summaryrefslogtreecommitdiff
path: root/source4/rpc_server
diff options
context:
space:
mode:
authorAndreas Schneider <asn@samba.org>2012-06-29 16:41:29 +0200
committerAndreas Schneider <asn@cryptomilk.org>2012-07-06 10:00:58 +0200
commit1a12bbd5d8a328ae91b8513a47e76c4e32607df4 (patch)
treef10d029c60bc565bb6f41b1cb508cf8a1f0dea61 /source4/rpc_server
parent13a7f98f9f9a6dd26d0a2ab73ca8d0b40fc441e2 (diff)
downloadsamba-1a12bbd5d8a328ae91b8513a47e76c4e32607df4.tar.gz
samba-1a12bbd5d8a328ae91b8513a47e76c4e32607df4.tar.bz2
samba-1a12bbd5d8a328ae91b8513a47e76c4e32607df4.zip
s4-lsarpc: Restrict LookupNames4 to crypto connections only.
Diffstat (limited to 'source4/rpc_server')
-rw-r--r--source4/rpc_server/lsa/lsa_lookup.c10
1 files changed, 10 insertions, 0 deletions
diff --git a/source4/rpc_server/lsa/lsa_lookup.c b/source4/rpc_server/lsa/lsa_lookup.c
index dffd2a572f..0855b9dfce 100644
--- a/source4/rpc_server/lsa/lsa_lookup.c
+++ b/source4/rpc_server/lsa/lsa_lookup.c
@@ -861,10 +861,20 @@ NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
struct lsa_LookupNames4 *r)
{
+ struct dcerpc_auth *auth_info = dce_call->conn->auth_state.auth_info;
struct lsa_policy_state *policy_state;
struct lsa_LookupNames3 q;
NTSTATUS status;
+ /*
+ * We don't have policy handles on this call. So this must be restricted
+ * to crypto connections only.
+ */
+ if (auth_info->auth_type != DCERPC_AUTH_TYPE_SCHANNEL ||
+ auth_info->auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
+ DCESRV_FAULT(DCERPC_FAULT_ACCESS_DENIED);
+ }
+
status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &policy_state);
if (!NT_STATUS_IS_OK(status)) {
return status;