?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-rpc_server: Add server support for NCALRPC system user pipe.
[Samba/gebeck_regimport.git] / source3 / rpc_server / rpc_server.c
blobbf9952e215bb82dd82dc6d48fd97458348081c51
1 /*
2 Unix SMB/Netbios implementation.
3 Generic infrstructure for RPC Daemons
4 Copyright (C) Simo Sorce 2010
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "rpc_server/rpc_server.h"
22 #include "rpc_dce.h"
23 #include "librpc/gen_ndr/netlogon.h"
24 #include "librpc/gen_ndr/auth.h"
25 #include "registry/reg_parse_prs.h"
26 #include "lib/tsocket/tsocket.h"
27 #include "libcli/named_pipe_auth/npa_tstream.h"
28 #include "../auth/auth_sam_reply.h"
29
30 #define SERVER_TCP_LOW_PORT 1024
31 #define SERVER_TCP_HIGH_PORT 1300
32
33 static NTSTATUS auth_anonymous_session_info(TALLOC_CTX *mem_ctx,
34 struct auth_session_info_transport **session_info)
35 {
36 struct auth_session_info_transport *i;
37 struct auth_serversupplied_info *s;
38 struct auth_user_info_dc *u;
39 union netr_Validation val;
40 NTSTATUS status;
41
42 i = talloc_zero(mem_ctx, struct auth_session_info_transport);
43 if (i == NULL) {
44 return NT_STATUS_NO_MEMORY;
45 }
46
47 status = make_server_info_guest(i, &s);
48 if (!NT_STATUS_IS_OK(status)) {
49 return status;
50 }
51
52 i->security_token = s->security_token;
53 i->session_key = s->user_session_key;
54
55 val.sam3 = s->info3;
56
57 status = make_user_info_dc_netlogon_validation(mem_ctx,
58 "",
59 3,
60 &val,
61 &u);
62 if (!NT_STATUS_IS_OK(status)) {
63 DEBUG(0, ("conversion of info3 into user_info_dc failed!\n"));
64 return status;
65 }
66 i->info = talloc_move(i, &u->info);
67 talloc_free(u);
68
69 *session_info = i;
70
71 return NT_STATUS_OK;
72 }
73
74 /* Creates a pipes_struct and initializes it with the information
75 * sent from the client */
76 static int make_server_pipes_struct(TALLOC_CTX *mem_ctx,
77 const char *pipe_name,
78 const struct ndr_syntax_id id,
79 enum dcerpc_transport_t transport,
80 bool system_user,
81 const char *client_address,
82 const char *server_address,
83 struct auth_session_info_transport *session_info,
84 struct pipes_struct **_p,
85 int *perrno)
86 {
87 struct netr_SamInfo3 *info3;
88 struct auth_user_info_dc *auth_user_info_dc;
89 struct pipes_struct *p;
90 NTSTATUS status;
91 bool ok;
92
93 p = talloc_zero(mem_ctx, struct pipes_struct);
94 if (!p) {
95 *perrno = ENOMEM;
96 return -1;
97 }
98 p->syntax = id;
99 p->transport = transport;
100 p->system_user = system_user;
101
102 p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p);
103 if (!p->mem_ctx) {
104 TALLOC_FREE(p);
105 *perrno = ENOMEM;
106 return -1;
107 }
108
109 ok = init_pipe_handles(p, &id);
110 if (!ok) {
111 DEBUG(1, ("Failed to init handles\n"));
112 TALLOC_FREE(p);
113 *perrno = EINVAL;
114 return -1;
115 }
116
117
118 data_blob_free(&p->in_data.data);
119 data_blob_free(&p->in_data.pdu);
120
121 p->endian = RPC_LITTLE_ENDIAN;
122
123 /* Fake up an auth_user_info_dc for now, to make an info3, to make the session_info structure */
124 auth_user_info_dc = talloc_zero(p, struct auth_user_info_dc);
125 if (!auth_user_info_dc) {
126 TALLOC_FREE(p);
127 *perrno = ENOMEM;
128 return -1;
129 }
130
131 auth_user_info_dc->num_sids = session_info->security_token->num_sids;
132 auth_user_info_dc->sids = session_info->security_token->sids;
133 auth_user_info_dc->info = session_info->info;
134 auth_user_info_dc->user_session_key = session_info->session_key;
135
136 /* This creates the input structure that make_server_info_info3 is looking for */
137 status = auth_convert_user_info_dc_saminfo3(p, auth_user_info_dc,
138 &info3);
139
140 if (!NT_STATUS_IS_OK(status)) {
141 DEBUG(1, ("Failed to convert auth_user_info_dc into netr_SamInfo3\n"));
142 TALLOC_FREE(p);
143 *perrno = EINVAL;
144 return -1;
145 }
146
147 status = make_server_info_info3(p,
148 info3->base.account_name.string,
149 info3->base.domain.string,
150 &p->session_info, info3);
151 if (!NT_STATUS_IS_OK(status)) {
152 DEBUG(1, ("Failed to init server info\n"));
153 TALLOC_FREE(p);
154 *perrno = EINVAL;
155 return -1;
156 }
157
158 /*
159 * Some internal functions need a local token to determine access to
160 * resoutrces.
161 */
162 status = create_local_token(p->session_info);
163 if (!NT_STATUS_IS_OK(status)) {
164 DEBUG(1, ("Failed to init local auth token\n"));
165 TALLOC_FREE(p);
166 *perrno = EINVAL;
167 return -1;
168 }
169
170 /* Now override the session_info->security_token with the exact
171 * security_token we were given from the other side,
172 * regardless of what we just calculated */
173 p->session_info->security_token = talloc_move(p->session_info, &session_info->security_token);
174
175 /* Also set the session key to the correct value */
176 p->session_info->user_session_key = session_info->session_key;
177 p->session_info->user_session_key.data = talloc_move(p->session_info, &session_info->session_key.data);
178
179 p->client_id = talloc_zero(p, struct client_address);
180 if (!p->client_id) {
181 TALLOC_FREE(p);
182 *perrno = ENOMEM;
183 return -1;
184 }
185 strlcpy(p->client_id->addr,
186 client_address, sizeof(p->client_id->addr));
187 p->client_id->name = talloc_strdup(p->client_id, client_address);
188 if (p->client_id->name == NULL) {
189 TALLOC_FREE(p);
190 *perrno = ENOMEM;
191 return -1;
192 }
193
194 if (server_address != NULL) {
195 p->server_id = talloc_zero(p, struct client_address);
196 if (p->client_id == NULL) {
197 TALLOC_FREE(p);
198 *perrno = ENOMEM;
199 return -1;
200 }
201
202 strlcpy(p->server_id->addr,
203 server_address,
204 sizeof(p->server_id->addr));
205
206 p->server_id->name = talloc_strdup(p->server_id,
207 server_address);
208 if (p->server_id->name == NULL) {
209 TALLOC_FREE(p);
210 *perrno = ENOMEM;
211 return -1;
212 }
213 }
214
215 talloc_set_destructor(p, close_internal_rpc_pipe_hnd);
216
217 *_p = p;
218 return 0;
219 }
220
221 /* Start listening on the appropriate unix socket and setup all is needed to
222 * dispatch requests to the pipes rpc implementation */
223
224 struct dcerpc_ncacn_listen_state {
225 struct ndr_syntax_id syntax_id;
226
227 int fd;
228 union {
229 char *name;
230 uint16_t port;
231 } ep;
232
233 struct tevent_context *ev_ctx;
234 struct messaging_context *msg_ctx;
235 };
236
237 static void named_pipe_listener(struct tevent_context *ev,
238 struct tevent_fd *fde,
239 uint16_t flags,
240 void *private_data);
241
242 bool setup_named_pipe_socket(const char *pipe_name,
243 struct tevent_context *ev_ctx)
244 {
245 struct dcerpc_ncacn_listen_state *state;
246 struct tevent_fd *fde;
247 char *np_dir;
248
249 state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
250 if (!state) {
251 DEBUG(0, ("Out of memory\n"));
252 return false;
253 }
254 state->ep.name = talloc_strdup(state, pipe_name);
255 if (state->ep.name == NULL) {
256 DEBUG(0, ("Out of memory\n"));
257 goto out;
258 }
259 state->fd = -1;
260
261 np_dir = talloc_asprintf(state, "%s/np", lp_ncalrpc_dir());
262 if (!np_dir) {
263 DEBUG(0, ("Out of memory\n"));
264 goto out;
265 }
266
267 if (!directory_create_or_exist(np_dir, geteuid(), 0700)) {
268 DEBUG(0, ("Failed to create pipe directory %s - %s\n",
269 np_dir, strerror(errno)));
270 goto out;
271 }
272
273 state->fd = create_pipe_sock(np_dir, pipe_name, 0700);
274 if (state->fd == -1) {
275 DEBUG(0, ("Failed to create pipe socket! [%s/%s]\n",
276 np_dir, pipe_name));
277 goto out;
278 }
279
280 DEBUG(10, ("Openened pipe socket fd %d for %s\n",
281 state->fd, pipe_name));
282
283 fde = tevent_add_fd(ev_ctx,
284 state, state->fd, TEVENT_FD_READ,
285 named_pipe_listener, state);
286 if (!fde) {
287 DEBUG(0, ("Failed to add event handler!\n"));
288 goto out;
289 }
290
291 tevent_fd_set_auto_close(fde);
292 return true;
293
294 out:
295 if (state->fd != -1) {
296 close(state->fd);
297 }
298 TALLOC_FREE(state);
299 return false;
300 }
301
302 static void named_pipe_accept_function(const char *pipe_name, int fd);
303
304 static void named_pipe_listener(struct tevent_context *ev,
305 struct tevent_fd *fde,
306 uint16_t flags,
307 void *private_data)
308 {
309 struct dcerpc_ncacn_listen_state *state =
310 talloc_get_type_abort(private_data,
311 struct dcerpc_ncacn_listen_state);
312 struct sockaddr_un sunaddr;
313 socklen_t len;
314 int sd = -1;
315
316 /* TODO: should we have a limit to the number of clients ? */
317
318 len = sizeof(sunaddr);
319
320 while (sd == -1) {
321 sd = accept(state->fd,
322 (struct sockaddr *)(void *)&sunaddr, &len);
323 if (errno != EINTR) break;
324 }
325
326 if (sd == -1) {
327 DEBUG(6, ("Failed to get a valid socket [%s]\n",
328 strerror(errno)));
329 return;
330 }
331
332 DEBUG(6, ("Accepted socket %d\n", sd));
333
334 named_pipe_accept_function(state->ep.name, sd);
335 }
336
337
338 /* This is the core of the rpc server.
339 * Accepts connections from clients and process requests using the appropriate
340 * dispatcher table. */
341
342 struct named_pipe_client {
343 const char *pipe_name;
344 struct ndr_syntax_id pipe_id;
345
346 struct tevent_context *ev;
347 struct messaging_context *msg_ctx;
348
349 uint16_t file_type;
350 uint16_t device_state;
351 uint64_t allocation_size;
352
353 struct tstream_context *tstream;
354
355 struct tsocket_address *client;
356 char *client_name;
357 struct tsocket_address *server;
358 char *server_name;
359 struct auth_session_info_transport *session_info;
360
361 struct pipes_struct *p;
362
363 struct tevent_queue *write_queue;
364
365 struct iovec *iov;
366 size_t count;
367 };
368
369 static void named_pipe_accept_done(struct tevent_req *subreq);
370
371 static void named_pipe_accept_function(const char *pipe_name, int fd)
372 {
373 struct ndr_syntax_id syntax;
374 struct named_pipe_client *npc;
375 struct tstream_context *plain;
376 struct tevent_req *subreq;
377 bool ok;
378 int ret;
379
380 ok = is_known_pipename(pipe_name, &syntax);
381 if (!ok) {
382 DEBUG(1, ("Unknown pipe [%s]\n", pipe_name));
383 close(fd);
384 return;
385 }
386
387 npc = talloc_zero(NULL, struct named_pipe_client);
388 if (!npc) {
389 DEBUG(0, ("Out of memory!\n"));
390 close(fd);
391 return;
392 }
393 npc->pipe_name = pipe_name;
394 npc->pipe_id = syntax;
395 npc->ev = server_event_context();
396 npc->msg_ctx = server_messaging_context();
397
398 /* make sure socket is in NON blocking state */
399 ret = set_blocking(fd, false);
400 if (ret != 0) {
401 DEBUG(2, ("Failed to make socket non-blocking\n"));
402 TALLOC_FREE(npc);
403 close(fd);
404 return;
405 }
406
407 ret = tstream_bsd_existing_socket(npc, fd, &plain);
408 if (ret != 0) {
409 DEBUG(2, ("Failed to create tstream socket\n"));
410 TALLOC_FREE(npc);
411 close(fd);
412 return;
413 }
414
415 npc->file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
416 npc->device_state = 0xff | 0x0400 | 0x0100;
417 npc->allocation_size = 4096;
418
419 subreq = tstream_npa_accept_existing_send(npc, npc->ev, plain,
420 npc->file_type,
421 npc->device_state,
422 npc->allocation_size);
423 if (!subreq) {
424 DEBUG(2, ("Failed to start async accept procedure\n"));
425 TALLOC_FREE(npc);
426 close(fd);
427 return;
428 }
429 tevent_req_set_callback(subreq, named_pipe_accept_done, npc);
430 }
431
432 static void named_pipe_packet_process(struct tevent_req *subreq);
433 static void named_pipe_packet_done(struct tevent_req *subreq);
434
435 static void named_pipe_accept_done(struct tevent_req *subreq)
436 {
437 struct named_pipe_client *npc =
438 tevent_req_callback_data(subreq, struct named_pipe_client);
439 const char *cli_addr;
440 int error;
441 int ret;
442
443 ret = tstream_npa_accept_existing_recv(subreq, &error, npc,
444 &npc->tstream,
445 &npc->client,
446 &npc->client_name,
447 &npc->server,
448 &npc->server_name,
449 &npc->session_info);
450 TALLOC_FREE(subreq);
451 if (ret != 0) {
452 DEBUG(2, ("Failed to accept named pipe connection! (%s)\n",
453 strerror(error)));
454 TALLOC_FREE(npc);
455 return;
456 }
457
458 if (tsocket_address_is_inet(npc->client, "ip")) {
459 cli_addr = tsocket_address_inet_addr_string(npc->client,
460 subreq);
461 if (cli_addr == NULL) {
462 TALLOC_FREE(npc);
463 return;
464 }
465 } else {
466 cli_addr = "";
467 }
468
469 ret = make_server_pipes_struct(npc,
470 npc->pipe_name, npc->pipe_id, NCACN_NP,
471 false, cli_addr, NULL, npc->session_info,
472 &npc->p, &error);
473 if (ret != 0) {
474 DEBUG(2, ("Failed to create pipes_struct! (%s)\n",
475 strerror(error)));
476 goto fail;
477 }
478 npc->p->msg_ctx = npc->msg_ctx;
479
480 npc->write_queue = tevent_queue_create(npc, "np_server_write_queue");
481 if (!npc->write_queue) {
482 DEBUG(2, ("Failed to set up write queue!\n"));
483 goto fail;
484 }
485
486 /* And now start receaving and processing packets */
487 subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
488 if (!subreq) {
489 DEBUG(2, ("Failed to start receving packets\n"));
490 goto fail;
491 }
492 tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
493 return;
494
495 fail:
496 DEBUG(2, ("Fatal error. Terminating client(%s) connection!\n",
497 npc->client_name));
498 /* terminate client connection */
499 talloc_free(npc);
500 return;
501 }
502
503 static void named_pipe_packet_process(struct tevent_req *subreq)
504 {
505 struct named_pipe_client *npc =
506 tevent_req_callback_data(subreq, struct named_pipe_client);
507 struct _output_data *out = &npc->p->out_data;
508 DATA_BLOB recv_buffer = data_blob_null;
509 struct ncacn_packet *pkt;
510 NTSTATUS status;
511 ssize_t data_left;
512 ssize_t data_used;
513 char *data;
514 uint32_t to_send;
515 bool ok;
516
517 status = dcerpc_read_ncacn_packet_recv(subreq, npc, &pkt, &recv_buffer);
518 TALLOC_FREE(subreq);
519 if (!NT_STATUS_IS_OK(status)) {
520 goto fail;
521 }
522
523 data_left = recv_buffer.length;
524 data = (char *)recv_buffer.data;
525
526 while (data_left) {
527
528 data_used = process_incoming_data(npc->p, data, data_left);
529 if (data_used < 0) {
530 DEBUG(3, ("Failed to process dceprc request!\n"));
531 status = NT_STATUS_UNEXPECTED_IO_ERROR;
532 goto fail;
533 }
534
535 data_left -= data_used;
536 data += data_used;
537 }
538
539 /* Do not leak this buffer, npc is a long lived context */
540 talloc_free(recv_buffer.data);
541 talloc_free(pkt);
542
543 /* this is needed because of the way DCERPC Binds work in
544 * the RPC marshalling code */
545 to_send = out->frag.length - out->current_pdu_sent;
546 if (to_send > 0) {
547
548 DEBUG(10, ("Current_pdu_len = %u, "
549 "current_pdu_sent = %u "
550 "Returning %u bytes\n",
551 (unsigned int)out->frag.length,
552 (unsigned int)out->current_pdu_sent,
553 (unsigned int)to_send));
554
555 npc->iov = talloc_zero(npc, struct iovec);
556 if (!npc->iov) {
557 status = NT_STATUS_NO_MEMORY;
558 goto fail;
559 }
560 npc->count = 1;
561
562 npc->iov[0].iov_base = out->frag.data
563 + out->current_pdu_sent;
564 npc->iov[0].iov_len = to_send;
565
566 out->current_pdu_sent += to_send;
567 }
568
569 /* this condition is false for bind packets, or when we haven't
570 * yet got a full request, and need to wait for more data from
571 * the client */
572 while (out->data_sent_length < out->rdata.length) {
573
574 ok = create_next_pdu(npc->p);
575 if (!ok) {
576 DEBUG(3, ("Failed to create next PDU!\n"));
577 status = NT_STATUS_UNEXPECTED_IO_ERROR;
578 goto fail;
579 }
580
581 npc->iov = talloc_realloc(npc, npc->iov,
582 struct iovec, npc->count + 1);
583 if (!npc->iov) {
584 status = NT_STATUS_NO_MEMORY;
585 goto fail;
586 }
587
588 npc->iov[npc->count].iov_base = out->frag.data;
589 npc->iov[npc->count].iov_len = out->frag.length;
590
591 DEBUG(10, ("PDU number: %d, PDU Length: %u\n",
592 (unsigned int)npc->count,
593 (unsigned int)npc->iov[npc->count].iov_len));
594 dump_data(11, (const uint8_t *)npc->iov[npc->count].iov_base,
595 npc->iov[npc->count].iov_len);
596 npc->count++;
597 }
598
599 /* we still don't have a complete request, go back and wait for more
600 * data */
601 if (npc->count == 0) {
602 /* Wait for the next packet */
603 subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
604 if (!subreq) {
605 DEBUG(2, ("Failed to start receving packets\n"));
606 status = NT_STATUS_NO_MEMORY;
607 goto fail;
608 }
609 tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
610 return;
611 }
612
613 DEBUG(10, ("Sending a total of %u bytes\n",
614 (unsigned int)npc->p->out_data.data_sent_length));
615
616 subreq = tstream_writev_queue_send(npc, npc->ev,
617 npc->tstream,
618 npc->write_queue,
619 npc->iov, npc->count);
620 if (!subreq) {
621 DEBUG(2, ("Failed to send packet\n"));
622 status = NT_STATUS_NO_MEMORY;
623 goto fail;
624 }
625 tevent_req_set_callback(subreq, named_pipe_packet_done, npc);
626 return;
627
628 fail:
629 DEBUG(2, ("Fatal error(%s). "
630 "Terminating client(%s) connection!\n",
631 nt_errstr(status), npc->client_name));
632 /* terminate client connection */
633 talloc_free(npc);
634 return;
635 }
636
637 static void named_pipe_packet_done(struct tevent_req *subreq)
638 {
639 struct named_pipe_client *npc =
640 tevent_req_callback_data(subreq, struct named_pipe_client);
641 int sys_errno;
642 int ret;
643
644 ret = tstream_writev_queue_recv(subreq, &sys_errno);
645 TALLOC_FREE(subreq);
646 if (ret == -1) {
647 DEBUG(2, ("Writev failed!\n"));
648 goto fail;
649 }
650
651 /* clear out any data that may have been left around */
652 npc->count = 0;
653 TALLOC_FREE(npc->iov);
654 data_blob_free(&npc->p->in_data.data);
655 data_blob_free(&npc->p->out_data.frag);
656 data_blob_free(&npc->p->out_data.rdata);
657
658 /* Wait for the next packet */
659 subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
660 if (!subreq) {
661 DEBUG(2, ("Failed to start receving packets\n"));
662 sys_errno = ENOMEM;
663 goto fail;
664 }
665 tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
666 return;
667
668 fail:
669 DEBUG(2, ("Fatal error(%s). "
670 "Terminating client(%s) connection!\n",
671 strerror(sys_errno), npc->client_name));
672 /* terminate client connection */
673 talloc_free(npc);
674 return;
675 }
676
677 static void dcerpc_ncacn_accept(struct tevent_context *ev_ctx,
678 struct messaging_context *msg_ctx,
679 struct ndr_syntax_id syntax_id,
680 enum dcerpc_transport_t transport,
681 const char *name,
682 uint16_t port,
683 struct tsocket_address *cli_addr,
684 struct tsocket_address *srv_addr,
685 int s);
686
687 /********************************************************************
688 * Start listening on the tcp/ip socket
689 ********************************************************************/
690
691 static void dcerpc_ncacn_tcpip_listener(struct tevent_context *ev,
692 struct tevent_fd *fde,
693 uint16_t flags,
694 void *private_data);
695
696 uint16_t setup_dcerpc_ncacn_tcpip_socket(struct tevent_context *ev_ctx,
697 struct messaging_context *msg_ctx,
698 struct ndr_syntax_id syntax_id,
699 const struct sockaddr_storage *ifss,
700 uint16_t port)
701 {
702 struct dcerpc_ncacn_listen_state *state;
703 struct tevent_fd *fde;
704 int rc;
705
706 state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
707 if (state == NULL) {
708 DEBUG(0, ("setup_dcerpc_ncacn_tcpip_socket: Out of memory\n"));
709 return 0;
710 }
711
712 state->syntax_id = syntax_id;
713 state->fd = -1;
714 state->ep.port = port;
715
716 if (state->ep.port == 0) {
717 uint16_t i;
718
719 for (i = SERVER_TCP_LOW_PORT; i <= SERVER_TCP_HIGH_PORT; i++) {
720 state->fd = open_socket_in(SOCK_STREAM,
721 i,
722 0,
723 ifss,
724 false);
725 if (state->fd > 0) {
726 state->ep.port = i;
727 break;
728 }
729 }
730 } else {
731 state->fd = open_socket_in(SOCK_STREAM,
732 state->ep.port,
733 0,
734 ifss,
735 true);
736 }
737 if (state->fd == -1) {
738 DEBUG(0, ("setup_dcerpc_ncacn_tcpip_socket: Failed to create "
739 "socket on port %u!\n", state->ep.port));
740 goto out;
741 }
742
743 state->ev_ctx = ev_ctx;
744 state->msg_ctx = msg_ctx;
745
746 /* ready to listen */
747 set_socket_options(state->fd, "SO_KEEPALIVE");
748 set_socket_options(state->fd, lp_socket_options());
749
750 /* Set server socket to non-blocking for the accept. */
751 set_blocking(state->fd, false);
752
753 rc = listen(state->fd, SMBD_LISTEN_BACKLOG);
754 if (rc == -1) {
755 DEBUG(0,("setup_tcpip_socket: listen - %s\n", strerror(errno)));
756 goto out;
757 }
758
759 DEBUG(10, ("setup_tcpip_socket: openened socket fd %d for port %u\n",
760 state->fd, state->ep.port));
761
762 fde = tevent_add_fd(state->ev_ctx,
763 state,
764 state->fd,
765 TEVENT_FD_READ,
766 dcerpc_ncacn_tcpip_listener,
767 state);
768 if (fde == NULL) {
769 DEBUG(0, ("setup_tcpip_socket: Failed to add event handler!\n"));
770 goto out;
771 }
772
773 tevent_fd_set_auto_close(fde);
774
775 return state->ep.port;
776 out:
777 if (state->fd != -1) {
778 close(state->fd);
779 }
780 TALLOC_FREE(state);
781
782 return 0;
783 }
784
785 static void dcerpc_ncacn_tcpip_listener(struct tevent_context *ev,
786 struct tevent_fd *fde,
787 uint16_t flags,
788 void *private_data)
789 {
790 struct dcerpc_ncacn_listen_state *state =
791 talloc_get_type_abort(private_data,
792 struct dcerpc_ncacn_listen_state);
793 struct tsocket_address *cli_addr = NULL;
794 struct tsocket_address *srv_addr = NULL;
795 struct sockaddr_storage addr;
796 socklen_t in_addrlen = sizeof(addr);
797 int s = -1;
798 int rc;
799
800 while (s == -1) {
801 s = accept(state->fd, (struct sockaddr *)(void *) &addr, &in_addrlen);
802 if (s == -1 && errno != EINTR) {
803 break;
804 }
805 }
806
807 if (s == -1) {
808 DEBUG(0,("tcpip_listener accept: %s\n",
809 strerror(errno)));
810 return;
811 }
812
813 rc = tsocket_address_bsd_from_sockaddr(state,
814 (struct sockaddr *)(void *) &addr,
815 in_addrlen,
816 &cli_addr);
817 if (rc < 0) {
818 close(s);
819 return;
820 }
821
822 rc = getsockname(s, (struct sockaddr *)(void *) &addr, &in_addrlen);
823 if (rc < 0) {
824 close(s);
825 return;
826 }
827
828 rc = tsocket_address_bsd_from_sockaddr(state,
829 (struct sockaddr *)(void *) &addr,
830 in_addrlen,
831 &srv_addr);
832 if (rc < 0) {
833 close(s);
834 return;
835 }
836
837 DEBUG(6, ("tcpip_listener: Accepted socket %d\n", s));
838
839 dcerpc_ncacn_accept(state->ev_ctx,
840 state->msg_ctx,
841 state->syntax_id,
842 NCACN_IP_TCP,
843 NULL,
844 state->ep.port,
845 cli_addr,
846 srv_addr,
847 s);
848 }
849
850 /********************************************************************
851 * Start listening on the ncalrpc socket
852 ********************************************************************/
853
854 static void dcerpc_ncalrpc_listener(struct tevent_context *ev,
855 struct tevent_fd *fde,
856 uint16_t flags,
857 void *private_data);
858
859 bool setup_dcerpc_ncalrpc_socket(struct tevent_context *ev_ctx,
860 struct messaging_context *msg_ctx,
861 struct ndr_syntax_id syntax_id,
862 const char *name)
863 {
864 struct dcerpc_ncacn_listen_state *state;
865 struct tevent_fd *fde;
866
867 state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
868 if (state == NULL) {
869 DEBUG(0, ("Out of memory\n"));
870 return false;
871 }
872
873 state->syntax_id = syntax_id;
874 state->fd = -1;
875
876 if (name == NULL) {
877 name = "DEFAULT";
878 }
879 state->ep.name = talloc_strdup(state, name);
880
881 if (state->ep.name == NULL) {
882 DEBUG(0, ("Out of memory\n"));
883 talloc_free(state);
884 return false;
885 }
886
887 if (!directory_create_or_exist(lp_ncalrpc_dir(), geteuid(), 0700)) {
888 DEBUG(0, ("Failed to create pipe directory %s - %s\n",
889 lp_ncalrpc_dir(), strerror(errno)));
890 goto out;
891 }
892
893 state->fd = create_pipe_sock(lp_ncalrpc_dir(), name, 0700);
894 if (state->fd == -1) {
895 DEBUG(0, ("Failed to create pipe socket! [%s/%s]\n",
896 lp_ncalrpc_dir(), name));
897 goto out;
898 }
899
900 DEBUG(10, ("Openened pipe socket fd %d for %s\n", state->fd, name));
901
902 state->ev_ctx = ev_ctx;
903 state->msg_ctx = msg_ctx;
904
905 /* Set server socket to non-blocking for the accept. */
906 set_blocking(state->fd, false);
907
908 fde = tevent_add_fd(state->ev_ctx,
909 state,
910 state->fd,
911 TEVENT_FD_READ,
912 dcerpc_ncalrpc_listener,
913 state);
914 if (fde == NULL) {
915 DEBUG(0, ("Failed to add event handler for ncalrpc!\n"));
916 goto out;
917 }
918
919 tevent_fd_set_auto_close(fde);
920
921 return true;
922 out:
923 if (state->fd != -1) {
924 close(state->fd);
925 }
926 TALLOC_FREE(state);
927
928 return 0;
929 }
930
931 static void dcerpc_ncalrpc_listener(struct tevent_context *ev,
932 struct tevent_fd *fde,
933 uint16_t flags,
934 void *private_data)
935 {
936 struct dcerpc_ncacn_listen_state *state =
937 talloc_get_type_abort(private_data,
938 struct dcerpc_ncacn_listen_state);
939 struct tsocket_address *cli_addr = NULL;
940 struct sockaddr_un sunaddr;
941 struct sockaddr *addr = (struct sockaddr *)(void *)&sunaddr;
942 socklen_t len = sizeof(sunaddr);
943 int sd = -1;
944 int rc;
945
946 ZERO_STRUCT(sunaddr);
947
948 while (sd == -1) {
949 sd = accept(state->fd, addr, &len);
950 if (sd == -1 && errno != EINTR) {
951 break;
952 }
953 }
954
955 if (sd == -1) {
956 DEBUG(0, ("ncalrpc accept() failed: %s\n", strerror(errno)));
957 return;
958 }
959
960 rc = tsocket_address_bsd_from_sockaddr(state,
961 addr, len,
962 &cli_addr);
963 if (rc < 0) {
964 close(sd);
965 return;
966 }
967
968 DEBUG(10, ("Accepted ncalrpc socket %d\n", sd));
969
970 dcerpc_ncacn_accept(state->ev_ctx,
971 state->msg_ctx,
972 state->syntax_id, NCALRPC,
973 state->ep.name, 0,
974 cli_addr, NULL, sd);
975 }
976
977 struct dcerpc_ncacn_conn {
978 struct ndr_syntax_id syntax_id;
979
980 enum dcerpc_transport_t transport;
981
982 union {
983 const char *name;
984 uint16_t port;
985 } ep;
986
987 int sock;
988
989 struct pipes_struct *p;
990
991 struct tevent_context *ev_ctx;
992 struct messaging_context *msg_ctx;
993
994 struct tstream_context *tstream;
995 struct tevent_queue *send_queue;
996
997 struct tsocket_address *client;
998 char *client_name;
999 struct tsocket_address *server;
1000 char *server_name;
1001 struct auth_session_info_transport *session_info;
1002
1003 struct iovec *iov;
1004 size_t count;
1005 };
1006
1007 static void dcerpc_ncacn_packet_process(struct tevent_req *subreq);
1008 static void dcerpc_ncacn_packet_done(struct tevent_req *subreq);
1009
1010 static void dcerpc_ncacn_accept(struct tevent_context *ev_ctx,
1011 struct messaging_context *msg_ctx,
1012 struct ndr_syntax_id syntax_id,
1013 enum dcerpc_transport_t transport,
1014 const char *name,
1015 uint16_t port,
1016 struct tsocket_address *cli_addr,
1017 struct tsocket_address *srv_addr,
1018 int s) {
1019 struct dcerpc_ncacn_conn *ncacn_conn;
1020 struct tevent_req *subreq;
1021 const char *cli_str;
1022 const char *srv_str = NULL;
1023 bool system_user = false;
1024 char *pipe_name;
1025 NTSTATUS status;
1026 int sys_errno;
1027 uid_t uid;
1028 int rc;
1029
1030 DEBUG(10, ("dcerpc_ncacn_accept\n"));
1031
1032 ncacn_conn = talloc_zero(ev_ctx, struct dcerpc_ncacn_conn);
1033 if (ncacn_conn == NULL) {
1034 DEBUG(0, ("Out of memory!\n"));
1035 close(s);
1036 return;
1037 }
1038
1039 ncacn_conn->transport = transport;
1040 ncacn_conn->syntax_id = syntax_id;
1041 ncacn_conn->ev_ctx = ev_ctx;
1042 ncacn_conn->msg_ctx = msg_ctx;
1043 ncacn_conn->sock = s;
1044
1045 ncacn_conn->client = talloc_move(ncacn_conn, &cli_addr);
1046 if (tsocket_address_is_inet(ncacn_conn->client, "ip")) {
1047 ncacn_conn->client_name =
1048 tsocket_address_inet_addr_string(ncacn_conn->client,
1049 ncacn_conn);
1050 } else {
1051 ncacn_conn->client_name =
1052 tsocket_address_unix_path(ncacn_conn->client,
1053 ncacn_conn);
1054 }
1055 if (ncacn_conn->client_name == NULL) {
1056 DEBUG(0, ("Out of memory!\n"));
1057 talloc_free(ncacn_conn);
1058 close(s);
1059 return;
1060 }
1061
1062 if (srv_addr != NULL) {
1063 ncacn_conn->server = talloc_move(ncacn_conn, &srv_addr);
1064
1065 ncacn_conn->server_name =
1066 tsocket_address_inet_addr_string(ncacn_conn->server,
1067 ncacn_conn);
1068 if (ncacn_conn->server_name == NULL) {
1069 DEBUG(0, ("Out of memory!\n"));
1070 talloc_free(ncacn_conn);
1071 close(s);
1072 return;
1073 }
1074 }
1075
1076 switch (transport) {
1077 case NCACN_IP_TCP:
1078 ncacn_conn->ep.port = port;
1079
1080 pipe_name = tsocket_address_string(ncacn_conn->client,
1081 ncacn_conn);
1082 if (pipe_name == NULL) {
1083 close(s);
1084 talloc_free(ncacn_conn);
1085 return;
1086 }
1087
1088 break;
1089 case NCALRPC:
1090 rc = sys_getpeereid(s, &uid);
1091 if (rc < 0) {
1092 DEBUG(2, ("Failed to get ncalrpc connecting uid!"));
1093 } else {
1094 if (uid == sec_initial_uid()) {
1095 system_user = true;
1096 }
1097 }
1098 case NCACN_NP:
1099 ncacn_conn->ep.name = talloc_strdup(ncacn_conn, name);
1100 if (ncacn_conn->ep.name == NULL) {
1101 close(s);
1102 talloc_free(ncacn_conn);
1103 return;
1104 }
1105
1106 pipe_name = talloc_strdup(ncacn_conn,
1107 name);
1108 if (pipe_name == NULL) {
1109 close(s);
1110 talloc_free(ncacn_conn);
1111 return;
1112 }
1113 break;
1114 default:
1115 DEBUG(0, ("unknown dcerpc transport: %u!\n",
1116 transport));
1117 talloc_free(ncacn_conn);
1118 close(s);
1119 return;
1120 }
1121
1122 rc = set_blocking(s, false);
1123 if (rc < 0) {
1124 DEBUG(2, ("Failed to set dcerpc socket to non-blocking\n"));
1125 talloc_free(ncacn_conn);
1126 close(s);
1127 return;
1128 }
1129
1130 /*
1131 * As soon as we have tstream_bsd_existing_socket set up it will
1132 * take care of closing the socket.
1133 */
1134 rc = tstream_bsd_existing_socket(ncacn_conn, s, &ncacn_conn->tstream);
1135 if (rc < 0) {
1136 DEBUG(2, ("Failed to create tstream socket for dcerpc\n"));
1137 talloc_free(ncacn_conn);
1138 close(s);
1139 return;
1140 }
1141
1142 if (tsocket_address_is_inet(ncacn_conn->client, "ip")) {
1143 cli_str = ncacn_conn->client_name;
1144 } else {
1145 cli_str = "";
1146 }
1147
1148 if (ncacn_conn->server != NULL) {
1149 if (tsocket_address_is_inet(ncacn_conn->server, "ip")) {
1150 srv_str = ncacn_conn->server_name;
1151 } else {
1152 srv_str = NULL;
1153 }
1154 }
1155
1156 if (ncacn_conn->session_info == NULL) {
1157 status = auth_anonymous_session_info(ncacn_conn,
1158 &ncacn_conn->session_info);
1159 if (!NT_STATUS_IS_OK(status)) {
1160 DEBUG(2, ("Failed to create "
1161 "auth_anonymous_session_info - %s\n",
1162 nt_errstr(status)));
1163 talloc_free(ncacn_conn);
1164 return;
1165 }
1166 }
1167
1168 rc = make_server_pipes_struct(ncacn_conn,
1169 pipe_name,
1170 ncacn_conn->syntax_id,
1171 ncacn_conn->transport,
1172 system_user,
1173 cli_str,
1174 srv_str,
1175 ncacn_conn->session_info,
1176 &ncacn_conn->p,
1177 &sys_errno);
1178 if (rc < 0) {
1179 DEBUG(2, ("Failed to create pipe struct - %s",
1180 strerror(sys_errno)));
1181 talloc_free(ncacn_conn);
1182 return;
1183 }
1184
1185 ncacn_conn->send_queue = tevent_queue_create(ncacn_conn,
1186 "dcerpc send queue");
1187 if (ncacn_conn->send_queue == NULL) {
1188 DEBUG(0, ("Out of memory!\n"));
1189 talloc_free(ncacn_conn);
1190 return;
1191 }
1192
1193 subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1194 ncacn_conn->ev_ctx,
1195 ncacn_conn->tstream);
1196 if (subreq == NULL) {
1197 DEBUG(2, ("Failed to send ncacn packet\n"));
1198 talloc_free(ncacn_conn);
1199 return;
1200 }
1201
1202 tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1203
1204 DEBUG(10, ("dcerpc_ncacn_accept done\n"));
1205
1206 return;
1207 }
1208
1209 static void dcerpc_ncacn_packet_process(struct tevent_req *subreq)
1210 {
1211 struct dcerpc_ncacn_conn *ncacn_conn =
1212 tevent_req_callback_data(subreq, struct dcerpc_ncacn_conn);
1213
1214 struct _output_data *out = &ncacn_conn->p->out_data;
1215 DATA_BLOB recv_buffer = data_blob_null;
1216 struct ncacn_packet *pkt;
1217 ssize_t data_left;
1218 ssize_t data_used;
1219 uint32_t to_send;
1220 char *data;
1221 NTSTATUS status;
1222 bool ok;
1223
1224 status = dcerpc_read_ncacn_packet_recv(subreq, ncacn_conn, &pkt, &recv_buffer);
1225 TALLOC_FREE(subreq);
1226 if (!NT_STATUS_IS_OK(status)) {
1227 DEBUG(3, ("Failed to receive ncacn packet!\n"));
1228 goto fail;
1229 }
1230
1231 data_left = recv_buffer.length;
1232 data = (char *) recv_buffer.data;
1233
1234 while (data_left) {
1235 data_used = process_incoming_data(ncacn_conn->p, data, data_left);
1236 if (data_used < 0) {
1237 DEBUG(3, ("Failed to process dcerpc request!\n"));
1238 status = NT_STATUS_UNEXPECTED_IO_ERROR;
1239 goto fail;
1240 }
1241
1242 data_left -= data_used;
1243 data += data_used;
1244 }
1245
1246 /* Do not leak this buffer */
1247 talloc_free(recv_buffer.data);
1248 talloc_free(pkt);
1249
1250 /*
1251 * This is needed because of the way DCERPC binds work in the RPC
1252 * marshalling code
1253 */
1254 to_send = out->frag.length - out->current_pdu_sent;
1255 if (to_send > 0) {
1256
1257 DEBUG(10, ("Current_pdu_len = %u, "
1258 "current_pdu_sent = %u "
1259 "Returning %u bytes\n",
1260 (unsigned int)out->frag.length,
1261 (unsigned int)out->current_pdu_sent,
1262 (unsigned int)to_send));
1263
1264 ncacn_conn->iov = talloc_zero(ncacn_conn, struct iovec);
1265 if (ncacn_conn->iov == NULL) {
1266 status = NT_STATUS_NO_MEMORY;
1267 DEBUG(3, ("Out of memory!\n"));
1268 goto fail;
1269 }
1270 ncacn_conn->count = 1;
1271
1272 ncacn_conn->iov[0].iov_base = out->frag.data
1273 + out->current_pdu_sent;
1274 ncacn_conn->iov[0].iov_len = to_send;
1275
1276 out->current_pdu_sent += to_send;
1277 }
1278
1279 /*
1280 * This condition is false for bind packets, or when we haven't yet got
1281 * a full request, and need to wait for more data from the client
1282 */
1283 while (out->data_sent_length < out->rdata.length) {
1284 ok = create_next_pdu(ncacn_conn->p);
1285 if (!ok) {
1286 DEBUG(3, ("Failed to create next PDU!\n"));
1287 status = NT_STATUS_UNEXPECTED_IO_ERROR;
1288 goto fail;
1289 }
1290
1291 ncacn_conn->iov = talloc_realloc(ncacn_conn,
1292 ncacn_conn->iov,
1293 struct iovec,
1294 ncacn_conn->count + 1);
1295 if (ncacn_conn->iov == NULL) {
1296 DEBUG(3, ("Out of memory!\n"));
1297 status = NT_STATUS_NO_MEMORY;
1298 goto fail;
1299 }
1300
1301 ncacn_conn->iov[ncacn_conn->count].iov_base = out->frag.data;
1302 ncacn_conn->iov[ncacn_conn->count].iov_len = out->frag.length;
1303
1304 DEBUG(10, ("PDU number: %d, PDU Length: %u\n",
1305 (unsigned int) ncacn_conn->count,
1306 (unsigned int) ncacn_conn->iov[ncacn_conn->count].iov_len));
1307 dump_data(11, (const uint8_t *) ncacn_conn->iov[ncacn_conn->count].iov_base,
1308 ncacn_conn->iov[ncacn_conn->count].iov_len);
1309 ncacn_conn->count++;
1310 }
1311
1312 /*
1313 * We still don't have a complete request, go back and wait for more
1314 * data.
1315 */
1316 if (ncacn_conn->count == 0) {
1317 /* Wait for the next packet */
1318 subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1319 ncacn_conn->ev_ctx,
1320 ncacn_conn->tstream);
1321 if (subreq == NULL) {
1322 DEBUG(2, ("Failed to start receving packets\n"));
1323 status = NT_STATUS_NO_MEMORY;
1324 goto fail;
1325 }
1326 tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1327 return;
1328 }
1329
1330 DEBUG(10, ("Sending a total of %u bytes\n",
1331 (unsigned int)ncacn_conn->p->out_data.data_sent_length));
1332
1333 subreq = tstream_writev_queue_send(ncacn_conn,
1334 ncacn_conn->ev_ctx,
1335 ncacn_conn->tstream,
1336 ncacn_conn->send_queue,
1337 ncacn_conn->iov,
1338 ncacn_conn->count);
1339 if (subreq == NULL) {
1340 DEBUG(2, ("Failed to send packet\n"));
1341 status = NT_STATUS_NO_MEMORY;
1342 goto fail;
1343 }
1344
1345 tevent_req_set_callback(subreq, dcerpc_ncacn_packet_done, ncacn_conn);
1346 return;
1347
1348 fail:
1349 DEBUG(2, ("Fatal error(%s). "
1350 "Terminating client(%s) connection!\n",
1351 nt_errstr(status), ncacn_conn->client_name));
1352
1353 /* Terminate client connection */
1354 talloc_free(ncacn_conn);
1355 return;
1356 }
1357
1358 static void dcerpc_ncacn_packet_done(struct tevent_req *subreq)
1359 {
1360 struct dcerpc_ncacn_conn *ncacn_conn =
1361 tevent_req_callback_data(subreq, struct dcerpc_ncacn_conn);
1362 int sys_errno;
1363 int rc;
1364
1365 rc = tstream_writev_queue_recv(subreq, &sys_errno);
1366 TALLOC_FREE(subreq);
1367 if (rc < 0) {
1368 DEBUG(2, ("Writev failed!\n"));
1369 goto fail;
1370 }
1371
1372 /* clear out any data that may have been left around */
1373 ncacn_conn->count = 0;
1374 TALLOC_FREE(ncacn_conn->iov);
1375 data_blob_free(&ncacn_conn->p->in_data.data);
1376 data_blob_free(&ncacn_conn->p->out_data.frag);
1377 data_blob_free(&ncacn_conn->p->out_data.rdata);
1378
1379 /* Wait for the next packet */
1380 subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1381 ncacn_conn->ev_ctx,
1382 ncacn_conn->tstream);
1383 if (subreq == NULL) {
1384 DEBUG(2, ("Failed to start receving packets\n"));
1385 sys_errno = ENOMEM;
1386 goto fail;
1387 }
1388
1389 tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1390 return;
1391
1392 fail:
1393 DEBUG(2, ("Fatal error(%s). Terminating client(%s) connection!\n",
1394 strerror(sys_errno), ncacn_conn->client_name));
1395
1396 /* Terminate client connection */
1397 talloc_free(ncacn_conn);
1398 return;
1399 }
1400
1401 /* vim: set ts=8 sw=8 noet cindent syntax=c.doxygen: */
reg import