagram,
|
||
IN ULONG Length,
|
||
OUT PULONG BytesTaken,
|
||
IN PVOID OriginatorsAddress,
|
||
IN ULONG OriginatorsAddressLength,
|
||
IN PVOID OriginatorsName,
|
||
IN ULONG OriginatorsNameLength,
|
||
IN PWORKER_THREAD_ROUTINE Handler,
|
||
IN POOL_TYPE PoolType,
|
||
IN WORK_QUEUE_TYPE QueueType,
|
||
IN ULONG ReceiveFlags,
|
||
IN BOOLEAN PostToRdrWorkerThread
|
||
)
|
||
/*++
|
||
|
||
Routine Description:
|
||
|
||
Queue a datagram to a worker thread.
|
||
|
||
This routine increment the reference count on the Transport and TransportName.
|
||
The Handler routine is expected to dereference them.
|
||
|
||
Arguments:
|
||
|
||
Many.
|
||
|
||
Return Value:
|
||
|
||
NTSTATUS - Status of operation.
|
||
|
||
--*/
|
||
{
|
||
PPOST_DATAGRAM_CONTEXT Context;
|
||
PTA_NETBIOS_ADDRESS NetbiosAddress = OriginatorsAddress;
|
||
|
||
ASSERT (NetbiosAddress->TAAddressCount == 1);
|
||
|
||
ASSERT ((NetbiosAddress->Address[0].AddressType == TDI_ADDRESS_TYPE_NETBIOS) ||
|
||
(NetbiosAddress->Address[0].AddressType == TDI_ADDRESS_TYPE_IPX));
|
||
|
||
Context = ALLOCATE_POOL(PoolType, sizeof(POST_DATAGRAM_CONTEXT) + Length + OriginatorsAddressLength, POOL_POSTDG_CONTEXT);
|
||
|
||
if (Context == NULL) {
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
Context->TransportName = TransportName;
|
||
|
||
Context->Buffer = ((PCHAR)(Context+1))+OriginatorsAddressLength;
|
||
|
||
Context->BytesAvailable = Length;
|
||
|
||
TdiCopyLookaheadData(Context->Buffer, Datagram, Length, ReceiveFlags);
|
||
|
||
Context->ClientAddressLength = OriginatorsAddressLength;
|
||
|
||
TdiCopyLookaheadData(Context->TdiClientAddress, OriginatorsAddress, OriginatorsAddressLength, ReceiveFlags);
|
||
|
||
//
|
||
// Copy over the client name into the buffer.
|
||
//
|
||
|
||
Context->ClientNameLength = NETBIOS_NAME_LEN;
|
||
|
||
BowserCopyOemComputerName(Context->ClientName,
|
||
OriginatorsName,
|
||
OriginatorsNameLength,
|
||
ReceiveFlags);
|
||
|
||
*BytesTaken = Length;
|
||
|
||
ExInitializeWorkItem(&Context->WorkItem, Handler, Context);
|
||
|
||
if ( QueueType == CriticalWorkQueue ) {
|
||
|
||
//
|
||
// Ensure we've not consumed too much memory
|
||
//
|
||
|
||
InterlockedIncrement( &BowserPostedCriticalDatagramCount );
|
||
|
||
if ( BowserPostedCriticalDatagramCount > BOWSER_MAX_POSTED_DATAGRAMS ) {
|
||
InterlockedDecrement( &BowserPostedCriticalDatagramCount );
|
||
FREE_POOL( Context );
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
//
|
||
// Reference the Transport and TransportName to ensure they aren't deleted. The
|
||
// Handler routine is expected to dereference them.
|
||
//
|
||
BowserReferenceTransportName(TransportName);
|
||
dprintf(DPRT_REF, ("Call Reference transport %lx from BowserPostDatagramToWorkerThread %lx.\n", TransportName->Transport, Handler ));
|
||
BowserReferenceTransport( TransportName->Transport );
|
||
|
||
//
|
||
// Queue the workitem.
|
||
//
|
||
BowserQueueCriticalWorkItem( &Context->WorkItem );
|
||
} else {
|
||
|
||
//
|
||
// Ensure we've not consumed too much memory
|
||
//
|
||
|
||
InterlockedIncrement( &BowserPostedDatagramCount );
|
||
|
||
if ( BowserPostedDatagramCount > BOWSER_MAX_POSTED_DATAGRAMS ) {
|
||
InterlockedDecrement( &BowserPostedDatagramCount );
|
||
FREE_POOL( Context );
|
||
return STATUS_REQUEST_NOT_ACCEPTED;
|
||
}
|
||
|
||
//
|
||
// Reference the Transport and TransportName to ensure they aren't deleted. The
|
||
// Handler routine is expected to dereference them.
|
||
//
|
||
BowserReferenceTransportName(TransportName);
|
||
dprintf(DPRT_REF, ("Call Reference transport %lx from BowserPostDatagramToWorkerThread %lx (2).\n", TransportName->Transport, Handler ));
|
||
BowserReferenceTransport( TransportName->Transport );
|
||
|
||
//
|
||
// Queue the workitem.
|
||
//
|
||
BowserQueueDelayedWorkItem( &Context->WorkItem );
|
||
}
|
||
|
||
return STATUS_SUCCESS;
|
||
}
|