summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndreas Schneider <asn@samba.org>2012-06-25 18:49:11 +0200
committerAndreas Schneider <asn@cryptomilk.org>2012-07-06 10:00:57 +0200
commit426cf362ed672d44e266c18d58dff1cbe5f61c53 (patch)
tree56812a67eb17f13518c3dd808ca41a89e5436a41
parentbbf70e793c7bbb16a0b147a514a9431b13c40e9c (diff)
downloadsamba-426cf362ed672d44e266c18d58dff1cbe5f61c53.tar.gz
samba-426cf362ed672d44e266c18d58dff1cbe5f61c53.tar.bz2
samba-426cf362ed672d44e266c18d58dff1cbe5f61c53.zip
s3-lsarpc: Restrict lsa_LookupSids3 to ncacn_ip_tcp connections.
See MS-LAT, Section 2.1 Transport.
-rw-r--r--source3/rpc_server/lsa/srv_lsa_nt.c35
1 files changed, 23 insertions, 12 deletions
diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c
index 8ffcd13474..d74ed73fdd 100644
--- a/source3/rpc_server/lsa/srv_lsa_nt.c
+++ b/source3/rpc_server/lsa/srv_lsa_nt.c
@@ -1034,12 +1034,8 @@ NTSTATUS _lsa_LookupSids(struct pipes_struct *p,
return status;
}
-/***************************************************************************
- _lsa_LookupSids2
- ***************************************************************************/
-
-NTSTATUS _lsa_LookupSids2(struct pipes_struct *p,
- struct lsa_LookupSids2 *r)
+static NTSTATUS _lsa_LookupSids_common(struct pipes_struct *p,
+ struct lsa_LookupSids2 *r)
{
NTSTATUS status;
struct lsa_info *handle;
@@ -1049,11 +1045,6 @@ NTSTATUS _lsa_LookupSids2(struct pipes_struct *p,
struct lsa_TranslatedName2 *names = NULL;
bool check_policy = true;
- if (p->transport != NCACN_NP && p->transport != NCALRPC) {
- p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
- return NT_STATUS_ACCESS_DENIED;
- }
-
switch (p->opnum) {
case NDR_LSA_LOOKUPSIDS3:
check_policy = false;
@@ -1106,6 +1097,21 @@ NTSTATUS _lsa_LookupSids2(struct pipes_struct *p,
}
/***************************************************************************
+ _lsa_LookupSids2
+ ***************************************************************************/
+
+NTSTATUS _lsa_LookupSids2(struct pipes_struct *p,
+ struct lsa_LookupSids2 *r)
+{
+ if (p->transport != NCACN_NP && p->transport != NCALRPC) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ return _lsa_LookupSids_common(p, r);
+}
+
+/***************************************************************************
_lsa_LookupSids3
***************************************************************************/
@@ -1114,6 +1120,11 @@ NTSTATUS _lsa_LookupSids3(struct pipes_struct *p,
{
struct lsa_LookupSids2 q;
+ if (p->transport != NCACN_IP_TCP) {
+ p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
/* No policy handle on this call. Restrict to crypto connections. */
if (p->auth.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
DEBUG(0,("_lsa_LookupSids3: client %s not using schannel for netlogon\n",
@@ -1133,7 +1144,7 @@ NTSTATUS _lsa_LookupSids3(struct pipes_struct *p,
q.out.names = r->out.names;
q.out.count = r->out.count;
- return _lsa_LookupSids2(p, &q);
+ return _lsa_LookupSids_common(p, &q);
}
/***************************************************************************