*/
#include "includes.h"
+#include "system/passwd.h" /* uid_wrapper */
#include "../librpc/gen_ndr/ndr_lsa.h"
#include "../librpc/gen_ndr/ndr_samr.h"
+#include "auth.h"
+#include "rpc_server/rpc_pipes.h"
+#include "../libcli/security/security.h"
+#include "lib/tsocket/tsocket.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_RPC_SRV
-/*
- * Handle database - stored per pipe.
+static struct pipes_struct *InternalPipes;
+
+/* TODO
+ * the following prototypes are declared here to avoid
+ * code being moved about too much for a patch to be
+ * disrupted / less obvious.
+ *
+ * these functions, and associated functions that they
+ * call, should be moved behind a .so module-loading
+ * system _anyway_. so that's the next step...
*/
-struct policy {
- struct policy *next, *prev;
+int make_base_pipes_struct(TALLOC_CTX *mem_ctx,
+ struct messaging_context *msg_ctx,
+ const char *pipe_name,
+ enum dcerpc_transport_t transport,
+ bool endian, bool ncalrpc_as_system,
+ const struct tsocket_address *remote_address,
+ const struct tsocket_address *local_address,
+ struct pipes_struct **_p)
+{
+ struct pipes_struct *p;
+
+ p = talloc_zero(mem_ctx, struct pipes_struct);
+ if (!p) {
+ return ENOMEM;
+ }
- struct policy_handle pol_hnd;
+ p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p);
+ if (!p->mem_ctx) {
+ talloc_free(p);
+ return ENOMEM;
+ }
- uint32_t access_granted;
+ p->msg_ctx = msg_ctx;
+ p->transport = transport;
+ p->endian = endian;
+ p->ncalrpc_as_system = ncalrpc_as_system;
+
+ p->remote_address = tsocket_address_copy(remote_address, p);
+ if (p->remote_address == NULL) {
+ talloc_free(p);
+ return ENOMEM;
+ }
+
+ if (local_address) {
+ p->local_address = tsocket_address_copy(local_address, p);
+ if (p->local_address == NULL) {
+ talloc_free(p);
+ return ENOMEM;
+ }
+ }
+
+ DLIST_ADD(InternalPipes, p);
+ talloc_set_destructor(p, close_internal_rpc_pipe_hnd);
+
+ *_p = p;
+ return 0;
+}
+
+
+bool check_open_pipes(void)
+{
+ struct pipes_struct *p;
+
+ for (p = InternalPipes; p != NULL; p = p->next) {
+ if (num_pipe_handles(p) != 0) {
+ return true;
+ }
+ }
+ return false;
+}
+
+/****************************************************************************
+ Close an rpc pipe.
+****************************************************************************/
+
+int close_internal_rpc_pipe_hnd(struct pipes_struct *p)
+{
+ if (!p) {
+ DEBUG(0,("Invalid pipe in close_internal_rpc_pipe_hnd\n"));
+ return False;
+ }
- void *data_ptr;
+ /* Free the handles database. */
+ close_policy_by_pipe(p);
+
+ DLIST_REMOVE(InternalPipes, p);
+
+ return 0;
+}
+
+/*
+ * Handle database - stored per pipe.
+ */
+
+struct dcesrv_handle {
+ struct dcesrv_handle *prev, *next;
+ struct policy_handle wire_handle;
+ uint32_t access_granted;
+ void *data;
};
struct handle_list {
- struct policy *Policy; /* List of policies. */
+ struct dcesrv_handle *handles; /* List of pipe handles. */
size_t count; /* Current number of handles. */
- size_t pipe_ref_count; /* Number of pipe handles referring to this list. */
+ size_t pipe_ref_count; /* Number of pipe handles referring
+ * to this tree. */
};
/* This is the max handles across all instances of a pipe name. */
|| ndr_syntax_id_equal(syntax, &ndr_table_lsarpc.syntax_id));
}
-size_t num_pipe_handles(struct handle_list *list)
+size_t num_pipe_handles(struct pipes_struct *p)
{
- if (list == NULL) {
+ if (p->pipe_handles == NULL) {
return 0;
}
- return list->count;
+ return p->pipe_handles->count;
}
/****************************************************************************
pipes of the same name.
****************************************************************************/
-bool init_pipe_handle_list(pipes_struct *p, const struct ndr_syntax_id *syntax)
+bool init_pipe_handles(struct pipes_struct *p, const struct ndr_syntax_id *syntax)
{
- pipes_struct *plist;
+ struct pipes_struct *plist;
struct handle_list *hl;
- for (plist = get_first_internal_pipe();
- plist;
- plist = get_next_internal_pipe(plist)) {
- if (ndr_syntax_id_equal(syntax, &plist->syntax)) {
- break;
+ for (plist = InternalPipes; plist; plist = plist->next) {
+ struct pipe_rpc_fns *p_ctx;
+ bool stop = false;
+
+ for (p_ctx = plist->contexts;
+ p_ctx != NULL;
+ p_ctx = p_ctx->next) {
+ if (ndr_syntax_id_equal(syntax, &p_ctx->syntax)) {
+ stop = true;
+ break;
+ }
+ if (is_samr_lsa_pipe(&p_ctx->syntax)
+ && is_samr_lsa_pipe(syntax)) {
+ /*
+ * samr and lsa share a handle space (same process
+ * under Windows?)
+ */
+ stop = true;
+ break;
+ }
}
- if (is_samr_lsa_pipe(&plist->syntax)
- && is_samr_lsa_pipe(syntax)) {
- /*
- * samr and lsa share a handle space (same process
- * under Windows?)
- */
+
+ if (stop) {
break;
}
}
/*
* First open, we have to create the handle list
*/
- hl = SMB_MALLOC_P(struct handle_list);
+ hl = talloc_zero(NULL, struct handle_list);
if (hl == NULL) {
return false;
}
- ZERO_STRUCTP(hl);
DEBUG(10,("init_pipe_handle_list: created handle list for "
"pipe %s\n",
data_ptr is TALLOC_FREE()'ed
****************************************************************************/
-static struct policy *create_policy_hnd_internal(pipes_struct *p,
- struct policy_handle *hnd,
- void *data_ptr)
+static struct dcesrv_handle *create_rpc_handle_internal(struct pipes_struct *p,
+ struct policy_handle *hnd, void *data_ptr)
{
+ struct dcesrv_handle *rpc_hnd;
static uint32 pol_hnd_low = 0;
static uint32 pol_hnd_high = 0;
time_t t = time(NULL);
- struct policy *pol;
-
if (p->pipe_handles->count > MAX_OPEN_POLS) {
DEBUG(0,("create_policy_hnd: ERROR: too many handles (%d) on this pipe.\n",
(int)p->pipe_handles->count));
return NULL;
}
- pol = TALLOC_ZERO_P(NULL, struct policy);
- if (!pol) {
+ rpc_hnd = talloc_zero(p->pipe_handles, struct dcesrv_handle);
+ if (!rpc_hnd) {
DEBUG(0,("create_policy_hnd: ERROR: out of memory!\n"));
return NULL;
}
if (data_ptr != NULL) {
- pol->data_ptr = talloc_move(pol, &data_ptr);
+ rpc_hnd->data = talloc_move(rpc_hnd, &data_ptr);
}
pol_hnd_low++;
- if (pol_hnd_low == 0)
- (pol_hnd_high)++;
+ if (pol_hnd_low == 0) {
+ pol_hnd_high++;
+ }
- SIVAL(&pol->pol_hnd.handle_type, 0 , 0); /* first bit must be null */
- SIVAL(&pol->pol_hnd.uuid.time_low, 0 , pol_hnd_low ); /* second bit is incrementing */
- SSVAL(&pol->pol_hnd.uuid.time_mid, 0 , pol_hnd_high); /* second bit is incrementing */
- SSVAL(&pol->pol_hnd.uuid.time_hi_and_version, 0 , (pol_hnd_high>>16)); /* second bit is incrementing */
+ /* first bit must be null */
+ SIVAL(&rpc_hnd->wire_handle.handle_type, 0 , 0);
- /* split the current time into two 16 bit values */
+ /* second bit is incrementing */
+ SIVAL(&rpc_hnd->wire_handle.uuid.time_low, 0 , pol_hnd_low);
+ SSVAL(&rpc_hnd->wire_handle.uuid.time_mid, 0 , pol_hnd_high);
+ SSVAL(&rpc_hnd->wire_handle.uuid.time_hi_and_version, 0, (pol_hnd_high >> 16));
- SSVAL(pol->pol_hnd.uuid.clock_seq, 0, (t>>16)); /* something random */
- SSVAL(pol->pol_hnd.uuid.node, 0, t); /* something random */
+ /* split the current time into two 16 bit values */
- SIVAL(pol->pol_hnd.uuid.node, 2, sys_getpid()); /* something more random */
+ /* something random */
+ SSVAL(rpc_hnd->wire_handle.uuid.clock_seq, 0, (t >> 16));
+ /* something random */
+ SSVAL(rpc_hnd->wire_handle.uuid.node, 0, t);
+ /* something more random */
+ SIVAL(rpc_hnd->wire_handle.uuid.node, 2, getpid());
- DLIST_ADD(p->pipe_handles->Policy, pol);
+ DLIST_ADD(p->pipe_handles->handles, rpc_hnd);
p->pipe_handles->count++;
- *hnd = pol->pol_hnd;
-
- DEBUG(4,("Opened policy hnd[%d] ", (int)p->pipe_handles->count));
- dump_data(4, (uint8 *)hnd, sizeof(*hnd));
+ *hnd = rpc_hnd->wire_handle;
+
+ DEBUG(6, ("Opened policy hnd[%d] ", (int)p->pipe_handles->count));
+ dump_data(6, (uint8_t *)hnd, sizeof(*hnd));
- return pol;
+ return rpc_hnd;
}
-bool create_policy_hnd(pipes_struct *p, struct policy_handle *hnd,
+bool create_policy_hnd(struct pipes_struct *p, struct policy_handle *hnd,
void *data_ptr)
{
- return create_policy_hnd_internal(p, hnd, data_ptr) != NULL;
+ struct dcesrv_handle *rpc_hnd;
+
+ rpc_hnd = create_rpc_handle_internal(p, hnd, data_ptr);
+ if (rpc_hnd == NULL) {
+ return false;
+ }
+ return true;
}
/****************************************************************************
find policy by handle - internal version.
****************************************************************************/
-static struct policy *find_policy_by_hnd_internal(pipes_struct *p,
- const struct policy_handle *hnd,
- void **data_p)
+static struct dcesrv_handle *find_policy_by_hnd_internal(struct pipes_struct *p,
+ const struct policy_handle *hnd, void **data_p)
{
- struct policy *pol;
- size_t i;
+ struct dcesrv_handle *h;
+ unsigned int count;
- if (data_p)
+ if (data_p) {
*data_p = NULL;
+ }
- for (i = 0, pol=p->pipe_handles->Policy;pol;pol=pol->next, i++) {
- if (memcmp(&pol->pol_hnd, hnd, sizeof(*hnd)) == 0) {
- DEBUG(4,("Found policy hnd[%d] ", (int)i));
- dump_data(4, (uint8 *)hnd, sizeof(*hnd));
- if (data_p)
- *data_p = pol->data_ptr;
- return pol;
+ count = 0;
+ for (h = p->pipe_handles->handles; h != NULL; h = h->next) {
+ if (memcmp(&h->wire_handle, hnd, sizeof(*hnd)) == 0) {
+ DEBUG(6,("Found policy hnd[%u] ", count));
+ dump_data(6, (const uint8 *)hnd, sizeof(*hnd));
+ if (data_p) {
+ *data_p = h->data;
+ }
+ return h;
}
+ count++;
}
DEBUG(4,("Policy not found: "));
- dump_data(4, (uint8 *)hnd, sizeof(*hnd));
+ dump_data(4, (const uint8_t *)hnd, sizeof(*hnd));
- p->bad_handle_fault_state = True;
+ p->bad_handle_fault_state = true;
return NULL;
}
find policy by handle
****************************************************************************/
-bool find_policy_by_hnd(pipes_struct *p, const struct policy_handle *hnd,
+bool find_policy_by_hnd(struct pipes_struct *p, const struct policy_handle *hnd,
void **data_p)
{
- return find_policy_by_hnd_internal(p, hnd, data_p) == NULL ? False : True;
+ struct dcesrv_handle *rpc_hnd;
+
+ rpc_hnd = find_policy_by_hnd_internal(p, hnd, data_p);
+ if (rpc_hnd == NULL) {
+ return false;
+ }
+ return true;
}
/****************************************************************************
Close a policy.
****************************************************************************/
-bool close_policy_hnd(pipes_struct *p, struct policy_handle *hnd)
+bool close_policy_hnd(struct pipes_struct *p, struct policy_handle *hnd)
{
- struct policy *pol = find_policy_by_hnd_internal(p, hnd, NULL);
+ struct dcesrv_handle *rpc_hnd;
- if (!pol) {
- DEBUG(3,("Error closing policy\n"));
- return False;
+ rpc_hnd = find_policy_by_hnd_internal(p, hnd, NULL);
+
+ if (rpc_hnd == NULL) {
+ DEBUG(3, ("Error closing policy (policy not found)\n"));
+ return false;
}
- DEBUG(3,("Closed policy\n"));
+ DEBUG(6,("Closed policy\n"));
p->pipe_handles->count--;
- DLIST_REMOVE(p->pipe_handles->Policy, pol);
-
- TALLOC_FREE(pol);
+ DLIST_REMOVE(p->pipe_handles->handles, rpc_hnd);
+ TALLOC_FREE(rpc_hnd);
- return True;
+ return true;
}
/****************************************************************************
- Close a pipe - free the handle list if it was the last pipe reference.
+ Close a pipe - free the handle set if it was the last pipe reference.
****************************************************************************/
-void close_policy_by_pipe(pipes_struct *p)
+void close_policy_by_pipe(struct pipes_struct *p)
{
+ if (p->pipe_handles == NULL) {
+ return;
+ }
+
p->pipe_handles->pipe_ref_count--;
if (p->pipe_handles->pipe_ref_count == 0) {
/*
* Last pipe open on this list - free the list.
*/
- while (p->pipe_handles->Policy)
- close_policy_hnd(p, &p->pipe_handles->Policy->pol_hnd);
-
- p->pipe_handles->Policy = NULL;
- p->pipe_handles->count = 0;
+ TALLOC_FREE(p->pipe_handles);
- SAFE_FREE(p->pipe_handles);
- DEBUG(10,("close_policy_by_pipe: deleted handle list for "
- "pipe %s\n",
- get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
+ DEBUG(10,("Deleted handle list for RPC connection %s\n",
+ get_pipe_name_from_syntax(talloc_tos(),
+ &p->contexts->syntax)));
}
}
token has enough access to access the pipe.
********************************************************************/
-bool pipe_access_check(pipes_struct *p)
+bool pipe_access_check(struct pipes_struct *p)
{
/* Don't let anonymous users access this RPC if restrict
anonymous > 0 */
if (lp_restrict_anonymous() > 0) {
/* schannel, so we must be ok */
- if (p->pipe_bound && (p->auth.auth_type == PIPE_AUTH_TYPE_SCHANNEL)) {
+ if (p->pipe_bound &&
+ (p->auth.auth_type == DCERPC_AUTH_TYPE_SCHANNEL)) {
return True;
}
- if (p->server_info->guest) {
+ if (security_session_user_level(p->session_info, NULL) < SECURITY_USER) {
return False;
}
}
uint32_t access_granted, size_t data_size,
const char *type, NTSTATUS *pstatus)
{
- struct policy *pol;
+ struct dcesrv_handle *rpc_hnd;
void *data;
if (p->pipe_handles->count > MAX_OPEN_POLS) {
- DEBUG(0, ("policy_handle_create: ERROR: too many handles (%d) "
- "on pipe %s.\n", (int)p->pipe_handles->count,
- get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
+ DEBUG(0, ("ERROR: Too many handles (%d) for RPC connection %s\n",
+ (int) p->pipe_handles->count,
+ get_pipe_name_from_syntax(talloc_tos(),
+ &p->contexts->syntax)));
*pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
return NULL;
}
}
talloc_set_name_const(data, type);
- pol = create_policy_hnd_internal(p, hnd, data);
- if (pol == NULL) {
+ rpc_hnd = create_rpc_handle_internal(p, hnd, data);
+ if (rpc_hnd == NULL) {
TALLOC_FREE(data);
*pstatus = NT_STATUS_NO_MEMORY;
return NULL;
}
- pol->access_granted = access_granted;
+ rpc_hnd->access_granted = access_granted;
*pstatus = NT_STATUS_OK;
return data;
}
const char *name, const char *location,
NTSTATUS *pstatus)
{
- struct policy *pol;
+ struct dcesrv_handle *rpc_hnd;
void *data;
- pol = find_policy_by_hnd_internal(p, hnd, &data);
- if (pol == NULL) {
+ rpc_hnd = find_policy_by_hnd_internal(p, hnd, &data);
+ if (rpc_hnd == NULL) {
*pstatus = NT_STATUS_INVALID_HANDLE;
return NULL;
}
*pstatus = NT_STATUS_INVALID_HANDLE;
return NULL;
}
- if ((access_required & pol->access_granted) != access_required) {
+ if ((access_required & rpc_hnd->access_granted) != access_required) {
if (geteuid() == sec_initial_uid()) {
DEBUG(4, ("%s: ACCESS should be DENIED (granted: "
"%#010x; required: %#010x)\n", location,
- pol->access_granted, access_required));
+ rpc_hnd->access_granted, access_required));
DEBUGADD(4,("but overwritten by euid == 0\n"));
goto okay;
}
DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: "
- "%#010x)\n", location, pol->access_granted,
+ "%#010x)\n", location, rpc_hnd->access_granted,
access_required));
*pstatus = NT_STATUS_ACCESS_DENIED;
return NULL;
okay:
DEBUG(10, ("found handle of type %s\n", talloc_get_name(data)));
if (paccess_granted != NULL) {
- *paccess_granted = pol->access_granted;
+ *paccess_granted = rpc_hnd->access_granted;
}
*pstatus = NT_STATUS_OK;
return data;
git.samba.org / kai / samba.git / blobdiff