rpc.c 65.6 KB
Newer Older
1
/*
2
 *	RPC Manager
3
 *
4
 * Copyright 2001  Ove Kven, TransGaming Technologies
5 6
 * Copyright 2002  Marcus Meissner
 * Copyright 2005  Mike Hearn, Rob Shearman for CodeWeavers
7 8 9 10 11 12 13 14 15 16 17 18 19
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License along with this library; if not, write to the Free Software
20
 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
21 22 23
 */

#include "config.h"
24
#include "wine/port.h"
25

26
#include <stdarg.h>
27 28
#include <string.h>

29
#define COBJMACROS
30 31
#define NONAMELESSUNION
#define NONAMELESSSTRUCT
32

33
#include "windef.h"
34
#include "winbase.h"
35
#include "winuser.h"
36
#include "winsvc.h"
37 38 39 40 41 42 43 44 45
#include "objbase.h"
#include "ole2.h"
#include "rpc.h"
#include "winerror.h"
#include "winreg.h"
#include "wine/unicode.h"

#include "compobj_private.h"

46
#include "wine/debug.h"
47

48
WINE_DEFAULT_DEBUG_CHANNEL(ole);
49

50
static void __RPC_STUB dispatch_rpc(RPC_MESSAGE *msg);
51

52 53 54 55
/* we only use one function to dispatch calls for all methods - we use the
 * RPC_IF_OLE flag to tell the RPC runtime that this is the case */
static RPC_DISPATCH_FUNCTION rpc_dispatch_table[1] = { dispatch_rpc }; /* (RO) */
static RPC_DISPATCH_TABLE rpc_dispatch = { 1, rpc_dispatch_table }; /* (RO) */
56

57 58 59
static struct list registered_interfaces = LIST_INIT(registered_interfaces); /* (CS csRegIf) */
static CRITICAL_SECTION csRegIf;
static CRITICAL_SECTION_DEBUG csRegIf_debug =
60
{
61 62
    0, 0, &csRegIf,
    { &csRegIf_debug.ProcessLocksList, &csRegIf_debug.ProcessLocksList },
63
      0, 0, { (DWORD_PTR)(__FILE__ ": dcom registered server interfaces") }
64
};
65 66
static CRITICAL_SECTION csRegIf = { &csRegIf_debug, -1, 0, 0, 0, 0 };

67 68 69 70 71 72 73 74 75 76
static struct list channel_hooks = LIST_INIT(channel_hooks); /* (CS csChannelHook) */
static CRITICAL_SECTION csChannelHook;
static CRITICAL_SECTION_DEBUG csChannelHook_debug =
{
    0, 0, &csChannelHook,
    { &csChannelHook_debug.ProcessLocksList, &csChannelHook_debug.ProcessLocksList },
      0, 0, { (DWORD_PTR)(__FILE__ ": channel hooks") }
};
static CRITICAL_SECTION csChannelHook = { &csChannelHook_debug, -1, 0, 0, 0, 0 };

77
static WCHAR wszRpcTransport[] = {'n','c','a','l','r','p','c',0};
78

79

80
struct registered_if
81
{
82 83 84
    struct list entry;
    DWORD refs; /* ref count */
    RPC_SERVER_INTERFACE If; /* interface registered with the RPC runtime */
85
};
86

87 88 89 90 91 92 93
/* get the pipe endpoint specified of the specified apartment */
static inline void get_rpc_endpoint(LPWSTR endpoint, const OXID *oxid)
{
    /* FIXME: should get endpoint from rpcss */
    static const WCHAR wszEndpointFormat[] = {'\\','p','i','p','e','\\','O','L','E','_','%','0','8','l','x','%','0','8','l','x',0};
    wsprintfW(endpoint, wszEndpointFormat, (DWORD)(*oxid >> 32),(DWORD)*oxid);
}
94

95 96 97
typedef struct
{
    const IRpcChannelBufferVtbl *lpVtbl;
98
    LONG                  refs;
99
} RpcChannelBuffer;
100

101
typedef struct
102
{
103
    RpcChannelBuffer       super; /* superclass */
104

105
    RPC_BINDING_HANDLE     bind; /* handle to the remote server */
106
    OXID                   oxid; /* apartment in which the channel is valid */
107
    DWORD                  server_pid; /* id of server process */
108 109
    DWORD                  dest_context; /* returned from GetDestCtx */
    LPVOID                 dest_context_data; /* returned from GetDestCtx */
110
    HANDLE                 event; /* cached event handle */
111
} ClientRpcChannelBuffer;
112

113 114 115 116 117
struct dispatch_params
{
    RPCOLEMESSAGE     *msg; /* message */
    IRpcStubBuffer    *stub; /* stub buffer, if applicable */
    IRpcChannelBuffer *chan; /* server channel buffer, if applicable */
118 119
    IID                iid; /* ID of interface being called */
    IUnknown          *iface; /* interface being called */
120
    HANDLE             handle; /* handle that will become signaled when call finishes */
121
    BOOL               bypass_rpcrt; /* bypass RPC runtime? */
122
    RPC_STATUS         status; /* status (out) */
123
    HRESULT            hr; /* hresult (out) */
124 125
};

126 127 128 129
struct message_state
{
    RPC_BINDING_HANDLE binding_handle;
    ULONG prefix_data_len;
130
    SChannelHookCallInfo channel_hook_info;
131
    BOOL bypass_rpcrt;
132 133

    /* client only */
134 135
    HWND target_hwnd;
    DWORD target_tid;
136
    struct dispatch_params params;
137 138 139 140 141 142 143 144 145 146
};

typedef struct
{
    ULONG conformance; /* NDR */
    GUID id;
    ULONG size;
    /* [size_is((size+7)&~7)] */ unsigned char data[1];
} WIRE_ORPC_EXTENT;

147 148 149 150 151 152 153 154 155 156 157 158 159 160
struct channel_hook_entry
{
    struct list entry;
    GUID id;
    IChannelHook *hook;
};

struct channel_hook_buffer_data
{
    GUID id;
    ULONG extension_size;
};


161 162 163
static HRESULT unmarshal_ORPCTHAT(RPC_MESSAGE *msg, ORPCTHAT *orpcthat,
                                  ORPC_EXTENT_ARRAY *orpc_ext_array, WIRE_ORPC_EXTENT **first_wire_orpc_extent);

164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181
/* Channel Hook Functions */

static ULONG ChannelHooks_ClientGetSize(SChannelHookCallInfo *info,
    struct channel_hook_buffer_data **data, unsigned int *hook_count,
    ULONG *extension_count)
{
    struct channel_hook_entry *entry;
    ULONG total_size = 0;
    unsigned int hook_index = 0;

    *hook_count = 0;
    *extension_count = 0;

    EnterCriticalSection(&csChannelHook);

    LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
        (*hook_count)++;

182
    if (*hook_count)
183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244
        *data = HeapAlloc(GetProcessHeap(), 0, *hook_count * sizeof(struct channel_hook_buffer_data));
    else
        *data = NULL;

    LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
    {
        ULONG extension_size = 0;

        IChannelHook_ClientGetSize(entry->hook, &entry->id, &info->iid, &extension_size);

        TRACE("%s: extension_size = %u\n", debugstr_guid(&entry->id), extension_size);

        extension_size = (extension_size+7)&~7;
        (*data)[hook_index].id = entry->id;
        (*data)[hook_index].extension_size = extension_size;

        /* an extension is only put onto the wire if it has data to write */
        if (extension_size)
        {
            total_size += FIELD_OFFSET(WIRE_ORPC_EXTENT, data[extension_size]);
            (*extension_count)++;
        }

        hook_index++;
    }

    LeaveCriticalSection(&csChannelHook);

    return total_size;
}

static unsigned char * ChannelHooks_ClientFillBuffer(SChannelHookCallInfo *info,
    unsigned char *buffer, struct channel_hook_buffer_data *data,
    unsigned int hook_count)
{
    struct channel_hook_entry *entry;

    EnterCriticalSection(&csChannelHook);

    LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
    {
        unsigned int i;
        ULONG extension_size = 0;
        WIRE_ORPC_EXTENT *wire_orpc_extent = (WIRE_ORPC_EXTENT *)buffer;

        for (i = 0; i < hook_count; i++)
            if (IsEqualGUID(&entry->id, &data[i].id))
                extension_size = data[i].extension_size;

        /* an extension is only put onto the wire if it has data to write */
        if (!extension_size)
            continue;

        IChannelHook_ClientFillBuffer(entry->hook, &entry->id, &info->iid,
            &extension_size, buffer + FIELD_OFFSET(WIRE_ORPC_EXTENT, data[0]));

        TRACE("%s: extension_size = %u\n", debugstr_guid(&entry->id), extension_size);

        /* FIXME: set unused portion of wire_orpc_extent->data to 0? */

        wire_orpc_extent->conformance = (extension_size+7)&~7;
        wire_orpc_extent->size = extension_size;
245
        wire_orpc_extent->id = entry->id;
246 247 248 249 250 251 252 253
        buffer += FIELD_OFFSET(WIRE_ORPC_EXTENT, data[wire_orpc_extent->conformance]);
    }

    LeaveCriticalSection(&csChannelHook);

    return buffer;
}

254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283
static void ChannelHooks_ServerNotify(SChannelHookCallInfo *info,
    DWORD lDataRep, WIRE_ORPC_EXTENT *first_wire_orpc_extent,
    ULONG extension_count)
{
    struct channel_hook_entry *entry;
    ULONG i;

    EnterCriticalSection(&csChannelHook);

    LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
    {
        WIRE_ORPC_EXTENT *wire_orpc_extent;
        for (i = 0, wire_orpc_extent = first_wire_orpc_extent;
             i < extension_count;
             i++, wire_orpc_extent = (WIRE_ORPC_EXTENT *)&wire_orpc_extent->data[wire_orpc_extent->conformance])
        {
            if (IsEqualGUID(&entry->id, &wire_orpc_extent->id))
                break;
        }
        if (i == extension_count) wire_orpc_extent = NULL;

        IChannelHook_ServerNotify(entry->hook, &entry->id, &info->iid,
            wire_orpc_extent ? wire_orpc_extent->size : 0,
            wire_orpc_extent ? wire_orpc_extent->data : NULL,
            lDataRep);
    }

    LeaveCriticalSection(&csChannelHook);
}

284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364
static ULONG ChannelHooks_ServerGetSize(SChannelHookCallInfo *info,
                                        struct channel_hook_buffer_data **data, unsigned int *hook_count,
                                        ULONG *extension_count)
{
    struct channel_hook_entry *entry;
    ULONG total_size = 0;
    unsigned int hook_index = 0;

    *hook_count = 0;
    *extension_count = 0;

    EnterCriticalSection(&csChannelHook);

    LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
        (*hook_count)++;

    if (*hook_count)
        *data = HeapAlloc(GetProcessHeap(), 0, *hook_count * sizeof(struct channel_hook_buffer_data));
    else
        *data = NULL;

    LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
    {
        ULONG extension_size = 0;

        IChannelHook_ServerGetSize(entry->hook, &entry->id, &info->iid, S_OK,
                                   &extension_size);

        TRACE("%s: extension_size = %u\n", debugstr_guid(&entry->id), extension_size);

        extension_size = (extension_size+7)&~7;
        (*data)[hook_index].id = entry->id;
        (*data)[hook_index].extension_size = extension_size;

        /* an extension is only put onto the wire if it has data to write */
        if (extension_size)
        {
            total_size += FIELD_OFFSET(WIRE_ORPC_EXTENT, data[extension_size]);
            (*extension_count)++;
        }

        hook_index++;
    }

    LeaveCriticalSection(&csChannelHook);

    return total_size;
}

static unsigned char * ChannelHooks_ServerFillBuffer(SChannelHookCallInfo *info,
                                                     unsigned char *buffer, struct channel_hook_buffer_data *data,
                                                     unsigned int hook_count)
{
    struct channel_hook_entry *entry;

    EnterCriticalSection(&csChannelHook);

    LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
    {
        unsigned int i;
        ULONG extension_size = 0;
        WIRE_ORPC_EXTENT *wire_orpc_extent = (WIRE_ORPC_EXTENT *)buffer;

        for (i = 0; i < hook_count; i++)
            if (IsEqualGUID(&entry->id, &data[i].id))
                extension_size = data[i].extension_size;

        /* an extension is only put onto the wire if it has data to write */
        if (!extension_size)
            continue;

        IChannelHook_ServerFillBuffer(entry->hook, &entry->id, &info->iid,
                                      &extension_size, buffer + FIELD_OFFSET(WIRE_ORPC_EXTENT, data[0]),
                                      S_OK);

        TRACE("%s: extension_size = %u\n", debugstr_guid(&entry->id), extension_size);

        /* FIXME: set unused portion of wire_orpc_extent->data to 0? */

        wire_orpc_extent->conformance = (extension_size+7)&~7;
        wire_orpc_extent->size = extension_size;
365
        wire_orpc_extent->id = entry->id;
366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403
        buffer += FIELD_OFFSET(WIRE_ORPC_EXTENT, data[wire_orpc_extent->conformance]);
    }

    LeaveCriticalSection(&csChannelHook);

    return buffer;
}

static void ChannelHooks_ClientNotify(SChannelHookCallInfo *info,
                                      DWORD lDataRep, WIRE_ORPC_EXTENT *first_wire_orpc_extent,
                                      ULONG extension_count, HRESULT hrFault)
{
    struct channel_hook_entry *entry;
    ULONG i;

    EnterCriticalSection(&csChannelHook);

    LIST_FOR_EACH_ENTRY(entry, &channel_hooks, struct channel_hook_entry, entry)
    {
        WIRE_ORPC_EXTENT *wire_orpc_extent;
        for (i = 0, wire_orpc_extent = first_wire_orpc_extent;
             i < extension_count;
             i++, wire_orpc_extent = (WIRE_ORPC_EXTENT *)&wire_orpc_extent->data[wire_orpc_extent->conformance])
        {
            if (IsEqualGUID(&entry->id, &wire_orpc_extent->id))
                break;
        }
        if (i == extension_count) wire_orpc_extent = NULL;

        IChannelHook_ClientNotify(entry->hook, &entry->id, &info->iid,
                                  wire_orpc_extent ? wire_orpc_extent->size : 0,
                                  wire_orpc_extent ? wire_orpc_extent->data : NULL,
                                  lDataRep, hrFault);
    }

    LeaveCriticalSection(&csChannelHook);
}

404 405 406 407 408 409 410 411 412 413
HRESULT RPC_RegisterChannelHook(REFGUID rguid, IChannelHook *hook)
{
    struct channel_hook_entry *entry;

    TRACE("(%s, %p)\n", debugstr_guid(rguid), hook);

    entry = HeapAlloc(GetProcessHeap(), 0, sizeof(*entry));
    if (!entry)
        return E_OUTOFMEMORY;

414
    entry->id = *rguid;
415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436
    entry->hook = hook;
    IChannelHook_AddRef(hook);

    EnterCriticalSection(&csChannelHook);
    list_add_tail(&channel_hooks, &entry->entry);
    LeaveCriticalSection(&csChannelHook);

    return S_OK;
}

void RPC_UnregisterAllChannelHooks(void)
{
    struct channel_hook_entry *cursor;
    struct channel_hook_entry *cursor2;

    EnterCriticalSection(&csChannelHook);
    LIST_FOR_EACH_ENTRY_SAFE(cursor, cursor2, &channel_hooks, struct channel_hook_entry, entry)
        HeapFree(GetProcessHeap(), 0, cursor);
    LeaveCriticalSection(&csChannelHook);
}

/* RPC Channel Buffer Functions */
437

438
static HRESULT WINAPI RpcChannelBuffer_QueryInterface(LPRPCCHANNELBUFFER iface, REFIID riid, LPVOID *ppv)
439
{
440 441 442 443 444 445 446 447 448
    *ppv = NULL;
    if (IsEqualIID(riid,&IID_IRpcChannelBuffer) || IsEqualIID(riid,&IID_IUnknown))
    {
        *ppv = (LPVOID)iface;
        IUnknown_AddRef(iface);
        return S_OK;
    }
    return E_NOINTERFACE;
}
449

450 451 452 453 454
static ULONG WINAPI RpcChannelBuffer_AddRef(LPRPCCHANNELBUFFER iface)
{
    RpcChannelBuffer *This = (RpcChannelBuffer *)iface;
    return InterlockedIncrement(&This->refs);
}
455

456 457 458 459
static ULONG WINAPI ServerRpcChannelBuffer_Release(LPRPCCHANNELBUFFER iface)
{
    RpcChannelBuffer *This = (RpcChannelBuffer *)iface;
    ULONG ref;
460

461 462 463
    ref = InterlockedDecrement(&This->refs);
    if (ref)
        return ref;
464

465 466 467
    HeapFree(GetProcessHeap(), 0, This);
    return 0;
}
468

469 470 471 472
static ULONG WINAPI ClientRpcChannelBuffer_Release(LPRPCCHANNELBUFFER iface)
{
    ClientRpcChannelBuffer *This = (ClientRpcChannelBuffer *)iface;
    ULONG ref;
473

474 475 476
    ref = InterlockedDecrement(&This->super.refs);
    if (ref)
        return ref;
477

478
    if (This->event) CloseHandle(This->event);
479 480 481 482
    RpcBindingFree(&This->bind);
    HeapFree(GetProcessHeap(), 0, This);
    return 0;
}
483

484
static HRESULT WINAPI ServerRpcChannelBuffer_GetBuffer(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE* olemsg, REFIID riid)
485
{
486 487 488
    RpcChannelBuffer *This = (RpcChannelBuffer *)iface;
    RPC_MESSAGE *msg = (RPC_MESSAGE *)olemsg;
    RPC_STATUS status;
489
    ORPCTHAT *orpcthat;
490
    struct message_state *message_state;
491 492 493 494
    ULONG extensions_size;
    struct channel_hook_buffer_data *channel_hook_data;
    unsigned int channel_hook_count;
    ULONG extension_count;
495

496
    TRACE("(%p)->(%p,%s)\n", This, olemsg, debugstr_guid(riid));
497

498 499 500 501 502
    message_state = (struct message_state *)msg->Handle;
    /* restore the binding handle and the real start of data */
    msg->Handle = message_state->binding_handle;
    msg->Buffer = (char *)msg->Buffer - message_state->prefix_data_len;

503 504 505 506 507 508 509 510 511 512 513
    extensions_size = ChannelHooks_ServerGetSize(&message_state->channel_hook_info,
                                                 &channel_hook_data, &channel_hook_count, &extension_count);

    msg->BufferLength += FIELD_OFFSET(ORPCTHAT, extensions) + 4;
    if (extensions_size)
    {
        msg->BufferLength += FIELD_OFFSET(ORPC_EXTENT_ARRAY, extent) + 2*sizeof(DWORD) + extensions_size;
        if (extension_count & 1)
            msg->BufferLength += FIELD_OFFSET(WIRE_ORPC_EXTENT, data[0]);
    }

514 515 516 517 518 519 520 521 522 523
    if (message_state->bypass_rpcrt)
    {
        msg->Buffer = HeapAlloc(GetProcessHeap(), 0, msg->BufferLength);
        if (msg->Buffer)
            status = RPC_S_OK;
        else
            status = ERROR_OUTOFMEMORY;
    }
    else
        status = I_RpcGetBuffer(msg);
524

525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555
    orpcthat = (ORPCTHAT *)msg->Buffer;
    msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(ORPCTHAT, extensions);

    orpcthat->flags = ORPCF_NULL /* FIXME? */;

    /* NDR representation of orpcthat->extensions */
    *(DWORD *)msg->Buffer = extensions_size ? 1 : 0;
    msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);

    if (extensions_size)
    {
        ORPC_EXTENT_ARRAY *orpc_extent_array = msg->Buffer;
        orpc_extent_array->size = extension_count;
        orpc_extent_array->reserved = 0;
        msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(ORPC_EXTENT_ARRAY, extent);
        /* NDR representation of orpc_extent_array->extent */
        *(DWORD *)msg->Buffer = 1;
        msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);
        /* NDR representation of [size_is] attribute of orpc_extent_array->extent */
        *(DWORD *)msg->Buffer = (extension_count + 1) & ~1;
        msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);

        msg->Buffer = ChannelHooks_ServerFillBuffer(&message_state->channel_hook_info,
                                                    msg->Buffer, channel_hook_data, channel_hook_count);

        /* we must add a dummy extension if there is an odd extension
         * count to meet the contract specified by the size_is attribute */
        if (extension_count & 1)
        {
            WIRE_ORPC_EXTENT *wire_orpc_extent = msg->Buffer;
            wire_orpc_extent->conformance = 0;
556
            wire_orpc_extent->id = GUID_NULL;
557 558 559 560 561
            wire_orpc_extent->size = 0;
            msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(WIRE_ORPC_EXTENT, data[0]);
        }
    }

562 563
    HeapFree(GetProcessHeap(), 0, channel_hook_data);

564 565 566 567
    /* store the prefixed data length so that we can restore the real buffer
     * later */
    message_state->prefix_data_len = (char *)msg->Buffer - (char *)orpcthat;
    msg->BufferLength -= message_state->prefix_data_len;
568 569 570
    /* save away the message state again */
    msg->Handle = message_state;

571 572 573 574 575
    TRACE("-- %ld\n", status);

    return HRESULT_FROM_WIN32(status);
}

576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593
static HANDLE ClientRpcChannelBuffer_GetEventHandle(ClientRpcChannelBuffer *This)
{
    HANDLE event = InterlockedExchangePointer(&This->event, NULL);

    /* Note: must be auto-reset event so we can reuse it without a call
    * to ResetEvent */
    if (!event) event = CreateEventW(NULL, FALSE, FALSE, NULL);

    return event;
}

static void ClientRpcChannelBuffer_ReleaseEventHandle(ClientRpcChannelBuffer *This, HANDLE event)
{
    if (InterlockedCompareExchangePointer(&This->event, event, NULL))
        /* already a handle cached in This */
        CloseHandle(event);
}

594 595 596 597 598 599
static HRESULT WINAPI ClientRpcChannelBuffer_GetBuffer(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE* olemsg, REFIID riid)
{
    ClientRpcChannelBuffer *This = (ClientRpcChannelBuffer *)iface;
    RPC_MESSAGE *msg = (RPC_MESSAGE *)olemsg;
    RPC_CLIENT_INTERFACE *cif;
    RPC_STATUS status;
600 601
    ORPCTHIS *orpcthis;
    struct message_state *message_state;
602 603 604 605
    ULONG extensions_size;
    struct channel_hook_buffer_data *channel_hook_data;
    unsigned int channel_hook_count;
    ULONG extension_count;
606 607 608
    IPID ipid;
    HRESULT hr;
    APARTMENT *apt = NULL;
609

610
    TRACE("(%p)->(%p,%s)\n", This, olemsg, debugstr_guid(riid));
611 612 613 614 615

    cif = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(RPC_CLIENT_INTERFACE));
    if (!cif)
        return E_OUTOFMEMORY;

616 617 618 619 620 621 622
    message_state = HeapAlloc(GetProcessHeap(), 0, sizeof(*message_state));
    if (!message_state)
    {
        HeapFree(GetProcessHeap(), 0, cif);
        return E_OUTOFMEMORY;
    }

623 624 625 626 627 628 629
    cif->Length = sizeof(RPC_CLIENT_INTERFACE);
    /* RPC interface ID = COM interface ID */
    cif->InterfaceId.SyntaxGUID = *riid;
    /* COM objects always have a version of 0.0 */
    cif->InterfaceId.SyntaxVersion.MajorVersion = 0;
    cif->InterfaceId.SyntaxVersion.MinorVersion = 0;
    msg->Handle = This->bind;
630 631
    msg->RpcInterfaceInformation = cif;

632 633 634
    message_state->prefix_data_len = 0;
    message_state->binding_handle = This->bind;

635 636
    message_state->channel_hook_info.iid = *riid;
    message_state->channel_hook_info.cbSize = sizeof(message_state->channel_hook_info);
637
    message_state->channel_hook_info.uCausality = COM_CurrentCausalityId();
638
    message_state->channel_hook_info.dwServerPid = This->server_pid;
639 640
    message_state->channel_hook_info.iMethod = msg->ProcNum;
    message_state->channel_hook_info.pObject = NULL; /* only present on server-side */
641 642
    message_state->target_hwnd = NULL;
    message_state->target_tid = 0;
643
    memset(&message_state->params, 0, sizeof(message_state->params));
644

645
    extensions_size = ChannelHooks_ClientGetSize(&message_state->channel_hook_info,
646 647
        &channel_hook_data, &channel_hook_count, &extension_count);

648
    msg->BufferLength += FIELD_OFFSET(ORPCTHIS, extensions) + 4;
649 650 651 652 653 654 655
    if (extensions_size)
    {
        msg->BufferLength += FIELD_OFFSET(ORPC_EXTENT_ARRAY, extent) + 2*sizeof(DWORD) + extensions_size;
        if (extension_count & 1)
            msg->BufferLength += FIELD_OFFSET(WIRE_ORPC_EXTENT, data[0]);
    }

656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674
    RpcBindingInqObject(message_state->binding_handle, &ipid);
    hr = ipid_get_dispatch_params(&ipid, &apt, &message_state->params.stub,
                                  &message_state->params.chan,
                                  &message_state->params.iid,
                                  &message_state->params.iface);
    if (hr == S_OK)
    {
        /* stub, chan, iface and iid are unneeded in multi-threaded case as we go
         * via the RPC runtime */
        if (apt->multi_threaded)
        {
            IRpcStubBuffer_Release(message_state->params.stub);
            message_state->params.stub = NULL;
            IRpcChannelBuffer_Release(message_state->params.chan);
            message_state->params.chan = NULL;
            message_state->params.iface = NULL;
        }
        else
        {
675
            message_state->params.bypass_rpcrt = TRUE;
676 677 678 679 680 681 682 683 684 685 686 687 688
            message_state->target_hwnd = apartment_getwindow(apt);
            message_state->target_tid = apt->tid;
            /* we assume later on that this being non-NULL is the indicator that
             * means call directly instead of going through RPC runtime */
            if (!message_state->target_hwnd)
                ERR("window for apartment %s is NULL\n", wine_dbgstr_longlong(apt->oxid));
        }
    }
    if (apt) apartment_release(apt);
    message_state->params.handle = ClientRpcChannelBuffer_GetEventHandle(This);
    /* Note: message_state->params.msg is initialised in
     * ClientRpcChannelBuffer_SendReceive */

689 690 691 692 693 694 695 696 697 698 699
    /* shortcut the RPC runtime */
    if (message_state->target_hwnd)
    {
        msg->Buffer = HeapAlloc(GetProcessHeap(), 0, msg->BufferLength);
        if (msg->Buffer)
            status = RPC_S_OK;
        else
            status = ERROR_OUTOFMEMORY;
    }
    else
        status = I_RpcGetBuffer(msg);
700

701 702 703 704 705 706 707 708 709
    msg->Handle = message_state;

    if (status == RPC_S_OK)
    {
        orpcthis = (ORPCTHIS *)msg->Buffer;
        msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(ORPCTHIS, extensions);

        orpcthis->version.MajorVersion = COM_MAJOR_VERSION;
        orpcthis->version.MinorVersion = COM_MINOR_VERSION;
710
        orpcthis->flags = message_state->channel_hook_info.dwServerPid ? ORPCF_LOCAL : ORPCF_NULL;
711
        orpcthis->reserved1 = 0;
712
        orpcthis->cid = message_state->channel_hook_info.uCausality;
713 714

        /* NDR representation of orpcthis->extensions */
715
        *(DWORD *)msg->Buffer = extensions_size ? 1 : 0;
716 717
        msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);

718 719 720 721 722 723 724 725 726 727 728 729 730
        if (extensions_size)
        {
            ORPC_EXTENT_ARRAY *orpc_extent_array = msg->Buffer;
            orpc_extent_array->size = extension_count;
            orpc_extent_array->reserved = 0;
            msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(ORPC_EXTENT_ARRAY, extent);
            /* NDR representation of orpc_extent_array->extent */
            *(DWORD *)msg->Buffer = 1;
            msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);
            /* NDR representation of [size_is] attribute of orpc_extent_array->extent */
            *(DWORD *)msg->Buffer = (extension_count + 1) & ~1;
            msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);

731
            msg->Buffer = ChannelHooks_ClientFillBuffer(&message_state->channel_hook_info,
732 733 734 735 736 737 738 739
                msg->Buffer, channel_hook_data, channel_hook_count);

            /* we must add a dummy extension if there is an odd extension
             * count to meet the contract specified by the size_is attribute */
            if (extension_count & 1)
            {
                WIRE_ORPC_EXTENT *wire_orpc_extent = msg->Buffer;
                wire_orpc_extent->conformance = 0;
740
                wire_orpc_extent->id = GUID_NULL;
741 742 743 744 745
                wire_orpc_extent->size = 0;
                msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(WIRE_ORPC_EXTENT, data[0]);
            }
        }

746 747 748 749 750 751
        /* store the prefixed data length so that we can restore the real buffer
         * pointer in ClientRpcChannelBuffer_SendReceive. */
        message_state->prefix_data_len = (char *)msg->Buffer - (char *)orpcthis;
        msg->BufferLength -= message_state->prefix_data_len;
    }

752 753
    HeapFree(GetProcessHeap(), 0, channel_hook_data);

754 755 756
    TRACE("-- %ld\n", status);

    return HRESULT_FROM_WIN32(status);
757 758
}

759 760 761 762 763 764
static HRESULT WINAPI ServerRpcChannelBuffer_SendReceive(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE *olemsg, ULONG *pstatus)
{
    FIXME("stub\n");
    return E_NOTIMPL;
}

765 766 767
/* this thread runs an outgoing RPC */
static DWORD WINAPI rpc_sendreceive_thread(LPVOID param)
{
768
    struct dispatch_params *data = (struct dispatch_params *) param;
769

770 771
    /* Note: I_RpcSendReceive doesn't raise exceptions like the higher-level
     * RPC functions do */
772
    data->status = I_RpcSendReceive((RPC_MESSAGE *)data->msg);
773 774

    TRACE("completed with status 0x%lx\n", data->status);
775 776 777

    SetEvent(data->handle);

778 779 780
    return 0;
}

781 782 783 784 785 786 787 788 789 790 791 792 793
static inline HRESULT ClientRpcChannelBuffer_IsCorrectApartment(ClientRpcChannelBuffer *This, APARTMENT *apt)
{
    OXID oxid;
    if (!apt)
        return S_FALSE;
    if (apartment_getoxid(apt, &oxid) != S_OK)
        return S_FALSE;
    if (This->oxid != oxid)
        return S_FALSE;
    return S_OK;
}

static HRESULT WINAPI ClientRpcChannelBuffer_SendReceive(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE *olemsg, ULONG *pstatus)
794
{
795 796
    ClientRpcChannelBuffer *This = (ClientRpcChannelBuffer *)iface;
    HRESULT hr;
797
    RPC_MESSAGE *msg = (RPC_MESSAGE *)olemsg;
798
    RPC_STATUS status;
799
    DWORD index;
800
    struct message_state *message_state;
801 802 803
    ORPCTHAT orpcthat;
    ORPC_EXTENT_ARRAY orpc_ext_array;
    WIRE_ORPC_EXTENT *first_wire_orpc_extent = NULL;
804
    HRESULT hrFault = S_OK;
805

806
    TRACE("(%p) iMethod=%d\n", olemsg, olemsg->iMethod);
807

808 809 810 811 812 813 814
    hr = ClientRpcChannelBuffer_IsCorrectApartment(This, COM_CurrentApt());
    if (hr != S_OK)
    {
        ERR("called from wrong apartment, should have been 0x%s\n",
            wine_dbgstr_longlong(This->oxid));
        return RPC_E_WRONG_THREAD;
    }
Austin English's avatar
Austin English committed
815 816
    /* This situation should be impossible in multi-threaded apartments,
     * because the calling thread isn't re-enterable.
817 818 819 820 821 822 823 824 825 826
     * Note: doing a COM call during the processing of a sent message is
     * only disallowed if a client call is already being waited for
     * completion */
    if (!COM_CurrentApt()->multi_threaded &&
        COM_CurrentInfo()->pending_call_count_client &&
        InSendMessage())
    {
        ERR("can't make an outgoing COM call in response to a sent message\n");
        return RPC_E_CANTCALLOUT_ININPUTSYNCCALL;
    }
827

828 829 830 831 832 833
    message_state = (struct message_state *)msg->Handle;
    /* restore the binding handle and the real start of data */
    msg->Handle = message_state->binding_handle;
    msg->Buffer = (char *)msg->Buffer - message_state->prefix_data_len;
    msg->BufferLength += message_state->prefix_data_len;

834 835 836 837 838 839 840
    /* Note: this is an optimization in the Microsoft OLE runtime that we need
     * to copy, as shown by the test_no_couninitialize_client test. without
     * short-circuiting the RPC runtime in the case below, the test will
     * deadlock on the loader lock due to the RPC runtime needing to create
     * a thread to process the RPC when this function is called indirectly
     * from DllMain */

841
    message_state->params.msg = olemsg;
842
    if (message_state->params.bypass_rpcrt)
843
    {
844
        TRACE("Calling apartment thread 0x%08x...\n", message_state->target_tid);
845

846 847
        msg->ProcNum &= ~RPC_FLAGS_VALID_BIT;

848
        if (!PostMessageW(message_state->target_hwnd, DM_EXECUTERPC, 0,
849
                          (LPARAM)&message_state->params))
850
        {
851
            ERR("PostMessage failed with error %u\n", GetLastError());
852 853 854 855

            /* Note: message_state->params.iface doesn't have a reference and
             * so doesn't need to be released */

856 857
            hr = HRESULT_FROM_WIN32(GetLastError());
        }
858 859
    }
    else
860
    {
861 862 863 864 865 866
        /* we use a separate thread here because we need to be able to
         * pump the message loop in the application thread: if we do not,
         * any windows created by this thread will hang and RPCs that try
         * and re-enter this STA from an incoming server thread will
         * deadlock. InstallShield is an example of that.
         */
867
        if (!QueueUserWorkItem(rpc_sendreceive_thread, &message_state->params, WT_EXECUTEDEFAULT))
868
        {
869
            ERR("QueueUserWorkItem failed with error %u\n", GetLastError());
870 871
            hr = E_UNEXPECTED;
        }
872 873
        else
            hr = S_OK;
874
    }
875

876
    if (hr == S_OK)
877
    {
878
        if (WaitForSingleObject(message_state->params.handle, 0))
879 880
        {
            COM_CurrentInfo()->pending_call_count_client++;
881
            hr = CoWaitForMultipleHandles(0, INFINITE, 1, &message_state->params.handle, &index);
882 883
            COM_CurrentInfo()->pending_call_count_client--;
        }
884
    }
885
    ClientRpcChannelBuffer_ReleaseEventHandle(This, message_state->params.handle);
886

887 888
    /* for WM shortcut, faults are returned in params->hr */
    if (hr == S_OK)
889
        hrFault = message_state->params.hr;
890

891
    status = message_state->params.status;
892

893 894 895
    orpcthat.flags = ORPCF_NULL;
    orpcthat.extensions = NULL;

896
    TRACE("RPC call status: 0x%lx\n", status);
897
    if (status != RPC_S_OK)
898 899 900 901 902
        hr = HRESULT_FROM_WIN32(status);

    TRACE("hrFault = 0x%08x\n", hrFault);

    /* FIXME: this condition should be
903
     * "hr == S_OK && (!hrFault || msg->BufferLength > FIELD_OFFSET(ORPCTHAT, extensions) + 4)"
904 905 906
     * but we don't currently reset the message length for PostMessage
     * dispatched calls */
    if (hr == S_OK && hrFault == S_OK)
907 908 909 910 911 912 913 914 915 916
    {
        HRESULT hr2;
        char *original_buffer = msg->Buffer;

        /* handle ORPCTHAT and client extensions */

        hr2 = unmarshal_ORPCTHAT(msg, &orpcthat, &orpc_ext_array, &first_wire_orpc_extent);
        if (FAILED(hr2))
            hr = hr2;

917
        message_state->prefix_data_len = (char *)msg->Buffer - original_buffer;
918 919 920 921 922
        msg->BufferLength -= message_state->prefix_data_len;
    }
    else
        message_state->prefix_data_len = 0;

923 924 925 926 927 928 929 930
    if (hr == S_OK)
    {
        ChannelHooks_ClientNotify(&message_state->channel_hook_info,
                                  msg->DataRepresentation,
                                  first_wire_orpc_extent,
                                  orpcthat.extensions && first_wire_orpc_extent ? orpcthat.extensions->size : 0,
                                  hrFault);
    }
931 932 933 934

    /* save away the message state again */
    msg->Handle = message_state;

935 936
    if (pstatus) *pstatus = status;

937 938
    if (hr == S_OK)
        hr = hrFault;
939

940
    TRACE("-- 0x%08x\n", hr);
941 942

    return hr;
943 944
}

945
static HRESULT WINAPI ServerRpcChannelBuffer_FreeBuffer(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE* olemsg)
946
{
947 948
    RPC_MESSAGE *msg = (RPC_MESSAGE *)olemsg;
    RPC_STATUS status;
949
    struct message_state *message_state;
950 951 952

    TRACE("(%p)\n", msg);

953 954 955 956 957 958 959
    message_state = (struct message_state *)msg->Handle;
    /* restore the binding handle and the real start of data */
    msg->Handle = message_state->binding_handle;
    msg->Buffer = (char *)msg->Buffer - message_state->prefix_data_len;
    msg->BufferLength += message_state->prefix_data_len;
    message_state->prefix_data_len = 0;

960 961 962 963 964 965 966
    if (message_state->bypass_rpcrt)
    {
        HeapFree(GetProcessHeap(), 0, msg->Buffer);
        status = RPC_S_OK;
    }
    else
        status = I_RpcFreeBuffer(msg);
967

968 969
    msg->Handle = message_state;

970 971 972 973 974 975 976 977 978
    TRACE("-- %ld\n", status);

    return HRESULT_FROM_WIN32(status);
}

static HRESULT WINAPI ClientRpcChannelBuffer_FreeBuffer(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE* olemsg)
{
    RPC_MESSAGE *msg = (RPC_MESSAGE *)olemsg;
    RPC_STATUS status;
979
    struct message_state *message_state;
980 981 982

    TRACE("(%p)\n", msg);

983 984 985 986 987 988
    message_state = (struct message_state *)msg->Handle;
    /* restore the binding handle and the real start of data */
    msg->Handle = message_state->binding_handle;
    msg->Buffer = (char *)msg->Buffer - message_state->prefix_data_len;
    msg->BufferLength += message_state->prefix_data_len;

989 990 991 992 993 994 995
    if (message_state->params.bypass_rpcrt)
    {
        HeapFree(GetProcessHeap(), 0, msg->Buffer);
        status = RPC_S_OK;
    }
    else
        status = I_RpcFreeBuffer(msg);
996 997 998

    HeapFree(GetProcessHeap(), 0, msg->RpcInterfaceInformation);
    msg->RpcInterfaceInformation = NULL;
999 1000 1001 1002 1003

    if (message_state->params.stub)
        IRpcStubBuffer_Release(message_state->params.stub);
    if (message_state->params.chan)
        IRpcChannelBuffer_Release(message_state->params.chan);
1004
    HeapFree(GetProcessHeap(), 0, message_state);
1005 1006 1007 1008

    TRACE("-- %ld\n", status);

    return HRESULT_FROM_WIN32(status);
1009 1010
}

1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023
static HRESULT WINAPI ClientRpcChannelBuffer_GetDestCtx(LPRPCCHANNELBUFFER iface, DWORD* pdwDestContext, void** ppvDestContext)
{
    ClientRpcChannelBuffer *This = (ClientRpcChannelBuffer *)iface;

    TRACE("(%p,%p)\n", pdwDestContext, ppvDestContext);

    *pdwDestContext = This->dest_context;
    *ppvDestContext = This->dest_context_data;

    return S_OK;
}

static HRESULT WINAPI ServerRpcChannelBuffer_GetDestCtx(LPRPCCHANNELBUFFER iface, DWORD* pdwDestContext, void** ppvDestContext)
1024
{
1025 1026 1027 1028 1029 1030 1031
    WARN("(%p,%p), stub!\n", pdwDestContext, ppvDestContext);

    /* FIXME: implement this by storing the dwDestContext and pvDestContext
     * values passed into IMarshal_MarshalInterface and returning them here */
    *pdwDestContext = MSHCTX_DIFFERENTMACHINE;
    *ppvDestContext = NULL;
    return S_OK;
1032
}
1033

1034 1035 1036 1037 1038 1039
static HRESULT WINAPI RpcChannelBuffer_IsConnected(LPRPCCHANNELBUFFER iface)
{
    TRACE("()\n");
    /* native does nothing too */
    return S_OK;
}
1040

1041 1042 1043 1044 1045 1046
static const IRpcChannelBufferVtbl ClientRpcChannelBufferVtbl =
{
    RpcChannelBuffer_QueryInterface,
    RpcChannelBuffer_AddRef,
    ClientRpcChannelBuffer_Release,
    ClientRpcChannelBuffer_GetBuffer,
1047
    ClientRpcChannelBuffer_SendReceive,
1048
    ClientRpcChannelBuffer_FreeBuffer,
1049
    ClientRpcChannelBuffer_GetDestCtx,
1050 1051
    RpcChannelBuffer_IsConnected
};
1052

1053 1054 1055 1056 1057 1058
static const IRpcChannelBufferVtbl ServerRpcChannelBufferVtbl =
{
    RpcChannelBuffer_QueryInterface,
    RpcChannelBuffer_AddRef,
    ServerRpcChannelBuffer_Release,
    ServerRpcChannelBuffer_GetBuffer,
1059
    ServerRpcChannelBuffer_SendReceive,
1060
    ServerRpcChannelBuffer_FreeBuffer,
1061
    ServerRpcChannelBuffer_GetDestCtx,
1062 1063
    RpcChannelBuffer_IsConnected
};
1064

1065
/* returns a channel buffer for proxies */
1066
HRESULT RPC_CreateClientChannel(const OXID *oxid, const IPID *ipid,
1067
                                const OXID_INFO *oxid_info,
1068 1069
                                DWORD dest_context, void *dest_context_data,
                                IRpcChannelBuffer **chan)
1070
{
1071 1072 1073 1074 1075 1076
    ClientRpcChannelBuffer *This;
    WCHAR                   endpoint[200];
    RPC_BINDING_HANDLE      bind;
    RPC_STATUS              status;
    LPWSTR                  string_binding;

1077
    /* FIXME: get the endpoint from oxid_info->psa instead */
1078
    get_rpc_endpoint(endpoint, oxid);
1079

1080 1081 1082 1083
    TRACE("proxy pipe: connecting to endpoint: %s\n", debugstr_w(endpoint));

    status = RpcStringBindingComposeW(
        NULL,
1084
        wszRpcTransport,
1085 1086 1087 1088 1089 1090
        NULL,
        endpoint,
        NULL,
        &string_binding);
        
    if (status == RPC_S_OK)
1091
    {
1092 1093 1094
        status = RpcBindingFromStringBindingW(string_binding, &bind);

        if (status == RPC_S_OK)
1095
        {
1096 1097
            IPID ipid2 = *ipid; /* why can't RpcBindingSetObject take a const? */
            status = RpcBindingSetObject(bind, &ipid2);
1098 1099
            if (status != RPC_S_OK)
                RpcBindingFree(&bind);
1100
        }
1101 1102

        RpcStringFreeW(&string_binding);
1103 1104
    }

1105 1106 1107 1108
    if (status != RPC_S_OK)
    {
        ERR("Couldn't get binding for endpoint %s, status = %ld\n", debugstr_w(endpoint), status);
        return HRESULT_FROM_WIN32(status);
1109 1110
    }

1111 1112 1113 1114 1115 1116
    This = HeapAlloc(GetProcessHeap(), 0, sizeof(*This));
    if (!This)
    {
        RpcBindingFree(&bind);
        return E_OUTOFMEMORY;
    }
1117

1118 1119 1120
    This->super.lpVtbl = &ClientRpcChannelBufferVtbl;
    This->super.refs = 1;
    This->bind = bind;
1121
    apartment_getoxid(COM_CurrentApt(), &This->oxid);
1122
    This->server_pid = oxid_info->dwPid;
1123 1124
    This->dest_context = dest_context;
    This->dest_context_data = dest_context_data;
1125
    This->event = NULL;
1126

1127
    *chan = (IRpcChannelBuffer*)This;
1128

1129
    return S_OK;
1130 1131
}

1132
HRESULT RPC_CreateServerChannel(IRpcChannelBuffer **chan)
1133
{
1134 1135 1136 1137 1138 1139 1140 1141 1142
    RpcChannelBuffer *This = HeapAlloc(GetProcessHeap(), 0, sizeof(*This));
    if (!This)
        return E_OUTOFMEMORY;

    This->lpVtbl = &ServerRpcChannelBufferVtbl;
    This->refs = 1;
    
    *chan = (IRpcChannelBuffer*)This;

1143 1144 1145
    return S_OK;
}

1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174
/* unmarshals ORPC_EXTENT_ARRAY according to NDR rules, but doesn't allocate
 * any memory */
static HRESULT unmarshal_ORPC_EXTENT_ARRAY(RPC_MESSAGE *msg, const char *end,
                                           ORPC_EXTENT_ARRAY *extensions,
                                           WIRE_ORPC_EXTENT **first_wire_orpc_extent)
{
    DWORD pointer_id;
    DWORD i;

    memcpy(extensions, msg->Buffer, FIELD_OFFSET(ORPC_EXTENT_ARRAY, extent));
    msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(ORPC_EXTENT_ARRAY, extent);

    if ((const char *)msg->Buffer + 2 * sizeof(DWORD) > end)
        return RPC_E_INVALID_HEADER;

    pointer_id = *(DWORD *)msg->Buffer;
    msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);
    extensions->extent = NULL;

    if (pointer_id)
    {
        WIRE_ORPC_EXTENT *wire_orpc_extent;

        /* conformance */
        if (*(DWORD *)msg->Buffer != ((extensions->size+1)&~1))
            return RPC_S_INVALID_BOUND;

        msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);

Austin English's avatar
Austin English committed
1175
        /* arbitrary limit for security (don't know what native does) */
1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199
        if (extensions->size > 256)
        {
            ERR("too many extensions: %ld\n", extensions->size);
            return RPC_S_INVALID_BOUND;
        }

        *first_wire_orpc_extent = wire_orpc_extent = (WIRE_ORPC_EXTENT *)msg->Buffer;
        for (i = 0; i < ((extensions->size+1)&~1); i++)
        {
            if ((const char *)&wire_orpc_extent->data[0] > end)
                return RPC_S_INVALID_BOUND;
            if (wire_orpc_extent->conformance != ((wire_orpc_extent->size+7)&~7))
                return RPC_S_INVALID_BOUND;
            if ((const char *)&wire_orpc_extent->data[wire_orpc_extent->conformance] > end)
                return RPC_S_INVALID_BOUND;
            TRACE("size %u, guid %s\n", wire_orpc_extent->size, debugstr_guid(&wire_orpc_extent->id));
            wire_orpc_extent = (WIRE_ORPC_EXTENT *)&wire_orpc_extent->data[wire_orpc_extent->conformance];
        }
        msg->Buffer = wire_orpc_extent;
    }

    return S_OK;
}

1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228
/* unmarshals ORPCTHIS according to NDR rules, but doesn't allocate any memory */
static HRESULT unmarshal_ORPCTHIS(RPC_MESSAGE *msg, ORPCTHIS *orpcthis,
    ORPC_EXTENT_ARRAY *orpc_ext_array, WIRE_ORPC_EXTENT **first_wire_orpc_extent)
{
    const char *end = (char *)msg->Buffer + msg->BufferLength;

    *first_wire_orpc_extent = NULL;

    if (msg->BufferLength < FIELD_OFFSET(ORPCTHIS, extensions) + 4)
    {
        ERR("invalid buffer length\n");
        return RPC_E_INVALID_HEADER;
    }

    memcpy(orpcthis, msg->Buffer, FIELD_OFFSET(ORPCTHIS, extensions));
    msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(ORPCTHIS, extensions);

    if ((const char *)msg->Buffer + sizeof(DWORD) > end)
        return RPC_E_INVALID_HEADER;

    if (*(DWORD *)msg->Buffer)
        orpcthis->extensions = orpc_ext_array;
    else
        orpcthis->extensions = NULL;

    msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);

    if (orpcthis->extensions)
    {
1229 1230 1231 1232
        HRESULT hr = unmarshal_ORPC_EXTENT_ARRAY(msg, end, orpc_ext_array,
                                                 first_wire_orpc_extent);
        if (FAILED(hr))
            return hr;
1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246
    }

    if ((orpcthis->version.MajorVersion != COM_MAJOR_VERSION) ||
        (orpcthis->version.MinorVersion > COM_MINOR_VERSION))
    {
        ERR("COM version {%d, %d} not supported\n",
            orpcthis->version.MajorVersion, orpcthis->version.MinorVersion);
        return RPC_E_VERSION_MISMATCH;
    }

    if (orpcthis->flags & ~(ORPCF_LOCAL|ORPCF_RESERVED1|ORPCF_RESERVED2|ORPCF_RESERVED3|ORPCF_RESERVED4))
    {
        ERR("invalid flags 0x%lx\n", orpcthis->flags & ~(ORPCF_LOCAL|ORPCF_RESERVED1|ORPCF_RESERVED2|ORPCF_RESERVED3|ORPCF_RESERVED4));
        return RPC_E_INVALID_HEADER;
1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289
    }

    return S_OK;
}

static HRESULT unmarshal_ORPCTHAT(RPC_MESSAGE *msg, ORPCTHAT *orpcthat,
                                  ORPC_EXTENT_ARRAY *orpc_ext_array, WIRE_ORPC_EXTENT **first_wire_orpc_extent)
{
    const char *end = (char *)msg->Buffer + msg->BufferLength;

    *first_wire_orpc_extent = NULL;

    if (msg->BufferLength < FIELD_OFFSET(ORPCTHAT, extensions) + 4)
    {
        ERR("invalid buffer length\n");
        return RPC_E_INVALID_HEADER;
    }

    memcpy(orpcthat, msg->Buffer, FIELD_OFFSET(ORPCTHAT, extensions));
    msg->Buffer = (char *)msg->Buffer + FIELD_OFFSET(ORPCTHAT, extensions);

    if ((const char *)msg->Buffer + sizeof(DWORD) > end)
        return RPC_E_INVALID_HEADER;

    if (*(DWORD *)msg->Buffer)
        orpcthat->extensions = orpc_ext_array;
    else
        orpcthat->extensions = NULL;

    msg->Buffer = (char *)msg->Buffer + sizeof(DWORD);

    if (orpcthat->extensions)
    {
        HRESULT hr = unmarshal_ORPC_EXTENT_ARRAY(msg, end, orpc_ext_array,
                                                 first_wire_orpc_extent);
        if (FAILED(hr))
            return hr;
    }

    if (orpcthat->flags & ~(ORPCF_LOCAL|ORPCF_RESERVED1|ORPCF_RESERVED2|ORPCF_RESERVED3|ORPCF_RESERVED4))
    {
        ERR("invalid flags 0x%lx\n", orpcthat->flags & ~(ORPCF_LOCAL|ORPCF_RESERVED1|ORPCF_RESERVED2|ORPCF_RESERVED3|ORPCF_RESERVED4));
        return RPC_E_INVALID_HEADER;
1290 1291 1292 1293
    }

    return S_OK;
}
1294

1295
void RPC_ExecuteCall(struct dispatch_params *params)
1296
{
1297
    struct message_state *message_state = NULL;
1298 1299 1300 1301 1302
    RPC_MESSAGE *msg = (RPC_MESSAGE *)params->msg;
    char *original_buffer = msg->Buffer;
    ORPCTHIS orpcthis;
    ORPC_EXTENT_ARRAY orpc_ext_array;
    WIRE_ORPC_EXTENT *first_wire_orpc_extent;
1303
    GUID old_causality_id;
1304

1305 1306
    /* handle ORPCTHIS and server extensions */

1307 1308
    params->hr = unmarshal_ORPCTHIS(msg, &orpcthis, &orpc_ext_array, &first_wire_orpc_extent);
    if (params->hr != S_OK)
1309 1310
    {
        msg->Buffer = original_buffer;
1311
        goto exit;
1312
    }
1313 1314 1315 1316 1317

    message_state = HeapAlloc(GetProcessHeap(), 0, sizeof(*message_state));
    if (!message_state)
    {
        params->hr = E_OUTOFMEMORY;
1318
        msg->Buffer = original_buffer;
1319 1320 1321
        goto exit;
    }

1322
    message_state->prefix_data_len = (char *)msg->Buffer - original_buffer;
1323
    message_state->binding_handle = msg->Handle;
1324
    message_state->bypass_rpcrt = params->bypass_rpcrt;
1325

1326
    message_state->channel_hook_info.iid = params->iid;
1327 1328 1329 1330
    message_state->channel_hook_info.cbSize = sizeof(message_state->channel_hook_info);
    message_state->channel_hook_info.uCausality = orpcthis.cid;
    message_state->channel_hook_info.dwServerPid = GetCurrentProcessId();
    message_state->channel_hook_info.iMethod = msg->ProcNum;
1331
    message_state->channel_hook_info.pObject = params->iface;
1332 1333 1334 1335 1336

    if (orpcthis.extensions && first_wire_orpc_extent &&
        orpcthis.extensions->size)
        ChannelHooks_ServerNotify(&message_state->channel_hook_info, msg->DataRepresentation, first_wire_orpc_extent, orpcthis.extensions->size);

1337 1338 1339
    msg->Handle = message_state;
    msg->BufferLength -= message_state->prefix_data_len;

1340 1341 1342 1343 1344 1345
    /* call message filter */

    if (COM_CurrentApt()->filter)
    {
        DWORD handlecall;
        INTERFACEINFO interface_info;
1346
        CALLTYPE calltype;
1347

1348 1349
        interface_info.pUnk = params->iface;
        interface_info.iid = params->iid;
1350
        interface_info.wMethod = msg->ProcNum;
1351

1352 1353
        if (IsEqualGUID(&orpcthis.cid, &COM_CurrentInfo()->causality_id))
            calltype = CALLTYPE_NESTED;
1354
        else if (COM_CurrentInfo()->pending_call_count_server == 0)
1355
            calltype = CALLTYPE_TOPLEVEL;
1356 1357 1358
        else
            calltype = CALLTYPE_TOPLEVEL_CALLPENDING;

1359
        handlecall = IMessageFilter_HandleInComingCall(COM_CurrentApt()->filter,
1360
                                                       calltype,
1361 1362 1363 1364 1365 1366 1367 1368
                                                       (HTASK)GetCurrentProcessId(),
                                                       0 /* FIXME */,
                                                       &interface_info);
        TRACE("IMessageFilter_HandleInComingCall returned %d\n", handlecall);
        switch (handlecall)
        {
        case SERVERCALL_REJECTED:
            params->hr = RPC_E_CALL_REJECTED;
1369
            goto exit_reset_state;
1370 1371 1372
        case SERVERCALL_RETRYLATER:
#if 0 /* FIXME: handle retries on the client side before enabling this code */
            params->hr = RPC_E_RETRY;
1373
            goto exit_reset_state;
1374 1375 1376 1377 1378 1379 1380 1381 1382 1383
#else
            FIXME("retry call later not implemented\n");
            break;
#endif
        case SERVERCALL_ISHANDLED:
        default:
            break;
        }
    }

1384 1385
    /* invoke the method */

1386 1387 1388 1389 1390
    /* save the old causality ID - note: any calls executed while processing
     * messages received during the SendReceive will appear to originate from
     * this call - this should be checked with what Windows does */
    old_causality_id = COM_CurrentInfo()->causality_id;
    COM_CurrentInfo()->causality_id = orpcthis.cid;
1391
    COM_CurrentInfo()->pending_call_count_server++;
1392
    params->hr = IRpcStubBuffer_Invoke(params->stub, params->msg, params->chan);
1393
    COM_CurrentInfo()->pending_call_count_server--;
1394
    COM_CurrentInfo()->causality_id = old_causality_id;
1395

1396 1397 1398 1399
    /* the invoke allocated a new buffer, so free the old one */
    if (message_state->bypass_rpcrt && original_buffer != msg->Buffer)
        HeapFree(GetProcessHeap(), 0, original_buffer);

1400
exit_reset_state:
1401 1402 1403 1404 1405 1406
    message_state = (struct message_state *)msg->Handle;
    msg->Handle = message_state->binding_handle;
    msg->Buffer = (char *)msg->Buffer - message_state->prefix_data_len;
    msg->BufferLength += message_state->prefix_data_len;

exit:
1407
    HeapFree(GetProcessHeap(), 0, message_state);
1408
    if (params->handle) SetEvent(params->handle);
1409 1410
}

1411 1412
static void __RPC_STUB dispatch_rpc(RPC_MESSAGE *msg)
{
1413
    struct dispatch_params *params;
1414 1415 1416
    APARTMENT *apt;
    IPID ipid;
    HRESULT hr;
1417

1418
    RpcBindingInqObject(msg->Handle, &ipid);
1419

1420 1421
    TRACE("ipid = %s, iMethod = %d\n", debugstr_guid(&ipid), msg->ProcNum);

1422
    params = HeapAlloc(GetProcessHeap(), 0, sizeof(*params));
1423 1424 1425 1426 1427
    if (!params)
    {
        RpcRaiseException(E_OUTOFMEMORY);
        return;
    }
1428

1429 1430
    hr = ipid_get_dispatch_params(&ipid, &apt, &params->stub, &params->chan,
                                  &params->iid, &params->iface);
1431
    if (hr != S_OK)
1432
    {
1433
        ERR("no apartment found for ipid %s\n", debugstr_guid(&ipid));
1434
        HeapFree(GetProcessHeap(), 0, params);
1435 1436
        RpcRaiseException(hr);
        return;
1437 1438
    }

1439 1440
    params->msg = (RPCOLEMESSAGE *)msg;
    params->status = RPC_S_OK;
1441 1442
    params->hr = S_OK;
    params->handle = NULL;
1443
    params->bypass_rpcrt = FALSE;
1444

1445 1446 1447
    /* Note: this is the important difference between STAs and MTAs - we
     * always execute RPCs to STAs in the thread that originally created the
     * apartment (i.e. the one that pumps messages to the window) */
1448
    if (!apt->multi_threaded)
1449 1450 1451
    {
        params->handle = CreateEventW(NULL, FALSE, FALSE, NULL);

1452
        TRACE("Calling apartment thread 0x%08x...\n", apt->tid);
1453

1454
        if (PostMessageW(apartment_getwindow(apt), DM_EXECUTERPC, 0, (LPARAM)params))
1455 1456 1457
            WaitForSingleObject(params->handle, INFINITE);
        else
        {
1458
            ERR("PostMessage failed with error %u\n", GetLastError());
1459 1460 1461
            IRpcChannelBuffer_Release(params->chan);
            IRpcStubBuffer_Release(params->stub);
        }
1462 1463
        CloseHandle(params->handle);
    }
1464
    else
1465 1466 1467 1468 1469 1470 1471
    {
        BOOL joined = FALSE;
        if (!COM_CurrentInfo()->apt)
        {
            apartment_joinmta();
            joined = TRUE;
        }
1472
        RPC_ExecuteCall(params);
1473 1474 1475 1476 1477 1478
        if (joined)
        {
            apartment_release(COM_CurrentInfo()->apt);
            COM_CurrentInfo()->apt = NULL;
        }
    }
1479

1480
    hr = params->hr;
1481 1482 1483 1484
    if (params->chan)
        IRpcChannelBuffer_Release(params->chan);
    if (params->stub)
        IRpcStubBuffer_Release(params->stub);
1485
    HeapFree(GetProcessHeap(), 0, params);
1486

1487
    apartment_release(apt);
1488 1489 1490 1491

    /* if IRpcStubBuffer_Invoke fails, we should raise an exception to tell
     * the RPC runtime that the call failed */
    if (hr) RpcRaiseException(hr);
1492 1493
}

1494 1495
/* stub registration */
HRESULT RPC_RegisterInterface(REFIID riid)
1496
{
1497 1498 1499 1500 1501
    struct registered_if *rif;
    BOOL found = FALSE;
    HRESULT hr = S_OK;
    
    TRACE("(%s)\n", debugstr_guid(riid));
1502

1503 1504
    EnterCriticalSection(&csRegIf);
    LIST_FOR_EACH_ENTRY(rif, &registered_interfaces, struct registered_if, entry)
1505
    {
1506 1507 1508 1509 1510 1511
        if (IsEqualGUID(&rif->If.InterfaceId.SyntaxGUID, riid))
        {
            rif->refs++;
            found = TRUE;
            break;
        }
1512
    }
1513 1514 1515
    if (!found)
    {
        TRACE("Creating new interface\n");
1516

1517
        rif = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(*rif));
1518 1519 1520 1521 1522 1523 1524 1525 1526
        if (rif)
        {
            RPC_STATUS status;

            rif->refs = 1;
            rif->If.Length = sizeof(RPC_SERVER_INTERFACE);
            /* RPC interface ID = COM interface ID */
            rif->If.InterfaceId.SyntaxGUID = *riid;
            rif->If.DispatchTable = &rpc_dispatch;
1527 1528
            /* all other fields are 0, including the version asCOM objects
             * always have a version of 0.0 */
1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548
            status = RpcServerRegisterIfEx(
                (RPC_IF_HANDLE)&rif->If,
                NULL, NULL,
                RPC_IF_OLE | RPC_IF_AUTOLISTEN,
                RPC_C_LISTEN_MAX_CALLS_DEFAULT,
                NULL);
            if (status == RPC_S_OK)
                list_add_tail(&registered_interfaces, &rif->entry);
            else
            {
                ERR("RpcServerRegisterIfEx failed with error %ld\n", status);
                HeapFree(GetProcessHeap(), 0, rif);
                hr = HRESULT_FROM_WIN32(status);
            }
        }
        else
            hr = E_OUTOFMEMORY;
    }
    LeaveCriticalSection(&csRegIf);
    return hr;
1549 1550
}

1551 1552
/* stub unregistration */
void RPC_UnregisterInterface(REFIID riid)
1553
{
1554 1555 1556
    struct registered_if *rif;
    EnterCriticalSection(&csRegIf);
    LIST_FOR_EACH_ENTRY(rif, &registered_interfaces, struct registered_if, entry)
1557
    {
1558
        if (IsEqualGUID(&rif->If.InterfaceId.SyntaxGUID, riid))
1559
        {
1560 1561
            if (!--rif->refs)
            {
1562
                RpcServerUnregisterIf((RPC_IF_HANDLE)&rif->If, NULL, TRUE);
1563 1564 1565 1566
                list_remove(&rif->entry);
                HeapFree(GetProcessHeap(), 0, rif);
            }
            break;
1567
        }
1568 1569 1570
    }
    LeaveCriticalSection(&csRegIf);
}
1571

1572 1573
/* get the info for an OXID, including the IPID for the rem unknown interface
 * and the string binding */
1574 1575
HRESULT RPC_ResolveOxid(OXID oxid, OXID_INFO *oxid_info)
{
1576 1577
    TRACE("%s\n", wine_dbgstr_longlong(oxid));

1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592
    oxid_info->dwTid = 0;
    oxid_info->dwPid = 0;
    oxid_info->dwAuthnHint = RPC_C_AUTHN_LEVEL_NONE;
    /* FIXME: this is a hack around not having an OXID resolver yet -
     * this function should contact the machine's OXID resolver and then it
     * should give us the IPID of the IRemUnknown interface */
    oxid_info->ipidRemUnknown.Data1 = 0xffffffff;
    oxid_info->ipidRemUnknown.Data2 = 0xffff;
    oxid_info->ipidRemUnknown.Data3 = 0xffff;
    memcpy(&oxid_info->ipidRemUnknown.Data4, &oxid, sizeof(OXID));
    oxid_info->psa = NULL /* FIXME */;

    return S_OK;
}

1593 1594 1595
/* make the apartment reachable by other threads and processes and create the
 * IRemUnknown object */
void RPC_StartRemoting(struct apartment *apt)
1596
{
1597
    if (!InterlockedExchange(&apt->remoting_started, TRUE))
1598 1599 1600
    {
        WCHAR endpoint[200];
        RPC_STATUS status;
1601

1602
        get_rpc_endpoint(endpoint, &apt->oxid);
1603
    
1604
        status = RpcServerUseProtseqEpW(
1605
            wszRpcTransport,
1606 1607 1608 1609 1610
            RPC_C_PROTSEQ_MAX_REQS_DEFAULT,
            endpoint,
            NULL);
        if (status != RPC_S_OK)
            ERR("Couldn't register endpoint %s\n", debugstr_w(endpoint));
1611 1612

        /* FIXME: move remote unknown exporting into this function */
1613
    }
1614
    start_apartment_remote_unknown();
1615 1616
}

1617

1618
static HRESULT create_server(REFCLSID rclsid)
1619
{
1620
    static const WCHAR  wszLocalServer32[] = { 'L','o','c','a','l','S','e','r','v','e','r','3','2',0 };
1621 1622
    static const WCHAR  embedding[] = { ' ', '-','E','m','b','e','d','d','i','n','g',0 };
    HKEY                key;
1623
    HRESULT             hres;
1624
    WCHAR               command[MAX_PATH+sizeof(embedding)/sizeof(WCHAR)];
1625
    DWORD               size = (MAX_PATH+1) * sizeof(WCHAR);
1626 1627 1628
    STARTUPINFOW        sinfo;
    PROCESS_INFORMATION pinfo;

1629 1630
    hres = COM_OpenKeyForCLSID(rclsid, wszLocalServer32, KEY_READ, &key);
    if (FAILED(hres)) {
1631
        ERR("class %s not registered\n", debugstr_guid(rclsid));
1632
        return hres;
1633
    }
1634

1635
    hres = RegQueryValueExW(key, NULL, NULL, NULL, (LPBYTE)command, &size);
1636 1637 1638 1639 1640
    RegCloseKey(key);
    if (hres) {
        WARN("No default value for LocalServer32 key\n");
        return REGDB_E_CLASSNOTREG; /* FIXME: check retval */
    }
1641

1642 1643
    memset(&sinfo,0,sizeof(sinfo));
    sinfo.cb = sizeof(sinfo);
1644

1645
    /* EXE servers are started with the -Embedding switch. */
1646

1647
    strcatW(command, embedding);
1648

1649
    TRACE("activating local server %s for %s\n", debugstr_w(command), debugstr_guid(rclsid));
1650

1651 1652 1653 1654
    /* FIXME: Win2003 supports a ServerExecutable value that is passed into
     * CreateProcess */
    if (!CreateProcessW(NULL, command, NULL, NULL, FALSE, 0, NULL, NULL, &sinfo, &pinfo)) {
        WARN("failed to run local server %s\n", debugstr_w(command));
1655
        return HRESULT_FROM_WIN32(GetLastError());
1656
    }
1657 1658
    CloseHandle(pinfo.hProcess);
    CloseHandle(pinfo.hThread);
1659

1660
    return S_OK;
1661
}
1662 1663 1664 1665

/*
 * start_local_service()  - start a service given its name and parameters
 */
1666
static DWORD start_local_service(LPCWSTR name, DWORD num, LPCWSTR *params)
1667 1668
{
    SC_HANDLE handle, hsvc;
1669
    DWORD     r = ERROR_FUNCTION_FAILED;
1670

1671
    TRACE("Starting service %s %d params\n", debugstr_w(name), num);
1672

1673
    handle = OpenSCManagerW(NULL, NULL, SC_MANAGER_CONNECT);
1674 1675
    if (!handle)
        return r;
1676
    hsvc = OpenServiceW(handle, name, SERVICE_START);
1677 1678
    if (hsvc)
    {
1679
        if(StartServiceW(hsvc, num, params))
1680 1681 1682
            r = ERROR_SUCCESS;
        else
            r = GetLastError();
1683
        if (r == ERROR_SERVICE_ALREADY_RUNNING)
1684 1685 1686
            r = ERROR_SUCCESS;
        CloseServiceHandle(hsvc);
    }
1687 1688
    else
        r = GetLastError();
1689 1690
    CloseServiceHandle(handle);

1691
    TRACE("StartService returned error %u (%s)\n", r, (r == ERROR_SUCCESS) ? "ok":"failed");
1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704

    return r;
}

/*
 * create_local_service()  - start a COM server in a service
 *
 *   To start a Local Service, we read the AppID value under
 * the class's CLSID key, then open the HKCR\\AppId key specified
 * there and check for a LocalService value.
 *
 * Note:  Local Services are not supported under Windows 9x
 */
1705
static HRESULT create_local_service(REFCLSID rclsid)
1706
{
1707
    HRESULT hres;
1708
    WCHAR buf[CHARS_IN_GUID];
1709 1710
    static const WCHAR szLocalService[] = { 'L','o','c','a','l','S','e','r','v','i','c','e',0 };
    static const WCHAR szServiceParams[] = {'S','e','r','v','i','c','e','P','a','r','a','m','s',0};
1711 1712 1713 1714 1715 1716
    HKEY hkey;
    LONG r;
    DWORD type, sz;

    TRACE("Attempting to start Local service for %s\n", debugstr_guid(rclsid));

1717
    hres = COM_OpenKeyForAppIdFromCLSID(rclsid, KEY_READ, &hkey);
1718
    if (FAILED(hres))
1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743
        return hres;

    /* read the LocalService and ServiceParameters values from the AppID key */
    sz = sizeof buf;
    r = RegQueryValueExW(hkey, szLocalService, NULL, &type, (LPBYTE)buf, &sz);
    if (r==ERROR_SUCCESS && type==REG_SZ)
    {
        DWORD num_args = 0;
        LPWSTR args[1] = { NULL };

        /*
         * FIXME: I'm not really sure how to deal with the service parameters.
         *        I suspect that the string returned from RegQueryValueExW
         *        should be split into a number of arguments by spaces.
         *        It would make more sense if ServiceParams contained a
         *        REG_MULTI_SZ here, but it's a REG_SZ for the services
         *        that I'm interested in for the moment.
         */
        r = RegQueryValueExW(hkey, szServiceParams, NULL, &type, NULL, &sz);
        if (r == ERROR_SUCCESS && type == REG_SZ && sz)
        {
            args[0] = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sz);
            num_args++;
            RegQueryValueExW(hkey, szServiceParams, NULL, &type, (LPBYTE)args[0], &sz);
        }
1744
        r = start_local_service(buf, num_args, (LPCWSTR *)args);
1745 1746
        if (r != ERROR_SUCCESS)
            hres = REGDB_E_CLASSNOTREG; /* FIXME: check retval */
1747 1748
        HeapFree(GetProcessHeap(),0,args[0]);
    }
1749 1750 1751 1752 1753
    else
    {
        WARN("No LocalService value\n");
        hres = REGDB_E_CLASSNOTREG; /* FIXME: check retval */
    }
1754
    RegCloseKey(hkey);
1755

1756 1757 1758
    return hres;
}

1759 1760 1761 1762 1763 1764 1765

static void get_localserver_pipe_name(WCHAR *pipefn, REFCLSID rclsid)
{
    static const WCHAR wszPipeRef[] = {'\\','\\','.','\\','p','i','p','e','\\',0};
    strcpyW(pipefn, wszPipeRef);
    StringFromGUID2(rclsid, pipefn + sizeof(wszPipeRef)/sizeof(wszPipeRef[0]) - 1, CHARS_IN_GUID);
}
1766 1767

/* FIXME: should call to rpcss instead */
1768
HRESULT RPC_GetLocalClassObject(REFCLSID rclsid, REFIID iid, LPVOID *ppv)
1769 1770 1771
{
    HRESULT        hres;
    HANDLE         hPipe;
1772
    WCHAR          pipefn[100];
1773 1774 1775 1776 1777 1778
    DWORD          res, bufferlen;
    char           marshalbuffer[200];
    IStream       *pStm;
    LARGE_INTEGER  seekto;
    ULARGE_INTEGER newpos;
    int            tries = 0;
1779

1780
    static const int MAXTRIES = 30; /* 30 seconds */
1781 1782 1783

    TRACE("rclsid=%s, iid=%s\n", debugstr_guid(rclsid), debugstr_guid(iid));

1784
    get_localserver_pipe_name(pipefn, rclsid);
1785 1786

    while (tries++ < MAXTRIES) {
1787
        TRACE("waiting for %s\n", debugstr_w(pipefn));
1788

1789 1790
        WaitNamedPipeW( pipefn, NMPWAIT_WAIT_FOREVER );
        hPipe = CreateFileW(pipefn, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, 0);
1791
        if (hPipe == INVALID_HANDLE_VALUE) {
1792
            DWORD index;
1793
            DWORD start_ticks;
1794
            if (tries == 1) {
1795 1796
                if ( (hres = create_local_service(rclsid)) &&
                     (hres = create_server(rclsid)) )
1797 1798
                    return hres;
            } else {
1799
                WARN("Connecting to %s, no response yet, retrying: le is %u\n", debugstr_w(pipefn), GetLastError());
1800
            }
1801 1802 1803 1804 1805
            /* wait for one second, even if messages arrive */
            start_ticks = GetTickCount();
            do {
                CoWaitForMultipleHandles(0, 1000, 0, NULL, &index);
            } while (GetTickCount() - start_ticks < 1000);
1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826
            continue;
        }
        bufferlen = 0;
        if (!ReadFile(hPipe,marshalbuffer,sizeof(marshalbuffer),&bufferlen,NULL)) {
            FIXME("Failed to read marshal id from classfactory of %s.\n",debugstr_guid(rclsid));
            Sleep(1000);
            continue;
        }
        TRACE("read marshal id from pipe\n");
        CloseHandle(hPipe);
        break;
    }
    
    if (tries >= MAXTRIES)
        return E_NOINTERFACE;
    
    hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
    if (hres) return hres;
    hres = IStream_Write(pStm,marshalbuffer,bufferlen,&res);
    if (hres) goto out;
    seekto.u.LowPart = 0;seekto.u.HighPart = 0;
1827
    hres = IStream_Seek(pStm,seekto,STREAM_SEEK_SET,&newpos);
1828 1829 1830
    
    TRACE("unmarshalling classfactory\n");
    hres = CoUnmarshalInterface(pStm,&IID_IClassFactory,ppv);
1831
out:
1832 1833
    IStream_Release(pStm);
    return hres;
1834 1835 1836
}


1837 1838 1839 1840
struct local_server_params
{
    CLSID clsid;
    IStream *stream;
1841
    HANDLE ready_event;
1842 1843
    HANDLE stop_event;
    HANDLE thread;
1844
    BOOL multi_use;
1845 1846
};

1847
/* FIXME: should call to rpcss instead */
1848 1849 1850 1851
static DWORD WINAPI local_server_thread(LPVOID param)
{
    struct local_server_params * lsp = (struct local_server_params *)param;
    HANDLE		hPipe;
1852
    WCHAR 		pipefn[100];
1853 1854 1855 1856 1857 1858 1859 1860
    HRESULT		hres;
    IStream		*pStm = lsp->stream;
    STATSTG		ststg;
    unsigned char	*buffer;
    int 		buflen;
    LARGE_INTEGER	seekto;
    ULARGE_INTEGER	newpos;
    ULONG		res;
1861
    BOOL multi_use = lsp->multi_use;
1862 1863
    OVERLAPPED ovl;
    HANDLE pipe_event;
1864 1865 1866

    TRACE("Starting threader for %s.\n",debugstr_guid(&lsp->clsid));

1867
    memset(&ovl, 0, sizeof(ovl));
1868
    get_localserver_pipe_name(pipefn, &lsp->clsid);
1869

1870
    hPipe = CreateNamedPipeW( pipefn, PIPE_ACCESS_DUPLEX | FILE_FLAG_OVERLAPPED,
1871 1872
                              PIPE_TYPE_BYTE|PIPE_WAIT, PIPE_UNLIMITED_INSTANCES,
                              4096, 4096, 500 /* 0.5 second timeout */, NULL );
1873 1874 1875

    SetEvent(lsp->ready_event);

1876 1877
    if (hPipe == INVALID_HANDLE_VALUE)
    {
1878
        FIXME("pipe creation failed for %s, le is %u\n", debugstr_w(pipefn), GetLastError());
1879 1880
        return 1;
    }
1881 1882

    ovl.hEvent = pipe_event = CreateEventW(NULL, FALSE, FALSE, NULL);
1883
    
1884
    while (1) {
1885
        if (!ConnectNamedPipe(hPipe, &ovl))
1886 1887
        {
            DWORD error = GetLastError();
1888 1889 1890 1891 1892 1893 1894 1895
            if (error == ERROR_IO_PENDING)
            {
                HANDLE handles[2] = { pipe_event, lsp->stop_event };
                DWORD ret;
                ret = WaitForMultipleObjects(2, handles, FALSE, INFINITE);
                if (ret != WAIT_OBJECT_0)
                    break;
            }
1896
            /* client already connected isn't an error */
1897
            else if (error != ERROR_PIPE_CONNECTED)
1898
            {
1899
                ERR("ConnectNamedPipe failed with error %d\n", GetLastError());
1900 1901
                break;
            }
1902 1903 1904 1905 1906 1907 1908 1909 1910
        }

        TRACE("marshalling IClassFactory to client\n");
        
        hres = IStream_Stat(pStm,&ststg,0);
        if (hres) return hres;

        seekto.u.LowPart = 0;
        seekto.u.HighPart = 0;
1911
        hres = IStream_Seek(pStm,seekto,STREAM_SEEK_SET,&newpos);
1912
        if (hres) {
1913
            FIXME("IStream_Seek failed, %x\n",hres);
1914 1915
            CloseHandle(hPipe);
            CloseHandle(pipe_event);
1916 1917
            return hres;
        }
1918 1919 1920

        buflen = ststg.cbSize.u.LowPart;
        buffer = HeapAlloc(GetProcessHeap(),0,buflen);
1921 1922 1923
        
        hres = IStream_Read(pStm,buffer,buflen,&res);
        if (hres) {
1924
            FIXME("Stream Read failed, %x\n",hres);
1925 1926
            CloseHandle(hPipe);
            CloseHandle(pipe_event);
1927
            HeapFree(GetProcessHeap(),0,buffer);
1928 1929 1930
            return hres;
        }
        
1931 1932
        WriteFile(hPipe,buffer,buflen,&res,&ovl);
        GetOverlappedResult(hPipe, &ovl, NULL, TRUE);
1933 1934
        HeapFree(GetProcessHeap(),0,buffer);

1935 1936 1937 1938
        FlushFileBuffers(hPipe);
        DisconnectNamedPipe(hPipe);

        TRACE("done marshalling IClassFactory\n");
1939 1940 1941 1942 1943 1944

        if (!multi_use)
        {
            TRACE("single use object, shutting down pipe %s\n", debugstr_w(pipefn));
            break;
        }
1945
    }
1946 1947
    CloseHandle(hPipe);
    CloseHandle(pipe_event);
1948 1949 1950
    return 0;
}

1951
/* starts listening for a local server */
1952
HRESULT RPC_StartLocalServer(REFCLSID clsid, IStream *stream, BOOL multi_use, void **registration)
1953 1954
{
    DWORD tid;
1955 1956 1957 1958 1959
    struct local_server_params *lsp;

    lsp = HeapAlloc(GetProcessHeap(), 0, sizeof(*lsp));
    if (!lsp)
        return E_OUTOFMEMORY;
1960 1961 1962

    lsp->clsid = *clsid;
    lsp->stream = stream;
1963
    IStream_AddRef(stream);
1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976
    lsp->ready_event = CreateEventW(NULL, FALSE, FALSE, NULL);
    if (!lsp->ready_event)
    {
        HeapFree(GetProcessHeap(), 0, lsp);
        return HRESULT_FROM_WIN32(GetLastError());
    }
    lsp->stop_event = CreateEventW(NULL, FALSE, FALSE, NULL);
    if (!lsp->stop_event)
    {
        CloseHandle(lsp->ready_event);
        HeapFree(GetProcessHeap(), 0, lsp);
        return HRESULT_FROM_WIN32(GetLastError());
    }
1977
    lsp->multi_use = multi_use;
1978

1979 1980 1981 1982 1983 1984
    lsp->thread = CreateThread(NULL, 0, local_server_thread, lsp, 0, &tid);
    if (!lsp->thread)
    {
        CloseHandle(lsp->ready_event);
        CloseHandle(lsp->stop_event);
        HeapFree(GetProcessHeap(), 0, lsp);
1985
        return HRESULT_FROM_WIN32(GetLastError());
1986
    }
1987

1988 1989 1990
    WaitForSingleObject(lsp->ready_event, INFINITE);
    CloseHandle(lsp->ready_event);
    lsp->ready_event = NULL;
1991

1992
    *registration = lsp;
1993 1994 1995 1996 1997 1998
    return S_OK;
}

/* stops listening for a local server */
void RPC_StopLocalServer(void *registration)
{
1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009
    struct local_server_params *lsp = registration;

    /* signal local_server_thread to stop */
    SetEvent(lsp->stop_event);
    /* wait for it to exit */
    WaitForSingleObject(lsp->thread, INFINITE);

    IStream_Release(lsp->stream);
    CloseHandle(lsp->stop_event);
    CloseHandle(lsp->thread);
    HeapFree(GetProcessHeap(), 0, lsp);
2010
}