[PATCH v7 0/1] MR498: server: Allow creating named pipes using \Device\NamedPipe\ as RootDirectory. (#52105)

[Jinoh Kang (＠iamahuman)]

On Windows, \Device\NamedPipe\ is the root directory of the named pipe
file system (NPFS), and can be used as RootDirectory to skip its path
when accessing the NPFS namespace.

---

**Note**: `subpath->str` may look hacky, but it's used to indicate trailing `\`[^bks] and existing code already does it too:

- `server/directory.c` checks `name->str`[^dir] to test if this is the last component. This is evident by the fact that changing it to `name->len` will lead to major regression.
- `server/registry.c` has similar lookup logic.[^reg1][^reg2]

[^bks]: https://gitlab.winehq.org/wine/wine/-/blob/c64aa0006e4a33d755a57a693cd81dc1e...
[^dir]: https://gitlab.winehq.org/wine/wine/-/blob/c64aa0006e4a33d755a57a693cd81dc1e...
[^reg1]: https://gitlab.winehq.org/wine/wine/-/blob/c64aa0006e4a33d755a57a693cd81dc1ed95fa9d/server/registry.c#L521
[^reg2]: https://gitlab.winehq.org/wine/wine/-/blob/c64aa0006e4a33d755a57a693cd81dc1ed95fa9d/server/registry.c#L531

--
  v7: server: Allow creating named pipes using \Device\NamedPipe\ as RootDirectory.

https://gitlab.winehq.org/wine/wine/-/merge_requests/498

[PATCH v7 1/1] server: Allow creating named pipes using \Device\NamedPipe\ as RootDirectory.

[Jinoh Kang]

From: Jinoh Kang

Separate the named pipe root directory from the named pipe device file.
Open the root directory instead of the device file if the path ends
with backslash.

Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=52105
Fixes: 2600ecd4edfdb71097105c74312f83845305a4f2
---
 dlls/ntdll/tests/om.c   |  2 +-
 dlls/ntdll/tests/pipe.c |  4 +-
 server/named_pipe.c     | 96 ++++++++++++++++++++++++++++++++++++++---
 3 files changed, 92 insertions(+), 10 deletions(-)

diff --git a/dlls/ntdll/tests/om.c b/dlls/ntdll/tests/om.c
index fb45fe777b7..6b61cfec52c 100644
--- a/dlls/ntdll/tests/om.c
+++ b/dlls/ntdll/tests/om.c
@@ -1965,7 +1965,7 @@ static void test_query_object(void)
     handle = CreateFileA( "\\.\pipe\", 0, 0, NULL, OPEN_EXISTING, 0, 0 );
     ok( handle != INVALID_HANDLE_VALUE, "CreateFile failed (%lu)\n", GetLastError() );

-    test_object_name( handle, L"\Device\NamedPipe\", TRUE );
+    test_object_name( handle, L"\Device\NamedPipe\", FALSE );
     test_object_type( handle, L"File" );
     test_file_info( handle );

diff --git a/dlls/ntdll/tests/pipe.c b/dlls/ntdll/tests/pipe.c
index cdf5cdb4151..1887f1cdcad 100644
--- a/dlls/ntdll/tests/pipe.c
+++ b/dlls/ntdll/tests/pipe.c
@@ -2920,11 +2920,11 @@ static void test_empty_name(void)
     timeout.QuadPart = -(LONG64)10000000;
     status = pNtCreateNamedPipeFile(&hpipe, GENERIC_READ|GENERIC_WRITE, &attr, &io, FILE_SHARE_READ|FILE_SHARE_WRITE,
                                     FILE_CREATE, FILE_PIPE_FULL_DUPLEX, 0, 0, 0, 1, 256, 256, &timeout);
-    todo_wine ok(!status, "unexpected failure from NtCreateNamedPipeFile: %#lx\n", status);
+    ok(!status, "unexpected failure from NtCreateNamedPipeFile: %#lx\n", status);

handle = CreateFileA("\\.\pipe\test3\pipe", GENERIC_READ, FILE_SHARE_READ|FILE_SHARE_WRITE, NULL,
                          OPEN_EXISTING, 0, 0 );
-    todo_wine ok(handle != INVALID_HANDLE_VALUE, "Failed to open NamedPipe (%lu)\n", GetLastError());
+    ok(handle != INVALID_HANDLE_VALUE, "Failed to open NamedPipe (%lu)\n", GetLastError());

CloseHandle(handle);
     CloseHandle(hpipe);
diff --git a/server/named_pipe.c b/server/named_pipe.c
index dd8c14b30a9..a0d8ae0eacd 100644
--- a/server/named_pipe.c
+++ b/server/named_pipe.c
@@ -99,6 +99,7 @@ struct named_pipe_device
 struct named_pipe_device_file
 {
     struct object             obj;         /* object header */
+    int                       is_rootdir;  /* is root directory file? */
     struct fd                *fd;          /* pseudo-fd for ioctls */
     struct named_pipe_device *device;      /* named pipe device */
 };
@@ -277,6 +278,10 @@ static const struct object_ops named_pipe_device_ops =
 static void named_pipe_device_file_dump( struct object *obj, int verbose );
 static struct fd *named_pipe_device_file_get_fd( struct object *obj );
 static WCHAR *named_pipe_device_file_get_full_name( struct object *obj, data_size_t *len );
+static struct object *named_pipe_device_file_lookup_name( struct object *obj, struct unicode_str *name,
+                                                          unsigned int attr, struct object *root );
+static struct object *named_pipe_device_file_open_file( struct object *obj, unsigned int access,
+                                                        unsigned int sharing, unsigned int options );
 static void named_pipe_device_ioctl( struct fd *fd, ioctl_code_t code, struct async *async );
 static enum server_fd_type named_pipe_device_file_get_fd_type( struct fd *fd );
 static void named_pipe_device_file_destroy( struct object *obj );
@@ -296,10 +301,10 @@ static const struct object_ops named_pipe_device_file_ops =
     default_get_sd,                          /* get_sd */
     default_set_sd,                          /* set_sd */
     named_pipe_device_file_get_full_name,    /* get_full_name */
-    no_lookup_name,                          /* lookup_name */
+    named_pipe_device_file_lookup_name,      /* lookup_name */
     no_link_name,                            /* link_name */
     NULL,                                    /* unlink_name */
-    no_open_file,                            /* open_file */
+    named_pipe_device_file_open_file,        /* open_file */
     no_kernel_obj_list,                      /* get_kernel_obj_list */
     no_close_handle,                         /* close_handle */
     named_pipe_device_file_destroy           /* destroy */
@@ -502,6 +507,20 @@ static struct object *named_pipe_device_lookup_name( struct object *obj, struct

if (!name) return NULL;  /* open the device itself */

+    if (name->str && !name->len)
+    {
+        /* root directory: last component is empty ("\Device\NamedPipe\") */
+        struct named_pipe_device_file *dir = alloc_object( &named_pipe_device_file_ops );
+
+        if (!dir) return NULL;
+
+        dir->is_rootdir = 1;
+        dir->fd = NULL;  /* defer alloc_pseudo_fd() until after we have options */
+        dir->device = (struct named_pipe_device *)grab_object( obj );
+
+        return &dir->obj;
+    }
+
     if ((found = find_object( device->pipes, name, attr | OBJ_CASE_INSENSITIVE )))
         name->len = 0;

@@ -514,6 +533,7 @@ static struct object *named_pipe_device_open_file( struct object *obj, unsigned
     struct named_pipe_device_file *file;

if (!(file = alloc_object( &named_pipe_device_file_ops ))) return NULL;
+    file->is_rootdir = 0;
     file->device = (struct named_pipe_device *)grab_object( obj );
     if (!(file->fd = alloc_pseudo_fd( &named_pipe_device_fd_ops, obj, options )))
     {
@@ -553,7 +573,8 @@ static void named_pipe_device_file_dump( struct object *obj, int verbose )
 {
     struct named_pipe_device_file *file = (struct named_pipe_device_file *)obj;

-    fprintf( stderr, "File on named pipe device %p\n", file->device );
+    fprintf( stderr, "%s on named pipe device %p\n",
+             file->is_rootdir ? "Root directory" : "File", file->device );
 }

static struct fd *named_pipe_device_file_get_fd( struct object *obj )
@@ -562,10 +583,32 @@ static struct fd *named_pipe_device_file_get_fd( struct object *obj )
     return (struct fd *)grab_object( file->fd );
 }

-static WCHAR *named_pipe_device_file_get_full_name( struct object *obj, data_size_t *len )
+static WCHAR *named_pipe_device_file_get_full_name( struct object *obj, data_size_t *ret_len )
 {
     struct named_pipe_device_file *file = (struct named_pipe_device_file *)obj;
-    return file->device->obj.ops->get_full_name( &file->device->obj, len );
+    WCHAR *device_name;
+    data_size_t len;
+
+    device_name = file->device->obj.ops->get_full_name( &file->device->obj, &len );
+    if (!device_name) return NULL;
+
+    if (file->is_rootdir)
+    {
+        WCHAR *newbuf;
+
+        len += sizeof(WCHAR);
+        if (!(newbuf = realloc(device_name, len)))
+        {
+            free(device_name);
+            return NULL;
+        }
+
+        device_name = newbuf;
+        *(WCHAR *)((char *)device_name + len - sizeof(WCHAR)) = '\';
+    }
+
+    *ret_len = len;
+    return device_name;
 }

static enum server_fd_type named_pipe_device_file_get_fd_type( struct fd *fd )
@@ -573,6 +616,39 @@ static enum server_fd_type named_pipe_device_file_get_fd_type( struct fd *fd )
     return FD_TYPE_DEVICE;
 }

+static struct object *named_pipe_device_file_lookup_name( struct object *obj, struct unicode_str *name,
+                                                          unsigned int attr, struct object *root )
+{
+    struct named_pipe_device_file *file = (struct named_pipe_device_file *)obj;
+
+    if (!file->is_rootdir)
+        return no_lookup_name( obj, name, attr, root );
+
+    if (!file->fd)
+    {
+        /* not yet opened; complete the object name lookup */
+        return NULL;
+    }
+
+    return file->device->obj.ops->lookup_name( &file->device->obj, name, attr, root );
+}
+
+static struct object *named_pipe_device_file_open_file( struct object *obj, unsigned int access,
+                                                        unsigned int sharing, unsigned int options )
+{
+    struct named_pipe_device_file *file = (struct named_pipe_device_file *)obj;
+
+    if (!file->is_rootdir || file->fd)
+        return no_open_file( obj, access, sharing, options );
+
+    if (!(file->fd = alloc_pseudo_fd( &named_pipe_device_fd_ops, obj, options )))
+        return NULL;
+
+    allow_fd_caching( file->fd );
+
+    return grab_object( obj );
+}
+
 static void named_pipe_device_file_destroy( struct object *obj )
 {
     struct named_pipe_device_file *file = (struct named_pipe_device_file*)obj;
@@ -1321,14 +1397,20 @@ static struct pipe_end *create_pipe_client( struct named_pipe *pipe, data_size_t

static int named_pipe_link_name( struct object *obj, struct object_name *name, struct object *parent )
 {
-    struct named_pipe_device *dev = (struct named_pipe_device *)parent;
+    if (parent->ops == &named_pipe_device_file_ops)
+    {
+        struct named_pipe_device_file *file = (struct named_pipe_device_file *)parent;
+
+        if (file->is_rootdir)
+            parent = &((struct named_pipe_device_file *)parent)->device->obj;
+    }

if (parent->ops != &named_pipe_device_ops)
     {
         set_error( STATUS_OBJECT_NAME_INVALID );
         return 0;
     }
-    namespace_add( dev->pipes, name );
+    namespace_add( ((struct named_pipe_device *)parent)->pipes, name );
     name->parent = grab_object( parent );
     return 1;
 }

[Jinoh Kang (＠iamahuman)]

v7: Revert to the previous approach of creating the object inside `lookup_name` to avoid server-wide refactoring.