712742be1f57f569ff1b355b07a26493b94714a2
[ira/wip.git] / source4 / smbd / service_named_pipe.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    helper functions for NAMED PIPE servers
5
6    Copyright (C) Stefan (metze) Metzmacher      2008
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License as published by
10    the Free Software Foundation; either version 3 of the License, or
11    (at your option) any later version.
12
13    This program is distributed in the hope that it will be useful,
14    but WITHOUT ANY WARRANTY; without even the implied warranty of
15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16    GNU General Public License for more details.
17
18    You should have received a copy of the GNU General Public License
19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include <tevent.h>
24 #include "smbd/service.h"
25 #include "param/param.h"
26 #include "auth/session.h"
27 #include "auth/auth_sam_reply.h"
28 #include "lib/stream/packet.h"
29 #include "librpc/gen_ndr/ndr_named_pipe_auth.h"
30 #include "system/passwd.h"
31 #include "libcli/raw/smb.h"
32 #include "auth/credentials/credentials.h"
33 #include "auth/credentials/credentials_krb5.h"
34
35 struct named_pipe_socket {
36         const char *pipe_name;
37         const char *pipe_path;
38         const struct stream_server_ops *ops;
39         void *private_data;
40 };
41
42 struct named_pipe_connection {
43         struct stream_connection *connection;
44         struct packet_context *packet;
45         const struct named_pipe_socket *pipe_sock;
46         NTSTATUS status;
47 };
48
49 static void named_pipe_handover_connection(void *private_data)
50 {
51         struct named_pipe_connection *pipe_conn = talloc_get_type(
52                 private_data, struct named_pipe_connection);
53         struct stream_connection *conn = pipe_conn->connection;
54
55         TEVENT_FD_NOT_WRITEABLE(conn->event.fde);
56
57         packet_set_socket(pipe_conn->packet, NULL);
58         packet_set_event_context(pipe_conn->packet, NULL);
59         packet_set_fde(pipe_conn->packet, NULL);
60         TALLOC_FREE(pipe_conn->packet);
61
62         if (!NT_STATUS_IS_OK(pipe_conn->status)) {
63                 stream_terminate_connection(conn, nt_errstr(pipe_conn->status));
64                 return;
65         }
66
67         /*
68          * remove the named_pipe layer together with its packet layer
69          */
70         conn->ops               = pipe_conn->pipe_sock->ops;
71         conn->private_data      = pipe_conn->pipe_sock->private_data;
72         talloc_unlink(conn, pipe_conn);
73
74         /* we're now ready to start receiving events on this stream */
75         TEVENT_FD_READABLE(conn->event.fde);
76
77         /*
78          * hand over to the real pipe implementation,
79          * now that we have setup the transport session_info
80          */
81         conn->ops->accept_connection(conn);
82
83         DEBUG(10,("named_pipe_handover_connection[%s]: succeeded\n",
84               conn->ops->name));
85 }
86
87 static NTSTATUS named_pipe_recv_auth_request(void *private_data,
88                                              DATA_BLOB req_blob)
89 {
90         struct named_pipe_connection *pipe_conn = talloc_get_type(
91                 private_data, struct named_pipe_connection);
92         struct stream_connection *conn = pipe_conn->connection;
93         enum ndr_err_code ndr_err;
94         struct named_pipe_auth_req req;
95         union netr_Validation val;
96         struct auth_serversupplied_info *server_info;
97         struct named_pipe_auth_rep rep;
98         DATA_BLOB rep_blob;
99         NTSTATUS status;
100
101         /*
102          * make sure nothing happens on the socket untill the
103          * real implementation takes over
104          */
105         packet_recv_disable(pipe_conn->packet);
106
107         /*
108          * TODO: check it's a root (uid == 0) pipe
109          */
110
111         ZERO_STRUCT(rep);
112         rep.level = 0;
113         rep.status = NT_STATUS_INTERNAL_ERROR;
114
115         DEBUG(10,("named_pipe_auth: req_blob.length[%u]\n",
116                   (unsigned int)req_blob.length));
117         dump_data(11, req_blob.data, req_blob.length);
118
119         /* parse the passed credentials */
120         ndr_err = ndr_pull_struct_blob_all(
121                         &req_blob,
122                         pipe_conn,
123                         lp_iconv_convenience(conn->lp_ctx),
124                         &req,
125                         (ndr_pull_flags_fn_t)ndr_pull_named_pipe_auth_req);
126         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
127                 rep.status = ndr_map_error2ntstatus(ndr_err);
128                 DEBUG(2, ("Could not unmarshall named_pipe_auth_req: %s\n",
129                           nt_errstr(rep.status)));
130                 goto reply;
131         }
132
133         if (DEBUGLVL(10)) {
134                 NDR_PRINT_DEBUG(named_pipe_auth_req, &req);
135         }
136
137         if (strcmp(NAMED_PIPE_AUTH_MAGIC, req.magic) != 0) {
138                 DEBUG(2, ("named_pipe_auth_req: invalid magic '%s' != %s\n",
139                           req.magic, NAMED_PIPE_AUTH_MAGIC));
140                 rep.status = NT_STATUS_INVALID_PARAMETER;
141                 goto reply;
142         }
143
144         switch (req.level) {
145         case 0:
146                 /*
147                  * anon connection, we don't create a session info
148                  * and leave it NULL
149                  */
150                 rep.level = 0;
151                 rep.status = NT_STATUS_OK;
152                 break;
153         case 1:
154                 val.sam3 = &req.info.info1;
155
156                 rep.level = 1;
157                 rep.status = make_server_info_netlogon_validation(pipe_conn,
158                                                                   "TODO",
159                                                                   3, &val,
160                                                                   &server_info);
161                 if (!NT_STATUS_IS_OK(rep.status)) {
162                         DEBUG(2, ("make_server_info_netlogon_validation returned "
163                                   "%s\n", nt_errstr(rep.status)));
164                         goto reply;
165                 }
166
167                 /* setup the session_info on the connection */
168                 rep.status = auth_generate_session_info(conn,
169                                                         conn->event.ctx,
170                                                         conn->lp_ctx,
171                                                         server_info,
172                                                         &conn->session_info);
173                 if (!NT_STATUS_IS_OK(rep.status)) {
174                         DEBUG(2, ("auth_generate_session_info failed: %s\n",
175                                   nt_errstr(rep.status)));
176                         goto reply;
177                 }
178
179                 break;
180         case 2:
181                 rep.level = 2;
182                 rep.info.info2.file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
183                 rep.info.info2.device_state = 0xff | 0x0400 | 0x0100;
184                 rep.info.info2.allocation_size = 4096;
185
186                 if (!req.info.info2.sam_info3) {
187                         /*
188                          * anon connection, we don't create a session info
189                          * and leave it NULL
190                          */
191                         rep.status = NT_STATUS_OK;
192                         break;
193                 }
194
195                 val.sam3 = req.info.info2.sam_info3;
196
197                 rep.status = make_server_info_netlogon_validation(pipe_conn,
198                                                 val.sam3->base.account_name.string,
199                                                 3, &val, &server_info);
200                 if (!NT_STATUS_IS_OK(rep.status)) {
201                         DEBUG(2, ("make_server_info_netlogon_validation returned "
202                                   "%s\n", nt_errstr(rep.status)));
203                         goto reply;
204                 }
205
206                 /* setup the session_info on the connection */
207                 rep.status = auth_generate_session_info(conn,
208                                                         conn->event.ctx,
209                                                         conn->lp_ctx,
210                                                         server_info,
211                                                         &conn->session_info);
212                 if (!NT_STATUS_IS_OK(rep.status)) {
213                         DEBUG(2, ("auth_generate_session_info failed: %s\n",
214                                   nt_errstr(rep.status)));
215                         goto reply;
216                 }
217
218                 conn->session_info->session_key = data_blob_const(req.info.info2.session_key,
219                                                         req.info.info2.session_key_length);
220                 talloc_steal(conn->session_info, req.info.info2.session_key);
221
222                 break;
223         case 3:
224                 rep.level = 3;
225                 rep.info.info3.file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
226                 rep.info.info3.device_state = 0xff | 0x0400 | 0x0100;
227                 rep.info.info3.allocation_size = 4096;
228
229                 if (!req.info.info3.sam_info3) {
230                         /*
231                          * anon connection, we don't create a session info
232                          * and leave it NULL
233                          */
234                         rep.status = NT_STATUS_OK;
235                         break;
236                 }
237
238                 val.sam3 = req.info.info3.sam_info3;
239
240                 rep.status = make_server_info_netlogon_validation(pipe_conn,
241                                                 val.sam3->base.account_name.string,
242                                                 3, &val, &server_info);
243                 if (!NT_STATUS_IS_OK(rep.status)) {
244                         DEBUG(2, ("make_server_info_netlogon_validation returned "
245                                   "%s\n", nt_errstr(rep.status)));
246                         goto reply;
247                 }
248
249                 /* setup the session_info on the connection */
250                 rep.status = auth_generate_session_info(conn,
251                                                         conn->event.ctx,
252                                                         conn->lp_ctx,
253                                                         server_info,
254                                                         &conn->session_info);
255                 if (!NT_STATUS_IS_OK(rep.status)) {
256                         DEBUG(2, ("auth_generate_session_info failed: %s\n",
257                                   nt_errstr(rep.status)));
258                         goto reply;
259                 }
260
261                 if (req.info.info3.gssapi_delegated_creds_length) {
262                         OM_uint32 minor_status;
263                         gss_buffer_desc cred_token;
264                         gss_cred_id_t cred_handle;
265                         int ret;
266                         const char *error_string;
267
268                         DEBUG(10, ("named_pipe_auth: delegated credentials supplied by client\n"));
269
270                         cred_token.value = req.info.info3.gssapi_delegated_creds;
271                         cred_token.length = req.info.info3.gssapi_delegated_creds_length;
272
273                         ret = gss_import_cred(&minor_status,
274                                                &cred_token,
275                                                &cred_handle);
276                         if (ret != GSS_S_COMPLETE) {
277                                 rep.status = NT_STATUS_INTERNAL_ERROR;
278                                 goto reply;
279                         }
280
281                         conn->session_info->credentials = cli_credentials_init(conn->session_info);
282                         if (!conn->session_info->credentials) {
283                                 rep.status = NT_STATUS_NO_MEMORY;
284                                 goto reply;
285                         }
286
287                         cli_credentials_set_conf(conn->session_info->credentials,
288                                                  conn->lp_ctx);
289                         /* Just so we don't segfault trying to get at a username */
290                         cli_credentials_set_anonymous(conn->session_info->credentials);
291
292                         ret = cli_credentials_set_client_gss_creds(conn->session_info->credentials,
293                                                                    conn->event.ctx,
294                                                                    conn->lp_ctx,
295                                                                    cred_handle,
296                                                                    CRED_SPECIFIED, &error_string);
297                         if (ret) {
298                                 rep.status = NT_STATUS_INTERNAL_ERROR;
299                                 DEBUG(2, ("Failed to set pipe forwarded creds: %s\n", error_string));
300                                 goto reply;
301                         }
302
303                         /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */
304                         cli_credentials_set_kerberos_state(conn->session_info->credentials,
305                                                            CRED_MUST_USE_KERBEROS);
306                 }
307
308                 conn->session_info->session_key = data_blob_const(req.info.info3.session_key,
309                                                         req.info.info3.session_key_length);
310                 talloc_steal(conn->session_info, req.info.info3.session_key);
311
312                 break;
313         default:
314                 DEBUG(2, ("named_pipe_auth_req: unknown level %u\n",
315                           req.level));
316                 rep.level = 0;
317                 rep.status = NT_STATUS_INVALID_LEVEL;
318                 goto reply;
319         }
320
321 reply:
322         /* create the output */
323         ndr_err = ndr_push_struct_blob(&rep_blob, pipe_conn,
324                         lp_iconv_convenience(conn->lp_ctx),
325                         &rep,
326                         (ndr_push_flags_fn_t)ndr_push_named_pipe_auth_rep);
327         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
328                 status = ndr_map_error2ntstatus(ndr_err);
329                 DEBUG(2, ("Could not marshall named_pipe_auth_rep: %s\n",
330                           nt_errstr(status)));
331                 return status;
332         }
333
334         DEBUG(10,("named_pipe_auth reply[%u]\n", (unsigned)rep_blob.length));
335         dump_data(11, rep_blob.data, rep_blob.length);
336         if (DEBUGLVL(10)) {
337                 NDR_PRINT_DEBUG(named_pipe_auth_rep, &rep);
338         }
339
340         pipe_conn->status = rep.status;
341         status = packet_send_callback(pipe_conn->packet, rep_blob,
342                                       named_pipe_handover_connection,
343                                       pipe_conn);
344         if (!NT_STATUS_IS_OK(status)) {
345                 DEBUG(0, ("packet_send_callback returned %s\n",
346                           nt_errstr(status)));
347                 return status;
348         }
349
350         return NT_STATUS_OK;
351 }
352
353 /*
354   called when a pipe socket becomes readable
355 */
356 static void named_pipe_recv(struct stream_connection *conn, uint16_t flags)
357 {
358         struct named_pipe_connection *pipe_conn = talloc_get_type(
359                 conn->private_data, struct named_pipe_connection);
360
361         DEBUG(10,("named_pipe_recv\n"));
362
363         packet_recv(pipe_conn->packet);
364 }
365
366 /*
367   called when a pipe socket becomes writable
368 */
369 static void named_pipe_send(struct stream_connection *conn, uint16_t flags)
370 {
371         struct named_pipe_connection *pipe_conn = talloc_get_type(
372                 conn->private_data, struct named_pipe_connection);
373
374         packet_queue_run(pipe_conn->packet);
375 }
376
377 /*
378   handle socket recv errors
379 */
380 static void named_pipe_recv_error(void *private_data, NTSTATUS status)
381 {
382         struct named_pipe_connection *pipe_conn = talloc_get_type(
383                 private_data, struct named_pipe_connection);
384
385         stream_terminate_connection(pipe_conn->connection, nt_errstr(status));
386 }
387
388 static NTSTATUS named_pipe_full_request(void *private_data, DATA_BLOB blob, size_t *size)
389 {
390         if (blob.length < 8) {
391                 return STATUS_MORE_ENTRIES;
392         }
393
394         if (memcmp(NAMED_PIPE_AUTH_MAGIC, &blob.data[4], 4) != 0) {
395                 DEBUG(0,("named_pipe_full_request: wrong protocol\n"));
396                 *size = blob.length;
397                 /* the error will be handled in named_pipe_recv_auth_request */
398                 return NT_STATUS_OK;
399         }
400
401         *size = 4 + RIVAL(blob.data, 0);
402         if (*size > blob.length) {
403                 return STATUS_MORE_ENTRIES;
404         }
405
406         return NT_STATUS_OK;
407 }
408
409 static void named_pipe_accept(struct stream_connection *conn)
410 {
411         struct named_pipe_socket *pipe_sock = talloc_get_type(
412                 conn->private_data, struct named_pipe_socket);
413         struct named_pipe_connection *pipe_conn;
414
415         DEBUG(5,("named_pipe_accept\n"));
416
417         pipe_conn = talloc_zero(conn, struct named_pipe_connection);
418         if (!pipe_conn) {
419                 stream_terminate_connection(conn, "out of memory");
420                 return;
421         }
422
423         pipe_conn->packet = packet_init(pipe_conn);
424         if (!pipe_conn->packet) {
425                 stream_terminate_connection(conn, "out of memory");
426                 return;
427         }
428         packet_set_private(pipe_conn->packet, pipe_conn);
429         packet_set_socket(pipe_conn->packet, conn->socket);
430         packet_set_callback(pipe_conn->packet, named_pipe_recv_auth_request);
431         packet_set_full_request(pipe_conn->packet, named_pipe_full_request);
432         packet_set_error_handler(pipe_conn->packet, named_pipe_recv_error);
433         packet_set_event_context(pipe_conn->packet, conn->event.ctx);
434         packet_set_fde(pipe_conn->packet, conn->event.fde);
435         packet_set_serialise(pipe_conn->packet);
436         packet_set_initial_read(pipe_conn->packet, 8);
437
438         pipe_conn->pipe_sock = pipe_sock;
439
440         pipe_conn->connection = conn;
441         conn->private_data = pipe_conn;
442 }
443
444 static const struct stream_server_ops named_pipe_stream_ops = {
445         .name                   = "named_pipe",
446         .accept_connection      = named_pipe_accept,
447         .recv_handler           = named_pipe_recv,
448         .send_handler           = named_pipe_send,
449 };
450
451 NTSTATUS stream_setup_named_pipe(struct tevent_context *event_context,
452                                  struct loadparm_context *lp_ctx,
453                                  const struct model_ops *model_ops,
454                                  const struct stream_server_ops *stream_ops,
455                                  const char *pipe_name,
456                                  void *private_data)
457 {
458         char *dirname;
459         struct named_pipe_socket *pipe_sock;
460         NTSTATUS status = NT_STATUS_NO_MEMORY;;
461
462         pipe_sock = talloc(event_context, struct named_pipe_socket);
463         if (pipe_sock == NULL) {
464                 goto fail;
465         }
466
467         /* remember the details about the pipe */
468         pipe_sock->pipe_name    = talloc_strdup(pipe_sock, pipe_name);
469         if (pipe_sock->pipe_name == NULL) {
470                 goto fail;
471         }
472
473         dirname = talloc_asprintf(pipe_sock, "%s/np", lp_ncalrpc_dir(lp_ctx));
474         if (dirname == NULL) {
475                 goto fail;
476         }
477
478         if (!directory_create_or_exist(dirname, geteuid(), 0700)) {
479                 status = map_nt_error_from_unix(errno);
480                 DEBUG(0,(__location__ ": Failed to create stream pipe directory %s - %s\n",
481                          dirname, nt_errstr(status)));
482                 goto fail;
483         }
484
485         if (strncmp(pipe_name, "\\pipe\\", 6) == 0) {
486                 pipe_name += 6;
487         }
488
489         pipe_sock->pipe_path = talloc_asprintf(pipe_sock, "%s/%s", dirname,
490                                                pipe_name);
491         if (pipe_sock->pipe_path == NULL) {
492                 goto fail;
493         }
494
495         talloc_free(dirname);
496
497         pipe_sock->ops          = stream_ops;
498         pipe_sock->private_data = talloc_reference(pipe_sock, private_data);
499
500         status = stream_setup_socket(event_context,
501                                      lp_ctx,
502                                      model_ops,
503                                      &named_pipe_stream_ops,
504                                      "unix",
505                                      pipe_sock->pipe_path,
506                                      NULL,
507                                      NULL,
508                                      pipe_sock);
509         if (!NT_STATUS_IS_OK(status)) {
510                 goto fail;
511         }
512         return NT_STATUS_OK;
513
514  fail:
515         talloc_free(pipe_sock);
516         return status;
517 }