89{
95 PSID CapturedServerSid;
96 ULONG ConnectionInfoLength = 0;
100 ULONG PortMessageLength;
106
109 "Name: %wZ. SecurityQos: %p. Views: %p/%p. Sid: %p\n",
111 SecurityQos,
112 ClientView,
113 ServerView,
114 ServerSid);
115
116
118 {
119
121 {
122
124
125
128
129
130
131
132
133 if (ClientView)
134 {
136 CapturedClientView = *(
volatile PORT_VIEW*)ClientView;
137
138
139 if (CapturedClientView.
Length !=
sizeof(CapturedClientView))
140 {
141
143 }
144
145 }
146
147
148 if (ServerView)
149 {
151
152
154 {
155
157 }
158 }
159
160 if (MaxMessageLength)
162
163
164 if (ConnectionInformationLength)
165 {
167 ConnectionInfoLength = *(
volatile ULONG*)ConnectionInformationLength;
168 }
169
170
171 if (ConnectionInformation)
173
174 CapturedServerSid = ServerSid;
175 if (ServerSid !=
NULL)
176 {
177
182 &CapturedServerSid);
184 {
185 DPRINT1(
"Failed to capture ServerSid!\n");
187 }
188 }
189 }
191 {
192
194 }
196 }
197 else
198 {
199 CapturedQos = *SecurityQos;
200
201
202
203
204
205 if (ClientView)
206 {
207
208 if (ClientView->Length != sizeof(*ClientView))
209 {
210
212 }
213 CapturedClientView = *ClientView;
214 }
215
216
217 if (ServerView)
218 {
219
220 if (ServerView->
Length !=
sizeof(*ServerView))
221 {
222
224 }
225 }
226
227
228 if (ConnectionInformationLength)
229 ConnectionInfoLength = *ConnectionInformationLength;
230
231 CapturedServerSid = ServerSid;
232 }
233
234
236 0,
244 {
246
247 if (CapturedServerSid != ServerSid)
249
251 }
252
253
255 {
257
258
260
261 if (CapturedServerSid != ServerSid)
263
265 }
266
267
268 if (ServerSid)
269 {
270
271 if (
Port->ServerProcess)
272 {
273
277
278
280 {
281
283 {
284
287 }
288
289
291 }
292 }
293 else
294 {
295
298 }
299
300
301 if (CapturedServerSid != ServerSid)
303
304
306 {
307
310 }
311 }
312
313
320 0,
321 0,
324 {
325
329 }
330
331
332
333
334
342
343
345 {
346
348 }
349 else
350 {
351
353 &CapturedQos,
357 {
358
362 }
363 }
364
365
368 {
369
373 }
374
375
376 if (ClientView)
377 {
378
384 (
PVOID*)&SectionToMap,
387 {
388
389 DPRINT1(
"Failed to reference port section handle: 0x%lx\n",
Status);
392 }
393
394
396
397
401 0,
402 0,
406 0,
408
409
411
412
414 {
415
420 }
421
422
424
425
428 }
429 else
430 {
431
433 }
434
435
436 if (ConnectionInfoLength >
Port->MaxConnectionInfoLength)
437 {
438
439 ConnectionInfoLength =
Port->MaxConnectionInfoLength;
440 }
441
442
445 {
446
447 DPRINT1(
"LpcpAllocateFromPortZone failed\n");
451 }
452
453
456
457
458 if (ClientView)
459 {
460
462
463
465 &CapturedClientView,
466 sizeof(CapturedClientView));
468 }
469 else
470 {
471
472 Message->Request.ClientViewSize = 0;
474 }
475
476
479
480
481 Message->Request.u1.s1.DataLength = (
CSHORT)ConnectionInfoLength +
484 Message->Request.u1.s1.DataLength;
486
487
488 if (ConnectionInformation)
489 {
491 {
492
494 ConnectionInformation,
495 ConnectionInfoLength);
496 }
498 {
499 DPRINT1(
"Exception 0x%lx when copying connection info to user mode\n",
501
502
503
504
506
507
510
511
513 }
515 }
516
517
519
520
522
523
525 {
526
528 }
529 else
530 {
531
533
534
538
539
543
544
547
548
550 }
551
552
554
555
557
558
560 {
562 "Messages: %p/%p. Ports: %p/%p. Status: %lx\n",
564 ConnectMessage,
568
569
572
573
576
577
579 }
580
581
583
584
586 {
587
589 {
590
596 }
597
598 goto Failure;
599 }
600
601
603 {
604
605 if ((
Message->Request.u1.s1.DataLength -
607 {
608
609 ConnectionInfoLength =
Message->Request.u1.s1.DataLength -
611 }
612
613
614 if (ConnectionInformation)
615 {
617 {
618
619 if (ConnectionInformationLength)
620 *ConnectionInformationLength = ConnectionInfoLength;
621
622
624 ConnectMessage + 1,
625 ConnectionInfoLength);
626 }
628 {
629
632 }
634 }
635
636
638 {
639
640 PortMessageLength =
Port->MaxMessageLength;
641
642
646 0,
650 {
652 "Handle: %p. Length: %lx\n",
654 PortMessageLength);
655
657 {
658
660
661
662 if (MaxMessageLength)
663 *MaxMessageLength = PortMessageLength;
664
665
666 if (ClientView)
667 {
668
671 sizeof(*ClientView));
672 }
673
674
675 if (ServerView)
676 {
677
680 sizeof(*ServerView));
681 }
682 }
684 {
685
688 }
690 }
691 }
692 else
693 {
694
696
697
699
700
703 {
704
706 }
707 else
708 {
709
711 }
712
713
715
716
718 }
719
720
722 }
723 else
724 {
725
727 goto Failure;
728 }
729
731
732
734
735Failure:
736
738
739
743
744
746}
#define NT_SUCCESS(StatCode)
#define InsertTailList(ListHead, Entry)
#define PsGetCurrentThread()
#define KeWaitForSingleObject(pEvt, foo, a, b, c)
#define KeSetEvent(pEvt, foo, foo2)
VOID NTAPI ProbeForRead(IN CONST VOID *Address, IN SIZE_T Length, IN ULONG Alignment)
VOID NTAPI ProbeForWrite(IN PVOID Address, IN SIZE_T Length, IN ULONG Alignment)
_Outptr_ PFLT_PORT * ClientPort
_In_opt_ PFILE_OBJECT _In_opt_ PETHREAD Thread
#define EXCEPTION_EXECUTE_HANDLER
#define KeLeaveCriticalRegion()
#define KeEnterCriticalRegion()
VOID NTAPI LpcpFreeToPortZone(IN PLPCP_MESSAGE Message, IN ULONG LockFlags)
POBJECT_TYPE LpcPortObjectType
#define LPCTRACE(x, fmt,...)
NTSTATUS NTAPI LpcpInitializePortQueue(IN PLPCP_PORT_OBJECT Port)
#define LPC_CONNECT_DEBUG
#define LpcpConnectWait(s, w)
#define LpcpCompleteWait(s)
static __inline PLPCP_MESSAGE LpcpAllocateFromPortZone(VOID)
#define LPCP_SECURITY_DYNAMIC
#define LPCP_CONNECTION_PORT
#define LPCP_NAME_DELETED
#define LPCP_WAITABLE_PORT
#define LPCP_PORT_TYPE_MASK
struct _LPCP_MESSAGE LPCP_MESSAGE
struct _LPCP_CONNECTION_MESSAGE LPCP_CONNECTION_MESSAGE
#define ExFreePoolWithTag(_P, _T)
NTKERNELAPI NTSTATUS NTAPI SeCreateClientSecurity(IN PETHREAD Thread, IN PSECURITY_QUALITY_OF_SERVICE QualityOfService, IN BOOLEAN RemoteClient, OUT PSECURITY_CLIENT_CONTEXT ClientContext)
#define PsDereferencePrimaryToken(T)
#define LPC_CONNECTION_REQUEST
#define KeGetPreviousMode()
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER SectionOffset
NTSYSAPI BOOLEAN NTAPI RtlEqualSid(_In_ PSID Sid1, _In_ PSID Sid2)
#define SECTION_MAP_WRITE
_In_ ULONG _In_ ULONG _In_ ULONG Length
VOID NTAPI SepReleaseSid(_In_ PSID CapturedSid, _In_ KPROCESSOR_MODE AccessMode, _In_ BOOLEAN CaptureIfKernel)
Releases a captured SID.
NTSTATUS NTAPI SepCaptureSid(_In_ PSID InputSid, _In_ KPROCESSOR_MODE AccessMode, _In_ POOL_TYPE PoolType, _In_ BOOLEAN CaptureIfKernel, _Out_ PSID *CapturedSid)
Captures a SID.
PVOID NTAPI LpcpFreeConMsg(IN OUT PLPCP_MESSAGE *Message, IN OUT PLPCP_CONNECTION_MESSAGE *ConnectMessage, IN PETHREAD CurrentThread)
PACCESS_TOKEN NTAPI PsReferencePrimaryToken(PEPROCESS Process)
#define STATUS_INVALID_PORT_HANDLE
#define STATUS_PORT_CONNECTION_REFUSED
#define STATUS_SERVER_SID_MISMATCH
NTSTATUS NTAPI ObCloseHandle(IN HANDLE Handle, IN KPROCESSOR_MODE AccessMode)
NTSTATUS NTAPI ObInsertObject(IN PVOID Object, IN PACCESS_STATE AccessState OPTIONAL, IN ACCESS_MASK DesiredAccess, IN ULONG ObjectPointerBias, OUT PVOID *NewObject OPTIONAL, OUT PHANDLE Handle)
NTSTATUS NTAPI ObCreateObject(IN KPROCESSOR_MODE ProbeMode OPTIONAL, IN POBJECT_TYPE Type, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext OPTIONAL, IN ULONG ObjectSize, IN ULONG PagedPoolCharge OPTIONAL, IN ULONG NonPagedPoolCharge OPTIONAL, OUT PVOID *Object)
NTSTATUS NTAPI ObReferenceObjectByName(IN PUNICODE_STRING ObjectPath, IN ULONG Attributes, IN PACCESS_STATE PassedAccessState, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, IN OUT PVOID ParseContext, OUT PVOID *ObjectPtr)
NTSTATUS NTAPI ObReferenceObjectByHandle(IN HANDLE Handle, IN ACCESS_MASK DesiredAccess, IN POBJECT_TYPE ObjectType, IN KPROCESSOR_MODE AccessMode, OUT PVOID *Object, OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL)
#define _SEH2_GetExceptionCode()
#define _SEH2_EXCEPT(...)
#define _SEH2_YIELD(__stmt)
#define ProbeForWriteHandle(Ptr)
#define ProbeForWriteUlong(Ptr)
NTSTATUS NTAPI MmMapViewOfSection(IN PVOID SectionObject, IN PEPROCESS Process, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
POBJECT_TYPE MmSectionObjectType
LONG NTAPI KeReadStateSemaphore(IN PKSEMAPHORE Semaphore)
PLPCP_PORT_OBJECT ClientPort
REMOTE_PORT_VIEW ServerView
SECURITY_CONTEXT_TRACKING_MODE ContextTrackingMode
NTSTATUS NTAPI SeQueryInformationToken(_In_ PACCESS_TOKEN AccessToken, _In_ TOKEN_INFORMATION_CLASS TokenInformationClass, _Outptr_result_buffer_(_Inexpressible_(token-dependent)) PVOID *TokenInformation)
Queries information details about the given token to the call. The difference between NtQueryInformat...
#define RtlCopyMemory(Destination, Source, Length)
#define RtlZeroMemory(Destination, Length)
#define STATUS_INVALID_PARAMETER
#define STATUS_OBJECT_NAME_NOT_FOUND
#define ObDereferenceObject
#define ObReferenceObject
#define PsGetCurrentProcess
_In_ KPROCESSOR_MODE PreviousMode
#define SECURITY_DYNAMIC_TRACKING