source3/rpc_server/rpc_server.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Generic infrstructure for RPC Daemons
   4    Copyright (C) Simo Sorce 2010
   5    Copyright (C) Andrew Bartlett 2011
   6    Copyright (C) Andreas Schneider 2011
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "rpc_server/rpc_pipes.h"
  24 #include "rpc_server/rpc_server.h"
  25 #include "rpc_server/rpc_config.h"
  26 #include "rpc_dce.h"
  27 #include "librpc/gen_ndr/netlogon.h"
  28 #include "librpc/gen_ndr/auth.h"
  29 #include "lib/tsocket/tsocket.h"
  30 #include "libcli/named_pipe_auth/npa_tstream.h"
  31 #include "../auth/auth_sam_reply.h"
  32 #include "auth.h"
  33 #include "rpc_server/rpc_ncacn_np.h"
  34 #include "rpc_server/srv_pipe_hnd.h"
  35 #include "rpc_server/srv_pipe.h"
  36
  37 #define SERVER_TCP_LOW_PORT  1024
  38 #define SERVER_TCP_HIGH_PORT 1300
  39
  40 /* Creates a pipes_struct and initializes it with the information
  41  * sent from the client */
  42 int make_server_pipes_struct(TALLOC_CTX *mem_ctx,
  43                              struct messaging_context *msg_ctx,
  44                              const char *pipe_name,
  45                              enum dcerpc_transport_t transport,
  46                              const struct tsocket_address *local_address,
  47                              const struct tsocket_address *remote_address,
  48                              struct auth_session_info *session_info,
  49                              struct pipes_struct **_p,
  50                              int *perrno)
  51 {
  52         struct pipes_struct *p;
  53         int ret;
  54
  55         ret = make_base_pipes_struct(mem_ctx, msg_ctx, pipe_name,
  56                                      transport, RPC_LITTLE_ENDIAN,
  57                                      remote_address, local_address, &p);
  58         if (ret) {
  59                 *perrno = ret;
  60                 return -1;
  61         }
  62
  63         if (session_info->unix_token && session_info->unix_info && session_info->security_token) {
  64                 /* Don't call create_local_token(), we already have the full details here */
  65                 p->session_info = talloc_steal(p, session_info);
  66
  67         } else {
  68                 DEBUG(0, ("Supplied session_info in make_server_pipes_struct was incomplete!"));
  69                 *perrno = EINVAL;
  70                 return -1;
  71         }
  72
  73         *_p = p;
  74         return 0;
  75 }
  76
  77 /* Start listening on the appropriate unix socket and setup all is needed to
  78  * dispatch requests to the pipes rpc implementation */
  79
  80 struct dcerpc_ncacn_listen_state {
  81         struct ndr_syntax_id syntax_id;
  82
  83         int fd;
  84         union {
  85                 char *name;
  86                 uint16_t port;
  87         } ep;
  88
  89         struct tevent_context *ev_ctx;
  90         struct messaging_context *msg_ctx;
  91         dcerpc_ncacn_disconnect_fn disconnect_fn;
  92 };
  93
  94 static void named_pipe_listener(struct tevent_context *ev,
  95                                 struct tevent_fd *fde,
  96                                 uint16_t flags,
  97                                 void *private_data);
  98
  99 int create_named_pipe_socket(const char *pipe_name)
 100 {
 101         char *np_dir = NULL;
 102         int fd = -1;
 103
 104         /*
 105          * As lp_ncalrpc_dir() should have 0755, but
 106          * lp_ncalrpc_dir()/np should have 0700, we need to
 107          * create lp_ncalrpc_dir() first.
 108          */
 109         if (!directory_create_or_exist(lp_ncalrpc_dir(), geteuid(), 0755)) {
 110                 DEBUG(0, ("Failed to create pipe directory %s - %s\n",
 111                           lp_ncalrpc_dir(), strerror(errno)));
 112                 goto out;
 113         }
 114
 115         np_dir = talloc_asprintf(talloc_tos(), "%s/np", lp_ncalrpc_dir());
 116         if (!np_dir) {
 117                 DEBUG(0, ("Out of memory\n"));
 118                 goto out;
 119         }
 120
 121         if (!directory_create_or_exist_strict(np_dir, geteuid(), 0700)) {
 122                 DEBUG(0, ("Failed to create pipe directory %s - %s\n",
 123                           np_dir, strerror(errno)));
 124                 goto out;
 125         }
 126
 127         fd = create_pipe_sock(np_dir, pipe_name, 0700);
 128         if (fd == -1) {
 129                 DEBUG(0, ("Failed to create pipe socket! [%s/%s]\n",
 130                           np_dir, pipe_name));
 131                 goto out;
 132         }
 133
 134         DEBUG(10, ("Openened pipe socket fd %d for %s\n", fd, pipe_name));
 135
 136 out:
 137         talloc_free(np_dir);
 138         return fd;
 139 }
 140
 141 bool setup_named_pipe_socket(const char *pipe_name,
 142                              struct tevent_context *ev_ctx,
 143                              struct messaging_context *msg_ctx)
 144 {
 145         struct dcerpc_ncacn_listen_state *state;
 146         struct tevent_fd *fde;
 147         int rc;
 148
 149         state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
 150         if (!state) {
 151                 DEBUG(0, ("Out of memory\n"));
 152                 return false;
 153         }
 154         state->ep.name = talloc_strdup(state, pipe_name);
 155         if (state->ep.name == NULL) {
 156                 DEBUG(0, ("Out of memory\n"));
 157                 goto out;
 158         }
 159         state->fd = create_named_pipe_socket(pipe_name);
 160         if (state->fd == -1) {
 161                 goto out;
 162         }
 163
 164         rc = listen(state->fd, 5);
 165         if (rc < 0) {
 166                 DEBUG(0, ("Failed to listen on pipe socket %s: %s\n",
 167                           pipe_name, strerror(errno)));
 168                 goto out;
 169         }
 170
 171         state->ev_ctx = ev_ctx;
 172         state->msg_ctx = msg_ctx;
 173
 174         DEBUG(10, ("Openened pipe socket fd %d for %s\n",
 175                    state->fd, pipe_name));
 176
 177         fde = tevent_add_fd(ev_ctx,
 178                             state, state->fd, TEVENT_FD_READ,
 179                             named_pipe_listener, state);
 180         if (!fde) {
 181                 DEBUG(0, ("Failed to add event handler!\n"));
 182                 goto out;
 183         }
 184
 185         tevent_fd_set_auto_close(fde);
 186         return true;
 187
 188 out:
 189         if (state->fd != -1) {
 190                 close(state->fd);
 191         }
 192         TALLOC_FREE(state);
 193         return false;
 194 }
 195
 196 static void named_pipe_listener(struct tevent_context *ev,
 197                                 struct tevent_fd *fde,
 198                                 uint16_t flags,
 199                                 void *private_data)
 200 {
 201         struct dcerpc_ncacn_listen_state *state =
 202                         talloc_get_type_abort(private_data,
 203                                               struct dcerpc_ncacn_listen_state);
 204         struct sockaddr_un sunaddr;
 205         socklen_t len;
 206         int sd = -1;
 207
 208         /* TODO: should we have a limit to the number of clients ? */
 209
 210         len = sizeof(sunaddr);
 211
 212         sd = accept(state->fd,
 213                     (struct sockaddr *)(void *)&sunaddr, &len);
 214
 215         if (sd == -1) {
 216                 if (errno != EINTR) {
 217                         DEBUG(6, ("Failed to get a valid socket [%s]\n",
 218                                   strerror(errno)));
 219                 }
 220                 return;
 221         }
 222
 223         DEBUG(6, ("Accepted socket %d\n", sd));
 224
 225         named_pipe_accept_function(state->ev_ctx,
 226                                    state->msg_ctx,
 227                                    state->ep.name,
 228                                    sd, NULL, 0);
 229 }
 230
 231
 232 /* This is the core of the rpc server.
 233  * Accepts connections from clients and process requests using the appropriate
 234  * dispatcher table. */
 235
 236 static int named_pipe_destructor(struct named_pipe_client *npc)
 237 {
 238         if (npc->term_fn) {
 239                 npc->term_fn(npc->private_data);
 240         }
 241         return 0;
 242 }
 243
 244 struct named_pipe_client *named_pipe_client_init(TALLOC_CTX *mem_ctx,
 245                                                  struct tevent_context *ev_ctx,
 246                                                  struct messaging_context *msg_ctx,
 247                                                  const char *pipe_name,
 248                                                  named_pipe_termination_fn *term_fn,
 249                                                  uint16_t file_type,
 250                                                  uint16_t device_state,
 251                                                  uint64_t allocation_size,
 252                                                  void *private_data)
 253 {
 254         struct named_pipe_client *npc;
 255
 256         npc = talloc_zero(mem_ctx, struct named_pipe_client);
 257         if (npc == NULL) {
 258                 DEBUG(0, ("Out of memory!\n"));
 259                 return NULL;
 260         }
 261         talloc_set_destructor(npc, named_pipe_destructor);
 262
 263         npc->pipe_name = talloc_strdup(npc, pipe_name);
 264         if (npc->pipe_name == NULL) {
 265                 DEBUG(0, ("Out of memory!\n"));
 266                 talloc_free(npc);
 267                 return NULL;
 268         }
 269
 270         npc->ev = ev_ctx;
 271         npc->msg_ctx = msg_ctx;
 272         npc->term_fn = term_fn;
 273         npc->private_data = private_data;
 274
 275         npc->file_type = file_type;
 276         npc->device_state = device_state;
 277         npc->allocation_size = allocation_size;
 278
 279         return npc;
 280 }
 281
 282 static void named_pipe_accept_done(struct tevent_req *subreq);
 283
 284 void named_pipe_accept_function(struct tevent_context *ev_ctx,
 285                                 struct messaging_context *msg_ctx,
 286                                 const char *pipe_name, int fd,
 287                                 named_pipe_termination_fn *term_fn,
 288                                 void *private_data)
 289 {
 290         struct named_pipe_client *npc;
 291         struct tstream_context *plain;
 292         struct tevent_req *subreq;
 293         int ret;
 294
 295         npc = talloc_zero(ev_ctx, struct named_pipe_client);
 296         if (!npc) {
 297                 DEBUG(0, ("Out of memory!\n"));
 298                 close(fd);
 299                 return;
 300         }
 301
 302         npc->pipe_name = talloc_strdup(npc, pipe_name);
 303         if (npc->pipe_name == NULL) {
 304                 DEBUG(0, ("Out of memory!\n"));
 305                 TALLOC_FREE(npc);
 306                 close(fd);
 307                 return;
 308         }
 309         npc->ev = ev_ctx;
 310         npc->msg_ctx = msg_ctx;
 311         npc->term_fn = term_fn;
 312         npc->private_data = private_data;
 313
 314         talloc_set_destructor(npc, named_pipe_destructor);
 315
 316         /* make sure socket is in NON blocking state */
 317         ret = set_blocking(fd, false);
 318         if (ret != 0) {
 319                 DEBUG(2, ("Failed to make socket non-blocking\n"));
 320                 TALLOC_FREE(npc);
 321                 close(fd);
 322                 return;
 323         }
 324
 325         ret = tstream_bsd_existing_socket(npc, fd, &plain);
 326         if (ret != 0) {
 327                 DEBUG(2, ("Failed to create tstream socket\n"));
 328                 TALLOC_FREE(npc);
 329                 close(fd);
 330                 return;
 331         }
 332
 333         npc->file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
 334         npc->device_state = 0xff | 0x0400 | 0x0100;
 335         npc->allocation_size = 4096;
 336
 337         subreq = tstream_npa_accept_existing_send(npc, npc->ev, plain,
 338                                                   npc->file_type,
 339                                                   npc->device_state,
 340                                                   npc->allocation_size);
 341         if (!subreq) {
 342                 DEBUG(2, ("Failed to start async accept procedure\n"));
 343                 TALLOC_FREE(npc);
 344                 close(fd);
 345                 return;
 346         }
 347         tevent_req_set_callback(subreq, named_pipe_accept_done, npc);
 348 }
 349
 350 static void named_pipe_packet_done(struct tevent_req *subreq);
 351
 352 static void named_pipe_accept_done(struct tevent_req *subreq)
 353 {
 354         struct auth_session_info_transport *session_info_transport;
 355         struct named_pipe_client *npc =
 356                 tevent_req_callback_data(subreq, struct named_pipe_client);
 357         int error;
 358         int ret;
 359
 360         ret = tstream_npa_accept_existing_recv(subreq, &error, npc,
 361                                                 &npc->tstream,
 362                                                 &npc->client,
 363                                                 &npc->client_name,
 364                                                 &npc->server,
 365                                                 &npc->server_name,
 366                                                 &session_info_transport);
 367
 368         npc->session_info = talloc_move(npc, &session_info_transport->session_info);
 369
 370         TALLOC_FREE(subreq);
 371         if (ret != 0) {
 372                 DEBUG(2, ("Failed to accept named pipe connection! (%s)\n",
 373                           strerror(error)));
 374                 TALLOC_FREE(npc);
 375                 return;
 376         }
 377
 378         ret = make_server_pipes_struct(npc,
 379                                        npc->msg_ctx,
 380                                        npc->pipe_name, NCACN_NP,
 381                                        npc->server,
 382                                        npc->client,
 383                                        npc->session_info,
 384                                        &npc->p, &error);
 385         if (ret != 0) {
 386                 DEBUG(2, ("Failed to create pipes_struct! (%s)\n",
 387                           strerror(error)));
 388                 goto fail;
 389         }
 390
 391         npc->write_queue = tevent_queue_create(npc, "np_server_write_queue");
 392         if (!npc->write_queue) {
 393                 DEBUG(2, ("Failed to set up write queue!\n"));
 394                 goto fail;
 395         }
 396
 397         /* And now start receiving and processing packets */
 398         subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
 399         if (!subreq) {
 400                 DEBUG(2, ("Failed to start receving packets\n"));
 401                 goto fail;
 402         }
 403         tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
 404         return;
 405
 406 fail:
 407         DEBUG(2, ("Fatal error. Terminating client(%s) connection!\n",
 408                   npc->client_name));
 409         /* terminate client connection */
 410         talloc_free(npc);
 411         return;
 412 }
 413
 414 void named_pipe_packet_process(struct tevent_req *subreq)
 415 {
 416         struct named_pipe_client *npc =
 417                 tevent_req_callback_data(subreq, struct named_pipe_client);
 418         struct _output_data *out = &npc->p->out_data;
 419         DATA_BLOB recv_buffer = data_blob_null;
 420         struct ncacn_packet *pkt;
 421         NTSTATUS status;
 422         uint32_t to_send;
 423         size_t i;
 424         bool ok;
 425
 426         status = dcerpc_read_ncacn_packet_recv(subreq, npc, &pkt, &recv_buffer);
 427         TALLOC_FREE(subreq);
 428         if (!NT_STATUS_IS_OK(status)) {
 429                 goto fail;
 430         }
 431
 432         /* dcerpc_read_ncacn_packet_recv() returns a full PDU */
 433         npc->p->in_data.pdu_needed_len = 0;
 434         npc->p->in_data.pdu = recv_buffer;
 435         if (dcerpc_get_endian_flag(&recv_buffer) & DCERPC_DREP_LE) {
 436                 npc->p->endian = RPC_LITTLE_ENDIAN;
 437         } else {
 438                 npc->p->endian = RPC_BIG_ENDIAN;
 439         }
 440         DEBUG(10, ("PDU is in %s Endian format!\n",
 441                    npc->p->endian ? "Big" : "Little"));
 442         process_complete_pdu(npc->p, pkt);
 443
 444         /* reset pipe state and free PDU */
 445         npc->p->in_data.pdu.length = 0;
 446         talloc_free(recv_buffer.data);
 447         talloc_free(pkt);
 448
 449         /* this is needed because of the way DCERPC Binds work in
 450          * the RPC marshalling code */
 451         to_send = out->frag.length - out->current_pdu_sent;
 452         if (to_send > 0) {
 453
 454                 npc->iov = talloc_zero(npc, struct iovec);
 455                 if (!npc->iov) {
 456                         status = NT_STATUS_NO_MEMORY;
 457                         goto fail;
 458                 }
 459                 npc->count = 1;
 460
 461                 npc->iov[0].iov_base = out->frag.data
 462                                         + out->current_pdu_sent;
 463                 npc->iov[0].iov_len = to_send;
 464
 465                 out->current_pdu_sent += to_send;
 466         }
 467
 468         /* this condition is false for bind packets, or when we haven't
 469          * yet got a full request, and need to wait for more data from
 470          * the client */
 471         while (out->data_sent_length < out->rdata.length) {
 472
 473                 ok = create_next_pdu(npc->p);
 474                 if (!ok) {
 475                         DEBUG(3, ("Failed to create next PDU!\n"));
 476                         status = NT_STATUS_UNEXPECTED_IO_ERROR;
 477                         goto fail;
 478                 }
 479
 480                 npc->iov = talloc_realloc(npc, npc->iov,
 481                                             struct iovec, npc->count + 1);
 482                 if (!npc->iov) {
 483                         status = NT_STATUS_NO_MEMORY;
 484                         goto fail;
 485                 }
 486
 487                 npc->iov[npc->count].iov_base = out->frag.data;
 488                 npc->iov[npc->count].iov_len = out->frag.length;
 489
 490                 npc->count++;
 491         }
 492
 493         /* we still don't have a complete request, go back and wait for more
 494          * data */
 495         if (npc->count == 0) {
 496                 /* Wait for the next packet */
 497                 subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
 498                 if (!subreq) {
 499                         DEBUG(2, ("Failed to start receving packets\n"));
 500                         status = NT_STATUS_NO_MEMORY;
 501                         goto fail;
 502                 }
 503                 tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
 504                 return;
 505         }
 506
 507         DEBUG(10, ("Sending %u fragments in a total of %u bytes\n",
 508                    (unsigned int)npc->count,
 509                    (unsigned int)npc->p->out_data.data_sent_length));
 510
 511         for (i = 0; i < npc->count; i++) {
 512                 DEBUG(10, ("Sending PDU number: %d, PDU Length: %u\n",
 513                           (unsigned int)i,
 514                           (unsigned int)npc->iov[i].iov_len));
 515                 dump_data(11, (const uint8_t *)npc->iov[i].iov_base,
 516                                 npc->iov[i].iov_len);
 517
 518                 subreq = tstream_writev_queue_send(npc,
 519                                                    npc->ev,
 520                                                    npc->tstream,
 521                                                    npc->write_queue,
 522                                                    (npc->iov + i),
 523                                                    1);
 524                 if (!subreq) {
 525                         DEBUG(2, ("Failed to send packet\n"));
 526                         status = NT_STATUS_NO_MEMORY;
 527                         goto fail;
 528                 }
 529                 tevent_req_set_callback(subreq, named_pipe_packet_done, npc);
 530         }
 531
 532         return;
 533
 534 fail:
 535         DEBUG(2, ("Fatal error(%s). "
 536                   "Terminating client(%s) connection!\n",
 537                   nt_errstr(status), npc->client_name));
 538         /* terminate client connection */
 539         talloc_free(npc);
 540         return;
 541 }
 542
 543 static void named_pipe_packet_done(struct tevent_req *subreq)
 544 {
 545         struct named_pipe_client *npc =
 546                 tevent_req_callback_data(subreq, struct named_pipe_client);
 547         int sys_errno;
 548         int ret;
 549
 550         ret = tstream_writev_queue_recv(subreq, &sys_errno);
 551         TALLOC_FREE(subreq);
 552         if (ret == -1) {
 553                 DEBUG(2, ("Writev failed!\n"));
 554                 goto fail;
 555         }
 556
 557         if (tevent_queue_length(npc->write_queue) > 0) {
 558                 return;
 559         }
 560
 561         /* clear out any data that may have been left around */
 562         npc->count = 0;
 563         TALLOC_FREE(npc->iov);
 564         data_blob_free(&npc->p->in_data.data);
 565         data_blob_free(&npc->p->out_data.frag);
 566         data_blob_free(&npc->p->out_data.rdata);
 567
 568         talloc_free_children(npc->p->mem_ctx);
 569
 570         /* Wait for the next packet */
 571         subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
 572         if (!subreq) {
 573                 DEBUG(2, ("Failed to start receving packets\n"));
 574                 sys_errno = ENOMEM;
 575                 goto fail;
 576         }
 577         tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
 578         return;
 579
 580 fail:
 581         DEBUG(2, ("Fatal error(%s). "
 582                   "Terminating client(%s) connection!\n",
 583                   strerror(sys_errno), npc->client_name));
 584         /* terminate client connection */
 585         talloc_free(npc);
 586         return;
 587 }
 588
 589 /********************************************************************
 590  * Start listening on the tcp/ip socket
 591  ********************************************************************/
 592
 593 static void dcerpc_ncacn_tcpip_listener(struct tevent_context *ev,
 594                                         struct tevent_fd *fde,
 595                                         uint16_t flags,
 596                                         void *private_data);
 597
 598 int create_tcpip_socket(const struct sockaddr_storage *ifss, uint16_t *port)
 599 {
 600         int fd = -1;
 601
 602         if (*port == 0) {
 603                 uint16_t i;
 604
 605                 for (i = SERVER_TCP_LOW_PORT; i <= SERVER_TCP_HIGH_PORT; i++) {
 606                         fd = open_socket_in(SOCK_STREAM,
 607                                             i,
 608                                             0,
 609                                             ifss,
 610                                             false);
 611                         if (fd >= 0) {
 612                                 *port = i;
 613                                 break;
 614                         }
 615                 }
 616         } else {
 617                 fd = open_socket_in(SOCK_STREAM,
 618                                     *port,
 619                                     0,
 620                                     ifss,
 621                                     true);
 622         }
 623         if (fd == -1) {
 624                 DEBUG(0, ("Failed to create socket on port %u!\n", *port));
 625                 return -1;
 626         }
 627
 628         DEBUG(10, ("Opened tcpip socket fd %d for port %u\n", fd, *port));
 629
 630         return fd;
 631 }
 632
 633 uint16_t setup_dcerpc_ncacn_tcpip_socket(struct tevent_context *ev_ctx,
 634                                          struct messaging_context *msg_ctx,
 635                                          const struct sockaddr_storage *ifss,
 636                                          uint16_t port)
 637 {
 638         struct dcerpc_ncacn_listen_state *state;
 639         struct tevent_fd *fde;
 640         int rc;
 641
 642         state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
 643         if (state == NULL) {
 644                 DEBUG(0, ("setup_dcerpc_ncacn_tcpip_socket: Out of memory\n"));
 645                 return 0;
 646         }
 647
 648         state->fd = -1;
 649         state->ep.port = port;
 650         state->disconnect_fn = NULL;
 651
 652         state->fd = create_tcpip_socket(ifss, &state->ep.port);
 653         if (state->fd == -1) {
 654                 goto out;
 655         }
 656
 657         state->ev_ctx = ev_ctx;
 658         state->msg_ctx = msg_ctx;
 659
 660         /* ready to listen */
 661         set_socket_options(state->fd, "SO_KEEPALIVE");
 662         set_socket_options(state->fd, lp_socket_options());
 663
 664         /* Set server socket to non-blocking for the accept. */
 665         set_blocking(state->fd, false);
 666
 667         rc = listen(state->fd, SMBD_LISTEN_BACKLOG);
 668         if (rc == -1) {
 669                 DEBUG(0,("setup_tcpip_socket: listen - %s\n", strerror(errno)));
 670                 goto out;
 671         }
 672
 673         DEBUG(10, ("setup_tcpip_socket: openened socket fd %d for port %u\n",
 674                    state->fd, state->ep.port));
 675
 676         fde = tevent_add_fd(state->ev_ctx,
 677                             state,
 678                             state->fd,
 679                             TEVENT_FD_READ,
 680                             dcerpc_ncacn_tcpip_listener,
 681                             state);
 682         if (fde == NULL) {
 683                 DEBUG(0, ("setup_tcpip_socket: Failed to add event handler!\n"));
 684                 goto out;
 685         }
 686
 687         tevent_fd_set_auto_close(fde);
 688
 689         return state->ep.port;
 690 out:
 691         if (state->fd != -1) {
 692                 close(state->fd);
 693         }
 694         TALLOC_FREE(state);
 695
 696         return 0;
 697 }
 698
 699 static void dcerpc_ncacn_tcpip_listener(struct tevent_context *ev,
 700                                         struct tevent_fd *fde,
 701                                         uint16_t flags,
 702                                         void *private_data)
 703 {
 704         struct dcerpc_ncacn_listen_state *state =
 705                         talloc_get_type_abort(private_data,
 706                                               struct dcerpc_ncacn_listen_state);
 707         struct tsocket_address *cli_addr = NULL;
 708         struct tsocket_address *srv_addr = NULL;
 709         struct sockaddr_storage addr;
 710         socklen_t in_addrlen = sizeof(addr);
 711         int s = -1;
 712         int rc;
 713
 714         s = accept(state->fd, (struct sockaddr *)(void *) &addr, &in_addrlen);
 715         if (s == -1) {
 716                 if (errno != EINTR) {
 717                         DEBUG(0,("tcpip_listener accept: %s\n",
 718                                  strerror(errno)));
 719                 }
 720                 return;
 721         }
 722
 723         rc = tsocket_address_bsd_from_sockaddr(state,
 724                                                (struct sockaddr *)(void *) &addr,
 725                                                in_addrlen,
 726                                                &cli_addr);
 727         if (rc < 0) {
 728                 close(s);
 729                 return;
 730         }
 731
 732         rc = getsockname(s, (struct sockaddr *)(void *) &addr, &in_addrlen);
 733         if (rc < 0) {
 734                 close(s);
 735                 return;
 736         }
 737
 738         rc = tsocket_address_bsd_from_sockaddr(state,
 739                                                (struct sockaddr *)(void *) &addr,
 740                                                in_addrlen,
 741                                                &srv_addr);
 742         if (rc < 0) {
 743                 close(s);
 744                 return;
 745         }
 746
 747         DEBUG(6, ("tcpip_listener: Accepted socket %d\n", s));
 748
 749         dcerpc_ncacn_accept(state->ev_ctx,
 750                             state->msg_ctx,
 751                             NCACN_IP_TCP,
 752                             NULL,
 753                             cli_addr,
 754                             srv_addr,
 755                             s,
 756                             NULL);
 757 }
 758
 759 /********************************************************************
 760  * Start listening on the ncalrpc socket
 761  ********************************************************************/
 762
 763 static void dcerpc_ncalrpc_listener(struct tevent_context *ev,
 764                                     struct tevent_fd *fde,
 765                                     uint16_t flags,
 766                                     void *private_data);
 767
 768 int create_dcerpc_ncalrpc_socket(const char *name)
 769 {
 770         int fd = -1;
 771
 772         if (name == NULL) {
 773                 name = "DEFAULT";
 774         }
 775
 776         if (!directory_create_or_exist(lp_ncalrpc_dir(), geteuid(), 0755)) {
 777                 DEBUG(0, ("Failed to create ncalrpc directory %s - %s\n",
 778                           lp_ncalrpc_dir(), strerror(errno)));
 779                 return -1;
 780         }
 781
 782         fd = create_pipe_sock(lp_ncalrpc_dir(), name, 0755);
 783         if (fd == -1) {
 784                 DEBUG(0, ("Failed to create ncalrpc socket! [%s/%s]\n",
 785                           lp_ncalrpc_dir(), name));
 786                 return -1;
 787         }
 788
 789         DEBUG(10, ("Openened ncalrpc socket fd %d for %s\n", fd, name));
 790
 791         return fd;
 792 }
 793
 794 bool setup_dcerpc_ncalrpc_socket(struct tevent_context *ev_ctx,
 795                                  struct messaging_context *msg_ctx,
 796                                  const char *name,
 797                                  dcerpc_ncacn_disconnect_fn fn)
 798 {
 799         struct dcerpc_ncacn_listen_state *state;
 800         struct tevent_fd *fde;
 801         int rc;
 802
 803         state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
 804         if (state == NULL) {
 805                 DEBUG(0, ("Out of memory\n"));
 806                 return false;
 807         }
 808
 809         state->fd = -1;
 810         state->disconnect_fn = fn;
 811
 812         if (name == NULL) {
 813                 name = "DEFAULT";
 814         }
 815
 816         state->ep.name = talloc_strdup(state, name);
 817         if (state->ep.name == NULL) {
 818                 DEBUG(0, ("Out of memory\n"));
 819                 talloc_free(state);
 820                 return false;
 821         }
 822
 823         state->fd = create_dcerpc_ncalrpc_socket(name);
 824         if (state->fd == -1) {
 825                 goto out;
 826         }
 827
 828         rc = listen(state->fd, 5);
 829         if (rc < 0) {
 830                 DEBUG(0, ("Failed to listen on ncalrpc socket %s: %s\n",
 831                           name, strerror(errno)));
 832                 goto out;
 833         }
 834
 835         state->ev_ctx = ev_ctx;
 836         state->msg_ctx = msg_ctx;
 837
 838         /* Set server socket to non-blocking for the accept. */
 839         set_blocking(state->fd, false);
 840
 841         fde = tevent_add_fd(state->ev_ctx,
 842                             state,
 843                             state->fd,
 844                             TEVENT_FD_READ,
 845                             dcerpc_ncalrpc_listener,
 846                             state);
 847         if (fde == NULL) {
 848                 DEBUG(0, ("Failed to add event handler for ncalrpc!\n"));
 849                 goto out;
 850         }
 851
 852         tevent_fd_set_auto_close(fde);
 853
 854         return true;
 855 out:
 856         if (state->fd != -1) {
 857                 close(state->fd);
 858         }
 859         TALLOC_FREE(state);
 860
 861         return 0;
 862 }
 863
 864 static void dcerpc_ncalrpc_listener(struct tevent_context *ev,
 865                                         struct tevent_fd *fde,
 866                                         uint16_t flags,
 867                                         void *private_data)
 868 {
 869         struct dcerpc_ncacn_listen_state *state =
 870                         talloc_get_type_abort(private_data,
 871                                               struct dcerpc_ncacn_listen_state);
 872         struct tsocket_address *cli_addr = NULL;
 873         struct sockaddr_un sunaddr;
 874         struct sockaddr *addr = (struct sockaddr *)(void *)&sunaddr;
 875         socklen_t len = sizeof(sunaddr);
 876         int sd = -1;
 877         int rc;
 878
 879         ZERO_STRUCT(sunaddr);
 880
 881         sd = accept(state->fd, addr, &len);
 882         if (sd == -1) {
 883                 if (errno != EINTR) {
 884                         DEBUG(0, ("ncalrpc accept() failed: %s\n", strerror(errno)));
 885                 }
 886                 return;
 887         }
 888
 889         rc = tsocket_address_bsd_from_sockaddr(state,
 890                                                addr, len,
 891                                                &cli_addr);
 892         if (rc < 0) {
 893                 close(sd);
 894                 return;
 895         }
 896
 897         DEBUG(10, ("Accepted ncalrpc socket %d\n", sd));
 898
 899         dcerpc_ncacn_accept(state->ev_ctx,
 900                             state->msg_ctx,
 901                             NCALRPC,
 902                             state->ep.name,
 903                             cli_addr, NULL, sd,
 904                             state->disconnect_fn);
 905 }
 906
 907 struct dcerpc_ncacn_conn {
 908         enum dcerpc_transport_t transport;
 909
 910         int sock;
 911
 912         struct pipes_struct *p;
 913         dcerpc_ncacn_disconnect_fn disconnect_fn;
 914
 915         struct tevent_context *ev_ctx;
 916         struct messaging_context *msg_ctx;
 917
 918         struct tstream_context *tstream;
 919         struct tevent_queue *send_queue;
 920
 921         struct tsocket_address *client;
 922         char *client_name;
 923         struct tsocket_address *server;
 924         char *server_name;
 925         struct auth_session_info *session_info;
 926
 927         struct iovec *iov;
 928         size_t count;
 929 };
 930
 931 static void dcerpc_ncacn_packet_process(struct tevent_req *subreq);
 932 static void dcerpc_ncacn_packet_done(struct tevent_req *subreq);
 933
 934 void dcerpc_ncacn_accept(struct tevent_context *ev_ctx,
 935                          struct messaging_context *msg_ctx,
 936                          enum dcerpc_transport_t transport,
 937                          const char *name,
 938                          struct tsocket_address *cli_addr,
 939                          struct tsocket_address *srv_addr,
 940                          int s,
 941                          dcerpc_ncacn_disconnect_fn fn) {
 942         struct dcerpc_ncacn_conn *ncacn_conn;
 943         struct tevent_req *subreq;
 944         char *pipe_name;
 945         NTSTATUS status;
 946         int sys_errno;
 947         uid_t uid;
 948         gid_t gid;
 949         int rc;
 950
 951         DEBUG(10, ("dcerpc_ncacn_accept\n"));
 952
 953         ncacn_conn = talloc_zero(ev_ctx, struct dcerpc_ncacn_conn);
 954         if (ncacn_conn == NULL) {
 955                 DEBUG(0, ("Out of memory!\n"));
 956                 close(s);
 957                 return;
 958         }
 959
 960         ncacn_conn->transport = transport;
 961         ncacn_conn->ev_ctx = ev_ctx;
 962         ncacn_conn->msg_ctx = msg_ctx;
 963         ncacn_conn->sock = s;
 964         ncacn_conn->disconnect_fn = fn;
 965
 966         ncacn_conn->client = talloc_move(ncacn_conn, &cli_addr);
 967         if (tsocket_address_is_inet(ncacn_conn->client, "ip")) {
 968                 ncacn_conn->client_name =
 969                         tsocket_address_inet_addr_string(ncacn_conn->client,
 970                                                          ncacn_conn);
 971         } else {
 972                 ncacn_conn->client_name =
 973                         tsocket_address_unix_path(ncacn_conn->client,
 974                                                   ncacn_conn);
 975         }
 976         if (ncacn_conn->client_name == NULL) {
 977                 DEBUG(0, ("Out of memory!\n"));
 978                 talloc_free(ncacn_conn);
 979                 close(s);
 980                 return;
 981         }
 982
 983         if (srv_addr != NULL) {
 984                 ncacn_conn->server = talloc_move(ncacn_conn, &srv_addr);
 985
 986                 ncacn_conn->server_name =
 987                         tsocket_address_inet_addr_string(ncacn_conn->server,
 988                                                          ncacn_conn);
 989                 if (ncacn_conn->server_name == NULL) {
 990                         DEBUG(0, ("Out of memory!\n"));
 991                         talloc_free(ncacn_conn);
 992                         close(s);
 993                         return;
 994                 }
 995         }
 996
 997         switch (transport) {
 998                 case NCACN_IP_TCP:
 999                         pipe_name = tsocket_address_string(ncacn_conn->client,
1000                                                            ncacn_conn);
1001                         if (pipe_name == NULL) {
1002                                 close(s);
1003                                 talloc_free(ncacn_conn);
1004                                 return;
1005                         }
1006
1007                         break;
1008                 case NCALRPC:
1009                         rc = getpeereid(s, &uid, &gid);
1010                         if (rc < 0) {
1011                                 DEBUG(2, ("Failed to get ncalrpc connecting "
1012                                           "uid - %s!\n", strerror(errno)));
1013                         } else {
1014                                 if (uid == sec_initial_uid()) {
1015                                         TALLOC_FREE(ncacn_conn->client);
1016
1017                                         rc = tsocket_address_unix_from_path(ncacn_conn,
1018                                                                             "/root/ncalrpc_as_system",
1019                                                                             &ncacn_conn->client);
1020                                         if (rc < 0) {
1021                                                 DEBUG(0, ("Out of memory!\n"));
1022                                                 talloc_free(ncacn_conn);
1023                                                 close(s);
1024                                                 return;
1025                                         }
1026
1027                                         TALLOC_FREE(ncacn_conn->client_name);
1028                                         ncacn_conn->client_name = tsocket_address_unix_path(ncacn_conn->client,
1029                                                                                             ncacn_conn);
1030                                         if (ncacn_conn->client == NULL) {
1031                                                 DEBUG(0, ("Out of memory!\n"));
1032                                                 talloc_free(ncacn_conn);
1033                                                 close(s);
1034                                                 return;
1035                                         }
1036                                 }
1037                         }
1038                         /* FALL TROUGH */
1039                 case NCACN_NP:
1040                         pipe_name = talloc_strdup(ncacn_conn,
1041                                                   name);
1042                         if (pipe_name == NULL) {
1043                                 close(s);
1044                                 talloc_free(ncacn_conn);
1045                                 return;
1046                         }
1047                         break;
1048                 default:
1049                         DEBUG(0, ("unknown dcerpc transport: %u!\n",
1050                                   transport));
1051                         talloc_free(ncacn_conn);
1052                         close(s);
1053                         return;
1054         }
1055
1056         rc = set_blocking(s, false);
1057         if (rc < 0) {
1058                 DEBUG(2, ("Failed to set dcerpc socket to non-blocking\n"));
1059                 talloc_free(ncacn_conn);
1060                 close(s);
1061                 return;
1062         }
1063
1064         /*
1065          * As soon as we have tstream_bsd_existing_socket set up it will
1066          * take care of closing the socket.
1067          */
1068         rc = tstream_bsd_existing_socket(ncacn_conn, s, &ncacn_conn->tstream);
1069         if (rc < 0) {
1070                 DEBUG(2, ("Failed to create tstream socket for dcerpc\n"));
1071                 talloc_free(ncacn_conn);
1072                 close(s);
1073                 return;
1074         }
1075
1076         if (ncacn_conn->session_info == NULL) {
1077                 /*
1078                  * TODO: use auth_anonymous_session_info() here?
1079                  */
1080                 status = make_session_info_guest(ncacn_conn,
1081                                                  &ncacn_conn->session_info);
1082                 if (!NT_STATUS_IS_OK(status)) {
1083                         DEBUG(2, ("Failed to create "
1084                                   "make_session_info_guest - %s\n",
1085                                   nt_errstr(status)));
1086                         talloc_free(ncacn_conn);
1087                         return;
1088                 }
1089         }
1090
1091         rc = make_server_pipes_struct(ncacn_conn,
1092                                       ncacn_conn->msg_ctx,
1093                                       pipe_name,
1094                                       ncacn_conn->transport,
1095                                       ncacn_conn->server,
1096                                       ncacn_conn->client,
1097                                       ncacn_conn->session_info,
1098                                       &ncacn_conn->p,
1099                                       &sys_errno);
1100         if (rc < 0) {
1101                 DEBUG(2, ("Failed to create pipe struct - %s",
1102                           strerror(sys_errno)));
1103                 talloc_free(ncacn_conn);
1104                 return;
1105         }
1106
1107         ncacn_conn->send_queue = tevent_queue_create(ncacn_conn,
1108                                                         "dcerpc send queue");
1109         if (ncacn_conn->send_queue == NULL) {
1110                 DEBUG(0, ("Out of memory!\n"));
1111                 talloc_free(ncacn_conn);
1112                 return;
1113         }
1114
1115         subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1116                                                ncacn_conn->ev_ctx,
1117                                                ncacn_conn->tstream);
1118         if (subreq == NULL) {
1119                 DEBUG(2, ("Failed to send ncacn packet\n"));
1120                 talloc_free(ncacn_conn);
1121                 return;
1122         }
1123
1124         tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1125
1126         DEBUG(10, ("dcerpc_ncacn_accept done\n"));
1127
1128         return;
1129 }
1130
1131 static void dcerpc_ncacn_packet_process(struct tevent_req *subreq)
1132 {
1133         struct dcerpc_ncacn_conn *ncacn_conn =
1134                 tevent_req_callback_data(subreq, struct dcerpc_ncacn_conn);
1135
1136         struct _output_data *out = &ncacn_conn->p->out_data;
1137         DATA_BLOB recv_buffer = data_blob_null;
1138         struct ncacn_packet *pkt;
1139         uint32_t to_send;
1140         NTSTATUS status;
1141         bool ok;
1142
1143         status = dcerpc_read_ncacn_packet_recv(subreq, ncacn_conn, &pkt, &recv_buffer);
1144         TALLOC_FREE(subreq);
1145         if (!NT_STATUS_IS_OK(status)) {
1146                 if (ncacn_conn->disconnect_fn != NULL) {
1147                         ok = ncacn_conn->disconnect_fn(ncacn_conn->p);
1148                         if (!ok) {
1149                                 DEBUG(3, ("Failed to call disconnect function\n"));
1150                         }
1151                 }
1152                 goto fail;
1153         }
1154
1155         /* dcerpc_read_ncacn_packet_recv() returns a full PDU */
1156         ncacn_conn->p->in_data.pdu_needed_len = 0;
1157         ncacn_conn->p->in_data.pdu = recv_buffer;
1158         if (dcerpc_get_endian_flag(&recv_buffer) & DCERPC_DREP_LE) {
1159                 ncacn_conn->p->endian = RPC_LITTLE_ENDIAN;
1160         } else {
1161                 ncacn_conn->p->endian = RPC_BIG_ENDIAN;
1162         }
1163         DEBUG(10, ("PDU is in %s Endian format!\n",
1164                    ncacn_conn->p->endian ? "Big" : "Little"));
1165         process_complete_pdu(ncacn_conn->p, pkt);
1166
1167         /* reset pipe state and free PDU */
1168         ncacn_conn->p->in_data.pdu.length = 0;
1169         talloc_free(recv_buffer.data);
1170         talloc_free(pkt);
1171
1172         /*
1173          * This is needed because of the way DCERPC binds work in the RPC
1174          * marshalling code
1175          */
1176         to_send = out->frag.length - out->current_pdu_sent;
1177         if (to_send > 0) {
1178
1179                 DEBUG(10, ("Current_pdu_len = %u, "
1180                            "current_pdu_sent = %u "
1181                            "Returning %u bytes\n",
1182                            (unsigned int)out->frag.length,
1183                            (unsigned int)out->current_pdu_sent,
1184                            (unsigned int)to_send));
1185
1186                 ncacn_conn->iov = talloc_zero(ncacn_conn, struct iovec);
1187                 if (ncacn_conn->iov == NULL) {
1188                         status = NT_STATUS_NO_MEMORY;
1189                         DEBUG(3, ("Out of memory!\n"));
1190                         goto fail;
1191                 }
1192                 ncacn_conn->count = 1;
1193
1194                 ncacn_conn->iov[0].iov_base = out->frag.data
1195                                             + out->current_pdu_sent;
1196                 ncacn_conn->iov[0].iov_len = to_send;
1197
1198                 out->current_pdu_sent += to_send;
1199         }
1200
1201         /*
1202          * This condition is false for bind packets, or when we haven't yet got
1203          * a full request, and need to wait for more data from the client
1204          */
1205         while (out->data_sent_length < out->rdata.length) {
1206                 ok = create_next_pdu(ncacn_conn->p);
1207                 if (!ok) {
1208                         DEBUG(3, ("Failed to create next PDU!\n"));
1209                         status = NT_STATUS_UNEXPECTED_IO_ERROR;
1210                         goto fail;
1211                 }
1212
1213                 ncacn_conn->iov = talloc_realloc(ncacn_conn,
1214                                                  ncacn_conn->iov,
1215                                                  struct iovec,
1216                                                  ncacn_conn->count + 1);
1217                 if (ncacn_conn->iov == NULL) {
1218                         DEBUG(3, ("Out of memory!\n"));
1219                         status = NT_STATUS_NO_MEMORY;
1220                         goto fail;
1221                 }
1222
1223                 ncacn_conn->iov[ncacn_conn->count].iov_base = out->frag.data;
1224                 ncacn_conn->iov[ncacn_conn->count].iov_len = out->frag.length;
1225
1226                 DEBUG(10, ("PDU number: %d, PDU Length: %u\n",
1227                            (unsigned int) ncacn_conn->count,
1228                            (unsigned int) ncacn_conn->iov[ncacn_conn->count].iov_len));
1229                 dump_data(11, (const uint8_t *) ncacn_conn->iov[ncacn_conn->count].iov_base,
1230                               ncacn_conn->iov[ncacn_conn->count].iov_len);
1231                 ncacn_conn->count++;
1232         }
1233
1234         /*
1235          * We still don't have a complete request, go back and wait for more
1236          * data.
1237          */
1238         if (ncacn_conn->count == 0) {
1239                 /* Wait for the next packet */
1240                 subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1241                                                        ncacn_conn->ev_ctx,
1242                                                        ncacn_conn->tstream);
1243                 if (subreq == NULL) {
1244                         DEBUG(2, ("Failed to start receving packets\n"));
1245                         status = NT_STATUS_NO_MEMORY;
1246                         goto fail;
1247                 }
1248                 tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1249                 return;
1250         }
1251
1252         DEBUG(10, ("Sending a total of %u bytes\n",
1253                    (unsigned int)ncacn_conn->p->out_data.data_sent_length));
1254
1255         subreq = tstream_writev_queue_send(ncacn_conn,
1256                                            ncacn_conn->ev_ctx,
1257                                            ncacn_conn->tstream,
1258                                            ncacn_conn->send_queue,
1259                                            ncacn_conn->iov,
1260                                            ncacn_conn->count);
1261         if (subreq == NULL) {
1262                 DEBUG(2, ("Failed to send packet\n"));
1263                 status = NT_STATUS_NO_MEMORY;
1264                 goto fail;
1265         }
1266
1267         tevent_req_set_callback(subreq, dcerpc_ncacn_packet_done, ncacn_conn);
1268         return;
1269
1270 fail:
1271         DEBUG(3, ("Terminating client(%s) connection! - '%s'\n",
1272                   ncacn_conn->client_name, nt_errstr(status)));
1273
1274         /* Terminate client connection */
1275         talloc_free(ncacn_conn);
1276         return;
1277 }
1278
1279 static void dcerpc_ncacn_packet_done(struct tevent_req *subreq)
1280 {
1281         struct dcerpc_ncacn_conn *ncacn_conn =
1282                 tevent_req_callback_data(subreq, struct dcerpc_ncacn_conn);
1283         NTSTATUS status = NT_STATUS_OK;
1284         int sys_errno;
1285         int rc;
1286
1287         rc = tstream_writev_queue_recv(subreq, &sys_errno);
1288         TALLOC_FREE(subreq);
1289         if (rc < 0) {
1290                 DEBUG(2, ("Writev failed!\n"));
1291                 status = map_nt_error_from_unix(sys_errno);
1292                 goto fail;
1293         }
1294
1295         /* clear out any data that may have been left around */
1296         ncacn_conn->count = 0;
1297         TALLOC_FREE(ncacn_conn->iov);
1298         data_blob_free(&ncacn_conn->p->in_data.data);
1299         data_blob_free(&ncacn_conn->p->out_data.frag);
1300         data_blob_free(&ncacn_conn->p->out_data.rdata);
1301
1302         talloc_free_children(ncacn_conn->p->mem_ctx);
1303
1304         /* Wait for the next packet */
1305         subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1306                                                ncacn_conn->ev_ctx,
1307                                                ncacn_conn->tstream);
1308         if (subreq == NULL) {
1309                 DEBUG(2, ("Failed to start receving packets\n"));
1310                 status = NT_STATUS_NO_MEMORY;
1311                 goto fail;
1312         }
1313
1314         tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1315         return;
1316
1317 fail:
1318         DEBUG(3, ("Terminating client(%s) connection! - '%s'\n",
1319                   ncacn_conn->client_name, nt_errstr(status)));
1320
1321         /* Terminate client connection */
1322         talloc_free(ncacn_conn);
1323         return;
1324 }
1325
1326 /* vim: set ts=8 sw=8 noet cindent syntax=c.doxygen: */