2 Unix SMB/CIFS implementation.
4 smbd-specific dcerpc server code
6 Copyright (C) Andrew Tridgell 2003-2005
7 Copyright (C) Stefan (metze) Metzmacher 2004-2005
8 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2004,2007
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "librpc/gen_ndr/ndr_dcerpc.h"
26 #include "auth/auth.h"
27 #include "../lib/util/dlinklist.h"
28 #include "rpc_server/dcerpc_server.h"
29 #include "rpc_server/dcerpc_server_proto.h"
30 #include "system/filesys.h"
31 #include "lib/messaging/irpc.h"
32 #include "system/network.h"
33 #include "lib/socket/netif.h"
34 #include "param/param.h"
35 #include "../lib/tsocket/tsocket.h"
36 #include "librpc/rpc/dcerpc_proto.h"
37 #include "../lib/util/tevent_ntstatus.h"
38 #include "libcli/raw/smb.h"
39 #include "../libcli/named_pipe_auth/npa_tstream.h"
40 #include "smbd/process_model.h"
42 struct dcesrv_socket_context {
43 const struct dcesrv_endpoint *endpoint;
44 struct dcesrv_context *dcesrv_ctx;
47 static void dcesrv_terminate_connection(struct dcesrv_connection *dce_conn, const char *reason)
49 struct stream_connection *srv_conn;
50 srv_conn = talloc_get_type(dce_conn->transport.private_data,
51 struct stream_connection);
53 stream_terminate_connection(srv_conn, reason);
56 static void dcesrv_sock_reply_done(struct tevent_req *subreq);
58 struct dcesrv_sock_reply_state {
59 struct dcesrv_connection *dce_conn;
60 struct dcesrv_call_state *call;
64 static void dcesrv_sock_report_output_data(struct dcesrv_connection *dce_conn)
66 struct dcesrv_call_state *call;
68 call = dce_conn->call_list;
69 if (!call || !call->replies) {
73 while (call->replies) {
74 struct data_blob_list_item *rep = call->replies;
75 struct dcesrv_sock_reply_state *substate;
76 struct tevent_req *subreq;
78 substate = talloc(call, struct dcesrv_sock_reply_state);
80 dcesrv_terminate_connection(dce_conn, "no memory");
84 substate->dce_conn = dce_conn;
85 substate->call = NULL;
87 DLIST_REMOVE(call->replies, rep);
89 if (call->replies == NULL) {
90 substate->call = call;
93 substate->iov.iov_base = rep->blob.data;
94 substate->iov.iov_len = rep->blob.length;
96 subreq = tstream_writev_queue_send(substate,
102 dcesrv_terminate_connection(dce_conn, "no memory");
105 tevent_req_set_callback(subreq, dcesrv_sock_reply_done,
109 DLIST_REMOVE(call->conn->call_list, call);
110 call->list = DCESRV_LIST_NONE;
113 static void dcesrv_sock_reply_done(struct tevent_req *subreq)
115 struct dcesrv_sock_reply_state *substate = tevent_req_callback_data(subreq,
116 struct dcesrv_sock_reply_state);
120 struct dcesrv_call_state *call = substate->call;
122 ret = tstream_writev_queue_recv(subreq, &sys_errno);
125 status = map_nt_error_from_unix(sys_errno);
126 dcesrv_terminate_connection(substate->dce_conn, nt_errstr(status));
130 talloc_free(substate);
136 static struct socket_address *dcesrv_sock_get_my_addr(struct dcesrv_connection *dcesrv_conn, TALLOC_CTX *mem_ctx)
138 struct stream_connection *srv_conn;
139 srv_conn = talloc_get_type(dcesrv_conn->transport.private_data,
140 struct stream_connection);
142 return socket_get_my_addr(srv_conn->socket, mem_ctx);
145 static struct socket_address *dcesrv_sock_get_peer_addr(struct dcesrv_connection *dcesrv_conn, TALLOC_CTX *mem_ctx)
147 struct stream_connection *srv_conn;
148 srv_conn = talloc_get_type(dcesrv_conn->transport.private_data,
149 struct stream_connection);
151 return socket_get_peer_addr(srv_conn->socket, mem_ctx);
154 struct dcerpc_read_ncacn_packet_state {
156 struct smb_iconv_convenience *smb_iconv_c;
159 struct ncacn_packet *pkt;
162 static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream,
165 struct iovec **_vector,
167 static void dcerpc_read_ncacn_packet_done(struct tevent_req *subreq);
169 static struct tevent_req *dcerpc_read_ncacn_packet_send(TALLOC_CTX *mem_ctx,
170 struct tevent_context *ev,
171 struct tstream_context *stream,
172 struct smb_iconv_convenience *ic)
174 struct tevent_req *req;
175 struct dcerpc_read_ncacn_packet_state *state;
176 struct tevent_req *subreq;
178 req = tevent_req_create(mem_ctx, &state,
179 struct dcerpc_read_ncacn_packet_state);
184 state->caller.smb_iconv_c = ic;
185 state->buffer = data_blob_const(NULL, 0);
186 state->pkt = talloc(state, struct ncacn_packet);
187 if (tevent_req_nomem(state->pkt, req)) {
191 subreq = tstream_readv_pdu_send(state, ev,
193 dcerpc_read_ncacn_packet_next_vector,
195 if (tevent_req_nomem(subreq, req)) {
198 tevent_req_set_callback(subreq, dcerpc_read_ncacn_packet_done, req);
202 tevent_req_post(req, ev);
206 static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream,
209 struct iovec **_vector,
212 struct dcerpc_read_ncacn_packet_state *state =
213 talloc_get_type_abort(private_data,
214 struct dcerpc_read_ncacn_packet_state);
215 struct iovec *vector;
218 if (state->buffer.length == 0) {
219 /* first get enough to read the fragment length */
221 state->buffer.length = DCERPC_FRAG_LEN_OFFSET + 2;
222 state->buffer.data = talloc_array(state, uint8_t,
223 state->buffer.length);
224 if (!state->buffer.data) {
227 } else if (state->buffer.length == (DCERPC_FRAG_LEN_OFFSET + 2)) {
228 /* now read the fragment length and allocate the full buffer */
229 size_t frag_len = dcerpc_get_frag_length(&state->buffer);
231 ofs = state->buffer.length;
233 state->buffer.data = talloc_realloc(state,
236 if (!state->buffer.data) {
239 state->buffer.length = frag_len;
241 /* if we reach this we have a full fragment */
247 /* now create the vector that we want to be filled */
248 vector = talloc_array(mem_ctx, struct iovec, 1);
253 vector[0].iov_base = state->buffer.data + ofs;
254 vector[0].iov_len = state->buffer.length - ofs;
261 static void dcerpc_read_ncacn_packet_done(struct tevent_req *subreq)
263 struct tevent_req *req = tevent_req_callback_data(subreq,
265 struct dcerpc_read_ncacn_packet_state *state = tevent_req_data(req,
266 struct dcerpc_read_ncacn_packet_state);
269 struct ndr_pull *ndr;
270 enum ndr_err_code ndr_err;
273 ret = tstream_readv_pdu_recv(subreq, &sys_errno);
276 status = map_nt_error_from_unix(sys_errno);
277 tevent_req_nterror(req, status);
281 ndr = ndr_pull_init_blob(&state->buffer,
283 state->caller.smb_iconv_c);
284 if (tevent_req_nomem(ndr, req)) {
288 if (!(CVAL(ndr->data, DCERPC_DREP_OFFSET) & DCERPC_DREP_LE)) {
289 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
292 if (CVAL(ndr->data, DCERPC_PFC_OFFSET) & DCERPC_PFC_FLAG_OBJECT_UUID) {
293 ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
296 ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, state->pkt);
298 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
299 status = ndr_map_error2ntstatus(ndr_err);
300 tevent_req_nterror(req, status);
304 tevent_req_done(req);
307 static NTSTATUS dcerpc_read_ncacn_packet_recv(struct tevent_req *req,
309 struct ncacn_packet **pkt,
312 struct dcerpc_read_ncacn_packet_state *state = tevent_req_data(req,
313 struct dcerpc_read_ncacn_packet_state);
316 if (tevent_req_is_nterror(req, &status)) {
317 tevent_req_received(req);
321 *pkt = talloc_move(mem_ctx, &state->pkt);
323 buffer->data = talloc_move(mem_ctx, &state->buffer.data);
324 buffer->length = state->buffer.length;
327 tevent_req_received(req);
331 static void dcesrv_read_fragment_done(struct tevent_req *subreq);
333 static void dcesrv_sock_accept(struct stream_connection *srv_conn)
336 struct dcesrv_socket_context *dcesrv_sock =
337 talloc_get_type(srv_conn->private_data, struct dcesrv_socket_context);
338 struct dcesrv_connection *dcesrv_conn = NULL;
340 struct tevent_req *subreq;
341 struct loadparm_context *lp_ctx = dcesrv_sock->dcesrv_ctx->lp_ctx;
343 if (!srv_conn->session_info) {
344 status = auth_anonymous_session_info(srv_conn,
347 &srv_conn->session_info);
348 if (!NT_STATUS_IS_OK(status)) {
349 DEBUG(0,("dcesrv_sock_accept: auth_anonymous_session_info failed: %s\n",
351 stream_terminate_connection(srv_conn, nt_errstr(status));
356 status = dcesrv_endpoint_connect(dcesrv_sock->dcesrv_ctx,
358 dcesrv_sock->endpoint,
359 srv_conn->session_info,
363 DCESRV_CALL_STATE_FLAG_MAY_ASYNC,
365 if (!NT_STATUS_IS_OK(status)) {
366 DEBUG(0,("dcesrv_sock_accept: dcesrv_endpoint_connect failed: %s\n",
368 stream_terminate_connection(srv_conn, nt_errstr(status));
372 dcesrv_conn->transport.private_data = srv_conn;
373 dcesrv_conn->transport.report_output_data = dcesrv_sock_report_output_data;
374 dcesrv_conn->transport.get_my_addr = dcesrv_sock_get_my_addr;
375 dcesrv_conn->transport.get_peer_addr = dcesrv_sock_get_peer_addr;
377 TALLOC_FREE(srv_conn->event.fde);
379 dcesrv_conn->send_queue = tevent_queue_create(dcesrv_conn, "dcesrv send queue");
380 if (!dcesrv_conn->send_queue) {
381 status = NT_STATUS_NO_MEMORY;
382 DEBUG(0,("dcesrv_sock_accept: tevent_queue_create(%s)\n",
384 stream_terminate_connection(srv_conn, nt_errstr(status));
388 if (dcesrv_sock->endpoint->ep_description->transport == NCACN_NP) {
389 dcesrv_conn->auth_state.session_key = dcesrv_inherited_session_key;
390 ret = tstream_npa_existing_socket(dcesrv_conn,
391 socket_get_fd(srv_conn->socket),
392 FILE_TYPE_MESSAGE_MODE_PIPE,
393 &dcesrv_conn->stream);
395 ret = tstream_bsd_existing_socket(dcesrv_conn,
396 socket_get_fd(srv_conn->socket),
397 &dcesrv_conn->stream);
400 status = map_nt_error_from_unix(errno);
401 DEBUG(0,("dcesrv_sock_accept: failed to setup tstream: %s\n",
403 stream_terminate_connection(srv_conn, nt_errstr(status));
407 srv_conn->private_data = dcesrv_conn;
409 irpc_add_name(srv_conn->msg_ctx, "rpc_server");
411 subreq = dcerpc_read_ncacn_packet_send(dcesrv_conn,
412 dcesrv_conn->event_ctx,
414 lp_iconv_convenience(lp_ctx));
416 status = NT_STATUS_NO_MEMORY;
417 DEBUG(0,("dcesrv_sock_accept: dcerpc_read_fragment_buffer_send(%s)\n",
419 stream_terminate_connection(srv_conn, nt_errstr(status));
422 tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dcesrv_conn);
427 static void dcesrv_read_fragment_done(struct tevent_req *subreq)
429 struct dcesrv_connection *dce_conn = tevent_req_callback_data(subreq,
430 struct dcesrv_connection);
431 struct ncacn_packet *pkt;
434 struct loadparm_context *lp_ctx = dce_conn->dce_ctx->lp_ctx;
436 status = dcerpc_read_ncacn_packet_recv(subreq, dce_conn,
439 if (!NT_STATUS_IS_OK(status)) {
440 dcesrv_terminate_connection(dce_conn, nt_errstr(status));
444 status = dcesrv_process_ncacn_packet(dce_conn, pkt, buffer);
445 if (!NT_STATUS_IS_OK(status)) {
446 dcesrv_terminate_connection(dce_conn, nt_errstr(status));
450 subreq = dcerpc_read_ncacn_packet_send(dce_conn,
453 lp_iconv_convenience(lp_ctx));
455 status = NT_STATUS_NO_MEMORY;
456 dcesrv_terminate_connection(dce_conn, nt_errstr(status));
459 tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dce_conn);
462 static void dcesrv_sock_recv(struct stream_connection *conn, uint16_t flags)
464 struct dcesrv_connection *dce_conn = talloc_get_type(conn->private_data,
465 struct dcesrv_connection);
466 dcesrv_terminate_connection(dce_conn, "dcesrv_sock_recv triggered");
469 static void dcesrv_sock_send(struct stream_connection *conn, uint16_t flags)
471 struct dcesrv_connection *dce_conn = talloc_get_type(conn->private_data,
472 struct dcesrv_connection);
473 dcesrv_terminate_connection(dce_conn, "dcesrv_sock_send triggered");
477 static const struct stream_server_ops dcesrv_stream_ops = {
479 .accept_connection = dcesrv_sock_accept,
480 .recv_handler = dcesrv_sock_recv,
481 .send_handler = dcesrv_sock_send,
486 static NTSTATUS dcesrv_add_ep_unix(struct dcesrv_context *dce_ctx,
487 struct loadparm_context *lp_ctx,
488 struct dcesrv_endpoint *e,
489 struct tevent_context *event_ctx, const struct model_ops *model_ops)
491 struct dcesrv_socket_context *dcesrv_sock;
495 dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
496 NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
498 /* remember the endpoint of this socket */
499 dcesrv_sock->endpoint = e;
500 dcesrv_sock->dcesrv_ctx = talloc_reference(dcesrv_sock, dce_ctx);
502 status = stream_setup_socket(event_ctx, lp_ctx,
503 model_ops, &dcesrv_stream_ops,
504 "unix", e->ep_description->endpoint, &port,
505 lp_socket_options(lp_ctx),
507 if (!NT_STATUS_IS_OK(status)) {
508 DEBUG(0,("service_setup_stream_socket(path=%s) failed - %s\n",
509 e->ep_description->endpoint, nt_errstr(status)));
515 static NTSTATUS dcesrv_add_ep_ncalrpc(struct dcesrv_context *dce_ctx,
516 struct loadparm_context *lp_ctx,
517 struct dcesrv_endpoint *e,
518 struct tevent_context *event_ctx, const struct model_ops *model_ops)
520 struct dcesrv_socket_context *dcesrv_sock;
525 if (!e->ep_description->endpoint) {
526 /* No identifier specified: use DEFAULT.
527 * DO NOT hardcode this value anywhere else. Rather, specify
528 * no endpoint and let the epmapper worry about it. */
529 e->ep_description->endpoint = talloc_strdup(dce_ctx, "DEFAULT");
532 full_path = talloc_asprintf(dce_ctx, "%s/%s", lp_ncalrpc_dir(lp_ctx),
533 e->ep_description->endpoint);
535 dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
536 NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
538 /* remember the endpoint of this socket */
539 dcesrv_sock->endpoint = e;
540 dcesrv_sock->dcesrv_ctx = talloc_reference(dcesrv_sock, dce_ctx);
542 status = stream_setup_socket(event_ctx, lp_ctx,
543 model_ops, &dcesrv_stream_ops,
544 "unix", full_path, &port,
545 lp_socket_options(lp_ctx),
547 if (!NT_STATUS_IS_OK(status)) {
548 DEBUG(0,("service_setup_stream_socket(identifier=%s,path=%s) failed - %s\n",
549 e->ep_description->endpoint, full_path, nt_errstr(status)));
554 static NTSTATUS dcesrv_add_ep_np(struct dcesrv_context *dce_ctx,
555 struct loadparm_context *lp_ctx,
556 struct dcesrv_endpoint *e,
557 struct tevent_context *event_ctx, const struct model_ops *model_ops)
559 struct dcesrv_socket_context *dcesrv_sock;
562 if (e->ep_description->endpoint == NULL) {
563 DEBUG(0, ("Endpoint mandatory for named pipes\n"));
564 return NT_STATUS_INVALID_PARAMETER;
567 dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
568 NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
570 /* remember the endpoint of this socket */
571 dcesrv_sock->endpoint = e;
572 dcesrv_sock->dcesrv_ctx = talloc_reference(dcesrv_sock, dce_ctx);
574 status = stream_setup_named_pipe(event_ctx, lp_ctx,
575 model_ops, &dcesrv_stream_ops,
576 e->ep_description->endpoint, dcesrv_sock);
577 if (!NT_STATUS_IS_OK(status)) {
578 DEBUG(0,("stream_setup_named_pipe(pipe=%s) failed - %s\n",
579 e->ep_description->endpoint, nt_errstr(status)));
587 add a socket address to the list of events, one event per dcerpc endpoint
589 static NTSTATUS add_socket_rpc_tcp_iface(struct dcesrv_context *dce_ctx, struct dcesrv_endpoint *e,
590 struct tevent_context *event_ctx, const struct model_ops *model_ops,
593 struct dcesrv_socket_context *dcesrv_sock;
597 if (e->ep_description->endpoint) {
598 port = atoi(e->ep_description->endpoint);
601 dcesrv_sock = talloc(event_ctx, struct dcesrv_socket_context);
602 NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
604 /* remember the endpoint of this socket */
605 dcesrv_sock->endpoint = e;
606 dcesrv_sock->dcesrv_ctx = talloc_reference(dcesrv_sock, dce_ctx);
608 status = stream_setup_socket(event_ctx, dce_ctx->lp_ctx,
609 model_ops, &dcesrv_stream_ops,
610 "ipv4", address, &port,
611 lp_socket_options(dce_ctx->lp_ctx),
613 if (!NT_STATUS_IS_OK(status)) {
614 DEBUG(0,("service_setup_stream_socket(address=%s,port=%u) failed - %s\n",
615 address, port, nt_errstr(status)));
618 if (e->ep_description->endpoint == NULL) {
619 e->ep_description->endpoint = talloc_asprintf(dce_ctx, "%d", port);
625 static NTSTATUS dcesrv_add_ep_tcp(struct dcesrv_context *dce_ctx,
626 struct loadparm_context *lp_ctx,
627 struct dcesrv_endpoint *e,
628 struct tevent_context *event_ctx, const struct model_ops *model_ops)
632 /* Add TCP/IP sockets */
633 if (lp_interfaces(lp_ctx) && lp_bind_interfaces_only(lp_ctx)) {
636 struct interface *ifaces;
638 load_interfaces(dce_ctx, lp_interfaces(lp_ctx), &ifaces);
640 num_interfaces = iface_count(ifaces);
641 for(i = 0; i < num_interfaces; i++) {
642 const char *address = iface_n_ip(ifaces, i);
643 status = add_socket_rpc_tcp_iface(dce_ctx, e, event_ctx, model_ops, address);
644 NT_STATUS_NOT_OK_RETURN(status);
647 status = add_socket_rpc_tcp_iface(dce_ctx, e, event_ctx, model_ops,
648 lp_socket_address(lp_ctx));
649 NT_STATUS_NOT_OK_RETURN(status);
655 NTSTATUS dcesrv_add_ep(struct dcesrv_context *dce_ctx,
656 struct loadparm_context *lp_ctx,
657 struct dcesrv_endpoint *e,
658 struct tevent_context *event_ctx,
659 const struct model_ops *model_ops)
661 switch (e->ep_description->transport) {
662 case NCACN_UNIX_STREAM:
663 return dcesrv_add_ep_unix(dce_ctx, lp_ctx, e, event_ctx, model_ops);
666 return dcesrv_add_ep_ncalrpc(dce_ctx, lp_ctx, e, event_ctx, model_ops);
669 return dcesrv_add_ep_tcp(dce_ctx, lp_ctx, e, event_ctx, model_ops);
672 return dcesrv_add_ep_np(dce_ctx, lp_ctx, e, event_ctx, model_ops);
675 return NT_STATUS_NOT_SUPPORTED;
680 open the dcerpc server sockets
682 static void dcesrv_task_init(struct task_server *task)
685 struct dcesrv_context *dce_ctx;
686 struct dcesrv_endpoint *e;
687 const struct model_ops *model_ops;
689 dcerpc_server_init(task->lp_ctx);
691 task_server_set_title(task, "task[dcesrv]");
693 /* run the rpc server as a single process to allow for shard
694 * handles, and sharing of ldb contexts */
695 model_ops = process_model_startup(task->event_ctx, "single");
696 if (!model_ops) goto failed;
698 status = dcesrv_init_context(task->event_ctx,
700 lp_dcerpc_endpoint_servers(task->lp_ctx),
702 if (!NT_STATUS_IS_OK(status)) goto failed;
704 /* Make sure the directory for NCALRPC exists */
705 if (!directory_exist(lp_ncalrpc_dir(task->lp_ctx))) {
706 mkdir(lp_ncalrpc_dir(task->lp_ctx), 0755);
709 for (e=dce_ctx->endpoint_list;e;e=e->next) {
710 status = dcesrv_add_ep(dce_ctx, task->lp_ctx, e, task->event_ctx, model_ops);
711 if (!NT_STATUS_IS_OK(status)) goto failed;
716 task_server_terminate(task, "Failed to startup dcerpc server task", true);
719 NTSTATUS server_service_rpc_init(void)
722 return register_server_service("rpc", dcesrv_task_init);