mirror of
https://github.com/samba-team/samba.git
synced 2025-02-03 13:47:25 +03:00
s4:smbd: Use tstream_npa_accept_existing to accept named pipe connections
Pair-programmed-with: Stefan Metzmacher <metze@samba.org>
This commit is contained in:
Simo Sorce
Stefan Metzmacher
parent
2e171239f9
commit
3c8dc5cd21
@ -361,21 +361,20 @@ static void dcesrv_sock_accept(struct stream_connection *srv_conn)
|
||||
|
||||
if (dcesrv_sock->endpoint->ep_description->transport == NCACN_NP) {
|
||||
dcesrv_conn->auth_state.session_key = dcesrv_inherited_session_key;
|
||||
ret = tstream_npa_existing_socket(dcesrv_conn,
|
||||
socket_get_fd(srv_conn->socket),
|
||||
FILE_TYPE_MESSAGE_MODE_PIPE,
|
||||
&dcesrv_conn->stream);
|
||||
dcesrv_conn->stream = talloc_move(dcesrv_conn,
|
||||
&srv_conn->tstream);
|
||||
} else {
|
||||
ret = tstream_bsd_existing_socket(dcesrv_conn,
|
||||
socket_get_fd(srv_conn->socket),
|
||||
&dcesrv_conn->stream);
|
||||
}
|
||||
if (ret == -1) {
|
||||
status = map_nt_error_from_unix(errno);
|
||||
DEBUG(0,("dcesrv_sock_accept: failed to setup tstream: %s\n",
|
||||
nt_errstr(status)));
|
||||
stream_terminate_connection(srv_conn, nt_errstr(status));
|
||||
return;
|
||||
if (ret == -1) {
|
||||
status = map_nt_error_from_unix(errno);
|
||||
DEBUG(0, ("dcesrv_sock_accept: "
|
||||
"failed to setup tstream: %s\n",
|
||||
nt_errstr(status)));
|
||||
stream_terminate_connection(srv_conn, nt_errstr(status));
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
dcesrv_conn->local_address = srv_conn->local_address;
|
||||
@ -545,9 +544,10 @@ static NTSTATUS dcesrv_add_ep_np(struct dcesrv_context *dce_ctx,
|
||||
dcesrv_sock->endpoint = e;
|
||||
dcesrv_sock->dcesrv_ctx = talloc_reference(dcesrv_sock, dce_ctx);
|
||||
|
||||
status = stream_setup_named_pipe(event_ctx, lp_ctx,
|
||||
model_ops, &dcesrv_stream_ops,
|
||||
e->ep_description->endpoint, dcesrv_sock);
|
||||
status = tstream_setup_named_pipe(event_ctx, lp_ctx,
|
||||
model_ops, &dcesrv_stream_ops,
|
||||
e->ep_description->endpoint,
|
||||
dcesrv_sock);
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
DEBUG(0,("stream_setup_named_pipe(pipe=%s) failed - %s\n",
|
||||
e->ep_description->endpoint, nt_errstr(status)));
|
||||
|
||||
@ -36,6 +36,7 @@
|
||||
#include "auth/credentials/credentials.h"
|
||||
#include "auth/credentials/credentials_krb5.h"
|
||||
#include "libcli/security/dom_sid.h"
|
||||
#include "libcli/named_pipe_auth/npa_tstream.h"
|
||||
|
||||
struct named_pipe_socket {
|
||||
const char *pipe_name;
|
||||
@ -44,234 +45,127 @@ struct named_pipe_socket {
|
||||
void *private_data;
|
||||
};
|
||||
|
||||
struct named_pipe_connection {
|
||||
struct stream_connection *connection;
|
||||
const struct named_pipe_socket *pipe_sock;
|
||||
struct tstream_context *tstream;
|
||||
};
|
||||
|
||||
static void named_pipe_terminate_connection(struct named_pipe_connection *pipe_conn, const char *reason)
|
||||
{
|
||||
stream_terminate_connection(pipe_conn->connection, reason);
|
||||
}
|
||||
|
||||
static NTSTATUS named_pipe_full_request(void *private_data, DATA_BLOB blob, size_t *size)
|
||||
{
|
||||
if (blob.length < 8) {
|
||||
return STATUS_MORE_ENTRIES;
|
||||
}
|
||||
|
||||
if (memcmp(NAMED_PIPE_AUTH_MAGIC, &blob.data[4], 4) != 0) {
|
||||
DEBUG(0,("named_pipe_full_request: wrong protocol\n"));
|
||||
*size = blob.length;
|
||||
/* the error will be handled in named_pipe_recv_auth_request */
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
*size = 4 + RIVAL(blob.data, 0);
|
||||
if (*size > blob.length) {
|
||||
return STATUS_MORE_ENTRIES;
|
||||
}
|
||||
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
static void named_pipe_auth_request(struct tevent_req *subreq);
|
||||
static void named_pipe_accept_done(struct tevent_req *subreq);
|
||||
|
||||
static void named_pipe_accept(struct stream_connection *conn)
|
||||
{
|
||||
struct named_pipe_socket *pipe_sock = talloc_get_type(conn->private_data,
|
||||
struct named_pipe_socket);
|
||||
struct named_pipe_connection *pipe_conn;
|
||||
struct tstream_context *plain_tstream;
|
||||
int fd;
|
||||
struct tevent_req *subreq;
|
||||
int rc, fd;
|
||||
int ret;
|
||||
|
||||
pipe_conn = talloc_zero(conn, struct named_pipe_connection);
|
||||
if (pipe_conn == NULL) {
|
||||
stream_terminate_connection(conn,
|
||||
"named_pipe_accept: out of memory");
|
||||
return;
|
||||
}
|
||||
/* Let tstream take over fd operations */
|
||||
|
||||
fd = socket_get_fd(conn->socket);
|
||||
socket_set_flags(conn->socket, SOCKET_FLAG_NOCLOSE);
|
||||
TALLOC_FREE(conn->event.fde);
|
||||
TALLOC_FREE(conn->socket);
|
||||
|
||||
/*
|
||||
* We have to duplicate the fd, cause it gets closed when the tstream
|
||||
* is freed and you shouldn't work a fd the tstream is based on.
|
||||
*/
|
||||
fd = dup(socket_get_fd(conn->socket));
|
||||
if (fd == -1) {
|
||||
char *reason;
|
||||
|
||||
reason = talloc_asprintf(conn,
|
||||
"named_pipe_accept: failed to duplicate the file descriptor - %s",
|
||||
strerror(errno));
|
||||
if (reason == NULL) {
|
||||
reason = strerror(errno);
|
||||
}
|
||||
stream_terminate_connection(conn, reason);
|
||||
}
|
||||
rc = tstream_bsd_existing_socket(pipe_conn,
|
||||
fd,
|
||||
&pipe_conn->tstream);
|
||||
if (rc < 0) {
|
||||
ret = tstream_bsd_existing_socket(conn, fd, &plain_tstream);
|
||||
if (ret != 0) {
|
||||
stream_terminate_connection(conn,
|
||||
"named_pipe_accept: out of memory");
|
||||
return;
|
||||
}
|
||||
|
||||
pipe_conn->connection = conn;
|
||||
pipe_conn->pipe_sock = pipe_sock;
|
||||
conn->private_data = pipe_conn;
|
||||
|
||||
/*
|
||||
* The named pipe pdu's have the length as 8 byte (initial_read_size),
|
||||
* named_pipe_full_request provides the pdu length then.
|
||||
*/
|
||||
subreq = tstream_read_pdu_blob_send(pipe_conn,
|
||||
pipe_conn->connection->event.ctx,
|
||||
pipe_conn->tstream,
|
||||
8, /* initial_read_size */
|
||||
named_pipe_full_request,
|
||||
pipe_conn);
|
||||
subreq = tstream_npa_accept_existing_send(conn, conn->event.ctx,
|
||||
plain_tstream,
|
||||
FILE_TYPE_MESSAGE_MODE_PIPE,
|
||||
0xff | 0x0400 | 0x0100,
|
||||
4096);
|
||||
if (subreq == NULL) {
|
||||
named_pipe_terminate_connection(pipe_conn,
|
||||
"named_pipe_accept: "
|
||||
"no memory for tstream_read_pdu_blob_send");
|
||||
stream_terminate_connection(conn,
|
||||
"named_pipe_accept: "
|
||||
"no memory for tstream_npa_accept_existing_send");
|
||||
return;
|
||||
}
|
||||
tevent_req_set_callback(subreq, named_pipe_auth_request, pipe_conn);
|
||||
tevent_req_set_callback(subreq, named_pipe_accept_done, conn);
|
||||
}
|
||||
|
||||
struct named_pipe_call {
|
||||
struct named_pipe_connection *pipe_conn;
|
||||
DATA_BLOB in;
|
||||
DATA_BLOB out;
|
||||
struct iovec out_iov[1];
|
||||
NTSTATUS status;
|
||||
};
|
||||
|
||||
static void named_pipe_handover_connection(struct tevent_req *subreq);
|
||||
|
||||
static void named_pipe_auth_request(struct tevent_req *subreq)
|
||||
static void named_pipe_accept_done(struct tevent_req *subreq)
|
||||
{
|
||||
struct named_pipe_connection *pipe_conn = tevent_req_callback_data(subreq,
|
||||
struct named_pipe_connection);
|
||||
struct stream_connection *conn = pipe_conn->connection;
|
||||
struct named_pipe_call *call;
|
||||
enum ndr_err_code ndr_err;
|
||||
struct stream_connection *conn = tevent_req_callback_data(subreq,
|
||||
struct stream_connection);
|
||||
struct named_pipe_socket *pipe_sock =
|
||||
talloc_get_type(conn->private_data,
|
||||
struct named_pipe_socket);
|
||||
struct tsocket_address *client;
|
||||
char *client_name;
|
||||
struct tsocket_address *server;
|
||||
char *server_name;
|
||||
struct netr_SamInfo3 *info3;
|
||||
DATA_BLOB session_key;
|
||||
DATA_BLOB delegated_creds;
|
||||
|
||||
union netr_Validation val;
|
||||
struct auth_serversupplied_info *server_info;
|
||||
struct named_pipe_auth_req pipe_request;
|
||||
struct named_pipe_auth_rep pipe_reply;
|
||||
struct auth_context *auth_context;
|
||||
uint32_t session_flags = 0;
|
||||
struct dom_sid *anonymous_sid;
|
||||
const char *reason = NULL;
|
||||
TALLOC_CTX *tmp_ctx;
|
||||
NTSTATUS status;
|
||||
int error;
|
||||
int ret;
|
||||
|
||||
call = talloc(pipe_conn, struct named_pipe_call);
|
||||
if (call == NULL) {
|
||||
named_pipe_terminate_connection(pipe_conn,
|
||||
"named_pipe_auth_request: "
|
||||
"no memory for named_pipe_call");
|
||||
return;
|
||||
tmp_ctx = talloc_new(conn);
|
||||
if (!tmp_ctx) {
|
||||
reason = "Out of memory!\n";
|
||||
goto out;
|
||||
}
|
||||
call->pipe_conn = pipe_conn;
|
||||
|
||||
status = tstream_read_pdu_blob_recv(subreq,
|
||||
call,
|
||||
&call->in);
|
||||
ret = tstream_npa_accept_existing_recv(subreq, &error, tmp_ctx,
|
||||
&conn->tstream,
|
||||
&client,
|
||||
&client_name,
|
||||
&server,
|
||||
&server_name,
|
||||
&info3,
|
||||
&session_key,
|
||||
&delegated_creds);
|
||||
TALLOC_FREE(subreq);
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
const char *reason;
|
||||
if (ret != 0) {
|
||||
reason = talloc_asprintf(conn,
|
||||
"tstream_npa_accept_existing_recv()"
|
||||
" failed: %s", strerror(error));
|
||||
goto out;
|
||||
}
|
||||
|
||||
reason = talloc_asprintf(call, "named_pipe_call_loop: "
|
||||
"tstream_read_pdu_blob_recv() - %s",
|
||||
nt_errstr(status));
|
||||
if (reason == NULL) {
|
||||
reason = nt_errstr(status);
|
||||
DEBUG(10, ("Accepted npa connection from %s. "
|
||||
"Client: %s (%s). Server: %s (%s)\n",
|
||||
tsocket_address_string(conn->remote_address, tmp_ctx),
|
||||
client_name, tsocket_address_string(client, tmp_ctx),
|
||||
server_name, tsocket_address_string(server, tmp_ctx)));
|
||||
|
||||
if (info3) {
|
||||
val.sam3 = info3;
|
||||
|
||||
status = make_server_info_netlogon_validation(conn,
|
||||
val.sam3->base.account_name.string,
|
||||
3, &val, &server_info);
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
reason = talloc_asprintf(conn,
|
||||
"make_server_info_netlogon_validation "
|
||||
"returned: %s", nt_errstr(status));
|
||||
goto out;
|
||||
}
|
||||
|
||||
named_pipe_terminate_connection(pipe_conn, reason);
|
||||
return;
|
||||
}
|
||||
|
||||
DEBUG(10,("Received named_pipe packet of length %lu from %s\n",
|
||||
(long) call->in.length,
|
||||
tsocket_address_string(pipe_conn->connection->remote_address, call)));
|
||||
dump_data(11, call->in.data, call->in.length);
|
||||
|
||||
/*
|
||||
* TODO: check it's a root (uid == 0) pipe
|
||||
*/
|
||||
|
||||
ZERO_STRUCT(pipe_reply);
|
||||
pipe_reply.level = 0;
|
||||
pipe_reply.status = NT_STATUS_INTERNAL_ERROR;
|
||||
|
||||
/* parse the passed credentials */
|
||||
ndr_err = ndr_pull_struct_blob_all(
|
||||
&call->in,
|
||||
pipe_conn,
|
||||
&pipe_request,
|
||||
(ndr_pull_flags_fn_t) ndr_pull_named_pipe_auth_req);
|
||||
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
||||
pipe_reply.status = ndr_map_error2ntstatus(ndr_err);
|
||||
DEBUG(2, ("Could not unmarshall named_pipe_auth_req: %s\n",
|
||||
nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
if (DEBUGLVL(10)) {
|
||||
NDR_PRINT_DEBUG(named_pipe_auth_req, &pipe_request);
|
||||
}
|
||||
|
||||
if (strcmp(NAMED_PIPE_AUTH_MAGIC, pipe_request.magic) != 0) {
|
||||
DEBUG(2, ("named_pipe_auth_req: invalid magic '%s' != %s\n",
|
||||
pipe_request.magic, NAMED_PIPE_AUTH_MAGIC));
|
||||
pipe_reply.status = NT_STATUS_INVALID_PARAMETER;
|
||||
goto reply;
|
||||
}
|
||||
|
||||
switch (pipe_request.level) {
|
||||
case 0:
|
||||
/*
|
||||
* anon connection, we don't create a session info
|
||||
* and leave it NULL
|
||||
*/
|
||||
pipe_reply.level = 0;
|
||||
pipe_reply.status = NT_STATUS_OK;
|
||||
break;
|
||||
case 1:
|
||||
val.sam3 = &pipe_request.info.info1;
|
||||
|
||||
pipe_reply.level = 1;
|
||||
pipe_reply.status = make_server_info_netlogon_validation(pipe_conn,
|
||||
"TODO",
|
||||
3, &val,
|
||||
&server_info);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("make_server_info_netlogon_validation returned "
|
||||
"%s\n", nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
status = auth_context_create(conn, conn->event.ctx,
|
||||
conn->msg_ctx, conn->lp_ctx,
|
||||
&auth_context);
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
reason = talloc_asprintf(conn,
|
||||
"auth_context_create returned: %s",
|
||||
nt_errstr(status));
|
||||
goto out;
|
||||
}
|
||||
|
||||
pipe_reply.status = auth_context_create(conn,
|
||||
conn->event.ctx, conn->msg_ctx,
|
||||
conn->lp_ctx,
|
||||
&auth_context);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("auth_context_create returned "
|
||||
"%s\n", nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
anonymous_sid = dom_sid_parse_talloc(auth_context, SID_NT_ANONYMOUS);
|
||||
anonymous_sid = dom_sid_parse_talloc(auth_context,
|
||||
SID_NT_ANONYMOUS);
|
||||
if (anonymous_sid == NULL) {
|
||||
named_pipe_terminate_connection(pipe_conn, "Failed to parse Anonymous SID ");
|
||||
talloc_free(auth_context);
|
||||
return;
|
||||
reason = "Failed to parse Anonymous SID ";
|
||||
goto out;
|
||||
}
|
||||
|
||||
session_flags = AUTH_SESSION_INFO_DEFAULT_GROUPS;
|
||||
@ -279,355 +173,98 @@ static void named_pipe_auth_request(struct tevent_req *subreq)
|
||||
session_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
|
||||
}
|
||||
|
||||
|
||||
/* setup the session_info on the connection */
|
||||
pipe_reply.status = auth_context->generate_session_info(conn,
|
||||
auth_context,
|
||||
server_info,
|
||||
session_flags,
|
||||
&conn->session_info);
|
||||
status = auth_context->generate_session_info(conn,
|
||||
auth_context,
|
||||
server_info,
|
||||
session_flags,
|
||||
&conn->session_info);
|
||||
talloc_free(auth_context);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("auth_generate_session_info failed: %s\n",
|
||||
nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
if (!NT_STATUS_IS_OK(status)) {
|
||||
reason = talloc_asprintf(conn,
|
||||
"auth_generate_session_info "
|
||||
"returned: %s", nt_errstr(status));
|
||||
goto out;
|
||||
}
|
||||
|
||||
break;
|
||||
case 2:
|
||||
pipe_reply.level = 2;
|
||||
pipe_reply.info.info2.file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
|
||||
pipe_reply.info.info2.device_state = 0xff | 0x0400 | 0x0100;
|
||||
pipe_reply.info.info2.allocation_size = 4096;
|
||||
|
||||
if (pipe_request.info.info2.sam_info3 == NULL) {
|
||||
/*
|
||||
* anon connection, we don't create a session info
|
||||
* and leave it NULL
|
||||
*/
|
||||
pipe_reply.status = NT_STATUS_OK;
|
||||
break;
|
||||
}
|
||||
|
||||
val.sam3 = pipe_request.info.info2.sam_info3;
|
||||
|
||||
pipe_reply.status = make_server_info_netlogon_validation(pipe_conn,
|
||||
val.sam3->base.account_name.string,
|
||||
3, &val, &server_info);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("make_server_info_netlogon_validation returned "
|
||||
"%s\n", nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
/* setup the session_info on the connection */
|
||||
pipe_reply.status = auth_context_create(conn,
|
||||
conn->event.ctx, conn->msg_ctx,
|
||||
conn->lp_ctx,
|
||||
&auth_context);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("auth_context_create returned "
|
||||
"%s\n", nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
anonymous_sid = dom_sid_parse_talloc(auth_context, SID_NT_ANONYMOUS);
|
||||
if (anonymous_sid == NULL) {
|
||||
named_pipe_terminate_connection(pipe_conn, "Failed to parse Anonymous SID ");
|
||||
talloc_free(auth_context);
|
||||
return;
|
||||
}
|
||||
|
||||
session_flags = AUTH_SESSION_INFO_DEFAULT_GROUPS;
|
||||
if (!dom_sid_equal(anonymous_sid, server_info->account_sid)) {
|
||||
session_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
|
||||
}
|
||||
|
||||
pipe_reply.status = auth_context->generate_session_info(conn,
|
||||
auth_context,
|
||||
server_info,
|
||||
session_flags,
|
||||
&conn->session_info);
|
||||
talloc_free(auth_context);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("auth_generate_session_info failed: %s\n",
|
||||
nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
conn->session_info->session_key = data_blob_const(pipe_request.info.info2.session_key,
|
||||
pipe_request.info.info2.session_key_length);
|
||||
talloc_steal(conn->session_info, pipe_request.info.info2.session_key);
|
||||
|
||||
break;
|
||||
case 3:
|
||||
pipe_reply.level = 3;
|
||||
pipe_reply.info.info3.file_type = FILE_TYPE_MESSAGE_MODE_PIPE;
|
||||
pipe_reply.info.info3.device_state = 0xff | 0x0400 | 0x0100;
|
||||
pipe_reply.info.info3.allocation_size = 4096;
|
||||
|
||||
if (pipe_request.info.info3.server_addr == NULL) {
|
||||
pipe_reply.status = NT_STATUS_INVALID_ADDRESS;
|
||||
DEBUG(2, ("Missing server address\n"));
|
||||
goto reply;
|
||||
}
|
||||
if (pipe_request.info.info3.client_addr == NULL) {
|
||||
pipe_reply.status = NT_STATUS_INVALID_ADDRESS;
|
||||
DEBUG(2, ("Missing client address\n"));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
ret = tsocket_address_inet_from_strings(conn, "ip",
|
||||
pipe_request.info.info3.server_addr,
|
||||
pipe_request.info.info3.server_port,
|
||||
&conn->local_address);
|
||||
if (ret != 0) {
|
||||
DEBUG(2, ("Invalid server address[%s] port[%u] - %s\n",
|
||||
pipe_request.info.info3.server_addr,
|
||||
pipe_request.info.info3.server_port,
|
||||
strerror(errno)));
|
||||
pipe_reply.status = NT_STATUS_INVALID_ADDRESS;
|
||||
goto reply;
|
||||
}
|
||||
|
||||
ret = tsocket_address_inet_from_strings(conn, "ip",
|
||||
pipe_request.info.info3.client_addr,
|
||||
pipe_request.info.info3.client_port,
|
||||
&conn->remote_address);
|
||||
if (ret != 0) {
|
||||
DEBUG(2, ("Invalid client address[%s] port[%u] - %s\n",
|
||||
pipe_request.info.info3.client_addr,
|
||||
pipe_request.info.info3.client_port,
|
||||
strerror(errno)));
|
||||
pipe_reply.status = NT_STATUS_INVALID_ADDRESS;
|
||||
goto reply;
|
||||
}
|
||||
|
||||
if (pipe_request.info.info3.sam_info3 == NULL) {
|
||||
/*
|
||||
* anon connection, we don't create a session info
|
||||
* and leave it NULL
|
||||
*/
|
||||
pipe_reply.status = NT_STATUS_OK;
|
||||
break;
|
||||
}
|
||||
|
||||
val.sam3 = pipe_request.info.info3.sam_info3;
|
||||
|
||||
pipe_reply.status = make_server_info_netlogon_validation(pipe_conn,
|
||||
val.sam3->base.account_name.string,
|
||||
3, &val, &server_info);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("make_server_info_netlogon_validation returned "
|
||||
"%s\n", nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
/* setup the session_info on the connection */
|
||||
pipe_reply.status = auth_context_create(conn,
|
||||
conn->event.ctx, conn->msg_ctx,
|
||||
conn->lp_ctx,
|
||||
&auth_context);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("auth_context_create returned "
|
||||
"%s\n", nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
anonymous_sid = dom_sid_parse_talloc(auth_context, SID_NT_ANONYMOUS);
|
||||
if (anonymous_sid == NULL) {
|
||||
named_pipe_terminate_connection(pipe_conn, "Failed to parse Anonymous SID ");
|
||||
talloc_free(auth_context);
|
||||
return;
|
||||
}
|
||||
|
||||
session_flags = AUTH_SESSION_INFO_DEFAULT_GROUPS;
|
||||
if (!dom_sid_equal(anonymous_sid, server_info->account_sid)) {
|
||||
session_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
|
||||
}
|
||||
|
||||
/* setup the session_info on the connection */
|
||||
pipe_reply.status = auth_context->generate_session_info(conn,
|
||||
auth_context,
|
||||
server_info,
|
||||
session_flags,
|
||||
&conn->session_info);
|
||||
talloc_free(auth_context);
|
||||
if (!NT_STATUS_IS_OK(pipe_reply.status)) {
|
||||
DEBUG(2, ("auth_generate_session_info failed: %s\n",
|
||||
nt_errstr(pipe_reply.status)));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
if (pipe_request.info.info3.gssapi_delegated_creds_length) {
|
||||
OM_uint32 minor_status;
|
||||
gss_buffer_desc cred_token;
|
||||
gss_cred_id_t cred_handle;
|
||||
const char *error_string;
|
||||
|
||||
DEBUG(10, ("named_pipe_auth: delegated credentials supplied by client\n"));
|
||||
|
||||
cred_token.value = pipe_request.info.info3.gssapi_delegated_creds;
|
||||
cred_token.length = pipe_request.info.info3.gssapi_delegated_creds_length;
|
||||
|
||||
ret = gss_import_cred(&minor_status,
|
||||
&cred_token,
|
||||
&cred_handle);
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
pipe_reply.status = NT_STATUS_INTERNAL_ERROR;
|
||||
goto reply;
|
||||
}
|
||||
|
||||
conn->session_info->credentials = cli_credentials_init(conn->session_info);
|
||||
if (conn->session_info->credentials == NULL) {
|
||||
pipe_reply.status = NT_STATUS_NO_MEMORY;
|
||||
goto reply;
|
||||
}
|
||||
|
||||
cli_credentials_set_conf(conn->session_info->credentials,
|
||||
conn->lp_ctx);
|
||||
/* Just so we don't segfault trying to get at a username */
|
||||
cli_credentials_set_anonymous(conn->session_info->credentials);
|
||||
|
||||
ret = cli_credentials_set_client_gss_creds(conn->session_info->credentials,
|
||||
conn->event.ctx,
|
||||
conn->lp_ctx,
|
||||
cred_handle,
|
||||
CRED_SPECIFIED, &error_string);
|
||||
if (ret) {
|
||||
pipe_reply.status = NT_STATUS_INTERNAL_ERROR;
|
||||
DEBUG(2, ("Failed to set pipe forwarded creds: %s\n", error_string));
|
||||
goto reply;
|
||||
}
|
||||
|
||||
/* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */
|
||||
cli_credentials_set_kerberos_state(conn->session_info->credentials,
|
||||
CRED_MUST_USE_KERBEROS);
|
||||
}
|
||||
|
||||
conn->session_info->session_key = data_blob_const(pipe_request.info.info3.session_key,
|
||||
pipe_request.info.info3.session_key_length);
|
||||
talloc_steal(conn->session_info, pipe_request.info.info3.session_key);
|
||||
|
||||
break;
|
||||
default:
|
||||
DEBUG(0, ("named_pipe_auth_req: unknown level %u\n",
|
||||
pipe_request.level));
|
||||
pipe_reply.level = 0;
|
||||
pipe_reply.status = NT_STATUS_INVALID_LEVEL;
|
||||
goto reply;
|
||||
}
|
||||
|
||||
reply:
|
||||
/* create the output */
|
||||
ndr_err = ndr_push_struct_blob(&call->out, pipe_conn,
|
||||
&pipe_reply,
|
||||
(ndr_push_flags_fn_t)ndr_push_named_pipe_auth_rep);
|
||||
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
||||
const char *reason;
|
||||
status = ndr_map_error2ntstatus(ndr_err);
|
||||
|
||||
reason = talloc_asprintf(pipe_conn, "named_pipe_auth_request: could not marshall named_pipe_auth_rep: %s\n",
|
||||
nt_errstr(status));
|
||||
if (reason == NULL) {
|
||||
reason = "named_pipe_auth_request: could not marshall named_pipe_auth_rep";
|
||||
}
|
||||
named_pipe_terminate_connection(pipe_conn, reason);
|
||||
return;
|
||||
if (session_key.length) {
|
||||
conn->session_info->session_key = session_key;
|
||||
talloc_steal(conn->session_info, session_key.data);
|
||||
}
|
||||
|
||||
DEBUG(10,("named_pipe_auth_request: named_pipe_auth reply[%u]\n",
|
||||
(unsigned) call->out.length));
|
||||
dump_data(11, call->out.data, call->out.length);
|
||||
if (DEBUGLVL(10)) {
|
||||
NDR_PRINT_DEBUG(named_pipe_auth_rep, &pipe_reply);
|
||||
}
|
||||
if (delegated_creds.length) {
|
||||
struct cli_credentials *creds;
|
||||
OM_uint32 minor_status;
|
||||
gss_buffer_desc cred_token;
|
||||
gss_cred_id_t cred_handle;
|
||||
const char *error_string;
|
||||
|
||||
call->status = pipe_reply.status;
|
||||
DEBUG(10, ("Delegated credentials supplied by client\n"));
|
||||
|
||||
call->out_iov[0].iov_base = call->out.data;
|
||||
call->out_iov[0].iov_len = call->out.length;
|
||||
cred_token.value = delegated_creds.data;
|
||||
cred_token.length = delegated_creds.length;
|
||||
|
||||
subreq = tstream_writev_send(call,
|
||||
pipe_conn->connection->event.ctx,
|
||||
pipe_conn->tstream,
|
||||
call->out_iov, 1);
|
||||
if (subreq == NULL) {
|
||||
named_pipe_terminate_connection(pipe_conn, "named_pipe_auth_request: "
|
||||
"no memory for tstream_writev_send");
|
||||
return;
|
||||
}
|
||||
|
||||
tevent_req_set_callback(subreq, named_pipe_handover_connection, call);
|
||||
}
|
||||
|
||||
static void named_pipe_handover_connection(struct tevent_req *subreq)
|
||||
{
|
||||
struct named_pipe_call *call = tevent_req_callback_data(subreq,
|
||||
struct named_pipe_call);
|
||||
struct named_pipe_connection *pipe_conn = call->pipe_conn;
|
||||
struct stream_connection *conn = pipe_conn->connection;
|
||||
int sys_errno;
|
||||
int rc;
|
||||
|
||||
rc = tstream_writev_recv(subreq, &sys_errno);
|
||||
TALLOC_FREE(subreq);
|
||||
if (rc == -1) {
|
||||
const char *reason;
|
||||
|
||||
reason = talloc_asprintf(call, "named_pipe_handover_connection: "
|
||||
"tstream_writev_recv() - %d:%s",
|
||||
sys_errno, strerror(sys_errno));
|
||||
if (reason == NULL) {
|
||||
reason = "named_pipe_handover_connection: "
|
||||
"tstream_writev_recv() failed";
|
||||
ret = gss_import_cred(&minor_status,
|
||||
&cred_token,
|
||||
&cred_handle);
|
||||
if (ret != GSS_S_COMPLETE) {
|
||||
reason = "Internal error in gss_import_cred()";
|
||||
goto out;
|
||||
}
|
||||
|
||||
named_pipe_terminate_connection(pipe_conn, reason);
|
||||
return;
|
||||
}
|
||||
creds = cli_credentials_init(conn->session_info);
|
||||
if (!creds) {
|
||||
reason = "Out of memory in cli_credentials_init()";
|
||||
goto out;
|
||||
}
|
||||
conn->session_info->credentials = creds;
|
||||
|
||||
if (!NT_STATUS_IS_OK(call->status)) {
|
||||
const char *reason;
|
||||
cli_credentials_set_conf(creds, conn->lp_ctx);
|
||||
/* Just so we don't segfault trying to get at a username */
|
||||
cli_credentials_set_anonymous(creds);
|
||||
|
||||
reason = talloc_asprintf(call, "named_pipe_handover_connection: "
|
||||
"reply status - %s", nt_errstr(call->status));
|
||||
if (reason == NULL) {
|
||||
reason = nt_errstr(call->status);
|
||||
ret = cli_credentials_set_client_gss_creds(creds,
|
||||
conn->event.ctx,
|
||||
conn->lp_ctx,
|
||||
cred_handle,
|
||||
CRED_SPECIFIED,
|
||||
&error_string);
|
||||
if (ret) {
|
||||
reason = talloc_asprintf(conn,
|
||||
"Failed to set pipe forwarded"
|
||||
"creds: %s\n", error_string);
|
||||
goto out;
|
||||
}
|
||||
|
||||
named_pipe_terminate_connection(pipe_conn, reason);
|
||||
return;
|
||||
}
|
||||
/* This credential handle isn't useful for password
|
||||
* authentication, so ensure nobody tries to do that */
|
||||
cli_credentials_set_kerberos_state(creds,
|
||||
CRED_MUST_USE_KERBEROS);
|
||||
|
||||
/*
|
||||
* remove the named_pipe layer together with its packet layer
|
||||
*/
|
||||
conn->ops = pipe_conn->pipe_sock->ops;
|
||||
conn->private_data = pipe_conn->pipe_sock->private_data;
|
||||
talloc_unlink(conn, pipe_conn);
|
||||
|
||||
conn->event.fde = tevent_add_fd(conn->event.ctx,
|
||||
conn,
|
||||
socket_get_fd(conn->socket),
|
||||
TEVENT_FD_READ,
|
||||
stream_io_handler_fde,
|
||||
conn);
|
||||
if (conn->event.fde == NULL) {
|
||||
named_pipe_terminate_connection(pipe_conn, "named_pipe_handover_connection: "
|
||||
"setting up the stream_io_handler_fde failed");
|
||||
return;
|
||||
}
|
||||
|
||||
/*
|
||||
* hand over to the real pipe implementation,
|
||||
* now that we have setup the transport session_info
|
||||
*/
|
||||
conn->ops = pipe_sock->ops;
|
||||
conn->private_data = pipe_sock->private_data;
|
||||
conn->ops->accept_connection(conn);
|
||||
|
||||
DEBUG(10,("named_pipe_handover_connection[%s]: succeeded\n",
|
||||
conn->ops->name));
|
||||
DEBUG(10, ("named pipe connection [%s] established\n",
|
||||
conn->ops->name));
|
||||
|
||||
/* we don't have to free call here as the connection got closed */
|
||||
talloc_free(tmp_ctx);
|
||||
return;
|
||||
|
||||
out:
|
||||
talloc_free(tmp_ctx);
|
||||
if (!reason) {
|
||||
reason = "Internal error";
|
||||
}
|
||||
stream_terminate_connection(conn, reason);
|
||||
}
|
||||
|
||||
/*
|
||||
@ -635,11 +272,7 @@ static void named_pipe_handover_connection(struct tevent_req *subreq)
|
||||
*/
|
||||
static void named_pipe_recv(struct stream_connection *conn, uint16_t flags)
|
||||
{
|
||||
struct named_pipe_connection *pipe_conn = talloc_get_type(
|
||||
conn->private_data, struct named_pipe_connection);
|
||||
|
||||
named_pipe_terminate_connection(pipe_conn,
|
||||
"named_pipe_recv: called");
|
||||
stream_terminate_connection(conn, "named_pipe_recv: called");
|
||||
}
|
||||
|
||||
/*
|
||||
@ -647,11 +280,7 @@ static void named_pipe_recv(struct stream_connection *conn, uint16_t flags)
|
||||
*/
|
||||
static void named_pipe_send(struct stream_connection *conn, uint16_t flags)
|
||||
{
|
||||
struct named_pipe_connection *pipe_conn = talloc_get_type(
|
||||
conn->private_data, struct named_pipe_connection);
|
||||
|
||||
named_pipe_terminate_connection(pipe_conn,
|
||||
"named_pipe_send: called");
|
||||
stream_terminate_connection(conn, "named_pipe_send: called");
|
||||
}
|
||||
|
||||
static const struct stream_server_ops named_pipe_stream_ops = {
|
||||
@ -661,12 +290,12 @@ static const struct stream_server_ops named_pipe_stream_ops = {
|
||||
.send_handler = named_pipe_send,
|
||||
};
|
||||
|
||||
NTSTATUS stream_setup_named_pipe(struct tevent_context *event_context,
|
||||
struct loadparm_context *lp_ctx,
|
||||
const struct model_ops *model_ops,
|
||||
const struct stream_server_ops *stream_ops,
|
||||
const char *pipe_name,
|
||||
void *private_data)
|
||||
NTSTATUS tstream_setup_named_pipe(struct tevent_context *event_context,
|
||||
struct loadparm_context *lp_ctx,
|
||||
const struct model_ops *model_ops,
|
||||
const struct stream_server_ops *stream_ops,
|
||||
const char *pipe_name,
|
||||
void *private_data)
|
||||
{
|
||||
char *dirname;
|
||||
struct named_pipe_socket *pipe_sock;
|
||||
@ -707,8 +336,8 @@ NTSTATUS stream_setup_named_pipe(struct tevent_context *event_context,
|
||||
|
||||
talloc_free(dirname);
|
||||
|
||||
pipe_sock->ops = stream_ops;
|
||||
pipe_sock->private_data = talloc_reference(pipe_sock, private_data);
|
||||
pipe_sock->ops = stream_ops;
|
||||
pipe_sock->private_data = private_data;
|
||||
|
||||
status = stream_setup_socket(event_context,
|
||||
lp_ctx,
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user