CVE-2013-4408:s4:dcerpc_sock: check for invalid frag_len within sock_complete_packet()
[Samba.git] / source4 / librpc / rpc / dcerpc_sock.c
blob9a596da47da628d7e98abf094ef1cf2b35d64290
1 /*
2 Unix SMB/CIFS implementation.
4 dcerpc over standard sockets transport
6 Copyright (C) Andrew Tridgell 2003
7 Copyright (C) Jelmer Vernooij 2004
8 Copyright (C) Rafal Szczesniak 2006
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "includes.h"
25 #include "lib/events/events.h"
26 #include "lib/socket/socket.h"
27 #include "lib/stream/packet.h"
28 #include "libcli/composite/composite.h"
29 #include "librpc/rpc/dcerpc.h"
30 #include "librpc/rpc/dcerpc_proto.h"
31 #include "libcli/resolve/resolve.h"
32 #include "librpc/rpc/rpc_common.h"
34 /* transport private information used by general socket pipe transports */
35 struct sock_private {
36 struct tevent_fd *fde;
37 struct socket_context *sock;
38 char *server_name;
40 struct packet_context *packet;
41 uint32_t pending_reads;
43 const char *path; /* For ncacn_unix_sock and ncalrpc */
48 mark the socket dead
50 static void sock_dead(struct dcecli_connection *p, NTSTATUS status)
52 struct sock_private *sock = (struct sock_private *)p->transport.private_data;
54 if (!sock) return;
56 if (sock->packet) {
57 packet_recv_disable(sock->packet);
58 packet_set_fde(sock->packet, NULL);
59 packet_set_socket(sock->packet, NULL);
62 if (sock->fde) {
63 talloc_free(sock->fde);
64 sock->fde = NULL;
67 if (sock->sock) {
68 talloc_free(sock->sock);
69 sock->sock = NULL;
72 if (NT_STATUS_EQUAL(NT_STATUS_UNSUCCESSFUL, status)) {
73 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
76 if (NT_STATUS_EQUAL(NT_STATUS_OK, status)) {
77 status = NT_STATUS_END_OF_FILE;
80 if (p->transport.recv_data) {
81 p->transport.recv_data(p, NULL, status);
87 handle socket recv errors
89 static void sock_error_handler(void *private_data, NTSTATUS status)
91 struct dcecli_connection *p = talloc_get_type(private_data,
92 struct dcecli_connection);
93 sock_dead(p, status);
97 check if a blob is a complete packet
99 static NTSTATUS sock_complete_packet(void *private_data, DATA_BLOB blob, size_t *size)
101 if (blob.length < DCERPC_FRAG_LEN_OFFSET+2) {
102 return STATUS_MORE_ENTRIES;
104 *size = dcerpc_get_frag_length(&blob);
105 if (*size < blob.length) {
107 * something is wrong, let the caller deal with it
109 *size = blob.length;
111 if (*size > blob.length) {
112 return STATUS_MORE_ENTRIES;
114 return NT_STATUS_OK;
118 process recv requests
120 static NTSTATUS sock_process_recv(void *private_data, DATA_BLOB blob)
122 struct dcecli_connection *p = talloc_get_type(private_data,
123 struct dcecli_connection);
124 struct sock_private *sock = (struct sock_private *)p->transport.private_data;
125 sock->pending_reads--;
126 if (sock->pending_reads == 0) {
127 packet_recv_disable(sock->packet);
129 p->transport.recv_data(p, &blob, NT_STATUS_OK);
130 return NT_STATUS_OK;
134 called when a IO is triggered by the events system
136 static void sock_io_handler(struct tevent_context *ev, struct tevent_fd *fde,
137 uint16_t flags, void *private_data)
139 struct dcecli_connection *p = talloc_get_type(private_data,
140 struct dcecli_connection);
141 struct sock_private *sock = (struct sock_private *)p->transport.private_data;
143 if (flags & EVENT_FD_WRITE) {
144 packet_queue_run(sock->packet);
145 return;
148 if (sock->sock == NULL) {
149 return;
152 if (flags & EVENT_FD_READ) {
153 packet_recv(sock->packet);
158 initiate a read request - not needed for dcerpc sockets
160 static NTSTATUS sock_send_read(struct dcecli_connection *p)
162 struct sock_private *sock = (struct sock_private *)p->transport.private_data;
163 sock->pending_reads++;
164 if (sock->pending_reads == 1) {
165 packet_recv_enable(sock->packet);
167 return NT_STATUS_OK;
171 send an initial pdu in a multi-pdu sequence
173 static NTSTATUS sock_send_request(struct dcecli_connection *p, DATA_BLOB *data,
174 bool trigger_read)
176 struct sock_private *sock = (struct sock_private *)p->transport.private_data;
177 DATA_BLOB blob;
178 NTSTATUS status;
180 if (sock->sock == NULL) {
181 return NT_STATUS_CONNECTION_DISCONNECTED;
184 blob = data_blob_talloc(sock->packet, data->data, data->length);
185 if (blob.data == NULL) {
186 return NT_STATUS_NO_MEMORY;
189 status = packet_send(sock->packet, blob);
190 if (!NT_STATUS_IS_OK(status)) {
191 return status;
194 if (trigger_read) {
195 sock_send_read(p);
198 return NT_STATUS_OK;
202 shutdown sock pipe connection
204 static NTSTATUS sock_shutdown_pipe(struct dcecli_connection *p, NTSTATUS status)
206 struct sock_private *sock = (struct sock_private *)p->transport.private_data;
208 if (sock && sock->sock) {
209 sock_dead(p, status);
212 return status;
216 return sock server name
218 static const char *sock_peer_name(struct dcecli_connection *p)
220 struct sock_private *sock = talloc_get_type(p->transport.private_data, struct sock_private);
221 return sock->server_name;
225 return remote name we make the actual connection (good for kerberos)
227 static const char *sock_target_hostname(struct dcecli_connection *p)
229 struct sock_private *sock = talloc_get_type(p->transport.private_data, struct sock_private);
230 return sock->server_name;
234 struct pipe_open_socket_state {
235 struct dcecli_connection *conn;
236 struct socket_context *socket_ctx;
237 struct sock_private *sock;
238 struct socket_address *localaddr;
239 struct socket_address *server;
240 const char *target_hostname;
241 enum dcerpc_transport_t transport;
245 static void continue_socket_connect(struct composite_context *ctx)
247 struct dcecli_connection *conn;
248 struct sock_private *sock;
249 struct composite_context *c = talloc_get_type(ctx->async.private_data,
250 struct composite_context);
251 struct pipe_open_socket_state *s = talloc_get_type(c->private_data,
252 struct pipe_open_socket_state);
254 /* make it easier to write a function calls */
255 conn = s->conn;
256 sock = s->sock;
258 c->status = socket_connect_recv(ctx);
259 if (!NT_STATUS_IS_OK(c->status)) {
260 DEBUG(0, ("Failed to connect host %s on port %d - %s\n",
261 s->server->addr, s->server->port,
262 nt_errstr(c->status)));
263 composite_error(c, c->status);
264 return;
268 fill in the transport methods
270 conn->transport.transport = s->transport;
271 conn->transport.private_data = NULL;
273 conn->transport.send_request = sock_send_request;
274 conn->transport.send_read = sock_send_read;
275 conn->transport.recv_data = NULL;
277 conn->transport.shutdown_pipe = sock_shutdown_pipe;
278 conn->transport.peer_name = sock_peer_name;
279 conn->transport.target_hostname = sock_target_hostname;
281 sock->sock = s->socket_ctx;
282 sock->pending_reads = 0;
283 sock->server_name = strupper_talloc(sock, s->target_hostname);
285 sock->fde = event_add_fd(conn->event_ctx, sock->sock, socket_get_fd(sock->sock),
286 EVENT_FD_READ, sock_io_handler, conn);
288 conn->transport.private_data = sock;
290 sock->packet = packet_init(sock);
291 if (sock->packet == NULL) {
292 composite_error(c, NT_STATUS_NO_MEMORY);
293 talloc_free(sock);
294 return;
297 packet_set_private(sock->packet, conn);
298 packet_set_socket(sock->packet, sock->sock);
299 packet_set_callback(sock->packet, sock_process_recv);
300 packet_set_full_request(sock->packet, sock_complete_packet);
301 packet_set_error_handler(sock->packet, sock_error_handler);
302 packet_set_event_context(sock->packet, conn->event_ctx);
303 packet_set_fde(sock->packet, sock->fde);
304 packet_set_serialise(sock->packet);
305 packet_set_initial_read(sock->packet, 16);
307 /* ensure we don't get SIGPIPE */
308 BlockSignals(true, SIGPIPE);
310 composite_done(c);
314 static struct composite_context *dcerpc_pipe_open_socket_send(TALLOC_CTX *mem_ctx,
315 struct dcecli_connection *cn,
316 struct socket_address *localaddr,
317 struct socket_address *server,
318 const char *target_hostname,
319 const char *full_path,
320 enum dcerpc_transport_t transport)
322 struct composite_context *c;
323 struct pipe_open_socket_state *s;
324 struct composite_context *conn_req;
326 c = composite_create(mem_ctx, cn->event_ctx);
327 if (c == NULL) return NULL;
329 s = talloc_zero(c, struct pipe_open_socket_state);
330 if (composite_nomem(s, c)) return c;
331 c->private_data = s;
333 s->conn = cn;
334 s->transport = transport;
335 if (localaddr) {
336 s->localaddr = talloc_reference(c, localaddr);
337 if (composite_nomem(s->localaddr, c)) return c;
339 s->server = talloc_reference(c, server);
340 if (composite_nomem(s->server, c)) return c;
341 s->target_hostname = talloc_reference(s, target_hostname);
343 s->sock = talloc(cn, struct sock_private);
344 if (composite_nomem(s->sock, c)) return c;
346 c->status = socket_create(server->family, SOCKET_TYPE_STREAM, &s->socket_ctx, 0);
347 if (!composite_is_ok(c)) return c;
349 talloc_steal(s->sock, s->socket_ctx);
351 s->sock->path = talloc_reference(s->sock, full_path);
353 conn_req = socket_connect_send(s->socket_ctx, s->localaddr, s->server, 0,
354 c->event_ctx);
355 composite_continue(c, conn_req, continue_socket_connect, c);
356 return c;
360 static NTSTATUS dcerpc_pipe_open_socket_recv(struct composite_context *c)
362 NTSTATUS status = composite_wait(c);
364 talloc_free(c);
365 return status;
368 struct pipe_tcp_state {
369 const char *server;
370 const char *target_hostname;
371 const char *address;
372 uint32_t port;
373 struct socket_address *localaddr;
374 struct socket_address *srvaddr;
375 struct resolve_context *resolve_ctx;
376 struct dcecli_connection *conn;
380 #if 0 /* disabled till we can resolve names to ipv6 addresses */
381 static void continue_ipv6_open_socket(struct composite_context *ctx);
382 #endif
383 static void continue_ipv4_open_socket(struct composite_context *ctx);
384 static void continue_ip_resolve_name(struct composite_context *ctx);
386 static void continue_ip_resolve_name(struct composite_context *ctx)
388 struct composite_context *c = talloc_get_type(ctx->async.private_data,
389 struct composite_context);
390 struct pipe_tcp_state *s = talloc_get_type(c->private_data,
391 struct pipe_tcp_state);
392 struct composite_context *sock_ipv4_req;
394 c->status = resolve_name_recv(ctx, s, &s->address);
395 if (!composite_is_ok(c)) return;
397 /* prepare server address using host ip:port and transport name */
398 s->srvaddr = socket_address_from_strings(s->conn, "ipv4", s->address, s->port);
399 if (composite_nomem(s->srvaddr, c)) return;
401 /* resolve_nbt_name gives only ipv4 ... - send socket open request */
402 sock_ipv4_req = dcerpc_pipe_open_socket_send(c, s->conn, s->localaddr,
403 s->srvaddr, s->target_hostname,
404 NULL,
405 NCACN_IP_TCP);
406 composite_continue(c, sock_ipv4_req, continue_ipv4_open_socket, c);
410 Stage 2 of dcerpc_pipe_open_tcp_send: receive result of pipe open request
411 on IPv6 and send the request on IPv4 unless IPv6 transport succeeded.
413 #if 0 /* disabled till we can resolve names to ipv6 addresses */
414 static void continue_ipv6_open_socket(struct composite_context *ctx)
416 struct composite_context *c = talloc_get_type(ctx->async.private_data,
417 struct composite_context);
418 struct pipe_tcp_state *s = talloc_get_type(c->private_data,
419 struct pipe_tcp_state);
420 struct composite_context *sock_ipv4_req;
422 /* receive result of socket open request */
423 c->status = dcerpc_pipe_open_socket_recv(ctx);
424 if (NT_STATUS_IS_OK(c->status)) {
425 composite_done(c);
426 return;
429 talloc_free(s->srvaddr);
431 /* prepare server address using host:ip and transport name */
432 s->srvaddr = socket_address_from_strings(s->conn, "ipv4", s->address, s->port);
433 if (composite_nomem(s->srvaddr, c)) return;
435 /* try IPv4 if IPv6 fails */
436 sock_ipv4_req = dcerpc_pipe_open_socket_send(c, s->conn, s->localaddr,
437 s->srvaddr, s->target_hostname,
438 NCACN_IP_TCP);
439 composite_continue(c, sock_ipv4_req, continue_ipv4_open_socket, c);
441 #endif
444 Stage 2 of dcerpc_pipe_open_tcp_send: receive result of pipe open request
445 on IPv4 transport.
447 static void continue_ipv4_open_socket(struct composite_context *ctx)
449 struct composite_context *c = talloc_get_type(ctx->async.private_data,
450 struct composite_context);
451 struct pipe_tcp_state *s = talloc_get_type(c->private_data,
452 struct pipe_tcp_state);
454 /* receive result socket open request */
455 c->status = dcerpc_pipe_open_socket_recv(ctx);
456 if (!NT_STATUS_IS_OK(c->status)) {
457 /* something went wrong... */
458 DEBUG(0, ("Failed to connect host %s (%s) on port %d - %s.\n",
459 s->address, s->target_hostname,
460 s->port, nt_errstr(c->status)));
462 composite_error(c, c->status);
463 return;
466 composite_done(c);
470 Send rpc pipe open request to given host:port using
471 tcp/ip transport
473 struct composite_context* dcerpc_pipe_open_tcp_send(struct dcecli_connection *conn,
474 const char *localaddr,
475 const char *server,
476 const char *target_hostname,
477 uint32_t port,
478 struct resolve_context *resolve_ctx)
480 struct composite_context *c;
481 struct pipe_tcp_state *s;
482 struct composite_context *resolve_req;
483 struct nbt_name name;
485 /* composite context allocation and setup */
486 c = composite_create(conn, conn->event_ctx);
487 if (c == NULL) return NULL;
489 s = talloc_zero(c, struct pipe_tcp_state);
490 if (composite_nomem(s, c)) return c;
491 c->private_data = s;
493 /* store input parameters in state structure */
494 s->server = talloc_strdup(c, server);
495 if (composite_nomem(s->server, c)) return c;
496 if (target_hostname) {
497 s->target_hostname = talloc_strdup(c, target_hostname);
498 if (composite_nomem(s->target_hostname, c)) return c;
500 s->port = port;
501 s->conn = conn;
502 s->resolve_ctx = resolve_ctx;
503 if (localaddr) {
504 s->localaddr = socket_address_from_strings(s, "ip", localaddr, 0);
505 /* if there is no localaddr, we pass NULL for
506 s->localaddr, which is handled by the socket libraries as
507 meaning no local binding address specified */
510 make_nbt_name_server(&name, server);
511 resolve_req = resolve_name_send(resolve_ctx, s, &name, c->event_ctx);
512 composite_continue(c, resolve_req, continue_ip_resolve_name, c);
513 return c;
517 Receive result of pipe open request on tcp/ip
519 NTSTATUS dcerpc_pipe_open_tcp_recv(struct composite_context *c)
521 NTSTATUS status;
522 status = composite_wait(c);
524 talloc_free(c);
525 return status;
529 struct pipe_unix_state {
530 const char *path;
531 struct socket_address *srvaddr;
532 struct dcecli_connection *conn;
537 Stage 2 of dcerpc_pipe_open_unix_stream_send: receive result of pipe open
538 request on unix socket.
540 static void continue_unix_open_socket(struct composite_context *ctx)
542 struct composite_context *c = talloc_get_type(ctx->async.private_data,
543 struct composite_context);
545 c->status = dcerpc_pipe_open_socket_recv(ctx);
546 if (NT_STATUS_IS_OK(c->status)) {
547 composite_done(c);
548 return;
551 composite_error(c, c->status);
556 Send pipe open request on unix socket
558 struct composite_context *dcerpc_pipe_open_unix_stream_send(struct dcecli_connection *conn,
559 const char *path)
561 struct composite_context *c;
562 struct composite_context *sock_unix_req;
563 struct pipe_unix_state *s;
565 /* composite context allocation and setup */
566 c = composite_create(conn, conn->event_ctx);
567 if (c == NULL) return NULL;
569 s = talloc_zero(c, struct pipe_unix_state);
570 if (composite_nomem(s, c)) return c;
571 c->private_data = s;
573 /* store parameters in state structure */
574 s->path = talloc_strdup(c, path);
575 if (composite_nomem(s->path, c)) return c;
576 s->conn = conn;
578 /* prepare server address using socket path and transport name */
579 s->srvaddr = socket_address_from_strings(conn, "unix", s->path, 0);
580 if (composite_nomem(s->srvaddr, c)) return c;
582 /* send socket open request */
583 sock_unix_req = dcerpc_pipe_open_socket_send(c, s->conn, NULL,
584 s->srvaddr, NULL,
585 s->path,
586 NCALRPC);
587 composite_continue(c, sock_unix_req, continue_unix_open_socket, c);
588 return c;
593 Receive result of pipe open request on unix socket
595 NTSTATUS dcerpc_pipe_open_unix_stream_recv(struct composite_context *c)
597 NTSTATUS status = composite_wait(c);
599 talloc_free(c);
600 return status;
605 Stage 2 of dcerpc_pipe_open_pipe_send: receive socket open request
607 static void continue_np_open_socket(struct composite_context *ctx)
609 struct composite_context *c = talloc_get_type(ctx->async.private_data,
610 struct composite_context);
612 c->status = dcerpc_pipe_open_socket_recv(ctx);
613 if (!composite_is_ok(c)) return;
615 composite_done(c);
620 Send pipe open request on ncalrpc
622 struct composite_context* dcerpc_pipe_open_pipe_send(struct dcecli_connection *conn,
623 const char *ncalrpc_dir,
624 const char *identifier)
626 char *canon = NULL;
628 struct composite_context *c;
629 struct composite_context *sock_np_req;
630 struct pipe_unix_state *s;
632 /* composite context allocation and setup */
633 c = composite_create(conn, conn->event_ctx);
634 if (c == NULL) return NULL;
636 s = talloc_zero(c, struct pipe_unix_state);
637 if (composite_nomem(s, c)) return c;
638 c->private_data = s;
640 /* store parameters in state structure */
641 canon = talloc_strdup(s, identifier);
642 if (composite_nomem(canon, c)) return c;
643 s->conn = conn;
645 string_replace(canon, '/', '\\');
646 s->path = talloc_asprintf(canon, "%s/%s", ncalrpc_dir, canon);
647 if (composite_nomem(s->path, c)) return c;
649 /* prepare server address using path and transport name */
650 s->srvaddr = socket_address_from_strings(conn, "unix", s->path, 0);
651 if (composite_nomem(s->srvaddr, c)) return c;
653 /* send socket open request */
654 sock_np_req = dcerpc_pipe_open_socket_send(c, s->conn, NULL, s->srvaddr, NULL, s->path, NCALRPC);
655 composite_continue(c, sock_np_req, continue_np_open_socket, c);
656 return c;
661 Receive result of pipe open request on ncalrpc
663 NTSTATUS dcerpc_pipe_open_pipe_recv(struct composite_context *c)
665 NTSTATUS status = composite_wait(c);
667 talloc_free(c);
668 return status;
673 Open a rpc pipe on a named pipe - sync version
675 NTSTATUS dcerpc_pipe_open_pipe(struct dcecli_connection *conn, const char *ncalrpc_dir, const char *identifier)
677 struct composite_context *c = dcerpc_pipe_open_pipe_send(conn, ncalrpc_dir, identifier);
678 return dcerpc_pipe_open_pipe_recv(c);
681 const char *dcerpc_unix_socket_path(struct dcecli_connection *p)
683 struct sock_private *sock = (struct sock_private *)p->transport.private_data;
684 return sock->path;
687 struct socket_address *dcerpc_socket_peer_addr(struct dcecli_connection *p, TALLOC_CTX *mem_ctx)
689 struct sock_private *sock = (struct sock_private *)p->transport.private_data;
690 return socket_get_peer_addr(sock->sock, mem_ctx);