client.c File Reference

#include <ntoskrnl.h>
#include <debug.h>

Include dependency graph for client.c:

Go to the source code of this file.

Macros
#define	NDEBUG

Functions
NTSTATUS NTAPI	SepCreateClientSecurity (_In_ PACCESS_TOKEN Token, _In_ PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos, _In_ BOOLEAN ServerIsRemote, _In_ TOKEN_TYPE TokenType, _In_ BOOLEAN ThreadEffectiveOnly, _In_ SECURITY_IMPERSONATION_LEVEL ImpersonationLevel, _Out_ PSECURITY_CLIENT_CONTEXT ClientContext)
	Creates a client security context based upon an access token.
NTSTATUS NTAPI	SeCreateClientSecurity (_In_ PETHREAD Thread, _In_ PSECURITY_QUALITY_OF_SERVICE Qos, _In_ BOOLEAN RemoteClient, _Out_ PSECURITY_CLIENT_CONTEXT ClientContext)
	Creates a client security context.
NTSTATUS NTAPI	SeCreateClientSecurityFromSubjectContext (_In_ PSECURITY_SUBJECT_CONTEXT SubjectContext, _In_ PSECURITY_QUALITY_OF_SERVICE ClientSecurityQos, _In_ BOOLEAN ServerIsRemote, _Out_ PSECURITY_CLIENT_CONTEXT ClientContext)
	Creates a client security context based upon the captured security subject context.
NTSTATUS NTAPI	SeImpersonateClientEx (_In_ PSECURITY_CLIENT_CONTEXT ClientContext, _In_opt_ PETHREAD ServerThread)
	Extended function that impersonates a client.
VOID NTAPI	SeImpersonateClient (_In_ PSECURITY_CLIENT_CONTEXT ClientContext, _In_opt_ PETHREAD ServerThread)
	Impersonates a client user.

Macro Definition Documentation

NDEBUG

#define NDEBUG

Definition at line 11 of file client.c.

Function Documentation

SeCreateClientSecurity()

NTSTATUS NTAPI SeCreateClientSecurity	(	_In_ PETHREAD	Thread,
		_In_ PSECURITY_QUALITY_OF_SERVICE	Qos,
		_In_ BOOLEAN	RemoteClient,
		_Out_ PSECURITY_CLIENT_CONTEXT	ClientContext
	)

Creates a client security context.

Parameters

[in]	Thread	Thread object of the client where impersonation has to begin.
[in]	Qos	Quality of service to specify what kind of impersonation to be done.
[in]	RemoteClient	If set to TRUE, the client that we're going to impersonate is remote.
[out]	ClientContext	The returned security client context.

Returns

See SepCreateClientSecurity.

Definition at line 162 of file client.c.

{
    TOKEN_TYPE TokenType;
    BOOLEAN ThreadEffectiveOnly;
    SECURITY_IMPERSONATION_LEVEL ImpersonationLevel;
    PACCESS_TOKEN Token;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Reference the correct token */
    Token = PsReferenceEffectiveToken(Thread,
                                      &TokenType,
                                      &ThreadEffectiveOnly,
                                      &ImpersonationLevel);
 
    /* Create client security from it */
    Status = SepCreateClientSecurity(Token,
                                     Qos,
                                     RemoteClient,
                                     TokenType,
                                     ThreadEffectiveOnly,
                                     ImpersonationLevel,
                                     ClientContext);
 
    /* Check if we failed or static tracking was used */
    if (!(NT_SUCCESS(Status)) || (Qos->ContextTrackingMode == SECURITY_STATIC_TRACKING))
    {
        /* Dereference our copy since it's not being used */
        ObDereferenceObject(Token);
    }
 
    /* Return status */
    return Status;
}

SeCreateClientSecurityFromSubjectContext()

NTSTATUS NTAPI SeCreateClientSecurityFromSubjectContext	(	_In_ PSECURITY_SUBJECT_CONTEXT	SubjectContext,
		_In_ PSECURITY_QUALITY_OF_SERVICE	ClientSecurityQos,
		_In_ BOOLEAN	ServerIsRemote,
		_Out_ PSECURITY_CLIENT_CONTEXT	ClientContext
	)

Creates a client security context based upon the captured security subject context.

Parameters

[in]	SubjectContext	The captured subject context where client security is to be created from.
[in]	ClientSecurityQos	Quality of service to specify what kind of impersonation to be done.
[in]	ServerIsRemote	If set to TRUE, the client that we're going to impersonate is remote.
[out]	ClientContext	The returned security client context.

Returns

See SepCreateClientSecurity.

Definition at line 224 of file client.c.

{
    PACCESS_TOKEN Token;
    NTSTATUS Status;
    PAGED_CODE();
 
    /* Get the right token and reference it */
    Token = SeQuerySubjectContextToken(SubjectContext);
    ObReferenceObject(Token);
 
    /* Create the context */
    Status = SepCreateClientSecurity(Token,
                                     ClientSecurityQos,
                                     ServerIsRemote,
                                     SubjectContext->ClientToken ?
                                     TokenImpersonation : TokenPrimary,
                                     FALSE,
                                     SubjectContext->ImpersonationLevel,
                                     ClientContext);
 
    /* Check if we failed or static tracking was used */
    if (!(NT_SUCCESS(Status)) ||
        (ClientSecurityQos->ContextTrackingMode == SECURITY_STATIC_TRACKING))
    {
        /* Dereference our copy since it's not being used */
        ObDereferenceObject(Token);
    }
 
    /* Return status */
    return Status;
}

Referenced by nfs41_get_sec_ctx(), nfs41_GetLUID(), and nfs41_UpcallCreate().

SeImpersonateClient()

VOID NTAPI SeImpersonateClient	(	_In_ PSECURITY_CLIENT_CONTEXT	ClientContext,
		_In_opt_ PETHREAD	ServerThread
	)

Impersonates a client user.

Parameters

[in]	ClientContext	A valid client context.
[in]	ServerThread	The thread where impersonation is to be done.

Returns

Nothing.

Definition at line 321 of file client.c.

{
    PAGED_CODE();
 
    /* Call the new API */
    SeImpersonateClientEx(ClientContext, ServerThread);
}

SeImpersonateClientEx()

NTSTATUS NTAPI SeImpersonateClientEx	(	_In_ PSECURITY_CLIENT_CONTEXT	ClientContext,
		_In_opt_ PETHREAD	ServerThread
	)

Extended function that impersonates a client.

Parameters

[in]	ClientContext	A valid client context.
[in]	ServerThread	The thread where impersonation is to be done.

Returns

STATUS_SUCCESS is returned if the calling thread successfully impersonates the client. A failure NTSTATUS code is returned otherwise.

Definition at line 276 of file client.c.

{
    BOOLEAN EffectiveOnly;
    PAGED_CODE();
 
    /* Check if direct access is requested */
    if (!ClientContext->DirectlyAccessClientToken)
    {
        /* No, so get the flag from QOS */
        EffectiveOnly = ClientContext->SecurityQos.EffectiveOnly;
    }
    else
    {
        /* Yes, so see if direct access should be effective only */
        EffectiveOnly = ClientContext->DirectAccessEffectiveOnly;
    }
 
    /* Use the current thread if one was not passed */
    if (!ServerThread) ServerThread = PsGetCurrentThread();
 
    /* Call the lower layer routine */
    return PsImpersonateClient(ServerThread,
                               ClientContext->ClientToken,
                               TRUE,
                               EffectiveOnly,
                               ClientContext->SecurityQos.ImpersonationLevel);
}

Referenced by CmpCmdHiveOpen(), handle_upcall(), NpImpersonateClientContext(), NtImpersonateClientOfPort(), and SeImpersonateClient().

SepCreateClientSecurity()

NTSTATUS NTAPI SepCreateClientSecurity	(	_In_ PACCESS_TOKEN	Token,
		_In_ PSECURITY_QUALITY_OF_SERVICE	ClientSecurityQos,
		_In_ BOOLEAN	ServerIsRemote,
		_In_ TOKEN_TYPE	TokenType,
		_In_ BOOLEAN	ThreadEffectiveOnly,
		_In_ SECURITY_IMPERSONATION_LEVEL	ImpersonationLevel,
		_Out_ PSECURITY_CLIENT_CONTEXT	ClientContext
	)

Creates a client security context based upon an access token.

Parameters

[in]	Token	A valid token object.
[in]	ClientSecurityQos	The Quality of Service (QoS) of a client security context.
[in]	ServerIsRemote	If the client is a remote server (TRUE), the function will retrieve the control information of an access token, that is, we're doing delegation and that the server isn't local.
[in]	TokenType	Type of token.
[in]	ThreadEffectiveOnly	If set to TRUE, the client wants that the current thread wants to modify (enable or disable) privileges and groups.
[in]	ImpersonationLevel	Security impersonation level filled in the QoS context.
[out]	ClientContext	The returned security client context.

Returns

Returns STATUS_SUCCESS if client security creation has completed successfully. STATUS_INVALID_PARAMETER is returned if one or more of the parameters are bogus. STATUS_BAD_IMPERSONATION_LEVEL is returned if the current impersonation level within QoS context doesn't meet with the conditions required. A failure NTSTATUS code is returned otherwise.

Definition at line 53 of file client.c.

{
    NTSTATUS Status;
    PACCESS_TOKEN NewToken;
    PAGED_CODE();
 
    /* Check for bogus impersonation level */
    if (!VALID_IMPERSONATION_LEVEL(ClientSecurityQos->ImpersonationLevel))
    {
        /* Fail the call */
        return STATUS_INVALID_PARAMETER;
    }
 
    /* Check what kind of token this is */
    if (TokenType != TokenImpersonation)
    {
        /* On a primary token, if we do direct access, copy the flag from the QOS */
        ClientContext->DirectAccessEffectiveOnly = ClientSecurityQos->EffectiveOnly;
    }
    else
    {
        /* This is an impersonation token, is the level ok? */
        if (ClientSecurityQos->ImpersonationLevel > ImpersonationLevel)
        {
            /* Nope, fail */
            return STATUS_BAD_IMPERSONATION_LEVEL;
        }
 
        /* Is the level too low, or are we doing something other than delegation remotely */
        if ((ImpersonationLevel == SecurityAnonymous) ||
            (ImpersonationLevel == SecurityIdentification) ||
            ((ServerIsRemote) && (ImpersonationLevel != SecurityDelegation)))
        {
            /* Fail the call */
            return STATUS_BAD_IMPERSONATION_LEVEL;
        }
 
        /* Pick either the thread setting or the QOS setting */
        ClientContext->DirectAccessEffectiveOnly =
            ((ThreadEffectiveOnly) || (ClientSecurityQos->EffectiveOnly)) ? TRUE : FALSE;
    }
 
    /* Is this static tracking */
    if (ClientSecurityQos->ContextTrackingMode == SECURITY_STATIC_TRACKING)
    {
        /* Do not use direct access and make a copy */
        ClientContext->DirectlyAccessClientToken = FALSE;
        Status = SeCopyClientToken(Token,
                                   ClientSecurityQos->ImpersonationLevel,
                                   KernelMode,
                                   &NewToken);
        if (!NT_SUCCESS(Status))
            return Status;
    }
    else
    {
        /* Use direct access and check if this is local */
        ClientContext->DirectlyAccessClientToken = TRUE;
        if (ServerIsRemote)
        {
            /* We are doing delegation, so make a copy of the control data */
            SeGetTokenControlInformation(Token,
                                         &ClientContext->ClientTokenControl);
        }
 
        /* Keep the same token */
        NewToken = Token;
    }
 
    /* Fill out the context and return success */
    ClientContext->SecurityQos.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
    ClientContext->SecurityQos.ImpersonationLevel = ClientSecurityQos->ImpersonationLevel;
    ClientContext->SecurityQos.ContextTrackingMode = ClientSecurityQos->ContextTrackingMode;
    ClientContext->SecurityQos.EffectiveOnly = ClientSecurityQos->EffectiveOnly;
    ClientContext->ServerIsRemote = ServerIsRemote;
    ClientContext->ClientToken = NewToken;
    return STATUS_SUCCESS;
}

Referenced by SeCreateClientSecurity(), and SeCreateClientSecurityFromSubjectContext().