s4:rpc_server: add a min_auth_level to context handles
authorStefan Metzmacher <metze@samba.org>
Wed, 21 Nov 2018 22:27:50 +0000 (23:27 +0100)
committerJeremy Allison <jra@samba.org>
Sat, 12 Jan 2019 02:13:37 +0000 (03:13 +0100)
BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
source4/rpc_server/dcerpc_server.h
source4/rpc_server/handles.c

index 4b6c0d1..abfb5c0 100644 (file)
@@ -189,6 +189,7 @@ struct dcesrv_handle {
        struct dcesrv_assoc_group *assoc_group;
        struct policy_handle wire_handle;
        struct dom_sid *sid;
+       enum dcerpc_AuthLevel min_auth_level;
        const struct dcesrv_interface *iface;
        void *data;
 };
index b0cef1c..68bacef 100644 (file)
@@ -65,6 +65,7 @@ struct dcesrv_handle *dcesrv_handle_create(struct dcesrv_call_state *call,
                talloc_free(h);
                return NULL;
        }
+       h->min_auth_level = call->auth_state->auth_level;
        h->assoc_group = context->conn->assoc_group;
        h->iface = context->iface;
        h->wire_handle.handle_type = handle_type;
@@ -120,6 +121,12 @@ struct dcesrv_handle *dcesrv_handle_lookup(struct dcesrv_call_state *call,
                                         dom_sid_string(context, sid)));
                                return NULL;
                        }
+                       if (call->auth_state->auth_level < h->min_auth_level) {
+                               DEBUG(0,(__location__ ": Attempt to use invalid auth_level %u < %u\n",
+                                        call->auth_state->auth_level,
+                                        h->min_auth_level));
+                               return NULL;
+                       }
                        if (h->iface != context->iface) {
                                DEBUG(0,(__location__ ": Attempt to use invalid iface\n"));
                                return NULL;