trunk/rdesktop/rdpdr.c

#include <unistd.h>
#include <sys/types.h>
#include <sys/time.h>
#include <time.h>
#include "rdesktop.h"

#define IRP_MJ_CREATE           0x00
#define IRP_MJ_CLOSE            0x02
#define IRP_MJ_READ             0x03
#define IRP_MJ_WRITE            0x04
#define IRP_MJ_DEVICE_CONTROL   0x0e

#define IRP_MJ_CREATE                   0x00
#define IRP_MJ_CLOSE                    0x02
#define IRP_MJ_READ                     0x03
#define IRP_MJ_WRITE                    0x04
#define IRP_MJ_QUERY_INFORMATION        0x05
#define IRP_MJ_SET_INFORMATION          0x06
#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a
#define IRP_MJ_DIRECTORY_CONTROL        0x0c
#define IRP_MJ_DEVICE_CONTROL           0x0e

#define IRP_MN_QUERY_DIRECTORY          0x01
#define IRP_MN_NOTIFY_CHANGE_DIRECTORY  0x02

extern char hostname[16];
extern DEVICE_FNS serial_fns;
extern DEVICE_FNS printer_fns;
extern DEVICE_FNS parallel_fns;
extern DEVICE_FNS disk_fns;

static VCHANNEL *rdpdr_channel;

/* If select() times out, the request for the device with handle g_min_timeout_fd is aborted */
HANDLE g_min_timeout_fd;
uint32 g_num_devices;

/* Table with information about rdpdr devices */
RDPDR_DEVICE g_rdpdr_device[RDPDR_MAX_DEVICES];

/* Used to store incoming io request, until they are ready to be completed */
/* using a linked list ensures that they are processed in the right order, */
/* if multiple ios are being done on the same fd */
struct async_iorequest
{
        uint32 fd, major, minor, offset, device, id, length, partial_len;
        long timeout,           /* Total timeout */
          itv_timeout;          /* Interval timeout (between serial characters) */
        uint8 *buffer;
        DEVICE_FNS *fns;

        struct async_iorequest *next;   /* next element in list */
};

struct async_iorequest *g_iorequest;

/* Return device_id for a given handle */
int
get_device_index(HANDLE handle)
{
        int i;
        for (i = 0; i < RDPDR_MAX_DEVICES; i++)
        {
                if (g_rdpdr_device[i].handle == handle)
                        return i;
        }
        return -1;
}

/* Converts a windows path to a unix path */
void
convert_to_unix_filename(char *filename)
{
        char *p;

        while ((p = strchr(filename, '\\')))
        {
                *p = '/';
        }
}

/* Add a new io request to the table containing pending io requests so it won't block rdesktop */
BOOL
add_async_iorequest(uint32 device, uint32 file, uint32 id, uint32 major, uint32 length,
                    DEVICE_FNS * fns, uint32 total_timeout, uint32 interval_timeout, uint8 * buffer)
{
        struct async_iorequest *iorq;

        if (g_iorequest == NULL)
        {
                g_iorequest = (struct async_iorequest *) xmalloc(sizeof(struct async_iorequest));
                g_iorequest->fd = 0;
                g_iorequest->next = NULL;
        }

        iorq = g_iorequest;

        while (iorq->fd != 0)
        {
                // create new element if needed
                if (iorq->next == NULL)
                {
                        iorq->next =
                                (struct async_iorequest *) xmalloc(sizeof(struct async_iorequest));
                        iorq->next->fd = 0;
                        iorq->next->next = NULL;
                }
                iorq = iorq->next;
        }
        iorq->device = device;
        iorq->fd = file;
        iorq->id = id;
        iorq->major = major;
        iorq->length = length;
        iorq->partial_len = 0;
        iorq->fns = fns;
        iorq->timeout = total_timeout;
        iorq->itv_timeout = interval_timeout;
        iorq->buffer = buffer;
        return True;
}

void
rdpdr_send_connect(void)
{
        uint8 magic[4] = "rDCC";
        STREAM s;

        s = channel_init(rdpdr_channel, 12);
        out_uint8a(s, magic, 4);
        out_uint16_le(s, 1);    /* unknown */
        out_uint16_le(s, 5);
        out_uint32_be(s, 0x815ed39d);   /* IP address (use 127.0.0.1) 0x815ed39d */
        s_mark_end(s);
        channel_send(s, rdpdr_channel);
}


void
rdpdr_send_name(void)
{
        uint8 magic[4] = "rDNC";
        uint32 hostlen = (strlen(hostname) + 1) * 2;
        STREAM s;

        s = channel_init(rdpdr_channel, 16 + hostlen);
        out_uint8a(s, magic, 4);
        out_uint16_le(s, 0x63); /* unknown */
        out_uint16_le(s, 0x72);
        out_uint32(s, 0);
        out_uint32_le(s, hostlen);
        rdp_out_unistr(s, hostname, hostlen - 2);
        s_mark_end(s);
        channel_send(s, rdpdr_channel);
}

/* Returns the size of the payload of the announce packet */
int
announcedata_size()
{
        int size, i;
        PRINTER *printerinfo;

        size = 8;               //static announce size
        size += g_num_devices * 0x14;

        for (i = 0; i < g_num_devices; i++)
        {
                if (g_rdpdr_device[i].device_type == DEVICE_TYPE_PRINTER)
                {
                        printerinfo = (PRINTER *) g_rdpdr_device[i].pdevice_data;
                        printerinfo->bloblen =
                                printercache_load_blob(printerinfo->printer, &(printerinfo->blob));

                        size += 0x18;
                        size += 2 * strlen(printerinfo->driver) + 2;
                        size += 2 * strlen(printerinfo->printer) + 2;
                        size += printerinfo->bloblen;
                }
        }

        return size;
}

void
rdpdr_send_available(void)
{

        uint8 magic[4] = "rDAD";
        uint32 driverlen, printerlen, bloblen;
        int i;
        STREAM s;
        PRINTER *printerinfo;

        s = channel_init(rdpdr_channel, announcedata_size());
        out_uint8a(s, magic, 4);
        out_uint32_le(s, g_num_devices);

        for (i = 0; i < g_num_devices; i++)
        {
                out_uint32_le(s, g_rdpdr_device[i].device_type);
                out_uint32_le(s, i);    /* RDP Device ID */
                out_uint8p(s, g_rdpdr_device[i].name, 8);

                switch (g_rdpdr_device[i].device_type)
                {
                        case DEVICE_TYPE_PRINTER:
                                printerinfo = (PRINTER *) g_rdpdr_device[i].pdevice_data;

                                driverlen = 2 * strlen(printerinfo->driver) + 2;
                                printerlen = 2 * strlen(printerinfo->printer) + 2;
                                bloblen = printerinfo->bloblen;

                                out_uint32_le(s, 24 + driverlen + printerlen + bloblen);        /* length of extra info */
                                out_uint32_le(s, printerinfo->default_printer ? 2 : 0);
                                out_uint8s(s, 8);       /* unknown */
                                out_uint32_le(s, driverlen);
                                out_uint32_le(s, printerlen);
                                out_uint32_le(s, bloblen);
                                rdp_out_unistr(s, printerinfo->driver, driverlen - 2);
                                rdp_out_unistr(s, printerinfo->printer, printerlen - 2);
                                out_uint8a(s, printerinfo->blob, bloblen);

                                if (printerinfo->blob)
                                        xfree(printerinfo->blob);       /* Blob is sent twice if reconnecting */
                                break;
                        default:
                                out_uint32(s, 0);
                }
        }
#if 0
        out_uint32_le(s, 0x20); /* Device type 0x20 - smart card */
        out_uint32_le(s, 0);
        out_uint8p(s, "SCARD", 5);
        out_uint8s(s, 3);
        out_uint32(s, 0);
#endif

        s_mark_end(s);
        channel_send(s, rdpdr_channel);
}

void
rdpdr_send_completion(uint32 device, uint32 id, uint32 status, uint32 result, uint8 * buffer,
                      uint32 length)
{
        uint8 magic[4] = "rDCI";
        STREAM s;

        s = channel_init(rdpdr_channel, 20 + length);
        out_uint8a(s, magic, 4);
        out_uint32_le(s, device);
        out_uint32_le(s, id);
        out_uint32_le(s, status);
        out_uint32_le(s, result);
        out_uint8p(s, buffer, length);
        s_mark_end(s);
        /* JIF
           hexdump(s->channel_hdr + 8, s->end - s->channel_hdr - 8); */
        channel_send(s, rdpdr_channel);
}

static void
rdpdr_process_irp(STREAM s)
{
        uint32 result = 0,
                length = 0,
                desired_access = 0,
                request,
                file,
                info_level,
                buffer_len,
                id,
                major,
                minor,
                device,
                offset,
                bytes_in,
                bytes_out,
                error_mode,
                share_mode, disposition, total_timeout, interval_timeout, flags_and_attributes = 0;

        char filename[256];
        uint8 *buffer, *pst_buf;
        struct stream out;
        DEVICE_FNS *fns;
        BOOL rw_blocking = True;
        NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;

        in_uint32_le(s, device);
        in_uint32_le(s, file);
        in_uint32_le(s, id);
        in_uint32_le(s, major);
        in_uint32_le(s, minor);

        buffer_len = 0;
        buffer = (uint8 *) xmalloc(1024);
        buffer[0] = 0;

        switch (g_rdpdr_device[device].device_type)
        {
                case DEVICE_TYPE_SERIAL:

                        fns = &serial_fns;
                        rw_blocking = False;
                        break;

                case DEVICE_TYPE_PARALLEL:

                        fns = &parallel_fns;
                        rw_blocking = False;
                        break;

                case DEVICE_TYPE_PRINTER:

                        fns = &printer_fns;
                        break;

                case DEVICE_TYPE_DISK:

                        fns = &disk_fns;
                        rw_blocking = False;
                        break;

                case DEVICE_TYPE_SCARD:
                default:

                        error("IRP for bad device %ld\n", device);
                        return;
        }

        switch (major)
        {
                case IRP_MJ_CREATE:

                        in_uint32_be(s, desired_access);
                        in_uint8s(s, 0x08);     // unknown
                        in_uint32_le(s, error_mode);
                        in_uint32_le(s, share_mode);
                        in_uint32_le(s, disposition);
                        in_uint32_le(s, flags_and_attributes);
                        in_uint32_le(s, length);

                        if (length && (length / 2) < 256)
                        {
                                rdp_in_unistr(s, filename, length);
                                convert_to_unix_filename(filename);
                        }
                        else
                        {
                                filename[0] = 0;
                        }

                        if (!fns->create)
                        {
                                status = STATUS_NOT_SUPPORTED;
                                break;
                        }

                        status = fns->create(device, desired_access, share_mode, disposition,
                                             flags_and_attributes, filename, &result);
                        buffer_len = 1;
                        break;

                case IRP_MJ_CLOSE:
                        if (!fns->close)
                        {
                                status = STATUS_NOT_SUPPORTED;
                                break;
                        }

                        status = fns->close(file);
                        break;

                case IRP_MJ_READ:

                        if (!fns->read)
                        {
                                status = STATUS_NOT_SUPPORTED;
                                break;
                        }

                        in_uint32_le(s, length);
                        in_uint32_le(s, offset);
#if WITH_DEBUG_RDP5
                        DEBUG(("RDPDR IRP Read (length: %d, offset: %d)\n", length, offset));
#endif
                        if (rw_blocking)        // Complete read immediately
                        {
                                buffer = (uint8 *) xrealloc((void *) buffer, length);
                                status = fns->read(file, buffer, length, offset, &result);
                                buffer_len = result;
                                break;
                        }

                        // Add request to table
                        pst_buf = (uint8 *) xmalloc(length);
                        serial_get_timeout(file, length, &total_timeout, &interval_timeout);
                        if (add_async_iorequest
                            (device, file, id, major, length, fns, total_timeout, interval_timeout,
                             pst_buf))
                        {
                                status = STATUS_PENDING;
                                break;
                        }

                        status = STATUS_CANCELLED;
                        break;
                case IRP_MJ_WRITE:

                        buffer_len = 1;

                        if (!fns->write)
                        {
                                status = STATUS_NOT_SUPPORTED;
                                break;
                        }

                        in_uint32_le(s, length);
                        in_uint32_le(s, offset);
                        in_uint8s(s, 0x18);
#if WITH_DEBUG_RDP5
                        DEBUG(("RDPDR IRP Write (length: %d)\n", result));
#endif
                        if (rw_blocking)        // Complete immediately
                        {
                                status = fns->write(file, s->p, length, offset, &result);
                                break;
                        }

                        // Add to table
                        pst_buf = (uint8 *) xmalloc(length);
                        in_uint8a(s, pst_buf, length);

                        if (add_async_iorequest
                            (device, file, id, major, length, fns, 0, 0, pst_buf))
                        {
                                status = STATUS_PENDING;
                                break;
                        }

                        status = STATUS_CANCELLED;
                        break;

                case IRP_MJ_QUERY_INFORMATION:

                        if (g_rdpdr_device[device].device_type != DEVICE_TYPE_DISK)
                        {
                                status = STATUS_INVALID_HANDLE;
                                break;
                        }
                        in_uint32_le(s, info_level);

                        out.data = out.p = buffer;
                        out.size = sizeof(buffer);
                        status = disk_query_information(file, info_level, &out);
                        result = buffer_len = out.p - out.data;

                        break;

                case IRP_MJ_SET_INFORMATION:

                        if (g_rdpdr_device[device].device_type != DEVICE_TYPE_DISK)
                        {
                                status = STATUS_INVALID_HANDLE;
                                break;
                        }

                        in_uint32_le(s, info_level);

                        out.data = out.p = buffer;
                        out.size = sizeof(buffer);
                        status = disk_set_information(file, info_level, s, &out);
                        result = buffer_len = out.p - out.data;
                        break;

                case IRP_MJ_QUERY_VOLUME_INFORMATION:

                        if (g_rdpdr_device[device].device_type != DEVICE_TYPE_DISK)
                        {
                                status = STATUS_INVALID_HANDLE;
                                break;
                        }

                        in_uint32_le(s, info_level);

                        out.data = out.p = buffer;
                        out.size = sizeof(buffer);
                        status = disk_query_volume_information(file, info_level, &out);
                        result = buffer_len = out.p - out.data;
                        break;

                case IRP_MJ_DIRECTORY_CONTROL:

                        if (g_rdpdr_device[device].device_type != DEVICE_TYPE_DISK)
                        {
                                status = STATUS_INVALID_HANDLE;
                                break;
                        }

                        switch (minor)
                        {
                                case IRP_MN_QUERY_DIRECTORY:

                                        in_uint32_le(s, info_level);
                                        in_uint8s(s, 1);
                                        in_uint32_le(s, length);
                                        in_uint8s(s, 0x17);
                                        if (length && length < 2 * 255)
                                        {
                                                rdp_in_unistr(s, filename, length);
                                                convert_to_unix_filename(filename);
                                        }
                                        else
                                        {
                                                filename[0] = 0;
                                        }
                                        out.data = out.p = buffer;
                                        out.size = sizeof(buffer);
                                        status = disk_query_directory(file, info_level, filename,
                                                                      &out);
                                        result = buffer_len = out.p - out.data;
                                        if (!buffer_len)
                                                buffer_len++;
                                        break;

                                case IRP_MN_NOTIFY_CHANGE_DIRECTORY:

                                        /* JIF
                                           unimpl("IRP major=0x%x minor=0x%x: IRP_MN_NOTIFY_CHANGE_DIRECTORY\n", major, minor); */
                                        status = STATUS_PENDING;        // Don't send completion packet
                                        break;

                                default:

                                        status = STATUS_INVALID_PARAMETER;
                                        /* JIF
                                           unimpl("IRP major=0x%x minor=0x%x\n", major, minor); */
                        }
                        break;

                case IRP_MJ_DEVICE_CONTROL:

                        if (!fns->device_control)
                        {
                                status = STATUS_NOT_SUPPORTED;
                                break;
                        }

                        in_uint32_le(s, bytes_out);
                        in_uint32_le(s, bytes_in);
                        in_uint32_le(s, request);
                        in_uint8s(s, 0x14);

                        buffer = (uint8 *) xrealloc((void *) buffer, bytes_out + 0x14);
                        out.data = out.p = buffer;
                        out.size = sizeof(buffer);
                        status = fns->device_control(file, request, s, &out);
                        result = buffer_len = out.p - out.data;
                        break;

                default:
                        unimpl("IRP major=0x%x minor=0x%x\n", major, minor);
                        break;
        }

        if (status != STATUS_PENDING)
        {
                rdpdr_send_completion(device, id, status, result, buffer, buffer_len);
        }
        xfree(buffer);

}

void
rdpdr_send_clientcapabilty(void)
{
        uint8 magic[4] = "rDPC";
        STREAM s;

        s = channel_init(rdpdr_channel, 0x50);
        out_uint8a(s, magic, 4);
        out_uint32_le(s, 5);    /* count */
        out_uint16_le(s, 1);    /* first */
        out_uint16_le(s, 0x28); /* length */
        out_uint32_le(s, 1);
        out_uint32_le(s, 2);
        out_uint16_le(s, 2);
        out_uint16_le(s, 5);
        out_uint16_le(s, 1);
        out_uint16_le(s, 5);
        out_uint16_le(s, 0xFFFF);
        out_uint16_le(s, 0);
        out_uint32_le(s, 0);
        out_uint32_le(s, 3);
        out_uint32_le(s, 0);
        out_uint32_le(s, 0);
        out_uint16_le(s, 2);    /* second */
        out_uint16_le(s, 8);    /* length */
        out_uint32_le(s, 1);
        out_uint16_le(s, 3);    /* third */
        out_uint16_le(s, 8);    /* length */
        out_uint32_le(s, 1);
        out_uint16_le(s, 4);    /* fourth */
        out_uint16_le(s, 8);    /* length */
        out_uint32_le(s, 1);
        out_uint16_le(s, 5);    /* fifth */
        out_uint16_le(s, 8);    /* length */
        out_uint32_le(s, 1);

        s_mark_end(s);
        channel_send(s, rdpdr_channel);
}

static void
rdpdr_process(STREAM s)
{
        uint32 handle;
        uint8 *magic;

#if WITH_DEBUG_RDP5
        printf("--- rdpdr_process ---\n");
        hexdump(s->p, s->end - s->p);
#endif
        in_uint8p(s, magic, 4);

        if ((magic[0] == 'r') && (magic[1] == 'D'))
        {
                if ((magic[2] == 'R') && (magic[3] == 'I'))
                {
                        rdpdr_process_irp(s);
                        return;
                }
                if ((magic[2] == 'n') && (magic[3] == 'I'))
                {
                        rdpdr_send_connect();
                        rdpdr_send_name();
                        return;
                }
                if ((magic[2] == 'C') && (magic[3] == 'C'))
                {
                        /* connect from server */
                        rdpdr_send_clientcapabilty();
                        rdpdr_send_available();
                        return;
                }
                if ((magic[2] == 'r') && (magic[3] == 'd'))
                {
                        /* connect to a specific resource */
                        in_uint32(s, handle);
#if WITH_DEBUG_RDP5
                        DEBUG(("RDPDR: Server connected to resource %d\n", handle));
#endif
                        return;
                }
                if ((magic[2] == 'P') && (magic[3] == 'S'))
                {
                        /* server capability */
                        return;
                }
        }
        if ((magic[0] == 'R') && (magic[1] == 'P'))
        {
                if ((magic[2] == 'C') && (magic[3] == 'P'))
                {
                        printercache_process(s);
                        return;
                }
        }
        unimpl("RDPDR packet type %c%c%c%c\n", magic[0], magic[1], magic[2], magic[3]);
}

BOOL
rdpdr_init()
{
        if (g_num_devices > 0)
        {
                rdpdr_channel =
                        channel_register("rdpdr",
                                         CHANNEL_OPTION_INITIALIZED | CHANNEL_OPTION_COMPRESS_RDP,
                                         rdpdr_process);
        }

        return (rdpdr_channel != NULL);
}

/* Add file descriptors of pending io request to select() */
void
rdpdr_add_fds(int *n, fd_set * rfds, fd_set * wfds, struct timeval *tv, BOOL * timeout)
{
        uint32 select_timeout = 0;      // Timeout value to be used for select() (in millisecons).
        struct async_iorequest *iorq;

        iorq = g_iorequest;
        while (iorq != NULL)
        {
                if (iorq->fd != 0)
                {
                        switch (iorq->major)
                        {
                                case IRP_MJ_READ:

                                        FD_SET(iorq->fd, rfds);

                                        // Check if io request timeout is smaller than current (but not 0).
                                        if (iorq->timeout
                                            && (select_timeout == 0
                                                || iorq->timeout < select_timeout))
                                        {
                                                // Set new timeout
                                                select_timeout = iorq->timeout;
                                                g_min_timeout_fd = iorq->fd;    /* Remember fd */
                                                tv->tv_sec = select_timeout / 1000;
                                                tv->tv_usec = (select_timeout % 1000) * 1000;
                                                *timeout = True;
                                        }
                                        break;

                                case IRP_MJ_WRITE:
                                        FD_SET(iorq->fd, wfds);
                                        break;

                        }
                        *n = MAX(*n, iorq->fd);
                }

                iorq = iorq->next;
        }
}


/* Check if select() returned with one of the rdpdr file descriptors, and complete io if it did */
void
rdpdr_check_fds(fd_set * rfds, fd_set * wfds, BOOL timed_out)
{
        NTSTATUS status;
        uint32 result = 0;
        DEVICE_FNS *fns;
        struct async_iorequest *iorq;
        struct async_iorequest *prev;
        uint32 req_size = 0;

        if (timed_out)
        {
                rdpdr_abort_io(g_min_timeout_fd, 0, STATUS_TIMEOUT);
                return;
        }

        iorq = g_iorequest;
        prev = NULL;
        while (iorq != NULL)
        {
                if (iorq->fd != 0)
                {
                        switch (iorq->major)
                        {
                                case IRP_MJ_READ:
                                        if (FD_ISSET(iorq->fd, rfds))
                                        {
                                                /* Read the data */
                                                fns = iorq->fns;

                                                req_size =
                                                        (iorq->length - iorq->partial_len) >
                                                        8192 ? 8192 : (iorq->length -
                                                                       iorq->partial_len);
                                                /* never read larger chunks than 8k - chances are that it will block */
                                                status = fns->read(iorq->fd,
                                                                   iorq->buffer + iorq->partial_len,
                                                                   req_size, 0, &result);
                                                iorq->partial_len += result;

#if WITH_DEBUG_RDP5
                                                DEBUG(("RDPDR: %d bytes of data read\n", result));
#endif
                                                /* only delete link if all data has been transfered */
                                                /* or if result was 0 and status success - EOF      */
                                                if ((iorq->partial_len == iorq->length) ||
                                                    (result == 0))
                                                {
#if WITH_DEBUG_RDP5
                                                        DEBUG(("RDPDR: AIO total %u bytes read of %u\n", iorq->partial_len, iorq->length));
#endif
                                                        /* send the data */
                                                        status = STATUS_SUCCESS;
                                                        rdpdr_send_completion(iorq->device,
                                                                              iorq->id, status,
                                                                              iorq->partial_len,
                                                                              iorq->buffer,
                                                                              iorq->partial_len);
                                                        xfree(iorq->buffer);
                                                        iorq->fd = 0;
                                                        if (prev != NULL)
                                                        {
                                                                prev->next = iorq->next;
                                                                xfree(iorq);
                                                        }
                                                        else
                                                        {
                                                                // Even if NULL
                                                                g_iorequest = iorq->next;
                                                                xfree(iorq);
                                                        }
                                                }
                                        }
                                        break;
                                case IRP_MJ_WRITE:
                                        if (FD_ISSET(iorq->fd, wfds))
                                        {
                                                /* Write data. */
                                                fns = iorq->fns;

                                                req_size =
                                                        (iorq->length - iorq->partial_len) >
                                                        8192 ? 8192 : (iorq->length -
                                                                       iorq->partial_len);

                                                /* never write larger chunks than 8k - chances are that it will block */
                                                status = fns->write(iorq->fd,
                                                                    iorq->buffer +
                                                                    iorq->partial_len, req_size, 0,
                                                                    &result);
                                                iorq->partial_len += result;
#if WITH_DEBUG_RDP5
                                                DEBUG(("RDPDR: %d bytes of data written\n",
                                                       result));
#endif
                                                /* only delete link if all data has been transfered */
                                                /* or we couldn't write */
                                                if ((iorq->partial_len == iorq->length)
                                                    || (result == 0))
                                                {
#if WITH_DEBUG_RDP5
                                                        DEBUG(("RDPDR: AIO total %u bytes written of %u\n", iorq->partial_len, iorq->length));
#endif
                                                        /* send a status success */
                                                        status = STATUS_SUCCESS;
                                                        rdpdr_send_completion(iorq->device,
                                                                              iorq->id, status,
                                                                              iorq->partial_len,
                                                                              (uint8 *) "", 1);

                                                        xfree(iorq->buffer);
                                                        iorq->fd = 0;
                                                        if (prev != NULL)
                                                        {
                                                                prev->next = iorq->next;
                                                                xfree(iorq);
                                                        }
                                                        else
                                                        {
                                                                // Even if NULL
                                                                g_iorequest = iorq->next;
                                                                xfree(iorq);
                                                        }
                                                }
                                        }
                                        break;
                        }

                }
                prev = iorq;
                iorq = iorq->next;
        }

}

/* Abort a pending io request for a given handle and major */
BOOL
rdpdr_abort_io(uint32 fd, uint32 major, NTSTATUS status)
{
        uint32 result;
        struct async_iorequest *iorq;
        struct async_iorequest *prev;

        iorq = g_iorequest;
        prev = NULL;
        while (iorq != NULL)
        {
                // Only remove from table when major is not set, or when correct major is supplied.
                // Abort read should not abort a write io request.
                if ((iorq->fd == fd) && (major == 0 || iorq->major == major))
                {
                        result = 0;
                        rdpdr_send_completion(iorq->device, iorq->id, status, result, (uint8 *) "",
                                              1);
                        xfree(iorq->buffer);
                        iorq->fd = 0;
                        if (prev != NULL)
                        {
                                prev->next = iorq->next;
                                xfree(iorq);
                        }
                        else
                        {
                                // Even if NULL
                                g_iorequest = iorq->next;
                                xfree(iorq);
                        }
                        return True;
                }

                prev = iorq;
                iorq = iorq->next;
        }

        return False;
}
1	#include <unistd.h>
2	#include <sys/types.h>
3	#include <sys/time.h>
4	#include <time.h>
5	#include "rdesktop.h"
6
7	#define IRP_MJ_CREATE 0x00
8	#define IRP_MJ_CLOSE 0x02
9	#define IRP_MJ_READ 0x03
10	#define IRP_MJ_WRITE 0x04
11	#define IRP_MJ_DEVICE_CONTROL 0x0e
12
13	#define IRP_MJ_CREATE 0x00
14	#define IRP_MJ_CLOSE 0x02
15	#define IRP_MJ_READ 0x03
16	#define IRP_MJ_WRITE 0x04
17	#define IRP_MJ_QUERY_INFORMATION 0x05
18	#define IRP_MJ_SET_INFORMATION 0x06
19	#define IRP_MJ_QUERY_VOLUME_INFORMATION 0x0a
20	#define IRP_MJ_DIRECTORY_CONTROL 0x0c
21	#define IRP_MJ_DEVICE_CONTROL 0x0e
22
23	#define IRP_MN_QUERY_DIRECTORY 0x01
24	#define IRP_MN_NOTIFY_CHANGE_DIRECTORY 0x02
25
26	extern char hostname[16];
27	extern DEVICE_FNS serial_fns;
28	extern DEVICE_FNS printer_fns;
29	extern DEVICE_FNS parallel_fns;
30	extern DEVICE_FNS disk_fns;
31
32	static VCHANNEL *rdpdr_channel;
33
34	/* If select() times out, the request for the device with handle g_min_timeout_fd is aborted */
35	HANDLE g_min_timeout_fd;
36	uint32 g_num_devices;
37
38	/* Table with information about rdpdr devices */
39	RDPDR_DEVICE g_rdpdr_device[RDPDR_MAX_DEVICES];
40
41	/* Used to store incoming io request, until they are ready to be completed */
42	/* using a linked list ensures that they are processed in the right order, */
43	/* if multiple ios are being done on the same fd */
44	struct async_iorequest
45	{
46	uint32 fd, major, minor, offset, device, id, length, partial_len;
47	long timeout, /* Total timeout */
48	itv_timeout; /* Interval timeout (between serial characters) */
49	uint8 *buffer;
50	DEVICE_FNS *fns;
51
52	struct async_iorequest next; / next element in list */
53	};
54
55	struct async_iorequest *g_iorequest;
56
57	/* Return device_id for a given handle */
58	int
59	get_device_index(HANDLE handle)
60	{
61	int i;
62	for (i = 0; i < RDPDR_MAX_DEVICES; i++)
63	{
64	if (g_rdpdr_device[i].handle == handle)
65	return i;
66	}
67	return -1;
68	}
69
70	/* Converts a windows path to a unix path */
71	void
72	convert_to_unix_filename(char *filename)
73	{
74	char *p;
75
76	while ((p = strchr(filename, '\\')))
77	{
78	*p = '/';
79	}
80	}
81
82	/* Add a new io request to the table containing pending io requests so it won't block rdesktop */
83	BOOL
84	add_async_iorequest(uint32 device, uint32 file, uint32 id, uint32 major, uint32 length,
85	DEVICE_FNS * fns, uint32 total_timeout, uint32 interval_timeout, uint8 * buffer)
86	{
87	struct async_iorequest *iorq;
88
89	if (g_iorequest == NULL)
90	{
91	g_iorequest = (struct async_iorequest *) xmalloc(sizeof(struct async_iorequest));
92	g_iorequest->fd = 0;
93	g_iorequest->next = NULL;
94	}
95
96	iorq = g_iorequest;
97
98	while (iorq->fd != 0)
99	{
100	// create new element if needed
101	if (iorq->next == NULL)
102	{
103	iorq->next =
104	(struct async_iorequest *) xmalloc(sizeof(struct async_iorequest));
105	iorq->next->fd = 0;
106	iorq->next->next = NULL;
107	}
108	iorq = iorq->next;
109	}
110	iorq->device = device;
111	iorq->fd = file;
112	iorq->id = id;
113	iorq->major = major;
114	iorq->length = length;
115	iorq->partial_len = 0;
116	iorq->fns = fns;
117	iorq->timeout = total_timeout;
118	iorq->itv_timeout = interval_timeout;
119	iorq->buffer = buffer;
120	return True;
121	}
122
123	void
124	rdpdr_send_connect(void)
125	{
126	uint8 magic[4] = "rDCC";
127	STREAM s;
128
129	s = channel_init(rdpdr_channel, 12);
130	out_uint8a(s, magic, 4);
131	out_uint16_le(s, 1); /* unknown */
132	out_uint16_le(s, 5);
133	out_uint32_be(s, 0x815ed39d); /* IP address (use 127.0.0.1) 0x815ed39d */
134	s_mark_end(s);
135	channel_send(s, rdpdr_channel);
136	}
137
138
139	void
140	rdpdr_send_name(void)
141	{
142	uint8 magic[4] = "rDNC";
143	uint32 hostlen = (strlen(hostname) + 1) * 2;
144	STREAM s;
145
146	s = channel_init(rdpdr_channel, 16 + hostlen);
147	out_uint8a(s, magic, 4);
148	out_uint16_le(s, 0x63); /* unknown */
149	out_uint16_le(s, 0x72);
150	out_uint32(s, 0);
151	out_uint32_le(s, hostlen);
152	rdp_out_unistr(s, hostname, hostlen - 2);
153	s_mark_end(s);
154	channel_send(s, rdpdr_channel);
155	}
156
157	/* Returns the size of the payload of the announce packet */
158	int
159	announcedata_size()
160	{
161	int size, i;
162	PRINTER *printerinfo;
163
164	size = 8; //static announce size
165	size += g_num_devices * 0x14;
166
167	for (i = 0; i < g_num_devices; i++)
168	{
169	if (g_rdpdr_device[i].device_type == DEVICE_TYPE_PRINTER)
170	{
171	printerinfo = (PRINTER *) g_rdpdr_device[i].pdevice_data;
172	printerinfo->bloblen =
173	printercache_load_blob(printerinfo->printer, &(printerinfo->blob));
174
175	size += 0x18;
176	size += 2 * strlen(printerinfo->driver) + 2;
177	size += 2 * strlen(printerinfo->printer) + 2;
178	size += printerinfo->bloblen;
179	}
180	}
181
182	return size;
183	}
184
185	void
186	rdpdr_send_available(void)
187	{
188
189	uint8 magic[4] = "rDAD";
190	uint32 driverlen, printerlen, bloblen;
191	int i;
192	STREAM s;
193	PRINTER *printerinfo;
194
195	s = channel_init(rdpdr_channel, announcedata_size());
196	out_uint8a(s, magic, 4);
197	out_uint32_le(s, g_num_devices);
198
199	for (i = 0; i < g_num_devices; i++)
200	{
201	out_uint32_le(s, g_rdpdr_device[i].device_type);
202	out_uint32_le(s, i); /* RDP Device ID */
203	out_uint8p(s, g_rdpdr_device[i].name, 8);
204
205	switch (g_rdpdr_device[i].device_type)
206	{
207	case DEVICE_TYPE_PRINTER:
208	printerinfo = (PRINTER *) g_rdpdr_device[i].pdevice_data;
209
210	driverlen = 2 * strlen(printerinfo->driver) + 2;
211	printerlen = 2 * strlen(printerinfo->printer) + 2;
212	bloblen = printerinfo->bloblen;
213
214	out_uint32_le(s, 24 + driverlen + printerlen + bloblen); /* length of extra info */
215	out_uint32_le(s, printerinfo->default_printer ? 2 : 0);
216	out_uint8s(s, 8); /* unknown */
217	out_uint32_le(s, driverlen);
218	out_uint32_le(s, printerlen);
219	out_uint32_le(s, bloblen);
220	rdp_out_unistr(s, printerinfo->driver, driverlen - 2);
221	rdp_out_unistr(s, printerinfo->printer, printerlen - 2);
222	out_uint8a(s, printerinfo->blob, bloblen);
223
224	if (printerinfo->blob)
225	xfree(printerinfo->blob); /* Blob is sent twice if reconnecting */
226	break;
227	default:
228	out_uint32(s, 0);
229	}
230	}
231	#if 0
232	out_uint32_le(s, 0x20); /* Device type 0x20 - smart card */
233	out_uint32_le(s, 0);
234	out_uint8p(s, "SCARD", 5);
235	out_uint8s(s, 3);
236	out_uint32(s, 0);
237	#endif
238
239	s_mark_end(s);
240	channel_send(s, rdpdr_channel);
241	}
242
243	void
244	rdpdr_send_completion(uint32 device, uint32 id, uint32 status, uint32 result, uint8 * buffer,
245	uint32 length)
246	{
247	uint8 magic[4] = "rDCI";
248	STREAM s;
249
250	s = channel_init(rdpdr_channel, 20 + length);
251	out_uint8a(s, magic, 4);
252	out_uint32_le(s, device);
253	out_uint32_le(s, id);
254	out_uint32_le(s, status);
255	out_uint32_le(s, result);
256	out_uint8p(s, buffer, length);
257	s_mark_end(s);
258	/* JIF
259	hexdump(s->channel_hdr + 8, s->end - s->channel_hdr - 8); */
260	channel_send(s, rdpdr_channel);
261	}
262
263	static void
264	rdpdr_process_irp(STREAM s)
265	{
266	uint32 result = 0,
267	length = 0,
268	desired_access = 0,
269	request,
270	file,
271	info_level,
272	buffer_len,
273	id,
274	major,
275	minor,
276	device,
277	offset,
278	bytes_in,
279	bytes_out,
280	error_mode,
281	share_mode, disposition, total_timeout, interval_timeout, flags_and_attributes = 0;
282
283	char filename[256];
284	uint8 buffer, pst_buf;
285	struct stream out;
286	DEVICE_FNS *fns;
287	BOOL rw_blocking = True;
288	NTSTATUS status = STATUS_INVALID_DEVICE_REQUEST;
289
290	in_uint32_le(s, device);
291	in_uint32_le(s, file);
292	in_uint32_le(s, id);
293	in_uint32_le(s, major);
294	in_uint32_le(s, minor);
295
296	buffer_len = 0;
297	buffer = (uint8 *) xmalloc(1024);
298	buffer[0] = 0;
299
300	switch (g_rdpdr_device[device].device_type)
301	{
302	case DEVICE_TYPE_SERIAL:
303
304	fns = &serial_fns;
305	rw_blocking = False;
306	break;
307
308	case DEVICE_TYPE_PARALLEL:
309
310	fns = &parallel_fns;
311	rw_blocking = False;
312	break;
313
314	case DEVICE_TYPE_PRINTER:
315
316	fns = &printer_fns;
317	break;
318
319	case DEVICE_TYPE_DISK:
320
321	fns = &disk_fns;
322	rw_blocking = False;
323	break;
324
325	case DEVICE_TYPE_SCARD:
326	default:
327
328	error("IRP for bad device %ld\n", device);
329	return;
330	}
331
332	switch (major)
333	{
334	case IRP_MJ_CREATE:
335
336	in_uint32_be(s, desired_access);
337	in_uint8s(s, 0x08); // unknown
338	in_uint32_le(s, error_mode);
339	in_uint32_le(s, share_mode);
340	in_uint32_le(s, disposition);
341	in_uint32_le(s, flags_and_attributes);
342	in_uint32_le(s, length);
343
344	if (length && (length / 2) < 256)
345	{
346	rdp_in_unistr(s, filename, length);
347	convert_to_unix_filename(filename);
348	}
349	else
350	{
351	filename[0] = 0;
352	}
353
354	if (!fns->create)
355	{
356	status = STATUS_NOT_SUPPORTED;
357	break;
358	}
359
360	status = fns->create(device, desired_access, share_mode, disposition,
361	flags_and_attributes, filename, &result);
362	buffer_len = 1;
363	break;
364
365	case IRP_MJ_CLOSE:
366	if (!fns->close)
367	{
368	status = STATUS_NOT_SUPPORTED;
369	break;
370	}
371
372	status = fns->close(file);
373	break;
374
375	case IRP_MJ_READ:
376
377	if (!fns->read)
378	{
379	status = STATUS_NOT_SUPPORTED;
380	break;
381	}
382
383	in_uint32_le(s, length);
384	in_uint32_le(s, offset);
385	#if WITH_DEBUG_RDP5
386	DEBUG(("RDPDR IRP Read (length: %d, offset: %d)\n", length, offset));
387	#endif
388	if (rw_blocking) // Complete read immediately
389	{
390	buffer = (uint8 ) xrealloc((void ) buffer, length);
391	status = fns->read(file, buffer, length, offset, &result);
392	buffer_len = result;
393	break;
394	}
395
396	// Add request to table
397	pst_buf = (uint8 *) xmalloc(length);
398	serial_get_timeout(file, length, &total_timeout, &interval_timeout);
399	if (add_async_iorequest
400	(device, file, id, major, length, fns, total_timeout, interval_timeout,
401	pst_buf))
402	{
403	status = STATUS_PENDING;
404	break;
405	}
406
407	status = STATUS_CANCELLED;
408	break;
409	case IRP_MJ_WRITE:
410
411	buffer_len = 1;
412
413	if (!fns->write)
414	{
415	status = STATUS_NOT_SUPPORTED;
416	break;
417	}
418
419	in_uint32_le(s, length);
420	in_uint32_le(s, offset);
421	in_uint8s(s, 0x18);
422	#if WITH_DEBUG_RDP5
423	DEBUG(("RDPDR IRP Write (length: %d)\n", result));
424	#endif
425	if (rw_blocking) // Complete immediately
426	{
427	status = fns->write(file, s->p, length, offset, &result);
428	break;
429	}
430
431	// Add to table
432	pst_buf = (uint8 *) xmalloc(length);
433	in_uint8a(s, pst_buf, length);
434
435	if (add_async_iorequest
436	(device, file, id, major, length, fns, 0, 0, pst_buf))
437	{
438	status = STATUS_PENDING;
439	break;
440	}
441
442	status = STATUS_CANCELLED;
443	break;
444
445	case IRP_MJ_QUERY_INFORMATION:
446
447	if (g_rdpdr_device[device].device_type != DEVICE_TYPE_DISK)
448	{
449	status = STATUS_INVALID_HANDLE;
450	break;
451	}
452	in_uint32_le(s, info_level);
453
454	out.data = out.p = buffer;
455	out.size = sizeof(buffer);
456	status = disk_query_information(file, info_level, &out);
457	result = buffer_len = out.p - out.data;
458
459	break;
460
461	case IRP_MJ_SET_INFORMATION:
462
463	if (g_rdpdr_device[device].device_type != DEVICE_TYPE_DISK)
464	{
465	status = STATUS_INVALID_HANDLE;
466	break;
467	}
468
469	in_uint32_le(s, info_level);
470
471	out.data = out.p = buffer;
472	out.size = sizeof(buffer);
473	status = disk_set_information(file, info_level, s, &out);
474	result = buffer_len = out.p - out.data;
475	break;
476
477	case IRP_MJ_QUERY_VOLUME_INFORMATION:
478
479	if (g_rdpdr_device[device].device_type != DEVICE_TYPE_DISK)
480	{
481	status = STATUS_INVALID_HANDLE;
482	break;
483	}
484
485	in_uint32_le(s, info_level);
486
487	out.data = out.p = buffer;
488	out.size = sizeof(buffer);
489	status = disk_query_volume_information(file, info_level, &out);
490	result = buffer_len = out.p - out.data;
491	break;
492
493	case IRP_MJ_DIRECTORY_CONTROL:
494
495	if (g_rdpdr_device[device].device_type != DEVICE_TYPE_DISK)
496	{
497	status = STATUS_INVALID_HANDLE;
498	break;
499	}
500
501	switch (minor)
502	{
503	case IRP_MN_QUERY_DIRECTORY:
504
505	in_uint32_le(s, info_level);
506	in_uint8s(s, 1);
507	in_uint32_le(s, length);
508	in_uint8s(s, 0x17);
509	if (length && length < 2 * 255)
510	{
511	rdp_in_unistr(s, filename, length);
512	convert_to_unix_filename(filename);
513	}
514	else
515	{
516	filename[0] = 0;
517	}
518	out.data = out.p = buffer;
519	out.size = sizeof(buffer);
520	status = disk_query_directory(file, info_level, filename,
521	&out);
522	result = buffer_len = out.p - out.data;
523	if (!buffer_len)
524	buffer_len++;
525	break;
526
527	case IRP_MN_NOTIFY_CHANGE_DIRECTORY:
528
529	/* JIF
530	unimpl("IRP major=0x%x minor=0x%x: IRP_MN_NOTIFY_CHANGE_DIRECTORY\n", major, minor); */
531	status = STATUS_PENDING; // Don't send completion packet
532	break;
533
534	default:
535
536	status = STATUS_INVALID_PARAMETER;
537	/* JIF
538	unimpl("IRP major=0x%x minor=0x%x\n", major, minor); */
539	}
540	break;
541
542	case IRP_MJ_DEVICE_CONTROL:
543
544	if (!fns->device_control)
545	{
546	status = STATUS_NOT_SUPPORTED;
547	break;
548	}
549
550	in_uint32_le(s, bytes_out);
551	in_uint32_le(s, bytes_in);
552	in_uint32_le(s, request);
553	in_uint8s(s, 0x14);
554
555	buffer = (uint8 ) xrealloc((void ) buffer, bytes_out + 0x14);
556	out.data = out.p = buffer;
557	out.size = sizeof(buffer);
558	status = fns->device_control(file, request, s, &out);
559	result = buffer_len = out.p - out.data;
560	break;
561
562	default:
563	unimpl("IRP major=0x%x minor=0x%x\n", major, minor);
564	break;
565	}
566
567	if (status != STATUS_PENDING)
568	{
569	rdpdr_send_completion(device, id, status, result, buffer, buffer_len);
570	}
571	xfree(buffer);
572
573	}
574
575	void
576	rdpdr_send_clientcapabilty(void)
577	{
578	uint8 magic[4] = "rDPC";
579	STREAM s;
580
581	s = channel_init(rdpdr_channel, 0x50);
582	out_uint8a(s, magic, 4);
583	out_uint32_le(s, 5); /* count */
584	out_uint16_le(s, 1); /* first */
585	out_uint16_le(s, 0x28); /* length */
586	out_uint32_le(s, 1);
587	out_uint32_le(s, 2);
588	out_uint16_le(s, 2);
589	out_uint16_le(s, 5);
590	out_uint16_le(s, 1);
591	out_uint16_le(s, 5);
592	out_uint16_le(s, 0xFFFF);
593	out_uint16_le(s, 0);
594	out_uint32_le(s, 0);
595	out_uint32_le(s, 3);
596	out_uint32_le(s, 0);
597	out_uint32_le(s, 0);
598	out_uint16_le(s, 2); /* second */
599	out_uint16_le(s, 8); /* length */
600	out_uint32_le(s, 1);
601	out_uint16_le(s, 3); /* third */
602	out_uint16_le(s, 8); /* length */
603	out_uint32_le(s, 1);
604	out_uint16_le(s, 4); /* fourth */
605	out_uint16_le(s, 8); /* length */
606	out_uint32_le(s, 1);
607	out_uint16_le(s, 5); /* fifth */
608	out_uint16_le(s, 8); /* length */
609	out_uint32_le(s, 1);
610
611	s_mark_end(s);
612	channel_send(s, rdpdr_channel);
613	}
614
615	static void
616	rdpdr_process(STREAM s)
617	{
618	uint32 handle;
619	uint8 *magic;
620
621	#if WITH_DEBUG_RDP5
622	printf("--- rdpdr_process ---\n");
623	hexdump(s->p, s->end - s->p);
624	#endif
625	in_uint8p(s, magic, 4);
626
627	if ((magic[0] == 'r') && (magic[1] == 'D'))
628	{
629	if ((magic[2] == 'R') && (magic[3] == 'I'))
630	{
631	rdpdr_process_irp(s);
632	return;
633	}
634	if ((magic[2] == 'n') && (magic[3] == 'I'))
635	{
636	rdpdr_send_connect();
637	rdpdr_send_name();
638	return;
639	}
640	if ((magic[2] == 'C') && (magic[3] == 'C'))
641	{
642	/* connect from server */
643	rdpdr_send_clientcapabilty();
644	rdpdr_send_available();
645	return;
646	}
647	if ((magic[2] == 'r') && (magic[3] == 'd'))
648	{
649	/* connect to a specific resource */
650	in_uint32(s, handle);
651	#if WITH_DEBUG_RDP5
652	DEBUG(("RDPDR: Server connected to resource %d\n", handle));
653	#endif
654	return;
655	}
656	if ((magic[2] == 'P') && (magic[3] == 'S'))
657	{
658	/* server capability */
659	return;
660	}
661	}
662	if ((magic[0] == 'R') && (magic[1] == 'P'))
663	{
664	if ((magic[2] == 'C') && (magic[3] == 'P'))
665	{
666	printercache_process(s);
667	return;
668	}
669	}
670	unimpl("RDPDR packet type %c%c%c%c\n", magic[0], magic[1], magic[2], magic[3]);
671	}
672
673	BOOL
674	rdpdr_init()
675	{
676	if (g_num_devices > 0)
677	{
678	rdpdr_channel =
679	channel_register("rdpdr",
680	CHANNEL_OPTION_INITIALIZED \| CHANNEL_OPTION_COMPRESS_RDP,
681	rdpdr_process);
682	}
683
684	return (rdpdr_channel != NULL);
685	}
686
687	/* Add file descriptors of pending io request to select() */
688	void
689	rdpdr_add_fds(int n, fd_set rfds, fd_set * wfds, struct timeval tv, BOOL timeout)
690	{
691	uint32 select_timeout = 0; // Timeout value to be used for select() (in millisecons).
692	struct async_iorequest *iorq;
693
694	iorq = g_iorequest;
695	while (iorq != NULL)
696	{
697	if (iorq->fd != 0)
698	{
699	switch (iorq->major)
700	{
701	case IRP_MJ_READ:
702
703	FD_SET(iorq->fd, rfds);
704
705	// Check if io request timeout is smaller than current (but not 0).
706	if (iorq->timeout
707	&& (select_timeout == 0
708	\|\| iorq->timeout < select_timeout))
709	{
710	// Set new timeout
711	select_timeout = iorq->timeout;
712	g_min_timeout_fd = iorq->fd; /* Remember fd */
713	tv->tv_sec = select_timeout / 1000;
714	tv->tv_usec = (select_timeout % 1000) * 1000;
715	*timeout = True;
716	}
717	break;
718
719	case IRP_MJ_WRITE:
720	FD_SET(iorq->fd, wfds);
721	break;
722
723	}
724	n = MAX(n, iorq->fd);
725	}
726
727	iorq = iorq->next;
728	}
729	}
730
731
732	/* Check if select() returned with one of the rdpdr file descriptors, and complete io if it did */
733	void
734	rdpdr_check_fds(fd_set * rfds, fd_set * wfds, BOOL timed_out)
735	{
736	NTSTATUS status;
737	uint32 result = 0;
738	DEVICE_FNS *fns;
739	struct async_iorequest *iorq;
740	struct async_iorequest *prev;
741	uint32 req_size = 0;
742
743	if (timed_out)
744	{
745	rdpdr_abort_io(g_min_timeout_fd, 0, STATUS_TIMEOUT);
746	return;
747	}
748
749	iorq = g_iorequest;
750	prev = NULL;
751	while (iorq != NULL)
752	{
753	if (iorq->fd != 0)
754	{
755	switch (iorq->major)
756	{
757	case IRP_MJ_READ:
758	if (FD_ISSET(iorq->fd, rfds))
759	{
760	/* Read the data */
761	fns = iorq->fns;
762
763	req_size =
764	(iorq->length - iorq->partial_len) >
765	8192 ? 8192 : (iorq->length -
766	iorq->partial_len);
767	/* never read larger chunks than 8k - chances are that it will block */
768	status = fns->read(iorq->fd,
769	iorq->buffer + iorq->partial_len,
770	req_size, 0, &result);
771	iorq->partial_len += result;
772
773	#if WITH_DEBUG_RDP5
774	DEBUG(("RDPDR: %d bytes of data read\n", result));
775	#endif
776	/* only delete link if all data has been transfered */
777	/* or if result was 0 and status success - EOF */
778	if ((iorq->partial_len == iorq->length) \|\|
779	(result == 0))
780	{
781	#if WITH_DEBUG_RDP5
782	DEBUG(("RDPDR: AIO total %u bytes read of %u\n", iorq->partial_len, iorq->length));
783	#endif
784	/* send the data */
785	status = STATUS_SUCCESS;
786	rdpdr_send_completion(iorq->device,
787	iorq->id, status,
788	iorq->partial_len,
789	iorq->buffer,
790	iorq->partial_len);
791	xfree(iorq->buffer);
792	iorq->fd = 0;
793	if (prev != NULL)
794	{
795	prev->next = iorq->next;
796	xfree(iorq);
797	}
798	else
799	{
800	// Even if NULL
801	g_iorequest = iorq->next;
802	xfree(iorq);
803	}
804	}
805	}
806	break;
807	case IRP_MJ_WRITE:
808	if (FD_ISSET(iorq->fd, wfds))
809	{
810	/* Write data. */
811	fns = iorq->fns;
812
813	req_size =
814	(iorq->length - iorq->partial_len) >
815	8192 ? 8192 : (iorq->length -
816	iorq->partial_len);
817
818	/* never write larger chunks than 8k - chances are that it will block */
819	status = fns->write(iorq->fd,
820	iorq->buffer +
821	iorq->partial_len, req_size, 0,
822	&result);
823	iorq->partial_len += result;
824	#if WITH_DEBUG_RDP5
825	DEBUG(("RDPDR: %d bytes of data written\n",
826	result));
827	#endif
828	/* only delete link if all data has been transfered */
829	/* or we couldn't write */
830	if ((iorq->partial_len == iorq->length)
831	\|\| (result == 0))
832	{
833	#if WITH_DEBUG_RDP5
834	DEBUG(("RDPDR: AIO total %u bytes written of %u\n", iorq->partial_len, iorq->length));
835	#endif
836	/* send a status success */
837	status = STATUS_SUCCESS;
838	rdpdr_send_completion(iorq->device,
839	iorq->id, status,
840	iorq->partial_len,
841	(uint8 *) "", 1);
842
843	xfree(iorq->buffer);
844	iorq->fd = 0;
845	if (prev != NULL)
846	{
847	prev->next = iorq->next;
848	xfree(iorq);
849	}
850	else
851	{
852	// Even if NULL
853	g_iorequest = iorq->next;
854	xfree(iorq);
855	}
856	}
857	}
858	break;
859	}
860
861	}
862	prev = iorq;
863	iorq = iorq->next;
864	}
865
866	}
867
868	/* Abort a pending io request for a given handle and major */
869	BOOL
870	rdpdr_abort_io(uint32 fd, uint32 major, NTSTATUS status)
871	{
872	uint32 result;
873	struct async_iorequest *iorq;
874	struct async_iorequest *prev;
875
876	iorq = g_iorequest;
877	prev = NULL;
878	while (iorq != NULL)
879	{
880	// Only remove from table when major is not set, or when correct major is supplied.
881	// Abort read should not abort a write io request.
882	if ((iorq->fd == fd) && (major == 0 \|\| iorq->major == major))
883	{
884	result = 0;
885	rdpdr_send_completion(iorq->device, iorq->id, status, result, (uint8 *) "",
886	1);
887	xfree(iorq->buffer);
888	iorq->fd = 0;
889	if (prev != NULL)
890	{
891	prev->next = iorq->next;
892	xfree(iorq);
893	}
894	else
895	{
896	// Even if NULL
897	g_iorequest = iorq->next;
898	xfree(iorq);
899	}
900	return True;
901	}
902
903	prev = iorq;
904	iorq = iorq->next;
905	}
906
907	return False;
908	}