summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndreas Schneider <asn@samba.org>2012-06-25 18:45:35 +0200
committerAndreas Schneider <asn@cryptomilk.org>2012-07-06 10:00:57 +0200
commitbbf70e793c7bbb16a0b147a514a9431b13c40e9c (patch)
tree4038d8aea7d07d4fdd6d77b8bcfa2600cf7f14ae
parenta866dcc4f6696ed409a219b5cdd1baf56ccb2ff0 (diff)
downloadsamba-bbf70e793c7bbb16a0b147a514a9431b13c40e9c.tar.gz
samba-bbf70e793c7bbb16a0b147a514a9431b13c40e9c.tar.bz2
samba-bbf70e793c7bbb16a0b147a514a9431b13c40e9c.zip
s3-lsarpc: Restrict the transport for ncacn_np functions.
See MS-LAT, section 2.1 Transport.
-rw-r--r--source3/rpc_server/lsa/srv_lsa_nt.c42
1 files changed, 42 insertions, 0 deletions
diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c
index 6225820a2d..8ffcd13474 100644
--- a/source3/rpc_server/lsa/srv_lsa_nt.c
+++ b/source3/rpc_server/lsa/srv_lsa_nt.c
@@ -436,6 +436,11 @@ NTSTATUS _lsa_OpenPolicy2(struct pipes_struct *p,
uint32 acc_granted;
NTSTATUS status;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
/* Work out max allowed. */
map_max_allowed_access(p->session_info->security_token,
p->session_info->unix_token,
@@ -481,6 +486,8 @@ NTSTATUS _lsa_OpenPolicy(struct pipes_struct *p,
{
struct lsa_OpenPolicy2 o;
+ /* _lsa_OpenPolicy2 will check if this is a NCACN_NP connection */
+
o.in.system_name = NULL; /* should be ignored */
o.in.attr = r->in.attr;
o.in.access_mask = r->in.access_mask;
@@ -957,6 +964,11 @@ NTSTATUS _lsa_LookupSids(struct pipes_struct *p,
struct lsa_TranslatedName2 *names = NULL;
int i;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if ((r->in.level < 1) || (r->in.level > 6)) {
return NT_STATUS_INVALID_PARAMETER;
}
@@ -1037,6 +1049,11 @@ NTSTATUS _lsa_LookupSids2(struct pipes_struct *p,
struct lsa_TranslatedName2 *names = NULL;
bool check_policy = true;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
switch (p->opnum) {
case NDR_LSA_LOOKUPSIDS3:
check_policy = false;
@@ -1164,6 +1181,11 @@ NTSTATUS _lsa_LookupNames(struct pipes_struct *p,
uint32 mapped_count = 0;
int flags = 0;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if (num_entries > MAX_LOOKUP_SIDS) {
num_entries = MAX_LOOKUP_SIDS;
DEBUG(5,("_lsa_LookupNames: truncating name lookup list to %d\n",
@@ -1239,6 +1261,11 @@ NTSTATUS _lsa_LookupNames2(struct pipes_struct *p,
struct lsa_TransSidArray *sid_array = NULL;
uint32_t i;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
sid_array = talloc_zero(p->mem_ctx, struct lsa_TransSidArray);
if (!sid_array) {
return NT_STATUS_NO_MEMORY;
@@ -1295,6 +1322,11 @@ NTSTATUS _lsa_LookupNames3(struct pipes_struct *p,
int flags = 0;
bool check_policy = true;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
switch (p->opnum) {
case NDR_LSA_LOOKUPNAMES4:
check_policy = false;
@@ -1406,6 +1438,11 @@ NTSTATUS _lsa_LookupNames4(struct pipes_struct *p,
NTSTATUS _lsa_Close(struct pipes_struct *p, struct lsa_Close *r)
{
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if (!find_policy_by_hnd(p, r->in.handle, NULL)) {
return NT_STATUS_INVALID_HANDLE;
}
@@ -2666,6 +2703,11 @@ NTSTATUS _lsa_GetUserName(struct pipes_struct *p,
struct lsa_String *account_name = NULL;
struct lsa_String *authority_name = NULL;
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
if (r->in.account_name &&
*r->in.account_name) {
return NT_STATUS_INVALID_PARAMETER;