1239 lines
31 KiB
C
1239 lines
31 KiB
C
/*++
|
|
|
|
Copyright (c) 1995 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
NdsRead.c
|
|
|
|
Abstract:
|
|
|
|
This module implements the NDS read and request routines called
|
|
by the redirector natively and the support routines that go with
|
|
them.
|
|
|
|
Author:
|
|
|
|
Cory West [CoryWest] 23-Feb-1995
|
|
|
|
--*/
|
|
|
|
#include "Procs.h"
|
|
|
|
#define Dbg (DEBUG_TRACE_NDS)
|
|
|
|
#pragma alloc_text( PAGE, NdsResolveNameKm )
|
|
#pragma alloc_text( PAGE, NdsReadStringAttribute )
|
|
#pragma alloc_text( PAGE, NdsReadAttributesKm )
|
|
#pragma alloc_text( PAGE, NdsCompletionCodetoNtStatus )
|
|
#pragma alloc_text( PAGE, FreeNdsContext )
|
|
#pragma alloc_text( PAGE, NdsPing )
|
|
#pragma alloc_text( PAGE, NdsGetUserName )
|
|
#pragma alloc_text( PAGE, NdsGetServerBasicName )
|
|
#pragma alloc_text( PAGE, NdsGetServerName )
|
|
#pragma alloc_text( PAGE, NdsReadPublicKey )
|
|
#pragma alloc_text( PAGE, NdsCheckGroupMembership )
|
|
#pragma alloc_text( PAGE, NdsAllocateLockedBuffer )
|
|
#pragma alloc_text( PAGE, NdsFreeLockedBuffer )
|
|
|
|
NTSTATUS
|
|
NdsResolveNameKm (
|
|
PIRP_CONTEXT pIrpContext,
|
|
IN PUNICODE_STRING puObjectName,
|
|
OUT DWORD *dwObjectId,
|
|
BOOLEAN AllowDsJump,
|
|
DWORD dwFlags
|
|
)
|
|
/*++
|
|
|
|
Description:
|
|
|
|
This is a wrapper routine to the browser routine NdsResolveName
|
|
for kernel components that need to resolve NDS names.
|
|
|
|
Arguments:
|
|
|
|
pIrpContext - must point to the dir server that we should query
|
|
puObjectName - what we want to resolve
|
|
*dwObjectId - where to report the result
|
|
AllowDsJump - if we are referred to another dir server, can we jump?
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status;
|
|
|
|
PNWR_NDS_REQUEST_PACKET Rrp;
|
|
|
|
PNDS_RESPONSE_RESOLVE_NAME Rsp;
|
|
LOCKED_BUFFER NdsRequestBuffer;
|
|
|
|
PSCB Scb, OldScb;
|
|
UNICODE_STRING ReferredServer;
|
|
BOOL fReleasedCredentials = FALSE;
|
|
PLOGON pLogon;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Note: If you are holding the credential resource coming in, then you
|
|
// need to be at the head of the queue.
|
|
//
|
|
|
|
//
|
|
// Prepare the request and response buffers.
|
|
//
|
|
|
|
Rrp = ALLOCATE_POOL( PagedPool, NDS_BUFFER_SIZE );
|
|
|
|
if ( !Rrp ) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
Status = NdsAllocateLockedBuffer( &NdsRequestBuffer, NDS_BUFFER_SIZE );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
FREE_POOL( Rrp );
|
|
return Status;
|
|
}
|
|
|
|
//
|
|
// Set up the request packet.
|
|
//
|
|
|
|
RtlZeroMemory( Rrp, NDS_BUFFER_SIZE );
|
|
|
|
Rrp->Version = 0;
|
|
Rrp->Parameters.ResolveName.ObjectNameLength = puObjectName->Length;
|
|
Rrp->Parameters.ResolveName.ResolverFlags = dwFlags;
|
|
|
|
RtlCopyMemory( Rrp->Parameters.ResolveName.ObjectName,
|
|
puObjectName->Buffer,
|
|
puObjectName->Length );
|
|
|
|
//
|
|
// Do the resolve.
|
|
//
|
|
|
|
Status = NdsResolveName( pIrpContext, Rrp, NDS_BUFFER_SIZE, &NdsRequestBuffer );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
Status = NdsCompletionCodetoNtStatus( &NdsRequestBuffer );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
Rsp = ( PNDS_RESPONSE_RESOLVE_NAME ) NdsRequestBuffer.pRecvBufferVa;
|
|
|
|
if ( ( Rsp->RemoteEntry == RESOLVE_NAME_REFER_REMOTE ) &&
|
|
( AllowDsJump ) ) {
|
|
|
|
//
|
|
// We need to queue this request to another server
|
|
// since this server doesn't have any details about
|
|
// the object.
|
|
//
|
|
|
|
ReferredServer.Length = (USHORT) Rsp->ServerNameLength;
|
|
ReferredServer.MaximumLength = ReferredServer.Length;
|
|
ReferredServer.Buffer = Rsp->ReferredServer;
|
|
|
|
OldScb = pIrpContext->pScb;
|
|
ASSERT( OldScb != NULL );
|
|
|
|
//
|
|
// If you hold the credential lock, this is the time to let go of it or
|
|
// we might deadlock. We can reclaim it after we are at the head of the
|
|
// new SCB queue
|
|
//
|
|
|
|
if (BooleanFlagOn (pIrpContext->Flags, IRP_FLAG_HAS_CREDENTIAL_LOCK)) {
|
|
|
|
PSCB pScb;
|
|
|
|
pScb = pIrpContext->pNpScb->pScb;
|
|
|
|
NwAcquireExclusiveRcb( &NwRcb, TRUE );
|
|
pLogon = FindUser( &pScb->UserUid, FALSE );
|
|
NwReleaseRcb( &NwRcb );
|
|
|
|
NwReleaseCredList( pLogon, pIrpContext );
|
|
fReleasedCredentials = TRUE;
|
|
}
|
|
|
|
NwDequeueIrpContext( pIrpContext, FALSE );
|
|
|
|
Status = CreateScb( &Scb,
|
|
pIrpContext,
|
|
&ReferredServer,
|
|
NULL,
|
|
NULL,
|
|
NULL,
|
|
TRUE,
|
|
FALSE );
|
|
|
|
if (fReleasedCredentials == TRUE) {
|
|
|
|
//
|
|
// You have to be at the head of the queue before you
|
|
// grab the resource
|
|
//
|
|
|
|
if ( pIrpContext->pNpScb->Requests.Flink != &pIrpContext->NextRequest )
|
|
{
|
|
NwAppendToQueueAndWait( pIrpContext );
|
|
}
|
|
NwAcquireExclusiveCredList( pLogon, pIrpContext );
|
|
}
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
//
|
|
// Since we've jumped servers, dereference the old host
|
|
// server. The new one was referenced in CreateScb().
|
|
//
|
|
|
|
NwDereferenceScb( OldScb->pNpScb );
|
|
|
|
}
|
|
|
|
*dwObjectId = Rsp->EntryId;
|
|
|
|
ExitWithCleanup:
|
|
|
|
NdsFreeLockedBuffer( &NdsRequestBuffer );
|
|
FREE_POOL( Rrp );
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
NdsReadStringAttribute(
|
|
PIRP_CONTEXT pIrpContext,
|
|
IN DWORD dwObjectId,
|
|
IN PUNICODE_STRING puAttributeName,
|
|
OUT PUNICODE_STRING puAttributeVal
|
|
)
|
|
/*++
|
|
|
|
Description:
|
|
|
|
This is a wrapper routine to the browser routine NdsReadAttributes
|
|
for kernel components that need to read NDS string attributes.
|
|
|
|
Arguments:
|
|
|
|
pIrpContext - must point to the dir server that we should query
|
|
dwObjectId - oid of the object to query
|
|
puAttributeName - attribute that we want
|
|
puAttributeVal - value of the attribute
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status;
|
|
PNWR_NDS_REQUEST_PACKET Rrp;
|
|
DWORD dwRequestSize, dwAttributeCount;
|
|
LOCKED_BUFFER NdsRequest;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Set up the request and response buffers.
|
|
//
|
|
|
|
dwRequestSize = sizeof( NWR_NDS_REQUEST_PACKET ) + puAttributeName->Length;
|
|
|
|
Rrp = ( PNWR_NDS_REQUEST_PACKET ) ALLOCATE_POOL( PagedPool, dwRequestSize );
|
|
|
|
if ( !Rrp ) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
FREE_POOL( Rrp );
|
|
return Status;
|
|
}
|
|
|
|
//
|
|
// Prepare the request packet.
|
|
//
|
|
|
|
RtlZeroMemory( (BYTE *)Rrp, dwRequestSize );
|
|
|
|
Rrp->Version = 0;
|
|
Rrp->Parameters.ReadAttribute.ObjectId = dwObjectId;
|
|
Rrp->Parameters.ReadAttribute.IterHandle = DUMMY_ITER_HANDLE;
|
|
Rrp->Parameters.ReadAttribute.AttributeNameLength = puAttributeName->Length;
|
|
|
|
RtlCopyMemory( Rrp->Parameters.ReadAttribute.AttributeName,
|
|
puAttributeName->Buffer,
|
|
puAttributeName->Length );
|
|
|
|
//
|
|
// Make the request.
|
|
//
|
|
|
|
Status = NdsReadAttributes( pIrpContext, Rrp, NDS_BUFFER_SIZE, &NdsRequest );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
//
|
|
// Dig out the string attribute and return it.
|
|
//
|
|
|
|
Status = ParseResponse( NULL,
|
|
NdsRequest.pRecvBufferVa,
|
|
NdsRequest.dwBytesWritten,
|
|
"G___D_S_T",
|
|
sizeof( DWORD ), // completion code
|
|
sizeof( DWORD ), // iter handle
|
|
sizeof( DWORD ), // info type
|
|
&dwAttributeCount, // attribute count
|
|
sizeof( DWORD ), // syntax id
|
|
NULL, // attribute name
|
|
sizeof( DWORD ), // number of values
|
|
puAttributeVal ); // attribute string
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
|
|
ExitWithCleanup:
|
|
|
|
FREE_POOL( Rrp );
|
|
NdsFreeLockedBuffer( &NdsRequest );
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
NdsReadAttributesKm(
|
|
PIRP_CONTEXT pIrpContext,
|
|
IN DWORD dwObjectId,
|
|
IN PUNICODE_STRING puAttributeName,
|
|
IN OUT PLOCKED_BUFFER pNdsRequest
|
|
)
|
|
/*++
|
|
|
|
Description:
|
|
|
|
This is a wrapper routine to the browser routine NdsReadAttributes
|
|
for kernel components that need to read NDS string attributes and
|
|
get back the raw response.
|
|
|
|
Arguments:
|
|
|
|
pIrpContext - must point to the dir server that we should query
|
|
dwObjectId - oid of the object to query
|
|
puAttributeName - attribute that we want
|
|
puAttributeVal - value of the attribute
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status;
|
|
PNWR_NDS_REQUEST_PACKET Rrp;
|
|
DWORD dwRequestSize;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Set up the request.
|
|
//
|
|
|
|
dwRequestSize = sizeof( NWR_NDS_REQUEST_PACKET ) + puAttributeName->Length;
|
|
|
|
Rrp = ( PNWR_NDS_REQUEST_PACKET ) ALLOCATE_POOL( PagedPool, dwRequestSize );
|
|
|
|
if ( !Rrp ) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
RtlZeroMemory( (BYTE *)Rrp, dwRequestSize );
|
|
|
|
Rrp->Version = 0;
|
|
Rrp->Parameters.ReadAttribute.ObjectId = dwObjectId;
|
|
Rrp->Parameters.ReadAttribute.IterHandle = DUMMY_ITER_HANDLE;
|
|
Rrp->Parameters.ReadAttribute.AttributeNameLength = puAttributeName->Length;
|
|
|
|
RtlCopyMemory( Rrp->Parameters.ReadAttribute.AttributeName,
|
|
puAttributeName->Buffer,
|
|
puAttributeName->Length );
|
|
|
|
Status = NdsReadAttributes( pIrpContext, Rrp, NDS_BUFFER_SIZE, pNdsRequest );
|
|
|
|
FREE_POOL( Rrp );
|
|
return Status;
|
|
|
|
}
|
|
|
|
//
|
|
// Frosting and other helper wrapper functions.
|
|
//
|
|
|
|
NTSTATUS
|
|
NdsCompletionCodetoNtStatus(
|
|
IN PLOCKED_BUFFER pLockedBuffer
|
|
)
|
|
/*+++
|
|
|
|
Description:
|
|
|
|
Translates the completion code of an NDS transaction into
|
|
an NTSTATUS error code.
|
|
|
|
Arguments:
|
|
|
|
pLockedBuffer - describes the locked reply buffer that contains
|
|
the response.
|
|
|
|
---*/
|
|
{
|
|
NTSTATUS Status;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Try to get the completion code from the user's buffer.
|
|
//
|
|
|
|
try {
|
|
|
|
Status = *((DWORD *)pLockedBuffer->pRecvBufferVa);
|
|
|
|
} except ( EXCEPTION_EXECUTE_HANDLER ) {
|
|
|
|
return STATUS_UNSUCCESSFUL;
|
|
|
|
}
|
|
|
|
//
|
|
// Decode it.
|
|
//
|
|
|
|
if ( Status != STATUS_SUCCESS ) {
|
|
|
|
DebugTrace( 0, Dbg, "NDS Error Code: %08lx\n", Status );
|
|
|
|
switch ( Status ) {
|
|
|
|
case -601: // No such entry.
|
|
case -602: // No such value.
|
|
case -603: // No such attribute.
|
|
case -607: // Illegal attribute.
|
|
case -610: // Illegal ds name.
|
|
|
|
Status = STATUS_BAD_NETWORK_PATH;
|
|
break;
|
|
|
|
//
|
|
// These may only come on a VERIFY_PASSWORD verb, which
|
|
// we do not support. I'm not sure, though.
|
|
//
|
|
|
|
case -216: // Password too short.
|
|
case -215: // Duplicate password.
|
|
|
|
Status = STATUS_PASSWORD_RESTRICTION;
|
|
break;
|
|
|
|
case -222: // Expired password (and no grace logins left).
|
|
|
|
Status = STATUS_PASSWORD_EXPIRED;
|
|
break;
|
|
|
|
case -223: // Expired password; this is a successful grace login.
|
|
|
|
Status = NWRDR_PASSWORD_HAS_EXPIRED;
|
|
break;
|
|
|
|
case -639: // Incomplete authentication.
|
|
case -672: // No access.
|
|
case -677: // Invalid identity.
|
|
case -669: // Wrong password.
|
|
|
|
Status = STATUS_WRONG_PASSWORD;
|
|
break;
|
|
|
|
case -197: // Intruder lockout active.
|
|
case -220: // Account expired or disabled.
|
|
|
|
Status = STATUS_ACCOUNT_DISABLED;
|
|
break;
|
|
|
|
case -218: // Login time restrictions.
|
|
|
|
Status = STATUS_LOGIN_TIME_RESTRICTION;
|
|
break;
|
|
|
|
case -217: // Maximum logins exceeded.
|
|
|
|
Status = STATUS_CONNECTION_COUNT_LIMIT;
|
|
break;
|
|
|
|
case -630: // We get this back for bogus resolve
|
|
// name calls. Glenn prefers this error.
|
|
|
|
Status = STATUS_OBJECT_NAME_NOT_FOUND;
|
|
break;
|
|
|
|
default:
|
|
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
}
|
|
|
|
return Status;
|
|
}
|
|
|
|
VOID
|
|
FreeNdsContext(
|
|
IN PNDS_SECURITY_CONTEXT pNdsSecContext
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Free the referenced NDS context.
|
|
|
|
--*/
|
|
{
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Make sure this is a valid thing to be mucking with.
|
|
//
|
|
|
|
if ( !pNdsSecContext ||
|
|
pNdsSecContext->ntc != NW_NTC_NDS_CREDENTIAL ) {
|
|
|
|
DebugTrace( 0, Dbg, "FreeNdsContext didn't get an NDS context.\n", 0 );
|
|
return;
|
|
}
|
|
|
|
if ( pNdsSecContext->Credential ) {
|
|
FREE_POOL( pNdsSecContext->Credential );
|
|
}
|
|
|
|
if ( pNdsSecContext->Signature ) {
|
|
FREE_POOL( pNdsSecContext->Signature );
|
|
}
|
|
|
|
if ( pNdsSecContext->PublicNdsKey ) {
|
|
FREE_POOL( pNdsSecContext->PublicNdsKey );
|
|
}
|
|
|
|
if ( pNdsSecContext->Password.Buffer ) {
|
|
FREE_POOL( pNdsSecContext->Password.Buffer );
|
|
}
|
|
|
|
DebugTrace( 0, Dbg, "Freeing NDS security context at 0x%08lx\n", pNdsSecContext );
|
|
|
|
FREE_POOL( pNdsSecContext );
|
|
|
|
return;
|
|
}
|
|
|
|
VOID
|
|
NdsPing(
|
|
IN PIRP_CONTEXT pIrpContext,
|
|
IN PSCB pScb
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Examine the server for NDS support and record the NDS tree
|
|
name in the SCB for later reference.
|
|
|
|
Routine Arguments:
|
|
|
|
pIrpContext - A pointer to the IRP context for this transaction.
|
|
pScb - The SCB for the server.
|
|
|
|
Return Value:
|
|
|
|
NTSTATUS - Status of the operation.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status;
|
|
|
|
OEM_STRING OemTreeName;
|
|
BYTE OemBuffer[NDS_TREE_NAME_LEN];
|
|
|
|
UNICODE_STRING TreeName;
|
|
WCHAR WBuffer[NDS_TREE_NAME_LEN];
|
|
|
|
UNICODE_STRING CredentialName;
|
|
|
|
PAGED_CODE();
|
|
|
|
pScb->NdsTreeName.Length = 0;
|
|
|
|
OemTreeName.Length = NDS_TREE_NAME_LEN;
|
|
OemTreeName.MaximumLength = NDS_TREE_NAME_LEN;
|
|
OemTreeName.Buffer = OemBuffer;
|
|
|
|
Status = ExchangeWithWait( pIrpContext,
|
|
SynchronousResponseCallback,
|
|
"N",
|
|
NDS_REQUEST, // NDS Function 104
|
|
NDS_PING ); // NDS Subfunction 1
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Pull out the padded NDS name
|
|
//
|
|
|
|
Status = ParseResponse( pIrpContext,
|
|
pIrpContext->rsp,
|
|
pIrpContext->ResponseLength,
|
|
"N_r",
|
|
2 * sizeof( DWORD ),
|
|
OemBuffer,
|
|
NDS_TREE_NAME_LEN );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return;
|
|
}
|
|
|
|
//
|
|
// Strip off the padding and convert to unicode.
|
|
//
|
|
|
|
while ( OemTreeName.Length > 0 &&
|
|
OemBuffer[OemTreeName.Length - 1] == '_' ) {
|
|
OemTreeName.Length--;
|
|
}
|
|
|
|
//
|
|
// Copy or munge the tree name, depending on the create type.
|
|
//
|
|
|
|
if ( pIrpContext->Specific.Create.fExCredentialCreate ) {
|
|
|
|
TreeName.Length = 0;
|
|
TreeName.MaximumLength = sizeof( WBuffer );
|
|
TreeName.Buffer = WBuffer;
|
|
|
|
Status = RtlOemStringToUnicodeString( &TreeName,
|
|
&OemTreeName,
|
|
FALSE );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
pScb->NdsTreeName.Length = 0;
|
|
return;
|
|
}
|
|
|
|
Status = BuildExCredentialServerName( &TreeName,
|
|
pIrpContext->Specific.Create.puCredentialName,
|
|
&CredentialName );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return;
|
|
}
|
|
|
|
RtlCopyUnicodeString( &pScb->NdsTreeName, &CredentialName );
|
|
|
|
FREE_POOL( CredentialName.Buffer );
|
|
|
|
} else {
|
|
|
|
Status = RtlOemStringToUnicodeString( &pScb->NdsTreeName,
|
|
&OemTreeName,
|
|
FALSE );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
pScb->NdsTreeName.Length = 0;
|
|
return;
|
|
}
|
|
|
|
}
|
|
|
|
DebugTrace( 0, Dbg, "Nds Ping: Tree is ""%wZ""\n", &pScb->NdsTreeName);
|
|
return;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
NdsGetUserName(
|
|
IN PIRP_CONTEXT pIrpContext,
|
|
IN DWORD dwUserOid,
|
|
OUT PUNICODE_STRING puUserName
|
|
)
|
|
/*++
|
|
|
|
Description:
|
|
|
|
Get the fully distinguished name of the user referred to
|
|
by the provided oid.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
LOCKED_BUFFER NdsRequest;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Allocate buffer space.
|
|
//
|
|
|
|
Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
//
|
|
// Make the request.
|
|
//
|
|
|
|
Status = FragExWithWait( pIrpContext,
|
|
NDSV_READ_ENTRY_INFO,
|
|
&NdsRequest,
|
|
"DD",
|
|
0,
|
|
dwUserOid );
|
|
|
|
if ( !NT_SUCCESS(Status) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
Status = NdsCompletionCodetoNtStatus( &NdsRequest );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
Status = ParseResponse( NULL,
|
|
NdsRequest.pRecvBufferVa,
|
|
NdsRequest.dwBytesWritten,
|
|
"G_St",
|
|
sizeof( NDS_RESPONSE_GET_OBJECT_INFO ),
|
|
NULL,
|
|
puUserName );
|
|
|
|
//
|
|
// We either got it or we didn't.
|
|
//
|
|
|
|
ExitWithCleanup:
|
|
|
|
NdsFreeLockedBuffer( &NdsRequest );
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
NdsGetServerBasicName(
|
|
IN PUNICODE_STRING pServerX500Name,
|
|
IN OUT PUNICODE_STRING pServerName
|
|
) {
|
|
|
|
//
|
|
// Dig out the first component of the server's X.500 name.
|
|
// We count on the X500 prefix for the server object being "CN=",
|
|
// which might be unwise.
|
|
//
|
|
|
|
USHORT usPrefixSize, usSrv;
|
|
|
|
PAGED_CODE();
|
|
|
|
usPrefixSize = sizeof( "CN=" ) - sizeof( "" );
|
|
usSrv = 0;
|
|
|
|
if ( ( pServerX500Name->Buffer[0] != L'C' ) ||
|
|
( pServerX500Name->Buffer[1] != L'N' ) ||
|
|
( pServerX500Name->Buffer[2] != L'=' ) ) {
|
|
|
|
DebugTrace( 0, Dbg, "NdsGetServerBasicName: Bad prefix.\n", 0 );
|
|
return STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
if ( pServerX500Name->Length <= usPrefixSize ) {
|
|
|
|
DebugTrace( 0, Dbg, "NdsGetServerBasicName: Bad string length.\n", 0 );
|
|
return STATUS_INVALID_PARAMETER;
|
|
}
|
|
|
|
pServerName->Buffer = pServerX500Name->Buffer + usPrefixSize;
|
|
pServerName->Length = 0;
|
|
|
|
while ( ( usSrv < MAX_SERVER_NAME_LENGTH ) &&
|
|
( pServerName->Buffer[usSrv++] != L'.' ) ) {
|
|
|
|
pServerName->Length += sizeof( WCHAR );
|
|
}
|
|
|
|
if ( usSrv == MAX_SERVER_NAME_LENGTH ) {
|
|
|
|
DebugTrace( 0, Dbg, "NdsGetServerBasicName: Bad server name response.\n", 0 );
|
|
return STATUS_BAD_NETWORK_PATH;
|
|
}
|
|
|
|
pServerName->MaximumLength = pServerName->Length;
|
|
return STATUS_SUCCESS;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
NdsGetServerName(
|
|
IN PIRP_CONTEXT pIrpContext,
|
|
OUT PUNICODE_STRING puServerName
|
|
)
|
|
/*++
|
|
|
|
Description:
|
|
|
|
Get the fully distinguished name of the server that we
|
|
are connected to.
|
|
|
|
--*/
|
|
{
|
|
|
|
NTSTATUS Status;
|
|
LOCKED_BUFFER NdsRequest;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Make the request.
|
|
//
|
|
|
|
Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
Status = FragExWithWait( pIrpContext,
|
|
NDSV_GET_SERVER_ADDRESS,
|
|
&NdsRequest,
|
|
NULL );
|
|
|
|
if ( !NT_SUCCESS(Status) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
Status = NdsCompletionCodetoNtStatus( &NdsRequest );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
//
|
|
// Get the server name from the response.
|
|
//
|
|
|
|
Status = ParseResponse( NULL,
|
|
NdsRequest.pRecvBufferVa,
|
|
NdsRequest.dwBytesWritten,
|
|
"G_T",
|
|
sizeof( DWORD ),
|
|
puServerName );
|
|
|
|
if ( !NT_SUCCESS(Status) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
ExitWithCleanup:
|
|
|
|
NdsFreeLockedBuffer( &NdsRequest );
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
NdsReadPublicKey(
|
|
IN PIRP_CONTEXT pIrpContext,
|
|
IN DWORD dwEntryId,
|
|
OUT BYTE *pPubKeyVal,
|
|
IN OUT DWORD *pPubKeyLen
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Read the public key referenced by the given entry id.
|
|
|
|
Routine Arguments:
|
|
|
|
pIrpContext - The IRP context for this connection.
|
|
dwEntryId - The entry id of the key.
|
|
pPubKeyVal - The destination buffer for the public key.
|
|
pPubKeyLen - The length of the public key destination buffer.
|
|
|
|
Return Value:
|
|
|
|
The length of the key.
|
|
|
|
--*/
|
|
{
|
|
NTSTATUS Status;
|
|
|
|
LOCKED_BUFFER NdsRequest;
|
|
|
|
PNWR_NDS_REQUEST_PACKET Rrp;
|
|
|
|
DWORD dwAttrNameLen, dwAttrLen, dwRcvLen, dwNumEntries;
|
|
BYTE *pRcv;
|
|
|
|
PAGED_CODE();
|
|
|
|
//
|
|
// Allocate and zero send and receive space.
|
|
//
|
|
|
|
Rrp = ALLOCATE_POOL( PagedPool, NDS_BUFFER_SIZE );
|
|
|
|
if ( !Rrp ) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
FREE_POOL( Rrp );
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
//
|
|
// Fill in and prepare the request buffer.
|
|
//
|
|
|
|
RtlZeroMemory( Rrp, NDS_BUFFER_SIZE );
|
|
|
|
Rrp->Version = 0;
|
|
Rrp->Parameters.ReadAttribute.ObjectId = dwEntryId;
|
|
Rrp->Parameters.ReadAttribute.IterHandle = DUMMY_ITER_HANDLE;
|
|
Rrp->Parameters.ReadAttribute.AttributeNameLength =
|
|
sizeof( PUBLIC_KEY_ATTRIBUTE ) - sizeof( WCHAR );
|
|
|
|
RtlCopyMemory( Rrp->Parameters.ReadAttribute.AttributeName,
|
|
PUBLIC_KEY_ATTRIBUTE,
|
|
sizeof( PUBLIC_KEY_ATTRIBUTE ) - sizeof( WCHAR ) );
|
|
|
|
//
|
|
// Do the exchange.
|
|
//
|
|
|
|
Status = NdsReadAttributes( pIrpContext,
|
|
Rrp,
|
|
NDS_BUFFER_SIZE,
|
|
&NdsRequest );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
//
|
|
// Skip over the attribute header and name.
|
|
//
|
|
|
|
Status = ParseResponse( NULL,
|
|
NdsRequest.pRecvBufferVa,
|
|
NdsRequest.dwBytesWritten,
|
|
"G_D",
|
|
5 * sizeof( DWORD ),
|
|
&dwAttrNameLen );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
//
|
|
// Skip over the part we've parsed and pull out the attribute.
|
|
//
|
|
|
|
pRcv = (PBYTE)NdsRequest.pRecvBufferVa +
|
|
( 6 * sizeof( DWORD ) ) +
|
|
ROUNDUP4(dwAttrNameLen);
|
|
|
|
dwRcvLen = NdsRequest.dwBytesWritten -
|
|
( 6 * sizeof( DWORD ) ) +
|
|
ROUNDUP4(dwAttrNameLen);
|
|
|
|
Status = ParseResponse( NULL,
|
|
pRcv,
|
|
dwRcvLen,
|
|
"GDD",
|
|
&dwNumEntries,
|
|
&dwAttrLen );
|
|
|
|
if ( !NT_SUCCESS( Status ) ||
|
|
dwNumEntries != 1 ) {
|
|
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
DebugTrace( 0, Dbg, "Public Key Length: %d\n", dwAttrLen );
|
|
pRcv += ( 2 * sizeof( DWORD ) );
|
|
|
|
if ( dwAttrLen <= *pPubKeyLen ) {
|
|
|
|
RtlCopyMemory( pPubKeyVal, pRcv, dwAttrLen );
|
|
*pPubKeyLen = dwAttrLen;
|
|
Status = STATUS_SUCCESS;
|
|
|
|
} else {
|
|
|
|
DebugTrace( 0, Dbg, "Public key buffer is too small.\n", 0 );
|
|
Status = STATUS_BUFFER_TOO_SMALL;
|
|
}
|
|
|
|
ExitWithCleanup:
|
|
|
|
NdsFreeLockedBuffer( &NdsRequest );
|
|
FREE_POOL( Rrp );
|
|
return Status;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
NdsCheckGroupMembership(
|
|
PIRP_CONTEXT pIrpContext,
|
|
DWORD dwUserOid,
|
|
PUNICODE_STRING puGroupName
|
|
) {
|
|
|
|
NTSTATUS Status;
|
|
UNICODE_STRING GroupListAttribute;
|
|
LOCKED_BUFFER NdsRequest;
|
|
|
|
PNDS_RESPONSE_READ_ATTRIBUTE pAttributeResponse;
|
|
PNDS_ATTRIBUTE pAttribute;
|
|
PBYTE pAttribData;
|
|
DWORD dwAttribLength, dwCurrentLength;
|
|
DWORD dwNumAttributes, dwCurrentAttribute;
|
|
UNICODE_STRING Group;
|
|
USHORT GroupLength;
|
|
|
|
PAGED_CODE();
|
|
|
|
RtlInitUnicodeString( &GroupListAttribute, GROUPS_ATTRIBUTE );
|
|
|
|
Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
Status = NdsReadAttributesKm( pIrpContext,
|
|
dwUserOid,
|
|
&GroupListAttribute,
|
|
&NdsRequest );
|
|
|
|
if ( !NT_SUCCESS( Status ) ) {
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
pAttributeResponse = ( PNDS_RESPONSE_READ_ATTRIBUTE ) NdsRequest.pRecvBufferVa;
|
|
ASSERT( pAttributeResponse->NumAttributes > 0 );
|
|
|
|
//
|
|
// Skip over the response header and walk down the attribute
|
|
// until we get to the data. This is a little clunky.
|
|
//
|
|
|
|
pAttribute = ( PNDS_ATTRIBUTE ) ( pAttributeResponse + 1 );
|
|
dwCurrentLength = sizeof( NDS_RESPONSE_READ_ATTRIBUTE );
|
|
|
|
dwAttribLength = ROUNDUP4( pAttribute->AttribNameLength );
|
|
dwAttribLength += ( 2 * sizeof( DWORD ) );
|
|
|
|
//
|
|
// Make sure we don't walk past the end of the buffer because
|
|
// of a bad packet from the server.
|
|
//
|
|
|
|
if ( ( dwCurrentLength + dwAttribLength ) > NDS_BUFFER_SIZE ) {
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
pAttribData = ( ( BYTE * )pAttribute ) + dwAttribLength;
|
|
dwCurrentLength += dwAttribLength;
|
|
|
|
//
|
|
// This is DWORD aligned for four byte DWORDs.
|
|
//
|
|
|
|
if ( ( NDS_BUFFER_SIZE - dwCurrentLength ) < sizeof( DWORD ) ) {
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
dwNumAttributes = * ( ( DWORD * ) pAttribData );
|
|
|
|
if ( dwNumAttributes == 0 ) {
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
//
|
|
// Each attribute is an NDS string DWORD aligned.
|
|
//
|
|
|
|
Status = STATUS_UNSUCCESSFUL;
|
|
|
|
pAttribData += sizeof( DWORD );
|
|
dwCurrentLength += sizeof( DWORD );
|
|
|
|
for ( dwCurrentAttribute = 0;
|
|
dwCurrentAttribute < dwNumAttributes ;
|
|
dwCurrentAttribute++ ) {
|
|
|
|
Group.Length = Group.MaximumLength =
|
|
( USHORT )( * ( ( DWORD * ) pAttribData ) ) - sizeof( WCHAR );
|
|
Group.Buffer = ( PWCHAR ) ( pAttribData + sizeof( DWORD ) );
|
|
|
|
if ( ( Group.Length + dwCurrentLength ) > NDS_BUFFER_SIZE ) {
|
|
return STATUS_UNSUCCESSFUL;
|
|
}
|
|
|
|
//
|
|
// Strip off the X500 prefix and the context.
|
|
//
|
|
|
|
GroupLength = 0;
|
|
|
|
while ( GroupLength < ( Group.Length / sizeof( WCHAR ) ) ) {
|
|
|
|
if ( Group.Buffer[GroupLength++] == L'=' ) {
|
|
|
|
Group.Buffer += 1;
|
|
Group.Length -= sizeof( WCHAR );
|
|
Group.MaximumLength -= sizeof( WCHAR );
|
|
|
|
GroupLength = ( Group.Length / sizeof( WCHAR ) );
|
|
}
|
|
|
|
Group.Buffer += 1;
|
|
Group.Length -= sizeof( WCHAR );
|
|
Group.MaximumLength -= sizeof( WCHAR );
|
|
}
|
|
|
|
GroupLength = 0;
|
|
|
|
while ( GroupLength < ( Group.Length / sizeof( WCHAR ) ) ) {
|
|
|
|
if ( Group.Buffer[GroupLength++] == L'.' ) {
|
|
Group.Length = ( GroupLength - 1 ) * sizeof( WCHAR );
|
|
Group.MaximumLength = Group.Length;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ( RtlEqualUnicodeString( puGroupName, &Group, TRUE ) ) {
|
|
|
|
DebugTrace( 0, Dbg, "Group check for %wZ succeeded.\n", &Group );
|
|
Status = STATUS_SUCCESS;
|
|
goto ExitWithCleanup;
|
|
}
|
|
|
|
//
|
|
// Dig out the attribute size and process the next entry.
|
|
//
|
|
|
|
dwAttribLength = ROUNDUP4( * ( ( DWORD * ) pAttribData ) );
|
|
dwAttribLength += sizeof( DWORD );
|
|
pAttribData += dwAttribLength;
|
|
dwCurrentLength += dwAttribLength;
|
|
|
|
}
|
|
|
|
ExitWithCleanup:
|
|
|
|
NdsFreeLockedBuffer( &NdsRequest );
|
|
return Status;
|
|
}
|
|
|
|
|
|
NTSTATUS
|
|
NdsAllocateLockedBuffer(
|
|
PLOCKED_BUFFER NdsRequest,
|
|
DWORD BufferSize
|
|
)
|
|
/*++
|
|
|
|
Description:
|
|
|
|
Allocate a buffer for io. Lock it down and fill in the
|
|
buffer data structure that we pass around.
|
|
|
|
--*/
|
|
{
|
|
|
|
PAGED_CODE();
|
|
|
|
NdsRequest->pRecvBufferVa = ALLOCATE_POOL( PagedPool, BufferSize );
|
|
|
|
if ( !NdsRequest->pRecvBufferVa ) {
|
|
DebugTrace( 0, Dbg, "Couldn't allocate locked io buffer.\n", 0 );
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
NdsRequest->dwRecvLen = BufferSize;
|
|
NdsRequest->pRecvMdl = ALLOCATE_MDL( NdsRequest->pRecvBufferVa,
|
|
BufferSize,
|
|
FALSE,
|
|
FALSE,
|
|
NULL );
|
|
|
|
if ( !NdsRequest->pRecvMdl ) {
|
|
DebugTrace( 0, Dbg, "Couldn't allocate mdl for locked io buffer.\n", 0 );
|
|
FREE_POOL( NdsRequest->pRecvBufferVa );
|
|
return STATUS_INSUFFICIENT_RESOURCES;
|
|
}
|
|
|
|
MmProbeAndLockPages( NdsRequest->pRecvMdl,
|
|
KernelMode,
|
|
IoWriteAccess );
|
|
|
|
return STATUS_SUCCESS;
|
|
|
|
}
|
|
|
|
NTSTATUS
|
|
NdsFreeLockedBuffer(
|
|
PLOCKED_BUFFER NdsRequest
|
|
)
|
|
/*++
|
|
|
|
Description:
|
|
|
|
Free a buffer allocated for io.
|
|
|
|
--*/
|
|
{
|
|
|
|
PAGED_CODE();
|
|
|
|
MmUnlockPages( NdsRequest->pRecvMdl );
|
|
FREE_MDL( NdsRequest->pRecvMdl );
|
|
FREE_POOL( NdsRequest->pRecvBufferVa );
|
|
return STATUS_SUCCESS;
|
|
|
|
}
|