rpc_server: Use the RPC TCPIP ports of Windows
[garming/samba-autobuild/.git] / source3 / rpc_server / rpc_server.c
1 /*
2    Unix SMB/Netbios implementation.
3    Generic infrstructure for RPC Daemons
4    Copyright (C) Simo Sorce 2010
5    Copyright (C) Andrew Bartlett 2011
6    Copyright (C) Andreas Schneider 2011
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "rpc_server/rpc_pipes.h"
24 #include "rpc_server/rpc_server.h"
25 #include "rpc_server/rpc_config.h"
26 #include "rpc_dce.h"
27 #include "librpc/gen_ndr/netlogon.h"
28 #include "librpc/gen_ndr/auth.h"
29 #include "lib/tsocket/tsocket.h"
30 #include "libcli/named_pipe_auth/npa_tstream.h"
31 #include "../auth/auth_sam_reply.h"
32 #include "auth.h"
33 #include "rpc_server/rpc_ncacn_np.h"
34 #include "rpc_server/srv_pipe_hnd.h"
35 #include "rpc_server/srv_pipe.h"
36
37 #define SERVER_TCP_LOW_PORT  49152
38 #define SERVER_TCP_HIGH_PORT 65535
39
40 /* Creates a pipes_struct and initializes it with the information
41  * sent from the client */
42 int make_server_pipes_struct(TALLOC_CTX *mem_ctx,
43                              struct messaging_context *msg_ctx,
44                              const char *pipe_name,
45                              enum dcerpc_transport_t transport,
46                              const struct tsocket_address *local_address,
47                              const struct tsocket_address *remote_address,
48                              struct auth_session_info *session_info,
49                              struct pipes_struct **_p,
50                              int *perrno)
51 {
52         struct pipes_struct *p;
53         int ret;
54
55         ret = make_base_pipes_struct(mem_ctx, msg_ctx, pipe_name,
56                                      transport, RPC_LITTLE_ENDIAN,
57                                      remote_address, local_address, &p);
58         if (ret) {
59                 *perrno = ret;
60                 return -1;
61         }
62
63         if (session_info->unix_token && session_info->unix_info && session_info->security_token) {
64                 /* Don't call create_local_token(), we already have the full details here */
65                 p->session_info = talloc_steal(p, session_info);
66
67         } else {
68                 DEBUG(0, ("Supplied session_info in make_server_pipes_struct was incomplete!"));
69                 *perrno = EINVAL;
70                 return -1;
71         }
72
73         *_p = p;
74         return 0;
75 }
76
77 /* Start listening on the appropriate unix socket and setup all is needed to
78  * dispatch requests to the pipes rpc implementation */
79
80 struct dcerpc_ncacn_listen_state {
81         struct ndr_syntax_id syntax_id;
82
83         int fd;
84         union {
85                 char *name;
86                 uint16_t port;
87         } ep;
88
89         struct tevent_context *ev_ctx;
90         struct messaging_context *msg_ctx;
91         dcerpc_ncacn_disconnect_fn disconnect_fn;
92 };
93
94 static void named_pipe_listener(struct tevent_context *ev,
95                                 struct tevent_fd *fde,
96                                 uint16_t flags,
97                                 void *private_data);
98
99 int create_named_pipe_socket(const char *pipe_name)
100 {
101         char *np_dir = NULL;
102         int fd = -1;
103
104         /*
105          * As lp_ncalrpc_dir() should have 0755, but
106          * lp_ncalrpc_dir()/np should have 0700, we need to
107          * create lp_ncalrpc_dir() first.
108          */
109         if (!directory_create_or_exist(lp_ncalrpc_dir(), 0755)) {
110                 DEBUG(0, ("Failed to create pipe directory %s - %s\n",
111                           lp_ncalrpc_dir(), strerror(errno)));
112                 goto out;
113         }
114
115         np_dir = talloc_asprintf(talloc_tos(), "%s/np", lp_ncalrpc_dir());
116         if (!np_dir) {
117                 DEBUG(0, ("Out of memory\n"));
118                 goto out;
119         }
120
121         if (!directory_create_or_exist_strict(np_dir, geteuid(), 0700)) {
122                 DEBUG(0, ("Failed to create pipe directory %s - %s\n",
123                           np_dir, strerror(errno)));
124                 goto out;
125         }
126
127         fd = create_pipe_sock(np_dir, pipe_name, 0700);
128         if (fd == -1) {
129                 DEBUG(0, ("Failed to create pipe socket! [%s/%s]\n",
130                           np_dir, pipe_name));
131                 goto out;
132         }
133
134         DEBUG(10, ("Openened pipe socket fd %d for %s\n", fd, pipe_name));
135
136 out:
137         talloc_free(np_dir);
138         return fd;
139 }
140
141 bool setup_named_pipe_socket(const char *pipe_name,
142                              struct tevent_context *ev_ctx,
143                              struct messaging_context *msg_ctx)
144 {
145         struct dcerpc_ncacn_listen_state *state;
146         struct tevent_fd *fde;
147         int rc;
148
149         state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
150         if (!state) {
151                 DEBUG(0, ("Out of memory\n"));
152                 return false;
153         }
154         state->ep.name = talloc_strdup(state, pipe_name);
155         if (state->ep.name == NULL) {
156                 DEBUG(0, ("Out of memory\n"));
157                 goto out;
158         }
159         state->fd = create_named_pipe_socket(pipe_name);
160         if (state->fd == -1) {
161                 goto out;
162         }
163
164         rc = listen(state->fd, 5);
165         if (rc < 0) {
166                 DEBUG(0, ("Failed to listen on pipe socket %s: %s\n",
167                           pipe_name, strerror(errno)));
168                 goto out;
169         }
170
171         state->ev_ctx = ev_ctx;
172         state->msg_ctx = msg_ctx;
173
174         DEBUG(10, ("Openened pipe socket fd %d for %s\n",
175                    state->fd, pipe_name));
176
177         fde = tevent_add_fd(ev_ctx,
178                             state, state->fd, TEVENT_FD_READ,
179                             named_pipe_listener, state);
180         if (!fde) {
181                 DEBUG(0, ("Failed to add event handler!\n"));
182                 goto out;
183         }
184
185         tevent_fd_set_auto_close(fde);
186         return true;
187
188 out:
189         if (state->fd != -1) {
190                 close(state->fd);
191         }
192         TALLOC_FREE(state);
193         return false;
194 }
195
196 static void named_pipe_listener(struct tevent_context *ev,
197                                 struct tevent_fd *fde,
198                                 uint16_t flags,
199                                 void *private_data)
200 {
201         struct dcerpc_ncacn_listen_state *state =
202                         talloc_get_type_abort(private_data,
203                                               struct dcerpc_ncacn_listen_state);
204         struct sockaddr_un sunaddr;
205         socklen_t len;
206         int sd = -1;
207
208         /* TODO: should we have a limit to the number of clients ? */
209
210         len = sizeof(sunaddr);
211
212         sd = accept(state->fd,
213                     (struct sockaddr *)(void *)&sunaddr, &len);
214
215         if (sd == -1) {
216                 if (errno != EINTR) {
217                         DEBUG(6, ("Failed to get a valid socket [%s]\n",
218                                   strerror(errno)));
219                 }
220                 return;
221         }
222
223         DEBUG(6, ("Accepted socket %d\n", sd));
224
225         named_pipe_accept_function(state->ev_ctx,
226                                    state->msg_ctx,
227                                    state->ep.name,
228                                    sd, NULL, 0);
229 }
230
231
232 /* This is the core of the rpc server.
233  * Accepts connections from clients and process requests using the appropriate
234  * dispatcher table. */
235
236 static int named_pipe_destructor(struct named_pipe_client *npc)
237 {
238         if (npc->term_fn) {
239                 npc->term_fn(npc->private_data);
240         }
241         return 0;
242 }
243
244 struct named_pipe_client *named_pipe_client_init(TALLOC_CTX *mem_ctx,
245                                                  struct tevent_context *ev_ctx,
246                                                  struct messaging_context *msg_ctx,
247                                                  const char *pipe_name,
248                                                  named_pipe_termination_fn *term_fn,
249                                                  uint16_t file_type,
250                                                  uint16_t device_state,
251                                                  uint64_t allocation_size,
252                                                  void *private_data)
253 {
254         struct named_pipe_client *npc;
255
256         npc = talloc_zero(mem_ctx, struct named_pipe_client);
257         if (npc == NULL) {
258                 DEBUG(0, ("Out of memory!\n"));
259                 return NULL;
260         }
261         talloc_set_destructor(npc, named_pipe_destructor);
262
263         npc->pipe_name = talloc_strdup(npc, pipe_name);
264         if (npc->pipe_name == NULL) {
265                 DEBUG(0, ("Out of memory!\n"));
266                 talloc_free(npc);
267                 return NULL;
268         }
269
270         npc->ev = ev_ctx;
271         npc->msg_ctx = msg_ctx;
272         npc->term_fn = term_fn;
273         npc->private_data = private_data;
274
275         npc->file_type = file_type;
276         npc->device_state = device_state;
277         npc->allocation_size = allocation_size;
278
279         return npc;
280 }
281
282 static void named_pipe_accept_done(struct tevent_req *subreq);
283
284 void named_pipe_accept_function(struct tevent_context *ev_ctx,
285                                 struct messaging_context *msg_ctx,
286                                 const char *pipe_name, int fd,
287                                 named_pipe_termination_fn *term_fn,
288                                 void *private_data)
289 {
290         struct named_pipe_client *npc;
291         struct tstream_context *plain;
292         struct tevent_req *subreq;
293         int ret;
294
295         npc = talloc_zero(ev_ctx, struct named_pipe_client);
296         if (!npc) {
297                 DEBUG(0, ("Out of memory!\n"));
298                 close(fd);
299                 return;
300         }
301
302         npc->pipe_name = talloc_strdup(npc, pipe_name);
303         if (npc->pipe_name == NULL) {
304                 DEBUG(0, ("Out of memory!\n"));
305                 TALLOC_FREE(npc);
306                 close(fd);
307                 return;
308         }
309         npc->ev = ev_ctx;
310         npc->msg_ctx = msg_ctx;
311         npc->term_fn = term_fn;
312         npc->private_data = private_data;
313
314         talloc_set_destructor(npc, named_pipe_destructor);
315
316         /* make sure socket is in NON blocking state */
317         ret = set_blocking(fd, false);
318         if (ret != 0) {
319                 DEBUG(2, ("Failed to make socket non-blocking\n"));
320                 TALLOC_FREE(npc);
321                 close(fd);
322                 return;
323         }
324
325         ret = tstream_bsd_existing_socket(npc, fd, &plain);
326         if (ret != 0) {
327                 DEBUG(2, ("Failed to create tstream socket\n"));
328                 TALLOC_FREE(npc);
329                 close(fd);
330                 return;
331         }
332
333         npc->file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
334         npc->device_state = 0xff | 0x0400 | 0x0100;
335         npc->allocation_size = 4096;
336
337         subreq = tstream_npa_accept_existing_send(npc, npc->ev, plain,
338                                                   npc->file_type,
339                                                   npc->device_state,
340                                                   npc->allocation_size);
341         if (!subreq) {
342                 DEBUG(2, ("Failed to start async accept procedure\n"));
343                 TALLOC_FREE(npc);
344                 close(fd);
345                 return;
346         }
347         tevent_req_set_callback(subreq, named_pipe_accept_done, npc);
348 }
349
350 static void named_pipe_packet_done(struct tevent_req *subreq);
351
352 static void named_pipe_accept_done(struct tevent_req *subreq)
353 {
354         struct auth_session_info_transport *session_info_transport;
355         struct named_pipe_client *npc =
356                 tevent_req_callback_data(subreq, struct named_pipe_client);
357         int error;
358         int ret;
359
360         ret = tstream_npa_accept_existing_recv(subreq, &error, npc,
361                                                 &npc->tstream,
362                                                 &npc->client,
363                                                 &npc->client_name,
364                                                 &npc->server,
365                                                 &npc->server_name,
366                                                 &session_info_transport);
367
368         npc->session_info = talloc_move(npc, &session_info_transport->session_info);
369
370         TALLOC_FREE(subreq);
371         if (ret != 0) {
372                 DEBUG(2, ("Failed to accept named pipe connection! (%s)\n",
373                           strerror(error)));
374                 TALLOC_FREE(npc);
375                 return;
376         }
377
378         ret = make_server_pipes_struct(npc,
379                                        npc->msg_ctx,
380                                        npc->pipe_name, NCACN_NP,
381                                        npc->server,
382                                        npc->client,
383                                        npc->session_info,
384                                        &npc->p, &error);
385         if (ret != 0) {
386                 DEBUG(2, ("Failed to create pipes_struct! (%s)\n",
387                           strerror(error)));
388                 goto fail;
389         }
390
391         npc->write_queue = tevent_queue_create(npc, "np_server_write_queue");
392         if (!npc->write_queue) {
393                 DEBUG(2, ("Failed to set up write queue!\n"));
394                 goto fail;
395         }
396
397         /* And now start receiving and processing packets */
398         subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
399         if (!subreq) {
400                 DEBUG(2, ("Failed to start receving packets\n"));
401                 goto fail;
402         }
403         tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
404         return;
405
406 fail:
407         DEBUG(2, ("Fatal error. Terminating client(%s) connection!\n",
408                   npc->client_name));
409         /* terminate client connection */
410         talloc_free(npc);
411         return;
412 }
413
414 void named_pipe_packet_process(struct tevent_req *subreq)
415 {
416         struct named_pipe_client *npc =
417                 tevent_req_callback_data(subreq, struct named_pipe_client);
418         struct _output_data *out = &npc->p->out_data;
419         DATA_BLOB recv_buffer = data_blob_null;
420         struct ncacn_packet *pkt;
421         NTSTATUS status;
422         uint32_t to_send;
423         size_t i;
424         bool ok;
425
426         status = dcerpc_read_ncacn_packet_recv(subreq, npc, &pkt, &recv_buffer);
427         TALLOC_FREE(subreq);
428         if (!NT_STATUS_IS_OK(status)) {
429                 goto fail;
430         }
431
432         /* dcerpc_read_ncacn_packet_recv() returns a full PDU */
433         npc->p->in_data.pdu_needed_len = 0;
434         npc->p->in_data.pdu = recv_buffer;
435         if (dcerpc_get_endian_flag(&recv_buffer) & DCERPC_DREP_LE) {
436                 npc->p->endian = RPC_LITTLE_ENDIAN;
437         } else {
438                 npc->p->endian = RPC_BIG_ENDIAN;
439         }
440         DEBUG(10, ("PDU is in %s Endian format!\n",
441                    npc->p->endian ? "Big" : "Little"));
442         process_complete_pdu(npc->p, pkt);
443
444         /* reset pipe state and free PDU */
445         npc->p->in_data.pdu.length = 0;
446         talloc_free(recv_buffer.data);
447         talloc_free(pkt);
448
449         /* this is needed because of the way DCERPC Binds work in
450          * the RPC marshalling code */
451         to_send = out->frag.length - out->current_pdu_sent;
452         if (to_send > 0) {
453
454                 npc->iov = talloc_zero(npc, struct iovec);
455                 if (!npc->iov) {
456                         status = NT_STATUS_NO_MEMORY;
457                         goto fail;
458                 }
459                 npc->count = 1;
460
461                 npc->iov[0].iov_base = out->frag.data
462                                         + out->current_pdu_sent;
463                 npc->iov[0].iov_len = to_send;
464
465                 out->current_pdu_sent += to_send;
466         }
467
468         /* this condition is false for bind packets, or when we haven't
469          * yet got a full request, and need to wait for more data from
470          * the client */
471         while (out->data_sent_length < out->rdata.length) {
472
473                 ok = create_next_pdu(npc->p);
474                 if (!ok) {
475                         DEBUG(3, ("Failed to create next PDU!\n"));
476                         status = NT_STATUS_UNEXPECTED_IO_ERROR;
477                         goto fail;
478                 }
479
480                 npc->iov = talloc_realloc(npc, npc->iov,
481                                             struct iovec, npc->count + 1);
482                 if (!npc->iov) {
483                         status = NT_STATUS_NO_MEMORY;
484                         goto fail;
485                 }
486
487                 npc->iov[npc->count].iov_base = out->frag.data;
488                 npc->iov[npc->count].iov_len = out->frag.length;
489
490                 npc->count++;
491         }
492
493         /* we still don't have a complete request, go back and wait for more
494          * data */
495         if (npc->count == 0) {
496                 /* Wait for the next packet */
497                 subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
498                 if (!subreq) {
499                         DEBUG(2, ("Failed to start receving packets\n"));
500                         status = NT_STATUS_NO_MEMORY;
501                         goto fail;
502                 }
503                 tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
504                 return;
505         }
506
507         DEBUG(10, ("Sending %u fragments in a total of %u bytes\n",
508                    (unsigned int)npc->count,
509                    (unsigned int)npc->p->out_data.data_sent_length));
510
511         for (i = 0; i < npc->count; i++) {
512                 DEBUG(10, ("Sending PDU number: %d, PDU Length: %u\n",
513                           (unsigned int)i,
514                           (unsigned int)npc->iov[i].iov_len));
515                 dump_data(11, (const uint8_t *)npc->iov[i].iov_base,
516                                 npc->iov[i].iov_len);
517
518                 subreq = tstream_writev_queue_send(npc,
519                                                    npc->ev,
520                                                    npc->tstream,
521                                                    npc->write_queue,
522                                                    (npc->iov + i),
523                                                    1);
524                 if (!subreq) {
525                         DEBUG(2, ("Failed to send packet\n"));
526                         status = NT_STATUS_NO_MEMORY;
527                         goto fail;
528                 }
529                 tevent_req_set_callback(subreq, named_pipe_packet_done, npc);
530         }
531
532         return;
533
534 fail:
535         DEBUG(2, ("Fatal error(%s). "
536                   "Terminating client(%s) connection!\n",
537                   nt_errstr(status), npc->client_name));
538         /* terminate client connection */
539         talloc_free(npc);
540         return;
541 }
542
543 static void named_pipe_packet_done(struct tevent_req *subreq)
544 {
545         struct named_pipe_client *npc =
546                 tevent_req_callback_data(subreq, struct named_pipe_client);
547         int sys_errno;
548         int ret;
549
550         ret = tstream_writev_queue_recv(subreq, &sys_errno);
551         TALLOC_FREE(subreq);
552         if (ret == -1) {
553                 DEBUG(2, ("Writev failed!\n"));
554                 goto fail;
555         }
556
557         if (tevent_queue_length(npc->write_queue) > 0) {
558                 return;
559         }
560
561         if (npc->p->fault_state != 0) {
562                 DEBUG(2, ("Disconnect after fault\n"));
563                 sys_errno = EINVAL;
564                 goto fail;
565         }
566
567         /* clear out any data that may have been left around */
568         npc->count = 0;
569         TALLOC_FREE(npc->iov);
570         data_blob_free(&npc->p->in_data.data);
571         data_blob_free(&npc->p->out_data.frag);
572         data_blob_free(&npc->p->out_data.rdata);
573
574         talloc_free_children(npc->p->mem_ctx);
575
576         /* Wait for the next packet */
577         subreq = dcerpc_read_ncacn_packet_send(npc, npc->ev, npc->tstream);
578         if (!subreq) {
579                 DEBUG(2, ("Failed to start receving packets\n"));
580                 sys_errno = ENOMEM;
581                 goto fail;
582         }
583         tevent_req_set_callback(subreq, named_pipe_packet_process, npc);
584         return;
585
586 fail:
587         DEBUG(2, ("Fatal error(%s). "
588                   "Terminating client(%s) connection!\n",
589                   strerror(sys_errno), npc->client_name));
590         /* terminate client connection */
591         talloc_free(npc);
592         return;
593 }
594
595 /********************************************************************
596  * Start listening on the tcp/ip socket
597  ********************************************************************/
598
599 static void dcerpc_ncacn_tcpip_listener(struct tevent_context *ev,
600                                         struct tevent_fd *fde,
601                                         uint16_t flags,
602                                         void *private_data);
603
604 int create_tcpip_socket(const struct sockaddr_storage *ifss, uint16_t *port)
605 {
606         int fd = -1;
607
608         if (*port == 0) {
609                 uint16_t i;
610
611                 for (i = SERVER_TCP_LOW_PORT; i <= SERVER_TCP_HIGH_PORT; i++) {
612                         fd = open_socket_in(SOCK_STREAM,
613                                             i,
614                                             0,
615                                             ifss,
616                                             false);
617                         if (fd >= 0) {
618                                 *port = i;
619                                 break;
620                         }
621                 }
622         } else {
623                 fd = open_socket_in(SOCK_STREAM,
624                                     *port,
625                                     0,
626                                     ifss,
627                                     true);
628         }
629         if (fd == -1) {
630                 DEBUG(0, ("Failed to create socket on port %u!\n", *port));
631                 return -1;
632         }
633
634         DEBUG(10, ("Opened tcpip socket fd %d for port %u\n", fd, *port));
635
636         return fd;
637 }
638
639 uint16_t setup_dcerpc_ncacn_tcpip_socket(struct tevent_context *ev_ctx,
640                                          struct messaging_context *msg_ctx,
641                                          const struct sockaddr_storage *ifss,
642                                          uint16_t port)
643 {
644         struct dcerpc_ncacn_listen_state *state;
645         struct tevent_fd *fde;
646         int rc;
647
648         state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
649         if (state == NULL) {
650                 DEBUG(0, ("setup_dcerpc_ncacn_tcpip_socket: Out of memory\n"));
651                 return 0;
652         }
653
654         state->fd = -1;
655         state->ep.port = port;
656         state->disconnect_fn = NULL;
657
658         state->fd = create_tcpip_socket(ifss, &state->ep.port);
659         if (state->fd == -1) {
660                 goto out;
661         }
662
663         state->ev_ctx = ev_ctx;
664         state->msg_ctx = msg_ctx;
665
666         /* ready to listen */
667         set_socket_options(state->fd, "SO_KEEPALIVE");
668         set_socket_options(state->fd, lp_socket_options());
669
670         /* Set server socket to non-blocking for the accept. */
671         set_blocking(state->fd, false);
672
673         rc = listen(state->fd, SMBD_LISTEN_BACKLOG);
674         if (rc == -1) {
675                 DEBUG(0,("setup_tcpip_socket: listen - %s\n", strerror(errno)));
676                 goto out;
677         }
678
679         DEBUG(10, ("setup_tcpip_socket: openened socket fd %d for port %u\n",
680                    state->fd, state->ep.port));
681
682         fde = tevent_add_fd(state->ev_ctx,
683                             state,
684                             state->fd,
685                             TEVENT_FD_READ,
686                             dcerpc_ncacn_tcpip_listener,
687                             state);
688         if (fde == NULL) {
689                 DEBUG(0, ("setup_tcpip_socket: Failed to add event handler!\n"));
690                 goto out;
691         }
692
693         tevent_fd_set_auto_close(fde);
694
695         return state->ep.port;
696 out:
697         if (state->fd != -1) {
698                 close(state->fd);
699         }
700         TALLOC_FREE(state);
701
702         return 0;
703 }
704
705 static void dcerpc_ncacn_tcpip_listener(struct tevent_context *ev,
706                                         struct tevent_fd *fde,
707                                         uint16_t flags,
708                                         void *private_data)
709 {
710         struct dcerpc_ncacn_listen_state *state =
711                         talloc_get_type_abort(private_data,
712                                               struct dcerpc_ncacn_listen_state);
713         struct tsocket_address *cli_addr = NULL;
714         struct tsocket_address *srv_addr = NULL;
715         struct sockaddr_storage addr;
716         socklen_t in_addrlen = sizeof(addr);
717         int s = -1;
718         int rc;
719
720         s = accept(state->fd, (struct sockaddr *)(void *) &addr, &in_addrlen);
721         if (s == -1) {
722                 if (errno != EINTR) {
723                         DEBUG(0,("tcpip_listener accept: %s\n",
724                                  strerror(errno)));
725                 }
726                 return;
727         }
728
729         rc = tsocket_address_bsd_from_sockaddr(state,
730                                                (struct sockaddr *)(void *) &addr,
731                                                in_addrlen,
732                                                &cli_addr);
733         if (rc < 0) {
734                 close(s);
735                 return;
736         }
737
738         rc = getsockname(s, (struct sockaddr *)(void *) &addr, &in_addrlen);
739         if (rc < 0) {
740                 close(s);
741                 return;
742         }
743
744         rc = tsocket_address_bsd_from_sockaddr(state,
745                                                (struct sockaddr *)(void *) &addr,
746                                                in_addrlen,
747                                                &srv_addr);
748         if (rc < 0) {
749                 close(s);
750                 return;
751         }
752
753         DEBUG(6, ("tcpip_listener: Accepted socket %d\n", s));
754
755         dcerpc_ncacn_accept(state->ev_ctx,
756                             state->msg_ctx,
757                             NCACN_IP_TCP,
758                             NULL,
759                             cli_addr,
760                             srv_addr,
761                             s,
762                             NULL);
763 }
764
765 /********************************************************************
766  * Start listening on the ncalrpc socket
767  ********************************************************************/
768
769 static void dcerpc_ncalrpc_listener(struct tevent_context *ev,
770                                     struct tevent_fd *fde,
771                                     uint16_t flags,
772                                     void *private_data);
773
774 int create_dcerpc_ncalrpc_socket(const char *name)
775 {
776         int fd = -1;
777
778         if (name == NULL) {
779                 name = "DEFAULT";
780         }
781
782         if (!directory_create_or_exist(lp_ncalrpc_dir(), 0755)) {
783                 DEBUG(0, ("Failed to create ncalrpc directory %s - %s\n",
784                           lp_ncalrpc_dir(), strerror(errno)));
785                 return -1;
786         }
787
788         fd = create_pipe_sock(lp_ncalrpc_dir(), name, 0755);
789         if (fd == -1) {
790                 DEBUG(0, ("Failed to create ncalrpc socket! [%s/%s]\n",
791                           lp_ncalrpc_dir(), name));
792                 return -1;
793         }
794
795         DEBUG(10, ("Openened ncalrpc socket fd %d for %s\n", fd, name));
796
797         return fd;
798 }
799
800 bool setup_dcerpc_ncalrpc_socket(struct tevent_context *ev_ctx,
801                                  struct messaging_context *msg_ctx,
802                                  const char *name,
803                                  dcerpc_ncacn_disconnect_fn fn)
804 {
805         struct dcerpc_ncacn_listen_state *state;
806         struct tevent_fd *fde;
807         int rc;
808
809         state = talloc(ev_ctx, struct dcerpc_ncacn_listen_state);
810         if (state == NULL) {
811                 DEBUG(0, ("Out of memory\n"));
812                 return false;
813         }
814
815         state->fd = -1;
816         state->disconnect_fn = fn;
817
818         if (name == NULL) {
819                 name = "DEFAULT";
820         }
821
822         state->ep.name = talloc_strdup(state, name);
823         if (state->ep.name == NULL) {
824                 DEBUG(0, ("Out of memory\n"));
825                 talloc_free(state);
826                 return false;
827         }
828
829         state->fd = create_dcerpc_ncalrpc_socket(name);
830         if (state->fd == -1) {
831                 goto out;
832         }
833
834         rc = listen(state->fd, 5);
835         if (rc < 0) {
836                 DEBUG(0, ("Failed to listen on ncalrpc socket %s: %s\n",
837                           name, strerror(errno)));
838                 goto out;
839         }
840
841         state->ev_ctx = ev_ctx;
842         state->msg_ctx = msg_ctx;
843
844         /* Set server socket to non-blocking for the accept. */
845         set_blocking(state->fd, false);
846
847         fde = tevent_add_fd(state->ev_ctx,
848                             state,
849                             state->fd,
850                             TEVENT_FD_READ,
851                             dcerpc_ncalrpc_listener,
852                             state);
853         if (fde == NULL) {
854                 DEBUG(0, ("Failed to add event handler for ncalrpc!\n"));
855                 goto out;
856         }
857
858         tevent_fd_set_auto_close(fde);
859
860         return true;
861 out:
862         if (state->fd != -1) {
863                 close(state->fd);
864         }
865         TALLOC_FREE(state);
866
867         return 0;
868 }
869
870 static void dcerpc_ncalrpc_listener(struct tevent_context *ev,
871                                         struct tevent_fd *fde,
872                                         uint16_t flags,
873                                         void *private_data)
874 {
875         struct dcerpc_ncacn_listen_state *state =
876                         talloc_get_type_abort(private_data,
877                                               struct dcerpc_ncacn_listen_state);
878         struct tsocket_address *cli_addr = NULL;
879         struct sockaddr_un sunaddr;
880         struct sockaddr *addr = (struct sockaddr *)(void *)&sunaddr;
881         socklen_t len = sizeof(sunaddr);
882         int sd = -1;
883         int rc;
884
885         ZERO_STRUCT(sunaddr);
886
887         sd = accept(state->fd, addr, &len);
888         if (sd == -1) {
889                 if (errno != EINTR) {
890                         DEBUG(0, ("ncalrpc accept() failed: %s\n", strerror(errno)));
891                 }
892                 return;
893         }
894
895         rc = tsocket_address_bsd_from_sockaddr(state,
896                                                addr, len,
897                                                &cli_addr);
898         if (rc < 0) {
899                 close(sd);
900                 return;
901         }
902
903         DEBUG(10, ("Accepted ncalrpc socket %d\n", sd));
904
905         dcerpc_ncacn_accept(state->ev_ctx,
906                             state->msg_ctx,
907                             NCALRPC,
908                             state->ep.name,
909                             cli_addr, NULL, sd,
910                             state->disconnect_fn);
911 }
912
913 struct dcerpc_ncacn_conn {
914         enum dcerpc_transport_t transport;
915
916         int sock;
917
918         struct pipes_struct *p;
919         dcerpc_ncacn_disconnect_fn disconnect_fn;
920
921         struct tevent_context *ev_ctx;
922         struct messaging_context *msg_ctx;
923
924         struct tstream_context *tstream;
925         struct tevent_queue *send_queue;
926
927         struct tsocket_address *client;
928         char *client_name;
929         struct tsocket_address *server;
930         char *server_name;
931         struct auth_session_info *session_info;
932
933         struct iovec *iov;
934         size_t count;
935 };
936
937 static void dcerpc_ncacn_packet_process(struct tevent_req *subreq);
938 static void dcerpc_ncacn_packet_done(struct tevent_req *subreq);
939
940 void dcerpc_ncacn_accept(struct tevent_context *ev_ctx,
941                          struct messaging_context *msg_ctx,
942                          enum dcerpc_transport_t transport,
943                          const char *name,
944                          struct tsocket_address *cli_addr,
945                          struct tsocket_address *srv_addr,
946                          int s,
947                          dcerpc_ncacn_disconnect_fn fn) {
948         struct dcerpc_ncacn_conn *ncacn_conn;
949         struct tevent_req *subreq;
950         char *pipe_name;
951         NTSTATUS status;
952         int sys_errno;
953         uid_t uid;
954         gid_t gid;
955         int rc;
956
957         DEBUG(10, ("dcerpc_ncacn_accept\n"));
958
959         ncacn_conn = talloc_zero(ev_ctx, struct dcerpc_ncacn_conn);
960         if (ncacn_conn == NULL) {
961                 DEBUG(0, ("Out of memory!\n"));
962                 close(s);
963                 return;
964         }
965
966         ncacn_conn->transport = transport;
967         ncacn_conn->ev_ctx = ev_ctx;
968         ncacn_conn->msg_ctx = msg_ctx;
969         ncacn_conn->sock = s;
970         ncacn_conn->disconnect_fn = fn;
971
972         ncacn_conn->client = talloc_move(ncacn_conn, &cli_addr);
973         if (tsocket_address_is_inet(ncacn_conn->client, "ip")) {
974                 ncacn_conn->client_name =
975                         tsocket_address_inet_addr_string(ncacn_conn->client,
976                                                          ncacn_conn);
977         } else {
978                 ncacn_conn->client_name =
979                         tsocket_address_unix_path(ncacn_conn->client,
980                                                   ncacn_conn);
981         }
982         if (ncacn_conn->client_name == NULL) {
983                 DEBUG(0, ("Out of memory!\n"));
984                 talloc_free(ncacn_conn);
985                 close(s);
986                 return;
987         }
988
989         if (srv_addr != NULL) {
990                 ncacn_conn->server = talloc_move(ncacn_conn, &srv_addr);
991
992                 ncacn_conn->server_name =
993                         tsocket_address_inet_addr_string(ncacn_conn->server,
994                                                          ncacn_conn);
995                 if (ncacn_conn->server_name == NULL) {
996                         DEBUG(0, ("Out of memory!\n"));
997                         talloc_free(ncacn_conn);
998                         close(s);
999                         return;
1000                 }
1001         }
1002
1003         switch (transport) {
1004                 case NCACN_IP_TCP:
1005                         pipe_name = tsocket_address_string(ncacn_conn->client,
1006                                                            ncacn_conn);
1007                         if (pipe_name == NULL) {
1008                                 close(s);
1009                                 talloc_free(ncacn_conn);
1010                                 return;
1011                         }
1012
1013                         break;
1014                 case NCALRPC:
1015                         rc = getpeereid(s, &uid, &gid);
1016                         if (rc < 0) {
1017                                 DEBUG(2, ("Failed to get ncalrpc connecting "
1018                                           "uid - %s!\n", strerror(errno)));
1019                         } else {
1020                                 if (uid == sec_initial_uid()) {
1021                                         TALLOC_FREE(ncacn_conn->client);
1022
1023                                         rc = tsocket_address_unix_from_path(ncacn_conn,
1024                                                                             "/root/ncalrpc_as_system",
1025                                                                             &ncacn_conn->client);
1026                                         if (rc < 0) {
1027                                                 DEBUG(0, ("Out of memory!\n"));
1028                                                 talloc_free(ncacn_conn);
1029                                                 close(s);
1030                                                 return;
1031                                         }
1032
1033                                         TALLOC_FREE(ncacn_conn->client_name);
1034                                         ncacn_conn->client_name = tsocket_address_unix_path(ncacn_conn->client,
1035                                                                                             ncacn_conn);
1036                                         if (ncacn_conn->client == NULL) {
1037                                                 DEBUG(0, ("Out of memory!\n"));
1038                                                 talloc_free(ncacn_conn);
1039                                                 close(s);
1040                                                 return;
1041                                         }
1042                                 }
1043                         }
1044                         /* FALL TROUGH */
1045                 case NCACN_NP:
1046                         pipe_name = talloc_strdup(ncacn_conn,
1047                                                   name);
1048                         if (pipe_name == NULL) {
1049                                 close(s);
1050                                 talloc_free(ncacn_conn);
1051                                 return;
1052                         }
1053                         break;
1054                 default:
1055                         DEBUG(0, ("unknown dcerpc transport: %u!\n",
1056                                   transport));
1057                         talloc_free(ncacn_conn);
1058                         close(s);
1059                         return;
1060         }
1061
1062         rc = set_blocking(s, false);
1063         if (rc < 0) {
1064                 DEBUG(2, ("Failed to set dcerpc socket to non-blocking\n"));
1065                 talloc_free(ncacn_conn);
1066                 close(s);
1067                 return;
1068         }
1069
1070         /*
1071          * As soon as we have tstream_bsd_existing_socket set up it will
1072          * take care of closing the socket.
1073          */
1074         rc = tstream_bsd_existing_socket(ncacn_conn, s, &ncacn_conn->tstream);
1075         if (rc < 0) {
1076                 DEBUG(2, ("Failed to create tstream socket for dcerpc\n"));
1077                 talloc_free(ncacn_conn);
1078                 close(s);
1079                 return;
1080         }
1081
1082         if (ncacn_conn->session_info == NULL) {
1083                 /*
1084                  * TODO: use auth_anonymous_session_info() here?
1085                  */
1086                 status = make_session_info_guest(ncacn_conn,
1087                                                  &ncacn_conn->session_info);
1088                 if (!NT_STATUS_IS_OK(status)) {
1089                         DEBUG(2, ("Failed to create "
1090                                   "make_session_info_guest - %s\n",
1091                                   nt_errstr(status)));
1092                         talloc_free(ncacn_conn);
1093                         return;
1094                 }
1095         }
1096
1097         rc = make_server_pipes_struct(ncacn_conn,
1098                                       ncacn_conn->msg_ctx,
1099                                       pipe_name,
1100                                       ncacn_conn->transport,
1101                                       ncacn_conn->server,
1102                                       ncacn_conn->client,
1103                                       ncacn_conn->session_info,
1104                                       &ncacn_conn->p,
1105                                       &sys_errno);
1106         if (rc < 0) {
1107                 DEBUG(2, ("Failed to create pipe struct - %s",
1108                           strerror(sys_errno)));
1109                 talloc_free(ncacn_conn);
1110                 return;
1111         }
1112
1113         ncacn_conn->send_queue = tevent_queue_create(ncacn_conn,
1114                                                         "dcerpc send queue");
1115         if (ncacn_conn->send_queue == NULL) {
1116                 DEBUG(0, ("Out of memory!\n"));
1117                 talloc_free(ncacn_conn);
1118                 return;
1119         }
1120
1121         subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1122                                                ncacn_conn->ev_ctx,
1123                                                ncacn_conn->tstream);
1124         if (subreq == NULL) {
1125                 DEBUG(2, ("Failed to send ncacn packet\n"));
1126                 talloc_free(ncacn_conn);
1127                 return;
1128         }
1129
1130         tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1131
1132         DEBUG(10, ("dcerpc_ncacn_accept done\n"));
1133
1134         return;
1135 }
1136
1137 static void dcerpc_ncacn_packet_process(struct tevent_req *subreq)
1138 {
1139         struct dcerpc_ncacn_conn *ncacn_conn =
1140                 tevent_req_callback_data(subreq, struct dcerpc_ncacn_conn);
1141
1142         struct _output_data *out = &ncacn_conn->p->out_data;
1143         DATA_BLOB recv_buffer = data_blob_null;
1144         struct ncacn_packet *pkt;
1145         uint32_t to_send;
1146         NTSTATUS status;
1147         bool ok;
1148
1149         status = dcerpc_read_ncacn_packet_recv(subreq, ncacn_conn, &pkt, &recv_buffer);
1150         TALLOC_FREE(subreq);
1151         if (!NT_STATUS_IS_OK(status)) {
1152                 if (ncacn_conn->disconnect_fn != NULL) {
1153                         ok = ncacn_conn->disconnect_fn(ncacn_conn->p);
1154                         if (!ok) {
1155                                 DEBUG(3, ("Failed to call disconnect function\n"));
1156                         }
1157                 }
1158                 goto fail;
1159         }
1160
1161         /* dcerpc_read_ncacn_packet_recv() returns a full PDU */
1162         ncacn_conn->p->in_data.pdu_needed_len = 0;
1163         ncacn_conn->p->in_data.pdu = recv_buffer;
1164         if (dcerpc_get_endian_flag(&recv_buffer) & DCERPC_DREP_LE) {
1165                 ncacn_conn->p->endian = RPC_LITTLE_ENDIAN;
1166         } else {
1167                 ncacn_conn->p->endian = RPC_BIG_ENDIAN;
1168         }
1169         DEBUG(10, ("PDU is in %s Endian format!\n",
1170                    ncacn_conn->p->endian ? "Big" : "Little"));
1171         process_complete_pdu(ncacn_conn->p, pkt);
1172
1173         /* reset pipe state and free PDU */
1174         ncacn_conn->p->in_data.pdu.length = 0;
1175         talloc_free(recv_buffer.data);
1176         talloc_free(pkt);
1177
1178         /*
1179          * This is needed because of the way DCERPC binds work in the RPC
1180          * marshalling code
1181          */
1182         to_send = out->frag.length - out->current_pdu_sent;
1183         if (to_send > 0) {
1184
1185                 DEBUG(10, ("Current_pdu_len = %u, "
1186                            "current_pdu_sent = %u "
1187                            "Returning %u bytes\n",
1188                            (unsigned int)out->frag.length,
1189                            (unsigned int)out->current_pdu_sent,
1190                            (unsigned int)to_send));
1191
1192                 ncacn_conn->iov = talloc_zero(ncacn_conn, struct iovec);
1193                 if (ncacn_conn->iov == NULL) {
1194                         status = NT_STATUS_NO_MEMORY;
1195                         DEBUG(3, ("Out of memory!\n"));
1196                         goto fail;
1197                 }
1198                 ncacn_conn->count = 1;
1199
1200                 ncacn_conn->iov[0].iov_base = out->frag.data
1201                                             + out->current_pdu_sent;
1202                 ncacn_conn->iov[0].iov_len = to_send;
1203
1204                 out->current_pdu_sent += to_send;
1205         }
1206
1207         /*
1208          * This condition is false for bind packets, or when we haven't yet got
1209          * a full request, and need to wait for more data from the client
1210          */
1211         while (out->data_sent_length < out->rdata.length) {
1212                 ok = create_next_pdu(ncacn_conn->p);
1213                 if (!ok) {
1214                         DEBUG(3, ("Failed to create next PDU!\n"));
1215                         status = NT_STATUS_UNEXPECTED_IO_ERROR;
1216                         goto fail;
1217                 }
1218
1219                 ncacn_conn->iov = talloc_realloc(ncacn_conn,
1220                                                  ncacn_conn->iov,
1221                                                  struct iovec,
1222                                                  ncacn_conn->count + 1);
1223                 if (ncacn_conn->iov == NULL) {
1224                         DEBUG(3, ("Out of memory!\n"));
1225                         status = NT_STATUS_NO_MEMORY;
1226                         goto fail;
1227                 }
1228
1229                 ncacn_conn->iov[ncacn_conn->count].iov_base = out->frag.data;
1230                 ncacn_conn->iov[ncacn_conn->count].iov_len = out->frag.length;
1231
1232                 DEBUG(10, ("PDU number: %d, PDU Length: %u\n",
1233                            (unsigned int) ncacn_conn->count,
1234                            (unsigned int) ncacn_conn->iov[ncacn_conn->count].iov_len));
1235                 dump_data(11, (const uint8_t *) ncacn_conn->iov[ncacn_conn->count].iov_base,
1236                               ncacn_conn->iov[ncacn_conn->count].iov_len);
1237                 ncacn_conn->count++;
1238         }
1239
1240         /*
1241          * We still don't have a complete request, go back and wait for more
1242          * data.
1243          */
1244         if (ncacn_conn->count == 0) {
1245                 /* Wait for the next packet */
1246                 subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1247                                                        ncacn_conn->ev_ctx,
1248                                                        ncacn_conn->tstream);
1249                 if (subreq == NULL) {
1250                         DEBUG(2, ("Failed to start receving packets\n"));
1251                         status = NT_STATUS_NO_MEMORY;
1252                         goto fail;
1253                 }
1254                 tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1255                 return;
1256         }
1257
1258         DEBUG(10, ("Sending a total of %u bytes\n",
1259                    (unsigned int)ncacn_conn->p->out_data.data_sent_length));
1260
1261         subreq = tstream_writev_queue_send(ncacn_conn,
1262                                            ncacn_conn->ev_ctx,
1263                                            ncacn_conn->tstream,
1264                                            ncacn_conn->send_queue,
1265                                            ncacn_conn->iov,
1266                                            ncacn_conn->count);
1267         if (subreq == NULL) {
1268                 DEBUG(2, ("Failed to send packet\n"));
1269                 status = NT_STATUS_NO_MEMORY;
1270                 goto fail;
1271         }
1272
1273         tevent_req_set_callback(subreq, dcerpc_ncacn_packet_done, ncacn_conn);
1274         return;
1275
1276 fail:
1277         DEBUG(3, ("Terminating client(%s) connection! - '%s'\n",
1278                   ncacn_conn->client_name, nt_errstr(status)));
1279
1280         /* Terminate client connection */
1281         talloc_free(ncacn_conn);
1282         return;
1283 }
1284
1285 static void dcerpc_ncacn_packet_done(struct tevent_req *subreq)
1286 {
1287         struct dcerpc_ncacn_conn *ncacn_conn =
1288                 tevent_req_callback_data(subreq, struct dcerpc_ncacn_conn);
1289         NTSTATUS status = NT_STATUS_OK;
1290         int sys_errno;
1291         int rc;
1292
1293         rc = tstream_writev_queue_recv(subreq, &sys_errno);
1294         TALLOC_FREE(subreq);
1295         if (rc < 0) {
1296                 DEBUG(2, ("Writev failed!\n"));
1297                 status = map_nt_error_from_unix(sys_errno);
1298                 goto fail;
1299         }
1300
1301         if (ncacn_conn->p->fault_state != 0) {
1302                 DEBUG(2, ("Disconnect after fault\n"));
1303                 sys_errno = EINVAL;
1304                 goto fail;
1305         }
1306
1307         /* clear out any data that may have been left around */
1308         ncacn_conn->count = 0;
1309         TALLOC_FREE(ncacn_conn->iov);
1310         data_blob_free(&ncacn_conn->p->in_data.data);
1311         data_blob_free(&ncacn_conn->p->out_data.frag);
1312         data_blob_free(&ncacn_conn->p->out_data.rdata);
1313
1314         talloc_free_children(ncacn_conn->p->mem_ctx);
1315
1316         /* Wait for the next packet */
1317         subreq = dcerpc_read_ncacn_packet_send(ncacn_conn,
1318                                                ncacn_conn->ev_ctx,
1319                                                ncacn_conn->tstream);
1320         if (subreq == NULL) {
1321                 DEBUG(2, ("Failed to start receving packets\n"));
1322                 status = NT_STATUS_NO_MEMORY;
1323                 goto fail;
1324         }
1325
1326         tevent_req_set_callback(subreq, dcerpc_ncacn_packet_process, ncacn_conn);
1327         return;
1328
1329 fail:
1330         DEBUG(3, ("Terminating client(%s) connection! - '%s'\n",
1331                   ncacn_conn->client_name, nt_errstr(status)));
1332
1333         /* Terminate client connection */
1334         talloc_free(ncacn_conn);
1335         return;
1336 }
1337
1338 /* vim: set ts=8 sw=8 noet cindent syntax=c.doxygen: */