From 9b29e5f726321e2b68e795ec6887c1207e9eac04 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Tue, 28 Apr 2020 21:59:46 +0300 Subject: [PATCH] s3: pass DCE RPC handle type to create_policy_hnd Various RPC services expect policy handles of a specific type. s3 RPC server did not allow to create policy handles with a specific type while actually requiring that policy handle type itself in some places. Make sure we are able to specify the policy on-wire handle type when creating the policy handle. The changes follow s4 DCE RPC server implementation. The original logic to always set on-wire handle type to 0 can be tracked down to commit fdeea341ed1bae670382e45eb731db1b5838ad21 when we didn't really know about differences in on-wire handle types. All but LSA trusted domain RPC calls do not check the on-wire handle type in s3 RPC server. Fixes trusted domain operations when Samba RPC client attempts to call s3 RPC server to perform lsa_lsaRSetForestTrustInformation in FreeIPA. This fix is a pre-requisite for FreeIPA-FreeIPA forest trust. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14359 Signed-off-by: Alexander Bokovoy Reviewed-by: Jeremy Allison Autobuild-User(master): Jeremy Allison Autobuild-Date(master): Tue Apr 28 22:55:29 UTC 2020 on sn-devel-184 (cherry picked from commit c7a4578d06427a82ead287f0c5248c1a54cc9336) --- source3/rpc_server/epmapper/srv_epmapper.c | 7 +- source3/rpc_server/eventlog/srv_eventlog_nt.c | 2 +- source3/rpc_server/lsa/srv_lsa_nt.c | 2 +- source3/rpc_server/mdssvc/srv_mdssvc_nt.c | 2 +- source3/rpc_server/rpc_handles.c | 30 ++++--- source3/rpc_server/rpc_pipes.h | 19 +++-- source3/rpc_server/samr/srv_samr_nt.c | 84 ++++++++++++++----- source3/rpc_server/spoolss/srv_spoolss_nt.c | 2 +- source3/rpc_server/svcctl/srv_svcctl_nt.c | 2 +- source3/rpc_server/winreg/srv_winreg_nt.c | 6 +- 10 files changed, 108 insertions(+), 48 deletions(-) diff --git a/source3/rpc_server/epmapper/srv_epmapper.c b/source3/rpc_server/epmapper/srv_epmapper.c index 1785cbbcfff..eaa8f065401 100644 --- a/source3/rpc_server/epmapper/srv_epmapper.c +++ b/source3/rpc_server/epmapper/srv_epmapper.c @@ -27,6 +27,9 @@ #include "srv_epmapper.h" #include "auth.h" +/* handle types for this module */ +enum handle_types {HTYPE_LOOKUP}; + typedef uint32_t error_status_t; /* An endpoint combined with an interface description */ @@ -680,7 +683,7 @@ error_status_t _epm_Lookup(struct pipes_struct *p, goto done; } - ok = create_policy_hnd(p, r->out.entry_handle, eps); + ok = create_policy_hnd(p, r->out.entry_handle, HTYPE_LOOKUP, eps); if (!ok) { rc = EPMAPPER_STATUS_NO_MEMORY; goto done; @@ -1072,7 +1075,7 @@ error_status_t _epm_Map(struct pipes_struct *p, } /* end of "some algorithm" */ - ok = create_policy_hnd(p, r->out.entry_handle, eps); + ok = create_policy_hnd(p, r->out.entry_handle, HTYPE_LOOKUP, eps); if (!ok) { rc = EPMAPPER_STATUS_NO_MEMORY; goto done; diff --git a/source3/rpc_server/eventlog/srv_eventlog_nt.c b/source3/rpc_server/eventlog/srv_eventlog_nt.c index 9d8322adf34..3c6474269f0 100644 --- a/source3/rpc_server/eventlog/srv_eventlog_nt.c +++ b/source3/rpc_server/eventlog/srv_eventlog_nt.c @@ -270,7 +270,7 @@ static NTSTATUS elog_open( struct pipes_struct * p, const char *logname, struct /* create the policy handle */ - if ( !create_policy_hnd( p, hnd, elog ) ) { + if ( !create_policy_hnd( p, hnd, 0, elog ) ) { TALLOC_FREE(elog); return NT_STATUS_NO_MEMORY; } diff --git a/source3/rpc_server/lsa/srv_lsa_nt.c b/source3/rpc_server/lsa/srv_lsa_nt.c index 4adb3b2bf6c..614cc06261a 100644 --- a/source3/rpc_server/lsa/srv_lsa_nt.c +++ b/source3/rpc_server/lsa/srv_lsa_nt.c @@ -371,7 +371,7 @@ static NTSTATUS create_lsa_policy_handle(TALLOC_CTX *mem_ctx, } } - if (!create_policy_hnd(p, handle, info)) { + if (!create_policy_hnd(p, handle, type, info)) { talloc_free(info); ZERO_STRUCTP(handle); return NT_STATUS_NO_MEMORY; diff --git a/source3/rpc_server/mdssvc/srv_mdssvc_nt.c b/source3/rpc_server/mdssvc/srv_mdssvc_nt.c index 04287008a5c..cfccd38a4c6 100644 --- a/source3/rpc_server/mdssvc/srv_mdssvc_nt.c +++ b/source3/rpc_server/mdssvc/srv_mdssvc_nt.c @@ -140,7 +140,7 @@ static NTSTATUS create_mdssvc_policy_handle(TALLOC_CTX *mem_ctx, return NT_STATUS_UNSUCCESSFUL; } - if (!create_policy_hnd(p, handle, mds_ctx)) { + if (!create_policy_hnd(p, handle, 0, mds_ctx)) { talloc_free(mds_ctx); ZERO_STRUCTP(handle); return NT_STATUS_NO_MEMORY; diff --git a/source3/rpc_server/rpc_handles.c b/source3/rpc_server/rpc_handles.c index 453dab6905f..700cc64d26a 100644 --- a/source3/rpc_server/rpc_handles.c +++ b/source3/rpc_server/rpc_handles.c @@ -250,8 +250,11 @@ bool init_pipe_handles(struct pipes_struct *p, const struct ndr_syntax_id *synta data_ptr is TALLOC_FREE()'ed ****************************************************************************/ -static struct dcesrv_handle_old *create_rpc_handle_internal(struct pipes_struct *p, - struct policy_handle *hnd, void *data_ptr) +static struct dcesrv_handle_old *create_rpc_handle_internal( + struct pipes_struct *p, + struct policy_handle *hnd, + uint8_t handle_type, + void *data_ptr) { struct dcesrv_handle_old *rpc_hnd = NULL; static uint32_t pol_hnd_low = 0; @@ -279,8 +282,7 @@ static struct dcesrv_handle_old *create_rpc_handle_internal(struct pipes_struct pol_hnd_high++; } - /* first bit must be null */ - SIVAL(&rpc_hnd->wire_handle.handle_type, 0 , 0); + rpc_hnd->wire_handle.handle_type = handle_type; /* second bit is incrementing */ SIVAL(&rpc_hnd->wire_handle.uuid.time_low, 0 , pol_hnd_low); @@ -307,12 +309,14 @@ static struct dcesrv_handle_old *create_rpc_handle_internal(struct pipes_struct return rpc_hnd; } -bool create_policy_hnd(struct pipes_struct *p, struct policy_handle *hnd, - void *data_ptr) +bool create_policy_hnd(struct pipes_struct *p, + struct policy_handle *hnd, + uint8_t handle_type, + void *data_ptr) { struct dcesrv_handle_old *rpc_hnd = NULL; - rpc_hnd = create_rpc_handle_internal(p, hnd, data_ptr); + rpc_hnd = create_rpc_handle_internal(p, hnd, handle_type, data_ptr); if (rpc_hnd == NULL) { return false; } @@ -450,9 +454,13 @@ bool pipe_access_check(struct pipes_struct *p) return True; } -void *_policy_handle_create(struct pipes_struct *p, struct policy_handle *hnd, - uint32_t access_granted, size_t data_size, - const char *type, NTSTATUS *pstatus) +void *_policy_handle_create(struct pipes_struct *p, + struct policy_handle *hnd, + uint8_t handle_type, + uint32_t access_granted, + size_t data_size, + const char *type, + NTSTATUS *pstatus) { struct dcesrv_handle_old *rpc_hnd = NULL; void *data; @@ -474,7 +482,7 @@ void *_policy_handle_create(struct pipes_struct *p, struct policy_handle *hnd, } talloc_set_name_const(data, type); - rpc_hnd = create_rpc_handle_internal(p, hnd, data); + rpc_hnd = create_rpc_handle_internal(p, hnd, handle_type, data); if (rpc_hnd == NULL) { TALLOC_FREE(data); *pstatus = NT_STATUS_NO_MEMORY; diff --git a/source3/rpc_server/rpc_pipes.h b/source3/rpc_server/rpc_pipes.h index 8a8f8e58169..5cdf2fdf6a2 100644 --- a/source3/rpc_server/rpc_pipes.h +++ b/source3/rpc_server/rpc_pipes.h @@ -199,18 +199,25 @@ int close_internal_rpc_pipe_hnd(struct pipes_struct *p); size_t num_pipe_handles(struct pipes_struct *p); bool init_pipe_handles(struct pipes_struct *p, const struct ndr_syntax_id *syntax); -bool create_policy_hnd(struct pipes_struct *p, struct policy_handle *hnd, void *data_ptr); +bool create_policy_hnd(struct pipes_struct *p, + struct policy_handle *hnd, + uint8_t handle_type, + void *data_ptr); bool find_policy_by_hnd(struct pipes_struct *p, const struct policy_handle *hnd, void **data_p); bool close_policy_hnd(struct pipes_struct *p, struct policy_handle *hnd); void close_policy_by_pipe(struct pipes_struct *p); bool pipe_access_check(struct pipes_struct *p); -void *_policy_handle_create(struct pipes_struct *p, struct policy_handle *hnd, - uint32_t access_granted, size_t data_size, - const char *type, NTSTATUS *pstatus); -#define policy_handle_create(_p, _hnd, _access, _type, _pstatus) \ - (_type *)_policy_handle_create((_p), (_hnd), (_access), sizeof(_type), #_type, \ +void *_policy_handle_create(struct pipes_struct *p, + struct policy_handle *hnd, + uint8_t handle_type, + uint32_t access_granted, + size_t data_size, + const char *type, + NTSTATUS *pstatus); +#define policy_handle_create(_p, _hnd, _hnd_type, _access, _type, _pstatus) \ + (_type *)_policy_handle_create((_p), (_hnd), (_hnd_type), (_access), sizeof(_type), #_type, \ (_pstatus)) void *_policy_handle_find(struct pipes_struct *p, diff --git a/source3/rpc_server/samr/srv_samr_nt.c b/source3/rpc_server/samr/srv_samr_nt.c index ee3a5660358..1ebced46bb3 100644 --- a/source3/rpc_server/samr/srv_samr_nt.c +++ b/source3/rpc_server/samr/srv_samr_nt.c @@ -65,6 +65,14 @@ #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */ #define MAX_SAM_ENTRIES_W95 50 +enum samr_handle { + SAMR_HANDLE_CONNECT, + SAMR_HANDLE_DOMAIN, + SAMR_HANDLE_USER, + SAMR_HANDLE_GROUP, + SAMR_HANDLE_ALIAS +}; + struct samr_connect_info { uint8_t dummy; }; @@ -498,8 +506,12 @@ NTSTATUS _samr_OpenDomain(struct pipes_struct *p, return NT_STATUS_NO_SUCH_DOMAIN; } - dinfo = policy_handle_create(p, r->out.domain_handle, acc_granted, - struct samr_domain_info, &status); + dinfo = policy_handle_create(p, + r->out.domain_handle, + SAMR_HANDLE_DOMAIN, + acc_granted, + struct samr_domain_info, + &status); if (!NT_STATUS_IS_OK(status)) { return status; } @@ -2221,8 +2233,12 @@ NTSTATUS _samr_OpenUser(struct pipes_struct *p, /* If we did the rid admins hack above, allow access. */ acc_granted |= extra_access; - uinfo = policy_handle_create(p, r->out.user_handle, acc_granted, - struct samr_user_info, &nt_status); + uinfo = policy_handle_create(p, + r->out.user_handle, + SAMR_HANDLE_USER, + acc_granted, + struct samr_user_info, + &nt_status); if (!NT_STATUS_IS_OK(nt_status)) { return nt_status; } @@ -3790,8 +3806,12 @@ NTSTATUS _samr_CreateUser2(struct pipes_struct *p, return nt_status; } - uinfo = policy_handle_create(p, r->out.user_handle, acc_granted, - struct samr_user_info, &nt_status); + uinfo = policy_handle_create(p, + r->out.user_handle, + SAMR_HANDLE_USER, + acc_granted, + struct samr_user_info, + &nt_status); if (!NT_STATUS_IS_OK(nt_status)) { return nt_status; } @@ -3859,9 +3879,12 @@ NTSTATUS _samr_Connect(struct pipes_struct *p, /* set up the SAMR connect_anon response */ - (void)policy_handle_create(p, &hnd, acc_granted, - struct samr_connect_info, - &status); + (void)policy_handle_create(p, + &hnd, + SAMR_HANDLE_CONNECT, + acc_granted, + struct samr_connect_info, + &status); if (!NT_STATUS_IS_OK(status)) { return status; } @@ -3923,8 +3946,12 @@ NTSTATUS _samr_Connect2(struct pipes_struct *p, if ( !NT_STATUS_IS_OK(nt_status) ) return nt_status; - (void)policy_handle_create(p, &hnd, acc_granted, - struct samr_connect_info, &nt_status); + (void)policy_handle_create(p, + &hnd, + SAMR_HANDLE_CONNECT, + acc_granted, + struct samr_connect_info, + &nt_status); if (!NT_STATUS_IS_OK(nt_status)) { return nt_status; } @@ -4160,8 +4187,12 @@ NTSTATUS _samr_OpenAlias(struct pipes_struct *p, } - ainfo = policy_handle_create(p, r->out.alias_handle, acc_granted, - struct samr_alias_info, &status); + ainfo = policy_handle_create(p, + r->out.alias_handle, + SAMR_HANDLE_ALIAS, + acc_granted, + struct samr_alias_info, + &status); if (!NT_STATUS_IS_OK(status)) { return status; } @@ -5906,9 +5937,12 @@ NTSTATUS _samr_CreateDomainGroup(struct pipes_struct *p, if ( !NT_STATUS_IS_OK(status) ) return status; - ginfo = policy_handle_create(p, r->out.group_handle, - GENERIC_RIGHTS_GROUP_ALL_ACCESS, - struct samr_group_info, &status); + ginfo = policy_handle_create(p, + r->out.group_handle, + SAMR_HANDLE_GROUP, + GENERIC_RIGHTS_GROUP_ALL_ACCESS, + struct samr_group_info, + &status); if (!NT_STATUS_IS_OK(status)) { return status; } @@ -5980,9 +6014,12 @@ NTSTATUS _samr_CreateDomAlias(struct pipes_struct *p, return NT_STATUS_ACCESS_DENIED; } - ainfo = policy_handle_create(p, r->out.alias_handle, - GENERIC_RIGHTS_ALIAS_ALL_ACCESS, - struct samr_alias_info, &result); + ainfo = policy_handle_create(p, + r->out.alias_handle, + SAMR_HANDLE_ALIAS, + GENERIC_RIGHTS_ALIAS_ALL_ACCESS, + struct samr_alias_info, + &result); if (!NT_STATUS_IS_OK(result)) { return result; } @@ -6386,9 +6423,12 @@ NTSTATUS _samr_OpenGroup(struct pipes_struct *p, TALLOC_FREE(map); - ginfo = policy_handle_create(p, r->out.group_handle, - acc_granted, - struct samr_group_info, &status); + ginfo = policy_handle_create(p, + r->out.group_handle, + SAMR_HANDLE_GROUP, + acc_granted, + struct samr_group_info, + &status); if (!NT_STATUS_IS_OK(status)) { return status; } diff --git a/source3/rpc_server/spoolss/srv_spoolss_nt.c b/source3/rpc_server/spoolss/srv_spoolss_nt.c index d92963ec32a..c80fc2aac2d 100644 --- a/source3/rpc_server/spoolss/srv_spoolss_nt.c +++ b/source3/rpc_server/spoolss/srv_spoolss_nt.c @@ -715,7 +715,7 @@ static WERROR open_printer_hnd(struct pipes_struct *p, talloc_set_destructor(new_printer, printer_entry_destructor); /* This also steals the printer_handle on the policy_handle */ - if (!create_policy_hnd(p, hnd, new_printer)) { + if (!create_policy_hnd(p, hnd, 0, new_printer)) { TALLOC_FREE(new_printer); return WERR_INVALID_HANDLE; } diff --git a/source3/rpc_server/svcctl/srv_svcctl_nt.c b/source3/rpc_server/svcctl/srv_svcctl_nt.c index ae787066873..9ba6fbb1fce 100644 --- a/source3/rpc_server/svcctl/srv_svcctl_nt.c +++ b/source3/rpc_server/svcctl/srv_svcctl_nt.c @@ -257,7 +257,7 @@ static WERROR create_open_service_handle(struct pipes_struct *p, /* store the SERVICE_INFO and create an open handle */ - if ( !create_policy_hnd( p, handle, info ) ) { + if ( !create_policy_hnd( p, handle, 0, info ) ) { result = WERR_ACCESS_DENIED; goto done; } diff --git a/source3/rpc_server/winreg/srv_winreg_nt.c b/source3/rpc_server/winreg/srv_winreg_nt.c index 6c3270d886a..d67608fdd76 100644 --- a/source3/rpc_server/winreg/srv_winreg_nt.c +++ b/source3/rpc_server/winreg/srv_winreg_nt.c @@ -34,6 +34,8 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_RPC_SRV +enum handle_types { HTYPE_REGVAL, HTYPE_REGKEY }; + /****************************************************************** Find a registry key handle and return a struct registry_key * *****************************************************************/ @@ -81,7 +83,7 @@ static WERROR open_registry_key(struct pipes_struct *p, return result; } - if ( !create_policy_hnd( p, hnd, key ) ) { + if ( !create_policy_hnd( p, hnd, HTYPE_REGKEY, key ) ) { return WERR_FILE_NOT_FOUND; } @@ -710,7 +712,7 @@ WERROR _winreg_CreateKey(struct pipes_struct *p, return result; } - if (!create_policy_hnd(p, r->out.new_handle, new_key)) { + if (!create_policy_hnd(p, r->out.new_handle, HTYPE_REGKEY, new_key)) { TALLOC_FREE(new_key); return WERR_FILE_NOT_FOUND; } -- 2.25.3