source3/rpc_server/rpc_handles.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1997,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
   6  *  Copyright (C) Jeremy Allison                           2001.
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 3 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  20  */
  21
  22 #include "includes.h"
  23 #include "../librpc/gen_ndr/ndr_lsa.h"
  24 #include "../librpc/gen_ndr/ndr_samr.h"
  25 #include "auth.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_RPC_SRV
  29
  30 /*
  31  * Handle database - stored per pipe.
  32  */
  33
  34 struct dcesrv_handle {
  35         struct dcesrv_handle *prev, *next;
  36         struct policy_handle wire_handle;
  37         uint32_t access_granted;
  38         void *data;
  39 };
  40
  41 struct handle_list {
  42         struct dcesrv_handle *handles;  /* List of pipe handles. */
  43         size_t count;                   /* Current number of handles. */
  44         size_t pipe_ref_count;          /* Number of pipe handles referring
  45                                          * to this tree. */
  46 };
  47
  48 /* This is the max handles across all instances of a pipe name. */
  49 #ifndef MAX_OPEN_POLS
  50 #define MAX_OPEN_POLS 2048
  51 #endif
  52
  53 /****************************************************************************
  54  Hack as handles need to be persisant over lsa pipe closes so long as a samr
  55  pipe is open. JRA.
  56 ****************************************************************************/
  57
  58 static bool is_samr_lsa_pipe(const struct ndr_syntax_id *syntax)
  59 {
  60         return (ndr_syntax_id_equal(syntax, &ndr_table_samr.syntax_id)
  61                 || ndr_syntax_id_equal(syntax, &ndr_table_lsarpc.syntax_id));
  62 }
  63
  64 size_t num_pipe_handles(struct pipes_struct *p)
  65 {
  66         if (p->pipe_handles == NULL) {
  67                 return 0;
  68         }
  69         return p->pipe_handles->count;
  70 }
  71
  72 /****************************************************************************
  73  Initialise a policy handle list on a pipe. Handle list is shared between all
  74  pipes of the same name.
  75 ****************************************************************************/
  76
  77 bool init_pipe_handles(struct pipes_struct *p, const struct ndr_syntax_id *syntax)
  78 {
  79         struct pipes_struct *plist;
  80         struct handle_list *hl;
  81
  82         for (plist = get_first_internal_pipe();
  83              plist;
  84              plist = get_next_internal_pipe(plist)) {
  85                 if (ndr_syntax_id_equal(syntax, &plist->syntax)) {
  86                         break;
  87                 }
  88                 if (is_samr_lsa_pipe(&plist->syntax)
  89                     && is_samr_lsa_pipe(syntax)) {
  90                         /*
  91                          * samr and lsa share a handle space (same process
  92                          * under Windows?)
  93                          */
  94                         break;
  95                 }
  96         }
  97
  98         if (plist != NULL) {
  99                 hl = plist->pipe_handles;
 100                 if (hl == NULL) {
 101                         return false;
 102                 }
 103         } else {
 104                 /*
 105                  * First open, we have to create the handle list
 106                  */
 107                 hl = talloc_zero(NULL, struct handle_list);
 108                 if (hl == NULL) {
 109                         return false;
 110                 }
 111
 112                 DEBUG(10,("init_pipe_handle_list: created handle list for "
 113                           "pipe %s\n",
 114                           get_pipe_name_from_syntax(talloc_tos(), syntax)));
 115         }
 116
 117         /*
 118          * One more pipe is using this list.
 119          */
 120
 121         hl->pipe_ref_count++;
 122
 123         /*
 124          * Point this pipe at this list.
 125          */
 126
 127         p->pipe_handles = hl;
 128
 129         DEBUG(10,("init_pipe_handle_list: pipe_handles ref count = %lu for "
 130                   "pipe %s\n", (unsigned long)p->pipe_handles->pipe_ref_count,
 131                   get_pipe_name_from_syntax(talloc_tos(), syntax)));
 132
 133         return True;
 134 }
 135
 136 /****************************************************************************
 137   find first available policy slot.  creates a policy handle for you.
 138
 139   If "data_ptr" is given, this must be a talloc'ed object, create_policy_hnd
 140   talloc_moves this into the handle. If the policy_hnd is closed,
 141   data_ptr is TALLOC_FREE()'ed
 142 ****************************************************************************/
 143
 144 static struct dcesrv_handle *create_rpc_handle_internal(struct pipes_struct *p,
 145                                 struct policy_handle *hnd, void *data_ptr)
 146 {
 147         struct dcesrv_handle *rpc_hnd;
 148         static uint32 pol_hnd_low  = 0;
 149         static uint32 pol_hnd_high = 0;
 150         time_t t = time(NULL);
 151
 152         if (p->pipe_handles->count > MAX_OPEN_POLS) {
 153                 DEBUG(0,("create_policy_hnd: ERROR: too many handles (%d) on this pipe.\n",
 154                                 (int)p->pipe_handles->count));
 155                 return NULL;
 156         }
 157
 158         rpc_hnd = talloc_zero(p->pipe_handles, struct dcesrv_handle);
 159         if (!rpc_hnd) {
 160                 DEBUG(0,("create_policy_hnd: ERROR: out of memory!\n"));
 161                 return NULL;
 162         }
 163
 164         if (data_ptr != NULL) {
 165                 rpc_hnd->data = talloc_move(rpc_hnd, &data_ptr);
 166         }
 167
 168         pol_hnd_low++;
 169         if (pol_hnd_low == 0) {
 170                 pol_hnd_high++;
 171         }
 172
 173         /* first bit must be null */
 174         SIVAL(&rpc_hnd->wire_handle.handle_type, 0 , 0);
 175
 176         /* second bit is incrementing */
 177         SIVAL(&rpc_hnd->wire_handle.uuid.time_low, 0 , pol_hnd_low);
 178         SSVAL(&rpc_hnd->wire_handle.uuid.time_mid, 0 , pol_hnd_high);
 179         SSVAL(&rpc_hnd->wire_handle.uuid.time_hi_and_version, 0, (pol_hnd_high >> 16));
 180
 181         /* split the current time into two 16 bit values */
 182
 183         /* something random */
 184         SSVAL(rpc_hnd->wire_handle.uuid.clock_seq, 0, (t >> 16));
 185         /* something random */
 186         SSVAL(rpc_hnd->wire_handle.uuid.node, 0, t);
 187         /* something more random */
 188         SIVAL(rpc_hnd->wire_handle.uuid.node, 2, sys_getpid());
 189
 190         DLIST_ADD(p->pipe_handles->handles, rpc_hnd);
 191         p->pipe_handles->count++;
 192
 193         *hnd = rpc_hnd->wire_handle;
 194
 195         DEBUG(4, ("Opened policy hnd[%d] ", (int)p->pipe_handles->count));
 196         dump_data(4, (uint8_t *)hnd, sizeof(*hnd));
 197
 198         return rpc_hnd;
 199 }
 200
 201 bool create_policy_hnd(struct pipes_struct *p, struct policy_handle *hnd,
 202                        void *data_ptr)
 203 {
 204         struct dcesrv_handle *rpc_hnd;
 205
 206         rpc_hnd = create_rpc_handle_internal(p, hnd, data_ptr);
 207         if (rpc_hnd == NULL) {
 208                 return false;
 209         }
 210         return true;
 211 }
 212
 213 /****************************************************************************
 214   find policy by handle - internal version.
 215 ****************************************************************************/
 216
 217 static struct dcesrv_handle *find_policy_by_hnd_internal(struct pipes_struct *p,
 218                                 const struct policy_handle *hnd, void **data_p)
 219 {
 220         struct dcesrv_handle *h;
 221         unsigned int count;
 222
 223         if (data_p) {
 224                 *data_p = NULL;
 225         }
 226
 227         count = 0;
 228         for (h = p->pipe_handles->handles; h != NULL; h = h->next) {
 229                 if (memcmp(&h->wire_handle, hnd, sizeof(*hnd)) == 0) {
 230                         DEBUG(4,("Found policy hnd[%u] ", count));
 231                         dump_data(4, (uint8 *)hnd, sizeof(*hnd));
 232                         if (data_p) {
 233                                 *data_p = h->data;
 234                         }
 235                         return h;
 236                 }
 237                 count++;
 238         }
 239
 240         DEBUG(4,("Policy not found: "));
 241         dump_data(4, (uint8_t *)hnd, sizeof(*hnd));
 242
 243         p->bad_handle_fault_state = true;
 244
 245         return NULL;
 246 }
 247
 248 /****************************************************************************
 249   find policy by handle
 250 ****************************************************************************/
 251
 252 bool find_policy_by_hnd(struct pipes_struct *p, const struct policy_handle *hnd,
 253                         void **data_p)
 254 {
 255         struct dcesrv_handle *rpc_hnd;
 256
 257         rpc_hnd = find_policy_by_hnd_internal(p, hnd, data_p);
 258         if (rpc_hnd == NULL) {
 259                 return false;
 260         }
 261         return true;
 262 }
 263
 264 /****************************************************************************
 265   Close a policy.
 266 ****************************************************************************/
 267
 268 bool close_policy_hnd(struct pipes_struct *p, struct policy_handle *hnd)
 269 {
 270         struct dcesrv_handle *rpc_hnd;
 271
 272         rpc_hnd = find_policy_by_hnd_internal(p, hnd, NULL);
 273
 274         if (rpc_hnd == NULL) {
 275                 DEBUG(3, ("Error closing policy (policy not found)\n"));
 276                 return false;
 277         }
 278
 279         DEBUG(3,("Closed policy\n"));
 280
 281         p->pipe_handles->count--;
 282
 283         DLIST_REMOVE(p->pipe_handles->handles, rpc_hnd);
 284         TALLOC_FREE(rpc_hnd);
 285
 286         return true;
 287 }
 288
 289 /****************************************************************************
 290  Close a pipe - free the handle set if it was the last pipe reference.
 291 ****************************************************************************/
 292
 293 void close_policy_by_pipe(struct pipes_struct *p)
 294 {
 295         p->pipe_handles->pipe_ref_count--;
 296
 297         if (p->pipe_handles->pipe_ref_count == 0) {
 298                 /*
 299                  * Last pipe open on this list - free the list.
 300                  */
 301                 TALLOC_FREE(p->pipe_handles);
 302
 303                 DEBUG(10,("close_policy_by_pipe: deleted handle list for "
 304                           "pipe %s\n",
 305                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 306         }
 307 }
 308
 309 /*******************************************************************
 310 Shall we allow access to this rpc?  Currently this function
 311 implements the 'restrict anonymous' setting by denying access to
 312 anonymous users if the restrict anonymous level is > 0.  Further work
 313 will be checking a security descriptor to determine whether a user
 314 token has enough access to access the pipe.
 315 ********************************************************************/
 316
 317 bool pipe_access_check(struct pipes_struct *p)
 318 {
 319         /* Don't let anonymous users access this RPC if restrict
 320            anonymous > 0 */
 321
 322         if (lp_restrict_anonymous() > 0) {
 323
 324                 /* schannel, so we must be ok */
 325                 if (p->pipe_bound &&
 326                     (p->auth.auth_type == DCERPC_AUTH_TYPE_SCHANNEL)) {
 327                         return True;
 328                 }
 329
 330                 if (p->session_info->guest) {
 331                         return False;
 332                 }
 333         }
 334
 335         return True;
 336 }
 337
 338 void *_policy_handle_create(struct pipes_struct *p, struct policy_handle *hnd,
 339                             uint32_t access_granted, size_t data_size,
 340                             const char *type, NTSTATUS *pstatus)
 341 {
 342         struct dcesrv_handle *rpc_hnd;
 343         void *data;
 344
 345         if (p->pipe_handles->count > MAX_OPEN_POLS) {
 346                 DEBUG(0, ("policy_handle_create: ERROR: too many handles (%d) "
 347                           "on pipe %s.\n", (int)p->pipe_handles->count,
 348                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 349                 *pstatus = NT_STATUS_INSUFFICIENT_RESOURCES;
 350                 return NULL;
 351         }
 352
 353         data = talloc_size(talloc_tos(), data_size);
 354         if (data == NULL) {
 355                 *pstatus = NT_STATUS_NO_MEMORY;
 356                 return NULL;
 357         }
 358         talloc_set_name_const(data, type);
 359
 360         rpc_hnd = create_rpc_handle_internal(p, hnd, data);
 361         if (rpc_hnd == NULL) {
 362                 TALLOC_FREE(data);
 363                 *pstatus = NT_STATUS_NO_MEMORY;
 364                 return NULL;
 365         }
 366         rpc_hnd->access_granted = access_granted;
 367         *pstatus = NT_STATUS_OK;
 368         return data;
 369 }
 370
 371 void *_policy_handle_find(struct pipes_struct *p,
 372                           const struct policy_handle *hnd,
 373                           uint32_t access_required,
 374                           uint32_t *paccess_granted,
 375                           const char *name, const char *location,
 376                           NTSTATUS *pstatus)
 377 {
 378         struct dcesrv_handle *rpc_hnd;
 379         void *data;
 380
 381         rpc_hnd = find_policy_by_hnd_internal(p, hnd, &data);
 382         if (rpc_hnd == NULL) {
 383                 *pstatus = NT_STATUS_INVALID_HANDLE;
 384                 return NULL;
 385         }
 386         if (strcmp(name, talloc_get_name(data)) != 0) {
 387                 DEBUG(10, ("expected %s, got %s\n", name,
 388                            talloc_get_name(data)));
 389                 *pstatus = NT_STATUS_INVALID_HANDLE;
 390                 return NULL;
 391         }
 392         if ((access_required & rpc_hnd->access_granted) != access_required) {
 393                 if (geteuid() == sec_initial_uid()) {
 394                         DEBUG(4, ("%s: ACCESS should be DENIED (granted: "
 395                                   "%#010x; required: %#010x)\n", location,
 396                                   rpc_hnd->access_granted, access_required));
 397                         DEBUGADD(4,("but overwritten by euid == 0\n"));
 398                         goto okay;
 399                 }
 400                 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: "
 401                          "%#010x)\n", location, rpc_hnd->access_granted,
 402                          access_required));
 403                 *pstatus = NT_STATUS_ACCESS_DENIED;
 404                 return NULL;
 405         }
 406
 407  okay:
 408         DEBUG(10, ("found handle of type %s\n", talloc_get_name(data)));
 409         if (paccess_granted != NULL) {
 410                 *paccess_granted = rpc_hnd->access_granted;
 411         }
 412         *pstatus = NT_STATUS_OK;
 413         return data;
 414 }