Microsoft/NT4
Microsoft/NT4
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
ce47f986d8
NT4/private/ntos/npfs/secursup.c

388 lines
8.9 KiB
C
Raw Normal View History

First commit
2001-01-01 00:00:00 +01:00
/*++
Copyright (c) 1989 Microsoft Corporation
Module Name:
SecurSup.c
Abstract:
This module implements the Named Pipe Security support routines
Author:
Gary Kimura [GaryKi] 06-May-1991
Revision History:
--*/
#include "NpProcs.h"
//
// The debug trace level
//
#define Dbg (DEBUG_TRACE_SECURSUP)
#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE, NpCopyClientContext)
#pragma alloc_text(PAGE, NpImpersonateClientContext)
#pragma alloc_text(PAGE, NpInitializeSecurity)
#pragma alloc_text(PAGE, NpSetDataEntryClientContext)
#pragma alloc_text(PAGE, NpUninitializeSecurity)
#endif
NTSTATUS
NpInitializeSecurity (
IN PCCB Ccb,
IN PSECURITY_QUALITY_OF_SERVICE SecurityQos,
IN PETHREAD UserThread
)
/*++
Routine Description:
This routine initializes the security (impersonation) fields
in the ccb. It is called when the client end gets opened.
Arguments:
Ccb - Supplies the ccb being initialized
SecurityQos - Supplies the clients quality of service parameter
UserThread - Supplise the client's user thread
Return Value:
NTSTATUS - Returns the result of the operation
--*/
{
NTSTATUS Status;
PAGED_CODE();
DebugTrace(+1, Dbg, "NpInitializeSecurity, Ccb = %08lx\n", Ccb);
//
// Either copy the security qos parameter, if it is not null or
// create a dummy qos
//
if (SecurityQos != NULL) {
RtlCopyMemory( &Ccb->SecurityQos,
SecurityQos,
sizeof(SECURITY_QUALITY_OF_SERVICE) );
} else {
Ccb->SecurityQos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
Ccb->SecurityQos.ImpersonationLevel = SecurityImpersonation;
Ccb->SecurityQos.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
Ccb->SecurityQos.EffectiveOnly = TRUE;
}
//
// Because we might be asked to reinitialize the ccb we need
// to first check if the security client context is not null and if so then
// free its pool
//
if (Ccb->SecurityClientContext != NULL) {
SeDeleteClientSecurity( Ccb->SecurityClientContext );
ExFreePool( Ccb->SecurityClientContext );
}
//
// If the tracking mode is static then we need to capture the
// client context now otherwise we set the client context field
// to null
//
if (Ccb->SecurityQos.ContextTrackingMode == SECURITY_STATIC_TRACKING) {
//
// Allocate a client context record, and then initialize it
//
Ccb->SecurityClientContext = FsRtlAllocatePool( PagedPool,
sizeof(SECURITY_CLIENT_CONTEXT) );
DebugTrace(0, Dbg, "Static tracking, ClientContext = %08lx\n", Ccb->SecurityClientContext);
if (!NT_SUCCESS(Status = SeCreateClientSecurity( UserThread,
&Ccb->SecurityQos,
FALSE,
Ccb->SecurityClientContext ))) {
DebugTrace(0, Dbg, "Not successful at creating client security, %08lx\n", Status);
ExFreePool( Ccb->SecurityClientContext );
Ccb->SecurityClientContext = NULL;
}
} else {
DebugTrace(0, Dbg, "Dynamic tracking\n", 0);
Ccb->SecurityClientContext = NULL;
Status = STATUS_SUCCESS;
}
DebugTrace(-1, Dbg, "NpInitializeSecurity -> %08lx\n", Status);
return Status;
}
VOID
NpUninitializeSecurity (
IN PCCB Ccb
)
/*++
Routine Description:
This routine deletes the client context referenced by the ccb
Arguments:
Ccb - Supplies the ccb being uninitialized
Return Value:
None
--*/
{
PAGED_CODE();
DebugTrace(+1, Dbg, "NpUninitializeSecurity, Ccb = %08lx\n", Ccb);
//
// We only have work to do if the client context field is not null
// and then we need to delete the client context, and free the memory.
//
if (Ccb->SecurityClientContext != NULL) {
DebugTrace(0, Dbg, "Delete client context, %08lx\n", Ccb->SecurityClientContext);
SeDeleteClientSecurity( Ccb->SecurityClientContext );
ExFreePool( Ccb->SecurityClientContext );
Ccb->SecurityClientContext = NULL;
}
DebugTrace(-1, Dbg, "NpUninitializeSecurity -> VOID\n", 0);
return;
}
NTSTATUS
NpSetDataEntryClientContext (
IN NAMED_PIPE_END NamedPipeEnd,
IN PCCB Ccb,
IN PDATA_ENTRY DataEntry,
IN PETHREAD UserThread
)
/*++
Routine Description:
This routine captures a new client context and stores it in the indicated
data entry, but only if the tracking mode is dynamic and only for the
client end of the named pipe.
Arguments:
NamedPipeEnd - Indicates the client or server end of the named pipe.
Only the client end does anything.
Ccb - Supplies the ccb for this instance of the named pipe.
DataEntry - Supplies the data entry to use to store the client context
UserThread - Supplies the thread of the client
Return Value:
NTSTATUS - Returns our success code.
--*/
{
NTSTATUS Status;
PAGED_CODE();
DebugTrace(+1, Dbg, "NpSetDataEntryClientContext, Ccb = %08lx\n", Ccb);
//
// Only do the work if this is the client end and tracking is dynamic
//
if ((NamedPipeEnd == FILE_PIPE_CLIENT_END) &&
(Ccb->SecurityQos.ContextTrackingMode == SECURITY_DYNAMIC_TRACKING)) {
//
// Allocate a client context record, and then initialize it
//
DataEntry->SecurityClientContext = FsRtlAllocatePool( NonPagedPoolMustSucceed,
sizeof(SECURITY_CLIENT_CONTEXT) );
DebugTrace(0, Dbg, "Client End, Dynamic Tracking, ClientContext = %08lx\n", DataEntry->SecurityClientContext);
if (!NT_SUCCESS(Status = SeCreateClientSecurity( UserThread,
&Ccb->SecurityQos,
FALSE,
DataEntry->SecurityClientContext ))) {
DebugTrace(0, Dbg, "Not successful at creating client security, %08lx\n", Status);
ExFreePool( DataEntry->SecurityClientContext );
DataEntry->SecurityClientContext = NULL;
}
} else {
DebugTrace(0, Dbg, "Static Tracking or Not Client End\n", 0);
DataEntry->SecurityClientContext = NULL;
Status = STATUS_SUCCESS;
}
DebugTrace(-1, Dbg, "NpSetDataEntryClientContext -> %08lx\n", Status);
return Status;
}
VOID
NpCopyClientContext (
IN PCCB Ccb,
IN PDATA_ENTRY DataEntry
)
/*++
Routine Description:
This routine copies the client context stored in the data entry into
the ccb, but only for dynamic tracking.
Arguments:
Ccb - Supplies the ccb to update.
DataEntry - Supplies the DataEntry to copy from.
Return Value:
--*/
{
PAGED_CODE();
DebugTrace(+1, Dbg, "NpCopyClientContext, Ccb = %08lx\n", Ccb);
//
// Only do the copy if the data entries client context field is not null
// which means that we are doing dynamic tracking. Note we will
// not be called with a server write data entry that has a non null
// client context.
//
if (DataEntry->SecurityClientContext != NULL) {
DebugTrace(0, Dbg, "have something to copy %08lx\n", DataEntry->SecurityClientContext);
//
// First check if we need to delete and deallocate the client
// context in the nonpaged ccb
//
if (Ccb->SecurityClientContext != NULL) {
DebugTrace(0, Dbg, "Remove current client context %08lx\n", Ccb->SecurityClientContext);
SeDeleteClientSecurity( Ccb->SecurityClientContext );
ExFreePool( Ccb->SecurityClientContext );
}
//
// Now copy over the reference to the client context, and zero
// out the reference in the data entry.
//
Ccb->SecurityClientContext = DataEntry->SecurityClientContext;
DataEntry->SecurityClientContext = NULL;
}
DebugTrace(-1, Dbg, "NpCopyClientContext -> VOID\n", 0 );
return;
}
NTSTATUS
NpImpersonateClientContext (
IN PCCB Ccb
)
/*++
Routine Description:
This routine impersonates the current client context stored in the
ccb
Arguments:
Ccb - Supplies the ccb for the named pipe
Return Value:
NTSTATUS - returns our status code.
--*/
{
NTSTATUS Status;
PAGED_CODE();
DebugTrace(+1, Dbg, "NpImpersonateClientContext, Ccb = %08lx\n", Ccb);
if (Ccb->SecurityClientContext == NULL) {
DebugTrace(0, Dbg, "Cannot impersonate\n", 0);
Status = STATUS_CANNOT_IMPERSONATE;
} else {
SeImpersonateClient( Ccb->SecurityClientContext, NULL );
Status = STATUS_SUCCESS;
}
DebugTrace(-1, Dbg, "NpImpersonateClientContext -> %08lx\n", Status);
return Status;
}
Reference in New Issue Copy Permalink