- added DCE/RPC "fault" PDU support.

- disabled (AGAIN) the GETDC "if (MAILSLOT\NTLOGON)" code that will get
NT5rc2 to work but WILL break win95 (AGAIN).  this needs _not_ to be
re-enabled but to be replaced with a better mechanism.

- added SMBwrite support (note: SMBwriteX already existed) as NT5rc2 is
sending DCE/RPC over SMBwrite not SMBwriteX.
(This used to be commit 25c70e3c984c4fed19763ed405741e83fe14f87e)

4 files changed, 51 insertions, 5 deletions

diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 10c859d266..a3e7932529 100644
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -3127,11 +3127,12 @@ static void api_rpc_trans_reply(char *outbuf,
 	{
 		/* all of data was sent: no need to wait for SMBreadX calls */
 		mem_free_data(p->rhdr .data);
-		mem_free_data(p->rdata.data);
+		mem_free_data(p->rfault .data);
+		mem_free_data(p->rdata  .data);
  		mem_free_data(p->rdata_i.data);		
-		mem_free_data(p->rauth.data);
-		mem_free_data(p->rverf.data);
- 		mem_free_data(p->rntlm.data);		
+		mem_free_data(p->rauth  .data);
+		mem_free_data(p->rverf  .data);
+ 		mem_free_data(p->rntlm  .data);		
 	}
 }
 
diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c
index 374aa70d0f..e20d049834 100644
--- a/source3/smbd/pipes.c
+++ b/source3/smbd/pipes.c
@@ -104,6 +104,47 @@ int reply_open_pipe_and_X(connection_struct *conn,
 	return chain_reply(inbuf,outbuf,length,bufsize);
 }
 
+/****************************************************************************
+  reply to a write 
+
+  This code is basically stolen from reply_write with some
+  wrinkles to handle pipes.
+****************************************************************************/
+int reply_pipe_write(char *inbuf,char *outbuf,int length,int bufsize)
+{
+	pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv0);
+	size_t numtowrite = SVAL(inbuf,smb_vwv1);
+	int nwritten = -1;
+	char *data;
+	size_t outsize;
+
+	if (!p) return(ERROR(ERRDOS,ERRbadfid));
+
+	data = smb_buf(inbuf) + 3;
+
+	if (numtowrite == 0)
+	{
+		nwritten = 0;
+	}
+	else
+	{
+		nwritten = write_pipe(p, data, numtowrite);
+	}
+
+	if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0))
+	{
+		return (UNIXERROR(ERRDOS,ERRnoaccess));
+	}
+  
+	outsize = set_message(outbuf,1,0,True);
+
+	SSVAL(outbuf,smb_vwv0,nwritten);
+
+	DEBUG(3,("write-IPC pnum=%04x nwritten=%d\n",
+		 p->pnum, nwritten));
+
+	return outsize;
+}
 
 /****************************************************************************
   reply to a write and X
diff --git a/source3/smbd/process.c b/source3/smbd/process.c
index e9fb230624..1a6ec320e1 100644
--- a/source3/smbd/process.c
+++ b/source3/smbd/process.c
@@ -283,7 +283,7 @@ struct smb_message_struct
 
    {SMBunlink,"SMBunlink",reply_unlink,AS_USER | NEED_WRITE | QUEUE_IN_OPLOCK},
    {SMBread,"SMBread",reply_read,AS_USER},
-   {SMBwrite,"SMBwrite",reply_write,AS_USER},
+   {SMBwrite,"SMBwrite",reply_write,AS_USER | CAN_IPC},
    {SMBclose,"SMBclose",reply_close,AS_USER | CAN_IPC},
    {SMBmkdir,"SMBmkdir",reply_mkdir,AS_USER | NEED_WRITE},
    {SMBrmdir,"SMBrmdir",reply_rmdir,AS_USER | NEED_WRITE},
diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 8723779d30..0c4fb2003c 100644
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -2348,6 +2348,10 @@ int reply_write(connection_struct *conn, char *inbuf,char *outbuf,int dum_size,i
   files_struct *fsp = file_fsp(inbuf,smb_vwv0);
   int outsize = 0;
 
+	  /* If it's an IPC, pass off the pipe handler. */
+	  if (IS_IPC(conn))
+	    return reply_pipe_write(inbuf,outbuf,dum_size,dum_buffsize);
+
   CHECK_FSP(fsp,conn);
   CHECK_WRITE(fsp);
   CHECK_ERROR(fsp);