source3/rpc_server/rpc_server.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Generic infrstructure for RPC Daemons
   4    Copyright (C) Simo Sorce 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "rpc_server/rpc_server.h"
  22 #include "rpc_dce.h"
  23 #include "librpc/gen_ndr/netlogon.h"
  24 #include "registry/reg_parse_prs.h"
  25 #include "lib/tsocket/tsocket.h"
  26 #include "libcli/named_pipe_auth/npa_tstream.h"
  27
  28 /* Creates a pipes_struct and initializes it with the information
  29  * sent from the client */
  30 static int make_server_pipes_struct(TALLOC_CTX *mem_ctx,
  31                                     const char *pipe_name,
  32                                     const struct ndr_syntax_id id,
  33                                     const char *client_address,
  34                                     struct netr_SamInfo3 *info3,
  35                                     struct pipes_struct **_p,
  36                                     int *perrno)
  37 {
  38         struct pipes_struct *p;
  39         NTSTATUS status;
  40         bool ok;
  41
  42         p = talloc_zero(mem_ctx, struct pipes_struct);
  43         if (!p) {
  44                 *perrno = ENOMEM;
  45                 return -1;
  46         }
  47         p->syntax = id;
  48
  49         p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p);
  50         if (!p->mem_ctx) {
  51                 TALLOC_FREE(p);
  52                 *perrno = ENOMEM;
  53                 return -1;
  54         }
  55
  56         ok = init_pipe_handles(p, &id);
  57         if (!ok) {
  58                 DEBUG(1, ("Failed to init handles\n"));
  59                 TALLOC_FREE(p);
  60                 *perrno = EINVAL;
  61                 return -1;
  62         }
  63
  64
  65         data_blob_free(&p->in_data.data);
  66         data_blob_free(&p->in_data.pdu);
  67
  68         p->endian = RPC_LITTLE_ENDIAN;
  69
  70         status = make_server_info_info3(p,
  71                                         info3->base.account_name.string,
  72                                         info3->base.domain.string,
  73                                         &p->server_info, info3);
  74         if (!NT_STATUS_IS_OK(status)) {
  75                 DEBUG(1, ("Failed to init server info\n"));
  76                 TALLOC_FREE(p);
  77                 *perrno = EINVAL;
  78                 return -1;
  79         }
  80
  81         /*
  82          * Some internal functions need a local token to determine access to
  83          * resoutrces.
  84          */
  85         status = create_local_token(p->server_info);
  86         if (!NT_STATUS_IS_OK(status)) {
  87                 DEBUG(1, ("Failed to init local auth token\n"));
  88                 TALLOC_FREE(p);
  89                 *perrno = EINVAL;
  90                 return -1;
  91         }
  92
  93         p->client_id = talloc_zero(p, struct client_address);
  94         if (!p->client_id) {
  95                 TALLOC_FREE(p);
  96                 *perrno = ENOMEM;
  97                 return -1;
  98         }
  99         strlcpy(p->client_id->addr,
 100                 client_address, sizeof(p->client_id->addr));
 101         p->client_id->name = talloc_strdup(p->client_id, client_address);
 102         if (p->client_id->name == NULL) {
 103                 TALLOC_FREE(p);
 104                 *perrno = ENOMEM;
 105                 return -1;
 106         }
 107
 108         talloc_set_destructor(p, close_internal_rpc_pipe_hnd);
 109
 110         *_p = p;
 111         return 0;
 112 }
 113
 114 /* Add some helper functions to wrap the common ncacn packet reading functions
 115  * until we can share more dcerpc code */
 116 struct named_pipe_read_packet_state {
 117         struct ncacn_packet *pkt;
 118         DATA_BLOB buffer;
 119 };
 120
 121 static void named_pipe_read_packet_done(struct tevent_req *subreq);
 122
 123 static struct tevent_req *named_pipe_read_packet_send(TALLOC_CTX *mem_ctx,
 124                                         struct tevent_context *ev,
 125                                         struct tstream_context *tstream)
 126 {
 127         struct named_pipe_read_packet_state *state;
 128         struct tevent_req *req, *subreq;
 129
 130         req = tevent_req_create(mem_ctx, &state,
 131                                 struct named_pipe_read_packet_state);
 132         if (!req) {
 133                 return NULL;
 134         }
 135         ZERO_STRUCTP(state);
 136
 137         subreq = dcerpc_read_ncacn_packet_send(state, ev, tstream);
 138         if (!subreq) {
 139                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 140                 tevent_req_post(req, ev);
 141                 return req;
 142         }
 143         tevent_req_set_callback(subreq, named_pipe_read_packet_done, req);
 144
 145         return req;
 146 }
 147
 148 static void named_pipe_read_packet_done(struct tevent_req *subreq)
 149 {
 150         struct tevent_req *req =
 151                 tevent_req_callback_data(subreq, struct tevent_req);
 152         struct named_pipe_read_packet_state *state =
 153                 tevent_req_data(req, struct named_pipe_read_packet_state);
 154         NTSTATUS status;
 155
 156         status = dcerpc_read_ncacn_packet_recv(subreq, state,
 157                                                 &state->pkt,
 158                                                 &state->buffer);
 159         TALLOC_FREE(subreq);
 160         if (!NT_STATUS_IS_OK(status)) {
 161                 DEBUG(3, ("Failed to receive dceprc packet!\n"));
 162                 tevent_req_nterror(req, status);
 163                 return;
 164         }
 165
 166         tevent_req_done(req);
 167 }
 168
 169 static NTSTATUS named_pipe_read_packet_recv(struct tevent_req *req,
 170                                                 TALLOC_CTX *mem_ctx,
 171                                                 DATA_BLOB *buffer)
 172 {
 173         struct named_pipe_read_packet_state *state =
 174                 tevent_req_data(req, struct named_pipe_read_packet_state);
 175         NTSTATUS status;
 176
 177         if (tevent_req_is_nterror(req, &status)) {
 178                 tevent_req_received(req);
 179                 return status;
 180         }
 181
 182         buffer->data = talloc_move(mem_ctx, &state->buffer.data);
 183         buffer->length = state->buffer.length;
 184
 185         tevent_req_received(req);
 186         return NT_STATUS_OK;
 187 }
 188
 189
 190
 191 /* Start listening on the appropriate unix socket and setup all is needed to
 192  * dispatch requests to the pipes rpc implementation */
 193
 194 struct named_pipe_listen_state {
 195         int fd;
 196         char *name;
 197 };
 198
 199 static void named_pipe_listener(struct tevent_context *ev,
 200                                 struct tevent_fd *fde,
 201                                 uint16_t flags,
 202                                 void *private_data);
 203
 204 bool setup_named_pipe_socket(const char *pipe_name,
 205                              struct tevent_context *ev_ctx)
 206 {
 207         struct named_pipe_listen_state *state;
 208         struct tevent_fd *fde;
 209         char *np_dir;
 210
 211         state = talloc(ev_ctx, struct named_pipe_listen_state);
 212         if (!state) {
 213                 DEBUG(0, ("Out of memory\n"));
 214                 return false;
 215         }
 216         state->name = talloc_strdup(state, pipe_name);
 217         if (!state->name) {
 218                 DEBUG(0, ("Out of memory\n"));
 219                 goto out;
 220         }
 221         state->fd = -1;
 222
 223         np_dir = talloc_asprintf(state, "%s/np", lp_ncalrpc_dir());
 224         if (!np_dir) {
 225                 DEBUG(0, ("Out of memory\n"));
 226                 goto out;
 227         }
 228
 229         if (!directory_create_or_exist(np_dir, geteuid(), 0700)) {
 230                 DEBUG(0, ("Failed to create pipe directory %s - %s\n",
 231                           np_dir, strerror(errno)));
 232                 goto out;
 233         }
 234
 235         state->fd = create_pipe_sock(np_dir, pipe_name, 0700);
 236         if (state->fd == -1) {
 237                 DEBUG(0, ("Failed to create pipe socket! [%s/%s]\n",
 238                           np_dir, pipe_name));
 239                 goto out;
 240         }
 241
 242         DEBUG(10, ("Openened pipe socket fd %d for %s\n",
 243                    state->fd, pipe_name));
 244
 245         fde = tevent_add_fd(ev_ctx,
 246                             state, state->fd, TEVENT_FD_READ,
 247                             named_pipe_listener, state);
 248         if (!fde) {
 249                 DEBUG(0, ("Failed to add event handler!\n"));
 250                 goto out;
 251         }
 252
 253         tevent_fd_set_auto_close(fde);
 254         return true;
 255
 256 out:
 257         if (state->fd != -1) {
 258                 close(state->fd);
 259         }
 260         TALLOC_FREE(state);
 261         return false;
 262 }
 263
 264 static void named_pipe_accept_function(const char *pipe_name, int fd);
 265
 266 static void named_pipe_listener(struct tevent_context *ev,
 267                                 struct tevent_fd *fde,
 268                                 uint16_t flags,
 269                                 void *private_data)
 270 {
 271         struct named_pipe_listen_state *state =
 272                         talloc_get_type_abort(private_data,
 273                                               struct named_pipe_listen_state);
 274         struct sockaddr_un sunaddr;
 275         socklen_t len;
 276         int sd = -1;
 277
 278         /* TODO: should we have a limit to the number of clients ? */
 279
 280         len = sizeof(sunaddr);
 281
 282         while (sd == -1) {
 283                 sd = accept(state->fd,
 284                             (struct sockaddr *)(void *)&sunaddr, &len);
 285                 if (errno != EINTR) break;
 286         }
 287
 288         if (sd == -1) {
 289                 DEBUG(6, ("Failed to get a valid socket [%s]\n",
 290                           strerror(errno)));
 291                 return;
 292         }
 293
 294         DEBUG(6, ("Accepted socket %d\n", sd));
 295
 296         named_pipe_accept_function(state->name, sd);
 297 }
 298
 299
 300 /* This is the core of the rpc server.
 301  * Accepts connections from clients and process requests using the appropriate
 302  * dispatcher table. */
 303
 304 struct named_pipe_client {
 305         const char *pipe_name;
 306         struct ndr_syntax_id pipe_id;
 307
 308         struct tevent_context *ev;
 309         struct messaging_context *msg_ctx;
 310
 311         uint16_t file_type;
 312         uint16_t device_state;
 313         uint64_t allocation_size;
 314
 315         struct tstream_context *tstream;
 316
 317         struct tsocket_address *client;
 318         char *client_name;
 319         struct tsocket_address *server;
 320         char *server_name;
 321         struct netr_SamInfo3 *info3;
 322         DATA_BLOB session_key;
 323         DATA_BLOB delegated_creds;
 324
 325         struct pipes_struct *p;
 326
 327         struct tevent_queue *write_queue;
 328
 329         struct iovec *iov;
 330         size_t count;
 331 };
 332
 333 static void named_pipe_accept_done(struct tevent_req *subreq);
 334
 335 static void named_pipe_accept_function(const char *pipe_name, int fd)
 336 {
 337         struct ndr_syntax_id syntax;
 338         struct named_pipe_client *npc;
 339         struct tstream_context *plain;
 340         struct tevent_req *subreq;
 341         bool ok;
 342         int ret;
 343
 344         ok = is_known_pipename(pipe_name, &syntax);
 345         if (!ok) {
 346                 DEBUG(1, ("Unknown pipe [%s]\n", pipe_name));
 347                 close(fd);
 348                 return;
 349         }
 350
 351         npc = talloc_zero(NULL, struct named_pipe_client);
 352         if (!npc) {
 353                 DEBUG(0, ("Out of memory!\n"));
 354                 close(fd);
 355                 return;
 356         }
 357         npc->pipe_name = pipe_name;
 358         npc->pipe_id = syntax;
 359         npc->ev = server_event_context();
 360         npc->msg_ctx = server_messaging_context();
 361
 362         /* make sure socket is in NON blocking state */
 363         ret = set_blocking(fd, false);
 364         if (ret != 0) {
 365                 DEBUG(2, ("Failed to make socket non-blocking\n"));
 366                 TALLOC_FREE(npc);
 367                 close(fd);
 368                 return;
 369         }
 370
 371         ret = tstream_bsd_existing_socket(npc, fd, &plain);
 372         if (ret != 0) {
 373                 DEBUG(2, ("Failed to create tstream socket\n"));
 374                 TALLOC_FREE(npc);
 375                 close(fd);
 376                 return;
 377         }
 378
 379         npc->file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
 380         npc->device_state = 0xff | 0x0400 | 0x0100;
 381         npc->allocation_size = 4096;
 382
 383         subreq = tstream_npa_accept_existing_send(npc, npc->ev, plain,
 384                                                   npc->file_type,
 385                                                   npc->device_state,
 386                                                   npc->allocation_size);
 387         if (!subreq) {
 388                 DEBUG(2, ("Failed to start async accept procedure\n"));
 389                 TALLOC_FREE(npc);
 390                 close(fd);
 391                 return;
 392         }
 393         tevent_req_set_callback(subreq, named_pipe_accept_done, npc);
 394 }
 395
 396 static void named_pipe_packet_process(struct tevent_req *subreq);
 397 static void named_pipe_packet_done(struct tevent_req *subreq);
 398
 399 static void named_pipe_accept_done(struct tevent_req *subreq)
 400 {
 401         struct named_pipe_client *npc =
 402                 tevent_req_callback_data(subreq, struct named_pipe_client);
 403         const char *cli_addr;
 404         int error;
 405         int ret;
 406
 407         ret = tstream_npa_accept_existing_recv(subreq, &error, npc,
 408                                                 &npc->tstream,
 409                                                 &npc->client,
 410                                                 &npc->client_name,
 411                                                 &npc->server,
 412                                                 &npc->server_name,
 413                                                 &npc->info3,
 414                                                 &npc->session_key,
 415                                                 &npc->delegated_creds);
 416         TALLOC_FREE(subreq);
 417         if (ret != 0) {
 418                 DEBUG(2, ("Failed to accept named pipe connection! (%s)\n",
 419                           strerror(error)));
 420                 TALLOC_FREE(npc);
 421                 return;
 422         }
 423
 424         if (tsocket_address_is_inet(npc->client, "ip")) {
 425                 cli_addr = tsocket_address_inet_addr_string(npc->client,
 426                                                             subreq);
 427                 if (cli_addr == NULL) {
 428                         TALLOC_FREE(npc);
 429                         return;
 430                 }
 431         } else {
 432                 cli_addr = "";
 433         }
 434
 435         ret = make_server_pipes_struct(npc,
 436                                         npc->pipe_name, npc->pipe_id,
 437                                         cli_addr, npc->info3,
 438                                         &npc->p, &error);
 439         if (ret != 0) {
 440                 DEBUG(2, ("Failed to create pipes_struct! (%s)\n",
 441                           strerror(error)));
 442                 goto fail;
 443         }
 444         npc->p->msg_ctx = npc->msg_ctx;
 445
 446         npc->write_queue = tevent_queue_create(npc, "np_server_write_queue");
 447         if (!npc->write_queue) {
 448                 DEBUG(2, ("Failed to set up write queue!\n"));
 449                 goto fail;
 450         }
 451
 452         /* And now start receaving and processing packets */
 453         subreq = named_pipe_read_packet_send(npc, npc->ev, npc->tstream);
 454         if (!subreq) {
 455                 DEBUG(2, ("Failed to start receving packets\n"));
 456                 goto fail;
 457         }
 458         tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
 459         return;
 460
 461 fail:
 462         DEBUG(2, ("Fatal error. Terminating client(%s) connection!\n",
 463                   npc->client_name));
 464         /* terminate client connection */
 465         talloc_free(npc);
 466         return;
 467 }
 468
 469 static void named_pipe_packet_process(struct tevent_req *subreq)
 470 {
 471         struct named_pipe_client *npc =
 472                 tevent_req_callback_data(subreq, struct named_pipe_client);
 473         struct _output_data *out = &npc->p->out_data;
 474         DATA_BLOB recv_buffer = data_blob_null;
 475         NTSTATUS status;
 476         ssize_t data_left;
 477         ssize_t data_used;
 478         char *data;
 479         uint32_t to_send;
 480         bool ok;
 481
 482         status = named_pipe_read_packet_recv(subreq, npc, &recv_buffer);
 483         TALLOC_FREE(subreq);
 484         if (!NT_STATUS_IS_OK(status)) {
 485                 goto fail;
 486         }
 487
 488         data_left = recv_buffer.length;
 489         data = (char *)recv_buffer.data;
 490
 491         while (data_left) {
 492
 493                 data_used = process_incoming_data(npc->p, data, data_left);
 494                 if (data_used < 0) {
 495                         DEBUG(3, ("Failed to process dceprc request!\n"));
 496                         status = NT_STATUS_UNEXPECTED_IO_ERROR;
 497                         goto fail;
 498                 }
 499
 500                 data_left -= data_used;
 501                 data += data_used;
 502         }
 503
 504         /* Do not leak this buffer, npc is a long lived context */
 505         talloc_free(recv_buffer.data);
 506
 507         /* this is needed because of the way DCERPC Binds work in
 508          * the RPC marshalling code */
 509         to_send = out->frag.length - out->current_pdu_sent;
 510         if (to_send > 0) {
 511
 512                 DEBUG(10, ("Current_pdu_len = %u, "
 513                            "current_pdu_sent = %u "
 514                            "Returning %u bytes\n",
 515                            (unsigned int)out->frag.length,
 516                            (unsigned int)out->current_pdu_sent,
 517                            (unsigned int)to_send));
 518
 519                 npc->iov = talloc_zero(npc, struct iovec);
 520                 if (!npc->iov) {
 521                         status = NT_STATUS_NO_MEMORY;
 522                         goto fail;
 523                 }
 524                 npc->count = 1;
 525
 526                 npc->iov[0].iov_base = out->frag.data
 527                                         + out->current_pdu_sent;
 528                 npc->iov[0].iov_len = to_send;
 529
 530                 out->current_pdu_sent += to_send;
 531         }
 532
 533         /* this condition is false for bind packets, or when we haven't
 534          * yet got a full request, and need to wait for more data from
 535          * the client */
 536         while (out->data_sent_length < out->rdata.length) {
 537
 538                 ok = create_next_pdu(npc->p);
 539                 if (!ok) {
 540                         DEBUG(3, ("Failed to create next PDU!\n"));
 541                         status = NT_STATUS_UNEXPECTED_IO_ERROR;
 542                         goto fail;
 543                 }
 544
 545                 npc->iov = talloc_realloc(npc, npc->iov,
 546                                             struct iovec, npc->count + 1);
 547                 if (!npc->iov) {
 548                         status = NT_STATUS_NO_MEMORY;
 549                         goto fail;
 550                 }
 551
 552                 npc->iov[npc->count].iov_base = out->frag.data;
 553                 npc->iov[npc->count].iov_len = out->frag.length;
 554
 555                 DEBUG(10, ("PDU number: %d, PDU Length: %u\n",
 556                            (unsigned int)npc->count,
 557                            (unsigned int)npc->iov[npc->count].iov_len));
 558                 dump_data(11, (const uint8_t *)npc->iov[npc->count].iov_base,
 559                                 npc->iov[npc->count].iov_len);
 560                 npc->count++;
 561         }
 562
 563         /* we still don't have a complete request, go back and wait for more
 564          * data */
 565         if (npc->count == 0) {
 566                 /* Wait for the next packet */
 567                 subreq = named_pipe_read_packet_send(npc, npc->ev, npc->tstream);
 568                 if (!subreq) {
 569                         DEBUG(2, ("Failed to start receving packets\n"));
 570                         status = NT_STATUS_NO_MEMORY;
 571                         goto fail;
 572                 }
 573                 tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
 574                 return;
 575         }
 576
 577         DEBUG(10, ("Sending a total of %u bytes\n",
 578                    (unsigned int)npc->p->out_data.data_sent_length));
 579
 580         subreq = tstream_writev_queue_send(npc, npc->ev,
 581                                            npc->tstream,
 582                                            npc->write_queue,
 583                                            npc->iov, npc->count);
 584         if (!subreq) {
 585                 DEBUG(2, ("Failed to send packet\n"));
 586                 status = NT_STATUS_NO_MEMORY;
 587                 goto fail;
 588         }
 589         tevent_req_set_callback(subreq, named_pipe_packet_done, npc);
 590         return;
 591
 592 fail:
 593         DEBUG(2, ("Fatal error(%s). "
 594                   "Terminating client(%s) connection!\n",
 595                   nt_errstr(status), npc->client_name));
 596         /* terminate client connection */
 597         talloc_free(npc);
 598         return;
 599 }
 600
 601 static void named_pipe_packet_done(struct tevent_req *subreq)
 602 {
 603         struct named_pipe_client *npc =
 604                 tevent_req_callback_data(subreq, struct named_pipe_client);
 605         int sys_errno;
 606         int ret;
 607
 608         ret = tstream_writev_queue_recv(subreq, &sys_errno);
 609         TALLOC_FREE(subreq);
 610         if (ret == -1) {
 611                 DEBUG(2, ("Writev failed!\n"));
 612                 goto fail;
 613         }
 614
 615         /* clear out any data that may have been left around */
 616         npc->count = 0;
 617         TALLOC_FREE(npc->iov);
 618         data_blob_free(&npc->p->in_data.data);
 619         data_blob_free(&npc->p->out_data.frag);
 620         data_blob_free(&npc->p->out_data.rdata);
 621
 622         /* Wait for the next packet */
 623         subreq = named_pipe_read_packet_send(npc, npc->ev, npc->tstream);
 624         if (!subreq) {
 625                 DEBUG(2, ("Failed to start receving packets\n"));
 626                 sys_errno = ENOMEM;
 627                 goto fail;
 628         }
 629         tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
 630         return;
 631
 632 fail:
 633         DEBUG(2, ("Fatal error(%s). "
 634                   "Terminating client(%s) connection!\n",
 635                   strerror(sys_errno), npc->client_name));
 636         /* terminate client connection */
 637         talloc_free(npc);
 638         return;
 639  }