summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndreas Schneider <asn@samba.org>2011-08-30 16:37:40 +0200
committerAndreas Schneider <asn@cryptomilk.org>2011-08-30 20:50:54 +0200
commita38ff63fcdc0d3ac1669b1c1343006d9db4e926b (patch)
treefe4f109ee7020bd2d434f8d4e8dba7bd1c255f35
parente52fa6298a461bce125e4292c3c035a7bed22a51 (diff)
downloadsamba-a38ff63fcdc0d3ac1669b1c1343006d9db4e926b.tar.gz
samba-a38ff63fcdc0d3ac1669b1c1343006d9db4e926b.tar.bz2
samba-a38ff63fcdc0d3ac1669b1c1343006d9db4e926b.zip
s3-rpc_server: Make sure we switch always the connecting user.
We always have a valid session info and if it is a anonymous connection we have a session info of the guest user. This means we should always call become_authenticated_pipe_user() else and anonymous user could do things as root. Autobuild-User: Andreas Schneider <asn@cryptomilk.org> Autobuild-Date: Tue Aug 30 20:50:54 CEST 2011 on sn-devel-104
-rw-r--r--source3/rpc_server/srv_pipe.c24
1 files changed, 11 insertions, 13 deletions
diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 058f1b8b14..7a616c0ee6 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -1521,18 +1521,18 @@ static bool api_pipe_request(struct pipes_struct *p,
struct ncacn_packet *pkt)
{
bool ret = False;
- bool changed_user = False;
struct pipe_rpc_fns *pipe_fns;
- if (p->pipe_bound &&
- ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
- (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
- (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
- if(!become_authenticated_pipe_user(p->session_info)) {
- data_blob_free(&p->out_data.rdata);
- return False;
- }
- changed_user = True;
+ if (!p->pipe_bound) {
+ DEBUG(1, ("Pipe not bound!\n"));
+ data_blob_free(&p->out_data.rdata);
+ return false;
+ }
+
+ if (!become_authenticated_pipe_user(p->session_info)) {
+ DEBUG(1, ("Failed to become pipe user!\n"));
+ data_blob_free(&p->out_data.rdata);
+ return false;
}
/* get the set of RPC functions for this context */
@@ -1557,9 +1557,7 @@ static bool api_pipe_request(struct pipes_struct *p,
pkt->u.request.context_id));
}
- if (changed_user) {
- unbecome_authenticated_pipe_user();
- }
+ unbecome_authenticated_pipe_user();
return ret;
}