Retrieving the computer name of a named pipe client

[Colin Finck]

Hi all,

For implementing the RpcBindingServerFromClient rpcrt4.dll API  function
needed by my Printing Stack, I need to know how to retrieve the computer
name of a named pipe client.
Vista and later implement GetNamedPipeClientComputerName in kernel32.dll
which does exactly this, but this is neither supported under Windows
Server 2003 nor implemented in ReactOS and WINE.

Determining client information is a basic feature of network
communication, so it should be possible under Windows 2003 as well.
Additionally, RpcBindingServerFromClient returns the proper computer
name of the client, when using named pipes over the ncacn_np transport.
It must have got it somehow.

Hoping for some ideas from your side!

Colin

[Timo Kreuzer]

You need to send an FSCTL to the named pipe file system driver.

// defined in ntifs.h
#define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE 
CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)

static const char AttributeName[] = "ClientComputerName";

Status = NtFsControlFile(NamedPipeHandle,
                              EventHandle,
                              NULL,
                              NULL,
                              &IoStatusBlock,
FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE,
                              (PVOID)AttributeName,
                              sizeof(AttributeName),
                              NameBuffer,
                              NameBufferLength);

Obviously this has to be implemented in ournpfs as well. :)

Regards,
Timo

Am 10.10.2016 um 13:21 schrieb Colin Finck:
> Hi all,
>
> For implementing the RpcBindingServerFromClient rpcrt4.dll API  function
> needed by my Printing Stack, I need to know how to retrieve the computer
> name of a named pipe client.
> Vista and later implement GetNamedPipeClientComputerName in kernel32.dll
> which does exactly this, but this is neither supported under Windows
> Server 2003 nor implemented in ReactOS and WINE.
>
> Determining client information is a basic feature of network
> communication, so it should be possible under Windows 2003 as well.
> Additionally, RpcBindingServerFromClient returns the proper computer
> name of the client, when using named pipes over the ncacn_np transport.
> It must have got it somehow.
>
> Hoping for some ideas from your side!
>
> Colin
>
> Ros-dev mailing list
> [e-mail]
> http://www.reactos.org/mailman/listinfo/ros-dev

[Colin Finck]

Am 10.10.2016 um 23:22 schrieb Timo Kreuzer:
> #define FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE
> CTL_CODE(FILE_DEVICE_NAMED_PIPE, 12, METHOD_BUFFERED, FILE_ANY_ACCESS)
> static const char AttributeName[] = "ClientComputerName";
>
> Status = NtFsControlFile(NamedPipeHandle,

Are you sure this is the right way of doing it under Windows 2003?
While 2003's rpcrt4.dll imports NtFsControlFile, running GNU strings on
it doesn't output any "ClientComputerName" string.

Furthermore, our NPFS driver only implements the FSCTL_PIPE_* control
codes up to FSCTL_PIPE_QUERY_CLIENT_PROCESS (#9). #10 to #16 (with
FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE being #12) are not processed. Same
goes for the free ntifs.h from https://www.acc.umu.se/~bosse/ntifs.h, it
lacks all FSCTL_PIPE_* codes after #9. I'm getting the impression, #10
to #16 were only introduced with NT 6.0.
If I had the ntifs.h from Windows 2003, I could confirm my theory, but
this file was never public and only part of the commercial IFS Kit.

So, talking to the NPFS driver probably goes into the right direction,
but I assume we have to find an alternative to
FSCTL_PIPE_GET_CONNECTION_ATTRIBUTE.

- Colin

[Neo Love]

Hi Colin,

Perhaps have a look at the CCB (client control block) of the pipe.
If ClientSession is NULL the client is the local machine.
Else you might look at the Process pointer and work it from there.

The CCB is initialized in NpCreateClientEnd.
Struct _EPROCESS is declared eg. in pstypes.h.

HTH
L.

On 2016-10-10 18.21, Colin Finck wrote:
> Determining client information is a basic feature of network
> communication, so it should be possible under Windows 2003 as well.
> Additionally, RpcBindingServerFromClient returns the proper computer
> name of the client, when using named pipes over the ncacn_np transport.
> It must have got it somehow.