stream_terminate_connection: Prevent use-after-free
[nivanova/samba-autobuild/.git] / source4 / smbd / service_stream.c
index e09ac1d9e6a7e185295dae60e406d38c1fcc7182..917a1876e07970ed1c66fd010f9e8918173cc835 100644 (file)
 #include "includes.h"
 #include <tevent.h>
 #include "process_model.h"
-#include "lib/socket/socket.h"
-#include "smbd/service.h"
-#include "smbd/service_stream.h"
+#include "lib/util/server_id.h"
 #include "lib/messaging/irpc.h"
 #include "cluster/cluster.h"
 #include "param/param.h"
-
-/* the range of ports to try for dcerpc over tcp endpoints */
-#define SERVER_TCP_LOW_PORT  1024
-#define SERVER_TCP_HIGH_PORT 1300
+#include "../lib/tsocket/tsocket.h"
+#include "lib/util/util_net.h"
 
 /* size of listen() backlog in smbd */
 #define SERVER_LISTEN_BACKLOG 10
@@ -58,10 +54,16 @@ void stream_terminate_connection(struct stream_connection *srv_conn, const char
 {
        struct tevent_context *event_ctx = srv_conn->event.ctx;
        const struct model_ops *model_ops = srv_conn->model_ops;
+       struct loadparm_context *lp_ctx = srv_conn->lp_ctx;
+       TALLOC_CTX *frame = NULL;
 
        if (!reason) reason = "unknown reason";
 
-       DEBUG(3,("Terminating connection - '%s'\n", reason));
+       if (srv_conn->processing) {
+               DEBUG(3,("Terminating connection deferred - '%s'\n", reason));
+       } else {
+               DEBUG(3,("Terminating connection - '%s'\n", reason));
+       }
 
        srv_conn->terminate = reason;
 
@@ -76,10 +78,20 @@ void stream_terminate_connection(struct stream_connection *srv_conn, const char
                return;
        }
 
+       frame = talloc_stackframe();
+
+       reason = talloc_strdup(frame, reason);
+       if (reason == NULL) {
+               reason = "OOM - unknown reason";
+       }
+
        talloc_free(srv_conn->event.fde);
        srv_conn->event.fde = NULL;
-       model_ops->terminate(event_ctx, srv_conn->lp_ctx, reason);
-       talloc_free(srv_conn);
+       imessaging_cleanup(srv_conn->msg_ctx);
+       TALLOC_FREE(srv_conn);
+       model_ops->terminate(event_ctx, lp_ctx, reason);
+
+       TALLOC_FREE(frame);
 }
 
 /**
@@ -100,7 +112,7 @@ static void stream_io_handler(struct stream_connection *conn, uint16_t flags)
        }
 }
 
-static void stream_io_handler_fde(struct tevent_context *ev, struct tevent_fd *fde, 
+void stream_io_handler_fde(struct tevent_context *ev, struct tevent_fd *fde,
                                  uint16_t flags, void *private_data)
 {
        struct stream_connection *conn = talloc_get_type(private_data,
@@ -123,9 +135,8 @@ void stream_io_handler_callback(void *private_data, uint16_t flags)
 NTSTATUS stream_new_connection_merge(struct tevent_context *ev,
                                     struct loadparm_context *lp_ctx,
                                     const struct model_ops *model_ops,
-                                    struct socket_context *sock,
                                     const struct stream_server_ops *stream_ops,
-                                    struct messaging_context *msg_ctx,
+                                    struct imessaging_context *msg_ctx,
                                     void *private_data,
                                     struct stream_connection **_srv_conn)
 {
@@ -134,23 +145,15 @@ NTSTATUS stream_new_connection_merge(struct tevent_context *ev,
        srv_conn = talloc_zero(ev, struct stream_connection);
        NT_STATUS_HAVE_NO_MEMORY(srv_conn);
 
-       talloc_steal(srv_conn, sock);
-
        srv_conn->private_data  = private_data;
        srv_conn->model_ops     = model_ops;
-       srv_conn->socket        = sock;
+       srv_conn->socket        = NULL;
        srv_conn->server_id     = cluster_id(0, 0);
        srv_conn->ops           = stream_ops;
        srv_conn->msg_ctx       = msg_ctx;
        srv_conn->event.ctx     = ev;
        srv_conn->lp_ctx        = lp_ctx;
-       srv_conn->event.fde     = tevent_add_fd(ev, srv_conn, socket_get_fd(sock),
-                                               TEVENT_FD_READ,
-                                               stream_io_handler_fde, srv_conn);
-       if (!srv_conn->event.fde) {
-               talloc_free(srv_conn);
-               return NT_STATUS_NO_MEMORY;
-       }
+       srv_conn->event.fde     = NULL;
 
        *_srv_conn = srv_conn;
        return NT_STATUS_OK;
@@ -167,7 +170,6 @@ static void stream_new_connection(struct tevent_context *ev,
 {
        struct stream_socket *stream_socket = talloc_get_type(private_data, struct stream_socket);
        struct stream_connection *srv_conn;
-       struct socket_address *c, *s;
 
        srv_conn = talloc_zero(ev, struct stream_connection);
        if (!srv_conn) {
@@ -185,7 +187,7 @@ static void stream_new_connection(struct tevent_context *ev,
        srv_conn->event.ctx     = ev;
        srv_conn->lp_ctx        = lp_ctx;
 
-       if (!socket_check_access(sock, "smbd", lp_hostsallow(NULL, lp_default_service(lp_ctx)), lp_hostsdeny(NULL, lp_default_service(lp_ctx)))) {
+       if (!socket_check_access(sock, "smbd", lpcfg_hosts_allow(NULL, lpcfg_default_service(lp_ctx)), lpcfg_hosts_deny(NULL, lpcfg_default_service(lp_ctx)))) {
                stream_terminate_connection(srv_conn, "denied by access rules");
                return;
        }
@@ -198,30 +200,43 @@ static void stream_new_connection(struct tevent_context *ev,
        }
 
        /* setup to receive internal messages on this connection */
-       srv_conn->msg_ctx = messaging_init(srv_conn, 
-                                          lp_messaging_path(srv_conn, lp_ctx),
-                                          srv_conn->server_id, 
-                                          lp_iconv_convenience(lp_ctx),
-                                          ev);
+       srv_conn->msg_ctx = imessaging_init(srv_conn,
+                                           lp_ctx,
+                                           srv_conn->server_id, ev);
        if (!srv_conn->msg_ctx) {
-               stream_terminate_connection(srv_conn, "messaging_init() failed");
+               stream_terminate_connection(srv_conn, "imessaging_init() failed");
+               return;
+       }
+
+       srv_conn->remote_address = socket_get_remote_addr(srv_conn->socket, srv_conn);
+       if (!srv_conn->remote_address) {
+               stream_terminate_connection(srv_conn, "socket_get_remote_addr() failed");
+               return;
+       }
+
+       srv_conn->local_address = socket_get_local_addr(srv_conn->socket, srv_conn);
+       if (!srv_conn->local_address) {
+               stream_terminate_connection(srv_conn, "socket_get_local_addr() failed");
                return;
        }
 
-       c = socket_get_peer_addr(sock, ev);
-       s = socket_get_my_addr(sock, ev);
-       if (s && c) {
+       {
+               TALLOC_CTX *tmp_ctx;
                const char *title;
-               title = talloc_asprintf(s, "conn[%s] c[%s:%u] s[%s:%u] server_id[%s]",
+               struct server_id_buf idbuf;
+
+               tmp_ctx = talloc_new(srv_conn);
+
+               title = talloc_asprintf(tmp_ctx, "conn[%s] c[%s] s[%s] server_id[%s]",
                                        stream_socket->ops->name, 
-                                       c->addr, c->port, s->addr, s->port,
-                                       cluster_id_string(s, server_id));
+                                       tsocket_address_string(srv_conn->remote_address, tmp_ctx),
+                                       tsocket_address_string(srv_conn->local_address, tmp_ctx),
+                                       server_id_str_buf(server_id, &idbuf));
                if (title) {
                        stream_connection_set_title(srv_conn, title);
                }
+               talloc_free(tmp_ctx);
        }
-       talloc_free(c);
-       talloc_free(s);
 
        /* we're now ready to start receiving events on this stream */
        TEVENT_FD_READABLE(srv_conn->event.fde);
@@ -242,7 +257,7 @@ static void stream_accept_handler(struct tevent_context *ev, struct tevent_fd *f
        /* ask the process model to create us a process for this new
           connection.  When done, it calls stream_new_connection()
           with the newly created socket */
-       stream_socket->model_ops->accept_connection(ev, stream_socket->lp_ctx, 
+       stream_socket->model_ops->accept_connection(ev, stream_socket->lp_ctx,
                                                    stream_socket->sock, 
                                                    stream_new_connection, stream_socket);
 }
@@ -255,7 +270,8 @@ static void stream_accept_handler(struct tevent_context *ev, struct tevent_fd *f
         a string for the port. Should leave allocating a port nr 
          to the socket implementation - JRV20070903
  */
-NTSTATUS stream_setup_socket(struct tevent_context *event_context,
+NTSTATUS stream_setup_socket(TALLOC_CTX *mem_ctx,
+                            struct tevent_context *event_context,
                             struct loadparm_context *lp_ctx,
                             const struct model_ops *model_ops,
                             const struct stream_server_ops *stream_ops,
@@ -270,12 +286,37 @@ NTSTATUS stream_setup_socket(struct tevent_context *event_context,
        struct socket_address *socket_address;
        struct tevent_fd *fde;
        int i;
+       struct sockaddr_storage ss;
 
-       stream_socket = talloc_zero(event_context, struct stream_socket);
+       stream_socket = talloc_zero(mem_ctx, struct stream_socket);
        NT_STATUS_HAVE_NO_MEMORY(stream_socket);
 
-       status = socket_create(family, SOCKET_TYPE_STREAM, &stream_socket->sock, 0);
-       NT_STATUS_NOT_OK_RETURN(status);
+       if (strcmp(family, "ip") == 0) {
+               /* we will get the real family from the address itself */
+               if (!interpret_string_addr(&ss, sock_addr, 0)) {
+                       talloc_free(stream_socket);
+                       return NT_STATUS_INVALID_ADDRESS;
+               }
+
+               socket_address = socket_address_from_sockaddr_storage(stream_socket, &ss, port?*port:0);
+               if (socket_address == NULL) {
+                       TALLOC_FREE(stream_socket);
+                       return NT_STATUS_NO_MEMORY;
+               }
+
+               status = socket_create(socket_address->family, SOCKET_TYPE_STREAM, &stream_socket->sock, 0);
+               NT_STATUS_NOT_OK_RETURN(status);
+       } else {
+               status = socket_create(family, SOCKET_TYPE_STREAM, &stream_socket->sock, 0);
+               NT_STATUS_NOT_OK_RETURN(status);
+
+               /* this is for non-IP sockets, eg. unix domain sockets */
+               socket_address = socket_address_from_strings(stream_socket,
+                                                            stream_socket->sock->backend_name,
+                                                            sock_addr, port?*port:0);
+               NT_STATUS_HAVE_NO_MEMORY(socket_address);
+       }
+
 
        talloc_steal(stream_socket, stream_socket->sock);
 
@@ -296,39 +337,27 @@ NTSTATUS stream_setup_socket(struct tevent_context *event_context,
        /* Some sockets don't have a port, or are just described from
         * the string.  We are indicating this by having port == NULL */
        if (!port) {
-               socket_address = socket_address_from_strings(stream_socket, 
-                                                            stream_socket->sock->backend_name,
-                                                            sock_addr, 0);
-               NT_STATUS_HAVE_NO_MEMORY(socket_address);
                status = socket_listen(stream_socket->sock, socket_address, SERVER_LISTEN_BACKLOG, 0);
-               talloc_free(socket_address);
-
        } else if (*port == 0) {
-               for (i=SERVER_TCP_LOW_PORT;i<= SERVER_TCP_HIGH_PORT;i++) {
-                       socket_address = socket_address_from_strings(stream_socket, 
-                                                                    stream_socket->sock->backend_name,
-                                                                    sock_addr, i);
-                       NT_STATUS_HAVE_NO_MEMORY(socket_address);
+               for (i = lpcfg_rpc_low_port(lp_ctx);
+                    i <= lpcfg_rpc_high_port(lp_ctx);
+                    i++) {
+                       socket_address->port = i;
                        status = socket_listen(stream_socket->sock, socket_address, 
                                               SERVER_LISTEN_BACKLOG, 0);
-                       talloc_free(socket_address);
                        if (NT_STATUS_IS_OK(status)) {
                                *port = i;
                                break;
                        }
                }
        } else {
-               socket_address = socket_address_from_strings(stream_socket, 
-                                                            stream_socket->sock->backend_name,
-                                                            sock_addr, *port);
-               NT_STATUS_HAVE_NO_MEMORY(socket_address);
                status = socket_listen(stream_socket->sock, socket_address, SERVER_LISTEN_BACKLOG, 0);
-               talloc_free(socket_address);
        }
 
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0,("Failed to listen on %s:%u - %s\n",
-                       sock_addr, *port, nt_errstr(status)));
+                        sock_addr, port ? (unsigned int)(*port) : 0,
+                        nt_errstr(status)));
                talloc_free(stream_socket);
                return status;
        }
@@ -360,6 +389,7 @@ NTSTATUS stream_setup_socket(struct tevent_context *event_context,
        return NT_STATUS_OK;
 }
 
+
 /*
   setup a connection title 
 */