|
|
/*++
Copyright (c) 1991 Microsoft Corporation
Module Name:
cmparse.c
Abstract:
This module contains parse routines for the configuration manager, particularly the registry.
Author:
Bryan M. Willman (bryanwi) 10-Sep-1991
Revision History:
--*/
#include "cmp.h"
#ifdef ALLOC_DATA_PRAGMA
#pragma const_seg("PAGECONST")
#endif
const ULONG CmpCacheOnFlag = CM_CACHE_FAKE_KEY;
extern PCMHIVE CmpMasterHive;extern BOOLEAN CmpNoMasterCreates;extern PCM_KEY_CONTROL_BLOCK CmpKeyControlBlockRoot;extern UNICODE_STRING CmSymbolicLinkValueName;
#define CM_HASH_STACK_SIZE 30
typedef struct _CM_HASH_ENTRY { ULONG ConvKey; UNICODE_STRING KeyName;} CM_HASH_ENTRY, *PCM_HASH_ENTRY;
BOOLEANCmpGetHiveName( PCMHIVE CmHive, PUNICODE_STRING HiveName );
ULONGCmpComputeHashValue( IN PCM_HASH_ENTRY HashStack, IN OUT ULONG *TotalSubkeys, IN ULONG BaseConvKey, IN PUNICODE_STRING RemainingName );
NTSTATUSCmpCacheLookup( IN PCM_HASH_ENTRY HashStack, IN ULONG TotalRemainingSubkeys, OUT ULONG *MatchRemainSubkeyLevel, IN OUT PCM_KEY_CONTROL_BLOCK *Kcb, OUT PUNICODE_STRING RemainingName, OUT PHHIVE *Hive, OUT HCELL_INDEX *Cell );
VOIDCmpCacheAdd( IN PCM_HASH_ENTRY LastHashEntry, IN ULONG Count );
PCM_KEY_CONTROL_BLOCKCmpAddInfoAfterParseFailure( PHHIVE Hive, HCELL_INDEX Cell, PCM_KEY_NODE Node, PCM_KEY_CONTROL_BLOCK kcb, PUNICODE_STRING NodeName );
//
// Prototypes for procedures private to this file
//
BOOLEANCmpGetSymbolicLink( IN PHHIVE Hive, IN OUT PUNICODE_STRING ObjectName, IN OUT PCM_KEY_CONTROL_BLOCK SymbolicKcb, IN PUNICODE_STRING RemainingName );
NTSTATUSCmpDoOpen( IN PHHIVE Hive, IN HCELL_INDEX Cell, IN PCM_KEY_NODE Node, IN PACCESS_STATE AccessState, IN KPROCESSOR_MODE AccessMode, IN ULONG Attributes, IN PCM_PARSE_CONTEXT Context OPTIONAL, IN BOOLEAN CompleteKeyCached, IN OUT PCM_KEY_CONTROL_BLOCK *CachedKcb, IN PUNICODE_STRING KeyName, IN PCMHIVE OriginatingHive OPTIONAL, OUT PVOID *Object, OUT PBOOLEAN NeedDeref OPTIONAL );
NTSTATUSCmpCreateLinkNode( IN PHHIVE Hive, IN HCELL_INDEX Cell, IN PACCESS_STATE AccessState, IN UNICODE_STRING Name, IN KPROCESSOR_MODE AccessMode, IN ULONG Attributes, IN PCM_PARSE_CONTEXT Context, IN PCM_KEY_CONTROL_BLOCK ParentKcb, OUT PVOID *Object );
#ifdef CM_DYN_SYM_LINK
BOOLEANCmpCaptureProcessEnvironmentString( OUT PWSTR *ProcessEnvironment, OUT PULONG Length );PWSTRCmpExpandEnvVars( IN PWSTR StringToExpand, IN ULONG LengthToExpand, OUT PULONG ExpandedLength );BOOLEANCmpGrowAndCopyString( IN OUT PWSTR *OldString, IN OUT PULONG OldStringSize, IN ULONG GrowIncrements );BOOLEANCmpFindEnvVar( IN PWSTR ProcessEnv, IN ULONG ProcessEnvLength, IN PWSTR CurrentEnvVar, IN ULONG CurrentEnvLength, OUT PWSTR *CurrentEnvValue, OUT PULONG CurrentEnvValueLength );#endif
BOOLEANCmpOKToFollowLink( IN PCMHIVE OrigHive, IN PCMHIVE DestHive );
#ifdef ALLOC_PRAGMA
#pragma alloc_text(PAGE,CmpParseKey)
#pragma alloc_text(PAGE,CmpGetNextName)
#pragma alloc_text(PAGE,CmpDoOpen)
#pragma alloc_text(PAGE,CmpCreateLinkNode)
#pragma alloc_text(PAGE,CmpGetSymbolicLink)
#pragma alloc_text(PAGE,CmpComputeHashValue)
#pragma alloc_text(PAGE,CmpCacheLookup)
#pragma alloc_text(PAGE,CmpAddInfoAfterParseFailure)
#ifdef CM_DYN_SYM_LINK
#pragma alloc_text(PAGE,CmpCaptureProcessEnvironmentString)
#pragma alloc_text(PAGE,CmpExpandEnvVars)
#pragma alloc_text(PAGE,CmpGrowAndCopyString)
#pragma alloc_text(PAGE,CmpFindEnvVar)
#endif //CM_DYN_SYM_LINK
#pragma alloc_text(PAGE,CmpOKToFollowLink)
#endif
/*
VOIDCmpStepThroughExit( IN OUT PHHIVE *Hive, IN OUT HCELL_INDEX *Cell, IN OUT PCM_KEY_NODE *pNode )*/#define CmpStepThroughExit(h,c,n,ReleaseHive,ReleaseCell) \
if ((n)->Flags & KEY_HIVE_EXIT) { \ if( ReleaseCell != HCELL_NIL ) { \ ASSERT( ReleaseHive != NULL ); \ HvReleaseCell( ReleaseHive,ReleaseCell); \ } \ (h)=(n)->ChildHiveReference.KeyHive; \ (c)=(n)->ChildHiveReference.KeyCell; \ (n)=(PCM_KEY_NODE)HvGetCell((h),(c)); \ if( (n) == NULL ) { \ ReleaseHive = NULL; \ ReleaseCell = HCELL_NIL; \ } else { \ ReleaseHive = (h); \ ReleaseCell = (c); \ } \}
#define CmpReleasePreviousAndHookNew(NewHive,NewCell,ReleaseHive,ReleaseCell) \
if( ReleaseCell != HCELL_NIL ) { \ ASSERT( ReleaseHive != NULL ); \ HvReleaseCell( ReleaseHive,ReleaseCell); \ } \ ReleaseHive = (NewHive); \ ReleaseCell = (NewCell)
#define CMP_PARSE_GOTO_NONE 0
#define CMP_PARSE_GOTO_CREATE 1
#define CMP_PARSE_GOTO_RETURN 2
#define CMP_PARSE_GOTO_RETURN2 3
#ifdef CMP_STATS
extern BOOLEAN CmpNtFakeCreateStarted; extern ULONG CmpNtFakeCreate;#endif
NTSTATUSCmpParseKey( IN PVOID ParseObject, IN PVOID ObjectType, IN OUT PACCESS_STATE AccessState, IN KPROCESSOR_MODE AccessMode, IN ULONG Attributes, IN OUT PUNICODE_STRING CompleteName, IN OUT PUNICODE_STRING RemainingName, IN OUT PVOID Context OPTIONAL, IN PSECURITY_QUALITY_OF_SERVICE SecurityQos OPTIONAL, OUT PVOID *Object )/*++
Routine Description:
This routine interfaces to the NT Object Manager. It is invoked when the object system is given the name of an entity to create or open and a Key or KeyRoot is encountered in the path. In practice this means that this routine is called for all objects whose names are of the form \REGISTRY\...
This routine will create a Key object, which is effectively an open instance to a registry key node, and return its address (for the success case.)
Arguments:
ParseObject - Pointer to a KeyRoot or Key, thus -> KEY_BODY.
ObjectType - Type of the object being opened.
AccessState - Running security access state information for operation.
AccessMode - Access mode of the original caller.
Attributes - Attributes to be applied to the object.
CompleteName - Supplies complete name of the object.
RemainingName - Remaining name of the object.
Context - if create or hive root open, points to a CM_PARSE_CONTEXT structure, if open, is NULL.
SecurityQos - Optional security quality of service indicator.
Object - The address of a variable to receive the created key object, if any.
Return Value:
The function return value is one of the following:
a) Success - This indicates that the function succeeded and the object parameter contains the address of the created key object.
b) STATUS_REPARSE - This indicates that a symbolic link key was found, and the path should be reparsed.
c) Error - This indicates that the file was not found or created and no file object was created.
--*/{ NTSTATUS status = STATUS_UNSUCCESSFUL; BOOLEAN rc; PHHIVE Hive = NULL; PCM_KEY_NODE Node = NULL; HCELL_INDEX Cell = HCELL_NIL; HCELL_INDEX NextCell; PCM_PARSE_CONTEXT lcontext; UNICODE_STRING Current; UNICODE_STRING NextName = {0}; // Component last returned by CmpGetNextName,
// will always be behind Current.
BOOLEAN Last; // TRUE if component NextName points to
// is the last one in the path.
ULONG TotalRemainingSubkeys; ULONG MatchRemainSubkeyLevel = 0; ULONG TotalSubkeys=0; PCM_KEY_CONTROL_BLOCK kcb; PCM_KEY_CONTROL_BLOCK ParentKcb = NULL; UNICODE_STRING TmpNodeName; ULONG GoToValue = CMP_PARSE_GOTO_NONE; BOOLEAN CompleteKeyCached = FALSE;
PHHIVE HiveToRelease = NULL; HCELL_INDEX CellToRelease = HCELL_NIL;
PAGED_CODE();
UNREFERENCED_PARAMETER (SecurityQos);
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpParseKey:\n\t")); CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CompleteName = '%wZ'\n\t", CompleteName)); CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"RemainingName = '%wZ'\n", RemainingName));
//
// Strip off any trailing path separators
//
while ((RemainingName->Length > 0) && (RemainingName->Buffer[(RemainingName->Length/sizeof(WCHAR)) - 1] == OBJ_NAME_PATH_SEPARATOR)) { RemainingName->Length -= sizeof(WCHAR); }
Current = *RemainingName; if (ObjectType != CmpKeyObjectType) { return STATUS_OBJECT_TYPE_MISMATCH; }
if( ARGUMENT_PRESENT(Context) && (((PCM_PARSE_CONTEXT)Context)->CreateOperation == TRUE) ) { lcontext = (PCM_PARSE_CONTEXT)Context; } else { //
// keep the old behaviour (open == parse without context)
//
lcontext = NULL; }
//
// PreCreate callback
//
if ( CmAreCallbacksRegistered() ) { if( ARGUMENT_PRESENT(lcontext) ) { //
// NtCreateKey
//
REG_CREATE_KEY_INFORMATION PreCreateInfo; PreCreateInfo.CompleteName = CompleteName; PreCreateInfo.RootObject = ParseObject;
status = CmpCallCallBacks(RegNtPreCreateKeyEx,&PreCreateInfo); } else { //
// NtOpenKey
//
REG_OPEN_KEY_INFORMATION PreOpenInfo; PreOpenInfo.CompleteName = CompleteName; PreOpenInfo.RootObject = ParseObject;
status = CmpCallCallBacks(RegNtPreOpenKeyEx,&PreOpenInfo); }
if( !NT_SUCCESS(status) ) { return status; } } BEGIN_LOCK_CHECKPOINT;
kcb = ((PCM_KEY_BODY)ParseObject)->KeyControlBlock;
BEGIN_KCB_LOCK_GUARD;
//
// give back the stack after we don't need it anymore.
//
{ CM_HASH_ENTRY HashStack[CM_HASH_STACK_SIZE]; ULONG HashKeyCopy; BOOLEAN RegLocked = FALSE;
RetryHash: HashKeyCopy = kcb->ConvKey; //
// Compute the hash values of each subkeys
//
TotalRemainingSubkeys = CmpComputeHashValue(HashStack, &TotalSubkeys, HashKeyCopy, &Current); PERFINFO_REG_PARSE(kcb, RemainingName);
//
// we now lock it shared as 85% of the create calls are in fact opens
// the lock will be aquired exclusively in CmpDoCreate/CmpCreateLinkNode
//
// We only lock the registry here, in the parse routine to reduce contention
// on the registry lock (NO reason to wait on OB)
//
if( !RegLocked ) { CmpLockRegistry(); RegLocked = TRUE; //CmpLockRegistryExclusive();
}
if( kcb->ConvKey != HashKeyCopy ) { goto RetryHash; } //
// Check to make sure the passed in root key is not marked for deletion.
//
if (((PCM_KEY_BODY)ParseObject)->KeyControlBlock->Delete == TRUE) { ASSERT( RegLocked ); CmpUnlockRegistry(); return(STATUS_KEY_DELETED); }
//
// Fetch the starting Hive.Cell. Because of the way the parse
// paths work, this will always be defined. (ObOpenObjectByName
// had to bounce off of a KeyObject or KeyRootObject to get here)
//
Hive = kcb->KeyHive; Cell = kcb->KeyCell;
CmpLockKCBTree(); // Look up from the cache. kcb will be changed if we find a partial or exact match
// PCmpCacheEntry, the entry found, will be moved to the front of
// the Cache.
status = CmpCacheLookup(HashStack, TotalRemainingSubkeys, &MatchRemainSubkeyLevel, &kcb, &Current, &Hive, &Cell); //
// The RefCount of kcb was increased in the CmpCacheLookup process,
// It is to protect it from being kicked out of cache.
// Make sure we dereference it after we are done.
//
}
//
// First make sure it is OK to proceed.
//
if (!NT_SUCCESS (status)) { CmpUnlockKCBTree(); goto JustReturn; }
ParentKcb = kcb;
if(TotalRemainingSubkeys == 0) { //
// We REALLY don't want to mess with the cache code below
// in this case (this could only happen if we called with
// the lpSubkey = NULL )
//
CompleteKeyCached = TRUE; CmpUnlockKCBTree(); goto Found; }
//
// First check if there are further information in the cached kcb.
//
// The additional information can be
// 1. This cached key is a fake key (CM_KCB_KEY_NON_EXIST), then either let it be created
// or return STATUS_OBJECT_NAME_NOT_FOUND.
// 2. The cached key is not the destination and it has no subkey (CM_KCB_NO_SUBKEY).
// 3. The cached key is not the destination and it has
// the first four characters of its subkeys. If the flag is CM_KCB_SUBKEY_ONE, there is only one subkey
// and the four char is embedded in the KCB. If the flag is CM_KCB_SUBKEY_INFO, then there is
// an allocation for these info.
//
// We do need to lock KCB tree to protect the KCB being modified. Currently there is not lock contention problem
// on KCBs, We can change KCB lock to a read-write lock if this becomes a problem.
// We already have the lock on the kcb tree and we need it until we finish work on the cache table.
//
StartOver: if( kcb->Delete ) { //
// kcb has been deleted while playing with the lock
//
status = STATUS_OBJECT_NAME_NOT_FOUND; CmpUnlockKCBTree(); goto JustReturn;
}
if (kcb->ExtFlags & CM_KCB_CACHE_MASK) { if (MatchRemainSubkeyLevel == TotalRemainingSubkeys) { //
// We have found a cache for the complete path,
//
if (kcb->ExtFlags & CM_KCB_KEY_NON_EXIST) { //
// This key does not exist.
//
if (ARGUMENT_PRESENT(lcontext)) { ULONG LevelToSkip = TotalRemainingSubkeys-1; ULONG i=0; // Promote KCB Lock if not already EX
if (CmpKcbOwner != KeGetCurrentThread()) { InterlockedIncrement( (PLONG)&kcb->RefCount ); CmpUnlockKCBTree(); CmpLockKCBTreeExclusive(); InterlockedDecrement( (PLONG)&kcb->RefCount ); goto StartOver; } //
// The non-existing key is the destination key and lcontext is present.
// delete this fake kcb and let the real one be created.
//
// Temporarily increase the RefCount of the ParentKcb so it's
// not removed while removing the fake and creating the real KCB.
//
ParentKcb = kcb->ParentKcb; if (CmpReferenceKeyControlBlock(ParentKcb)) { kcb->Delete = TRUE; CmpRemoveKeyControlBlock(kcb); CmpDereferenceKeyControlBlockWithLock(kcb);
//
// Update Hive, Cell and Node
//
Hive = ParentKcb->KeyHive; Cell = ParentKcb->KeyCell; Node = (PCM_KEY_NODE)HvGetCell(Hive,Cell); if( Node == NULL ) { //
// we couldn't map the bin contianing this cell
//
CmpUnlockKCBTree(); status = STATUS_INSUFFICIENT_RESOURCES; goto FreeAndReturn; } CmpReleasePreviousAndHookNew(Hive,Cell,HiveToRelease,CellToRelease);
//
// Now get the child name to be created.
//
NextName = *RemainingName; if ((NextName.Buffer == NULL) || (NextName.Length == 0)) { CmKdPrintEx((DPFLTR_CONFIG_ID,DPFLTR_ERROR_LEVEL,"Something wrong in finding the child name\n")); DbgBreakPoint(); } //
// Skip over leading path separators
//
while (*(NextName.Buffer) == OBJ_NAME_PATH_SEPARATOR) { NextName.Buffer++; NextName.Length -= sizeof(WCHAR); NextName.MaximumLength -= sizeof(WCHAR); } while (i < LevelToSkip) { if (*(NextName.Buffer) == OBJ_NAME_PATH_SEPARATOR) { i++; while (*(NextName.Buffer) == OBJ_NAME_PATH_SEPARATOR) { NextName.Buffer++; NextName.Length -= sizeof(WCHAR); NextName.MaximumLength -= sizeof(WCHAR); } } else { NextName.Buffer++; NextName.Length -= sizeof(WCHAR); NextName.MaximumLength -= sizeof(WCHAR); } } GoToValue = CMP_PARSE_GOTO_CREATE; } else { //
// We have maxed the RefCount of ParentKcb; treate it as key cannot be created.
// The ParentKcb will not be dereferenced at the end.
//
status = STATUS_INSUFFICIENT_RESOURCES; GoToValue = CMP_PARSE_GOTO_RETURN2; } } else { status = STATUS_OBJECT_NAME_NOT_FOUND; GoToValue = CMP_PARSE_GOTO_RETURN; } } } else if (kcb->ExtFlags & CM_KCB_KEY_NON_EXIST) { //
// one subkey (not destination) in the path does not exist. no point to continue.
//
status = STATUS_OBJECT_NAME_NOT_FOUND; GoToValue = CMP_PARSE_GOTO_RETURN; } else if (kcb->ExtFlags & CM_KCB_NO_SUBKEY) { //
// one parent in the path has no subkey. see if it is a create.
//
if (((TotalRemainingSubkeys - MatchRemainSubkeyLevel) == 1) && (ARGUMENT_PRESENT(lcontext))) { //
// Now we are going to create this subkey.
// The kcb cache will be updated in CmpDoCreate routine.
//
} else { status = STATUS_OBJECT_NAME_NOT_FOUND; GoToValue = CMP_PARSE_GOTO_RETURN; } } else { //
// We have a partial match. Current is the remaining name to be parsed.
// The Key has either one or a few subkeys and has index hint. check if it is the candidate.
//
BOOLEAN NoMatch = TRUE; ULONG NextHashKey; PULONG TempHashKey; ULONG HintCounts; ULONG CmpCount; //
// When NoMatch is TRUE, we know for sure there is no subkey that can match.
// When NoMatch is FALSE, it can we either we found a match or
// there is not enough information. Either case, we need to continue
// the parse.
//
TmpNodeName = Current;
rc = CmpGetNextName(&TmpNodeName, &NextName, &Last); NextHashKey = CmpComputeHashKey(&NextName);
if (kcb->ExtFlags & CM_KCB_SUBKEY_ONE) { HintCounts = 1; TempHashKey = &(kcb->HashKey); } else { //
// More than one child, the hint info in not inside the kcb but pointed by kcb.
//
HintCounts = kcb->IndexHint->Count; TempHashKey = &(kcb->IndexHint->HashKey[0]); }
for (CmpCount=0; CmpCount<HintCounts; CmpCount++) { if( TempHashKey[CmpCount] == 0) { //
// No hint available; assume the subkey exist and go on with the parse
//
//DbgPrint("KCB cache hit [0]\n");
NoMatch = FALSE; break; } if( NextHashKey == TempHashKey[CmpCount] ) { //
// There is a match.
//
//DbgPrint("KCB cache hit [1]\n");
NoMatch = FALSE; break; } }
if (NoMatch) { if (((TotalRemainingSubkeys - MatchRemainSubkeyLevel) == 1) && (ARGUMENT_PRESENT(lcontext))) { //
// No we are going to create this subkey.
// The kcb cache will be updated in CmpDoCreate.
//
} else { status = STATUS_OBJECT_NAME_NOT_FOUND; GoToValue = CMP_PARSE_GOTO_RETURN; } } } }
CmpUnlockKCBTree(); END_KCB_LOCK_GUARD;
if (GoToValue == CMP_PARSE_GOTO_CREATE) { goto CreateChild; } else if (GoToValue == CMP_PARSE_GOTO_RETURN) { goto FreeAndReturn; } else if (GoToValue == CMP_PARSE_GOTO_RETURN2) { goto JustReturn; }
if (MatchRemainSubkeyLevel) { // Found something, update the information to start the search
// from the new BaseName
if (MatchRemainSubkeyLevel == TotalSubkeys) { // The complete key has been found in the cache,
// go directly to the CmpDoOpen.
//
// Found the whole thing cached.
//
//
CompleteKeyCached = TRUE; goto Found; } ASSERT( (Cell == kcb->KeyCell) && (Hive == kcb->KeyHive) ); }
//
// Check if we hit a symbolic link case
//
if (kcb->Flags & KEY_SYM_LINK) { //
// The given key was a symbolic link. Find the name of
// its link, and return STATUS_REPARSE to the Object Manager.
//
rc = CmpGetNextName(&Current, &NextName, &Last); Current.Buffer = NextName.Buffer; if (Current.Length + NextName.Length > MAXUSHORT) { status = STATUS_NAME_TOO_LONG; goto FreeAndReturn; } Current.Length = (USHORT)(Current.Length + NextName.Length);
if (Current.MaximumLength + NextName.MaximumLength > MAXUSHORT) { status = STATUS_NAME_TOO_LONG; goto FreeAndReturn; } Current.MaximumLength = (USHORT)(Current.MaximumLength + NextName.MaximumLength); if (CmpGetSymbolicLink(Hive, CompleteName, kcb, &Current)) {
status = STATUS_REPARSE; CmpParseRecordOriginatingPoint(Context,(PCMHIVE)kcb->KeyHive); } else { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpParseKey: couldn't find symbolic link name\n")); status = STATUS_OBJECT_NAME_NOT_FOUND; } goto FreeAndReturn; }
Node = (PCM_KEY_NODE)HvGetCell(Hive,Cell); if( Node == NULL ) { //
// we couldn't map the bin contianing this cell
//
status = STATUS_INSUFFICIENT_RESOURCES; goto FreeAndReturn; } CmpReleasePreviousAndHookNew(Hive,Cell,HiveToRelease,CellToRelease);
//
// Parse the path.
//
status = STATUS_SUCCESS; while (TRUE) {
//
// Parse out next component of name
//
rc = CmpGetNextName(&Current, &NextName, &Last); if ((NextName.Length > 0) && (rc == TRUE)) {
//
// As we iterate through, we will create a kcb for each subkey parsed.
//
// Always use the information in kcb to avoid
// touching registry data.
//
#ifdef CMP_KCB_CACHE_VALIDATION
{ PCM_KEY_NODE TempNode; TempNode = (PCM_KEY_NODE)HvGetCell(kcb->KeyHive,kcb->KeyCell); if( TempNode == NULL ) { //
// we couldn't map the bin contianing this cell
//
status = STATUS_INSUFFICIENT_RESOURCES; break; } ASSERT( TempNode->Flags == kcb->Flags ); HvReleaseCell(kcb->KeyHive,kcb->KeyCell); }#endif
if (!(kcb->Flags & KEY_SYM_LINK)) { //
// Got a legal name component, see if we can find a sub key
// that actually has such a name.
//
NextCell = CmpFindSubKeyByName(Hive, Node, &NextName);
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpParseKey:\n\t")); CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"NextName = '%wZ'\n\t", &NextName)); CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"NextCell = %08lx Last = %01lx\n", NextCell, Last));
if (NextCell != HCELL_NIL) { Cell = NextCell; Node = (PCM_KEY_NODE)HvGetCell(Hive,Cell); if( Node == NULL ) { //
// we couldn't map the bin contianing this cell
//
status = STATUS_INSUFFICIENT_RESOURCES; break; } CmpReleasePreviousAndHookNew(Hive,Cell,HiveToRelease,CellToRelease);
if (Last == TRUE) { BOOLEAN NeedDeref;
Found: //
// We will open the key regardless of whether the
// call was open or create, so step through exit
// portholes here.
//
if (CompleteKeyCached == TRUE) { //
// If the key found is already cached,
// do not need to StepThroughExit
// (no kcb is created using exit node).
// This prevents us from touching the key node just for the Flags.
//
} else { CmpStepThroughExit(Hive, Cell, Node,HiveToRelease,CellToRelease); if( Node == NULL ) { //
// we couldn't map view for this cell
//
status = STATUS_INSUFFICIENT_RESOURCES; break; } } //
// We have found the entire path, so we want to open
// it (for both Open and Create calls).
// Hive,Cell -> the key we are supposed to open.
//
#ifdef CMP_STATS
if(CmpNtFakeCreateStarted == TRUE) { CmpNtFakeCreate++; }#endif
status = CmpDoOpen(Hive, Cell, Node, AccessState, AccessMode, Attributes, lcontext, CompleteKeyCached, &kcb, &NextName, CmpParseGetOriginatingPoint(Context), Object, &NeedDeref);
if (status == STATUS_REPARSE) { //
// The given key was a symbolic link. Find the name of
// its link, and return STATUS_REPARSE to the Object Manager.
//
if (!CmpGetSymbolicLink(Hive, CompleteName, kcb, NULL)) { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpParseKey: couldn't find symbolic link name\n")); status = STATUS_OBJECT_NAME_NOT_FOUND; } CmpParseRecordOriginatingPoint(Context,(PCMHIVE)kcb->KeyHive); if( TRUE == NeedDeref ) { CmpDereferenceKeyControlBlock(kcb); } } else { ASSERT( !NeedDeref ); }
break; } // else
// Not at end, so we'll simply iterate and consume
// the next component.
//
//
// Step through exit portholes here.
// This ensures that no KCB is created using
// the Exit node.
//
CmpStepThroughExit(Hive, Cell, Node,HiveToRelease,CellToRelease); if( Node == NULL ) { //
// we couldn't map view for this cell
//
status = STATUS_INSUFFICIENT_RESOURCES; break; }
//
// Create a kcb for each subkey parsed.
//
kcb = CmpCreateKeyControlBlock(Hive, Cell, Node, ParentKcb, FALSE, &NextName); if (kcb == NULL) { status = STATUS_INSUFFICIENT_RESOURCES; goto FreeAndReturn; //
// Currently, the kcb has one extra reference conut to be decremented.
// Remember it so we can dereference it properly.
//
} //
// Now we have created a kcb for the next level,
// the kcb in the previous level is no longer needed.
// Dereference the parent kcb.
//
CmpDereferenceKeyControlBlock(ParentKcb);
ParentKcb = kcb;
} else { //
// We did not find a key matching the name, but no
// unexpected error occured
//
if ((Last == TRUE) && (ARGUMENT_PRESENT(lcontext))) {
CreateChild: //
// Only unfound component is last one, and operation
// is a create, so perform the create.
//
//
// There are two possibilities here. The normal one
// is that we are simply creating a new node.
//
// The abnormal one is that we are creating a root
// node that is linked to the main hive. In this
// case, we must create the link. Once the link is
// created, we can check to see if the root node
// exists, then either create it or open it as
// necessary.
//
// CmpCreateLinkNode creates the link, and calls
// back to CmpDoCreate or CmpDoOpen to create or open
// the root node as appropriate.
//
//
// either one of this will drop the reglock and reaquire it
// exclusive; we need not to hurt ourselves, so release
// all cells here
//
CmpReleasePreviousAndHookNew(NULL,HCELL_NIL,HiveToRelease,CellToRelease);
if (lcontext->CreateLink) { status = CmpCreateLinkNode(Hive, Cell, AccessState, NextName, AccessMode, Attributes, lcontext, ParentKcb, Object);
} else {
if ( (Hive == &(CmpMasterHive->Hive)) && (CmpNoMasterCreates == TRUE) ) { //
// attempting to create a cell in the master
// hive, and not a link, so blow out of here,
// since it wouldn't work anyway.
//
status = STATUS_INVALID_PARAMETER; break; }
status = CmpDoCreate(Hive, Cell, AccessState, &NextName, AccessMode, lcontext, ParentKcb, CmpParseGetOriginatingPoint(Context), Object); }
if( status == STATUS_REPARSE ) { //
// somebody else created the key in between;
// let the Object Manager work for us !!!
// now we have the lock exclusive, so nothing can happen in between
// next iterarion will find the key very quick
//
break; } lcontext->Disposition = REG_CREATED_NEW_KEY; break;
} else {
//
// Did not find a key to match the component, and
// are not at the end of the path. Thus, open must
// fail because the whole path dosn't exist, create must
// fail because more than 1 component doesn't exist.
//
//
// We have a lookup failure here, so having additional information
// about this kcb may help us not to go through all the code just to fail again.
//
ParentKcb = CmpAddInfoAfterParseFailure(Hive, Cell, Node, kcb, &NextName ); status = STATUS_OBJECT_NAME_NOT_FOUND; break; }
}
} else { //
// The given key was a symbolic link. Find the name of
// its link, and return STATUS_REPARSE to the Object Manager.
//
Current.Buffer = NextName.Buffer; if (Current.Length + NextName.Length > MAXUSHORT) { status = STATUS_NAME_TOO_LONG; break; } Current.Length = (USHORT)(Current.Length + NextName.Length);
if (Current.MaximumLength + NextName.MaximumLength > MAXUSHORT) { status = STATUS_NAME_TOO_LONG; break; } Current.MaximumLength = (USHORT)(Current.MaximumLength + NextName.MaximumLength); if (CmpGetSymbolicLink(Hive, CompleteName, kcb, &Current)) {
status = STATUS_REPARSE; CmpParseRecordOriginatingPoint(Context,(PCMHIVE)kcb->KeyHive); break;
} else { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpParseKey: couldn't find symbolic link name\n")); status = STATUS_OBJECT_NAME_NOT_FOUND; break; } }
} else if (rc == TRUE && Last == TRUE) { //
// We will open the \Registry root.
// Or some strange remaining name that
// messes up the lookup.
//
CmpStepThroughExit(Hive, Cell, Node,HiveToRelease,CellToRelease); if( Node == NULL ) { //
// we couldn't map view for this cell
//
status = STATUS_INSUFFICIENT_RESOURCES; break; }
//
// We have found the entire path, so we want to open
// it (for both Open and Create calls).
// Hive,Cell -> the key we are supposed to open.
//
status = CmpDoOpen(Hive, Cell, Node, AccessState, AccessMode, Attributes, lcontext, TRUE, &kcb, &NextName, CmpParseGetOriginatingPoint(Context), Object, NULL); if(status == STATUS_REPARSE ) { CmpParseRecordOriginatingPoint(Context,(PCMHIVE)kcb->KeyHive); } break;
} else {
//
// bogus path -> fail
//
status = STATUS_INVALID_PARAMETER; break; }
} // while
FreeAndReturn: //
// Now we have to free the last kcb that still has one extra reference count to
// protect it from being freed.
//
if( ParentKcb != NULL ) { CmpDereferenceKeyControlBlock(ParentKcb); }JustReturn: CmpReleasePreviousAndHookNew(NULL,HCELL_NIL,HiveToRelease,CellToRelease);
CmpUnlockRegistry(); END_LOCK_CHECKPOINT;
//
// PostCreate callback. just a notification; disregard the return status
//
CmPostCallbackNotification((ARGUMENT_PRESENT(lcontext)?RegNtPostCreateKeyEx:RegNtPostOpenKeyEx),(*Object),status);
return status;}
BOOLEANCmpGetNextName( IN OUT PUNICODE_STRING RemainingName, OUT PUNICODE_STRING NextName, OUT PBOOLEAN Last )/*++
Routine Description:
This routine parses off the next component of a registry path, returning all of the interesting state about it, including whether it's legal.
Arguments:
Current - supplies pointer to variable which points to path to parse. on input - parsing starts from here on output - updated to reflect starting position for next call.
NextName - supplies pointer to a unicode_string, which will be set up to point into the parse string.
Last - supplies a pointer to a boolean - set to TRUE if this is the last component of the name being parse, FALSE otherwise.
Return Value:
TRUE if all is well.
FALSE if illegal name (too long component, bad character, etc.) (if false, all out parameter values are bogus.)
--*/{ BOOLEAN rc = TRUE;
//
// Deal with NULL paths, and pointers to NULL paths
//
if ((RemainingName->Buffer == NULL) || (RemainingName->Length == 0)) { *Last = TRUE; NextName->Buffer = NULL; NextName->Length = 0; return TRUE; }
if (*(RemainingName->Buffer) == UNICODE_NULL) { *Last = TRUE; NextName->Buffer = NULL; NextName->Length = 0; return TRUE; }
//
// Skip over leading path separators
//
if (*(RemainingName->Buffer) == OBJ_NAME_PATH_SEPARATOR) { RemainingName->Buffer++; RemainingName->Length -= sizeof(WCHAR); RemainingName->MaximumLength -= sizeof(WCHAR); }
//
// Remember where the component starts, and scan to the end
//
NextName->Buffer = RemainingName->Buffer; while (TRUE) { if (RemainingName->Length == 0) { break; } if (*RemainingName->Buffer == OBJ_NAME_PATH_SEPARATOR) { break; }
//
// NOT at end
// NOT another path sep
//
RemainingName->Buffer++; RemainingName->Length -= sizeof(WCHAR); RemainingName->MaximumLength -= sizeof(WCHAR); }
//
// Compute component length, return error if it's illegal
//
NextName->Length = (USHORT) ((PUCHAR)RemainingName->Buffer - (PUCHAR)(NextName->Buffer)); if (NextName->Length > REG_MAX_KEY_NAME_LENGTH) { rc = FALSE; } NextName->MaximumLength = NextName->Length;
//
// Set last, return success
//
*Last = (RemainingName->Length == 0) ? TRUE : FALSE; return rc;}
NTSTATUSCmpDoOpen( IN PHHIVE Hive, IN HCELL_INDEX Cell, IN PCM_KEY_NODE Node, IN PACCESS_STATE AccessState, IN KPROCESSOR_MODE AccessMode, IN ULONG Attributes, IN PCM_PARSE_CONTEXT Context OPTIONAL, IN BOOLEAN CompleteKeyCached, IN OUT PCM_KEY_CONTROL_BLOCK *CachedKcb, IN PUNICODE_STRING KeyName, IN PCMHIVE OriginatingHive OPTIONAL, OUT PVOID *Object, OUT PBOOLEAN NeedDeref OPTIONAL )/*++
Routine Description:
Open a registry key, create a keycontrol block.
Arguments:
Hive - supplies a pointer to the hive control structure for the hive
Cell - supplies index of node to delete
AccessState - Running security access state information for operation.
AccessMode - Access mode of the original caller.
Attributes - Attributes to be applied to the object.
Context - if create or hive root open, points to a CM_PARSE_CONTEXT structure, if open, is NULL.
CompleteKeyCached - BOOLEAN to indicate it the completekey is cached.
CachedKcb - If the completekey is cached, this is the kcb for the destination. If not, this is the parent kcb.
KeyName - Relative name (to BaseName)
Object - The address of a variable to receive the created key object, if any.
NeedDeref - if specified, keep reference in the fake create kcb (link case). Caller is responsible to release the fake kcb after it finishes with it.
Return Value:
NTSTATUS
--*/{ NTSTATUS status; PCM_KEY_BODY pbody; PCM_KEY_CONTROL_BLOCK kcb = NULL; KPROCESSOR_MODE mode; BOOLEAN BackupRestore;
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpDoOpen:\n")); if( ARGUMENT_PRESENT(NeedDeref) ) { *NeedDeref = FALSE; }
if (ARGUMENT_PRESENT(Context)) {
//
// It's a create of some sort
//
if (Context->CreateLink) { //
// The node already exists as a regular key, so it cannot be
// turned into a link node.
//
return STATUS_ACCESS_DENIED;
} else if (Context->CreateOptions & REG_OPTION_CREATE_LINK) { //
// Attempt to create a symbolic link has hit an existing key
// so return an error
//
return STATUS_OBJECT_NAME_COLLISION;
} else { //
// Operation is an open, so set Disposition
//
Context->Disposition = REG_OPENED_EXISTING_KEY; } }
//
// Check for symbolic link and caller does not want to open a link
//
if (CompleteKeyCached) { //
// The complete key is cached.
//
BEGIN_KCB_LOCK_GUARD; CmpLockKCBTree();StartOver: if ((*CachedKcb)->Flags & KEY_SYM_LINK && !(Attributes & OBJ_OPENLINK)) { //
// If the key is a symbolic link, check if the link has been resolved.
// If the link is resolved, change the kcb to the real KCB.
// Otherwise, return for reparse.
//
if ((*CachedKcb)->ExtFlags & CM_KCB_SYM_LINK_FOUND) { kcb = (*CachedKcb)->ValueCache.RealKcb;
if (kcb->Delete == TRUE) {
// Promote KCB Lock if not already EX
if (CmpKcbOwner != KeGetCurrentThread()) { InterlockedIncrement( (PLONG)&kcb->RefCount ); CmpUnlockKCBTree(); CmpLockKCBTreeExclusive(); InterlockedDecrement( (PLONG)&kcb->RefCount ); goto StartOver; } //
// The real key it pointes to had been deleted.
// We have no way of knowing if the key has been recreated.
// Just clean up the cache and do a reparse.
//
CmpCleanUpKcbValueCache(*CachedKcb); CmpUnlockKCBTree(); return(STATUS_REPARSE); } } else { CmpUnlockKCBTree(); return(STATUS_REPARSE); } } else { //
// Not a symbolic link, increase the reference Count of Kcb.
//
kcb = *CachedKcb; } // common path instead of repeating code
if (!CmpReferenceKeyControlBlock(kcb)) { CmpUnlockKCBTree(); return STATUS_INSUFFICIENT_RESOURCES; } CmpUnlockKCBTree(); END_KCB_LOCK_GUARD; } else { //
// The key is not in cache, the CachedKcb is the parentkcb of this
// key to be opened.
//
if (Node->Flags & KEY_SYM_LINK && !(Attributes & OBJ_OPENLINK)) { //
// Create a KCB for this symbolic key and put it in delay close.
//
kcb = CmpCreateKeyControlBlock(Hive, Cell, Node, *CachedKcb, FALSE, KeyName); if (kcb == NULL) { return STATUS_INSUFFICIENT_RESOURCES; } if( ARGUMENT_PRESENT(NeedDeref) ) { //
// caller will perform deref.
//
*NeedDeref = TRUE; } else { CmpDereferenceKeyControlBlock(kcb); } *CachedKcb = kcb; return(STATUS_REPARSE); } //
// If key control block does not exist, and cannot be created, fail,
// else just increment the ref count (done for us by CreateKeyControlBlock)
//
kcb = CmpCreateKeyControlBlock(Hive, Cell, Node, *CachedKcb, FALSE, KeyName); if (kcb == NULL) { return STATUS_INSUFFICIENT_RESOURCES; } ASSERT(kcb->Delete == FALSE); *CachedKcb = kcb; }
#if DBG
if( kcb->ExtFlags & CM_KCB_KEY_NON_EXIST ) { //
// we shouldn't fall into this
//
DbgBreakPoint(); return STATUS_OBJECT_NAME_NOT_FOUND; }#endif //DBG
if(!CmpOKToFollowLink(OriginatingHive,(PCMHIVE)Hive) ) { //
// about to cross class of trust boundary
//
status = STATUS_ACCESS_DENIED; } else { //
// Allocate the object.
//
status = ObCreateObject(AccessMode, CmpKeyObjectType, NULL, AccessMode, NULL, sizeof(CM_KEY_BODY), 0, 0, Object); } if (NT_SUCCESS(status)) {
pbody = (PCM_KEY_BODY)(*Object);
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_POOL,"CmpDoOpen: object allocated at:%p\n", pbody));
//
// Check for predefined handle
//
pbody = (PCM_KEY_BODY)(*Object);
if (kcb->Flags & KEY_PREDEF_HANDLE) { pbody->Type = kcb->ValueCache.Count; pbody->KeyControlBlock = kcb; return(STATUS_PREDEFINED_HANDLE); } else { //
// Fill in CM specific fields in the object
//
pbody->Type = KEY_BODY_TYPE; pbody->KeyControlBlock = kcb; pbody->NotifyBlock = NULL; pbody->ProcessID = PsGetCurrentProcessId(); ENLIST_KEYBODY_IN_KEYBODY_LIST(pbody); }
#ifdef CM_BREAK_ON_KEY_OPEN
if( kcb->Flags & KEY_BREAK_ON_OPEN ) { DbgPrint("\n\n Current process is opening a key tagged as BREAK ON OPEN\n"); DbgPrint("\nPlease type the following in the debugger window: !reg kcb %p\n\n\n",kcb); try { DbgBreakPoint(); } except (EXCEPTION_EXECUTE_HANDLER) {
//
// no debugger enabled, just keep going
//
} }#endif //CM_BREAK_ON_KEY_OPEN
} else {
//
// Failed to create object, so undo key control block work
//
CmpDereferenceKeyControlBlock(kcb); return status; }
//
// Check to make sure the caller can access the key.
//
BackupRestore = FALSE; if (ARGUMENT_PRESENT(Context)) { if (Context->CreateOptions & REG_OPTION_BACKUP_RESTORE) { BackupRestore = TRUE; } }
status = STATUS_SUCCESS;
if (BackupRestore == TRUE) {
//
// this is an open to support a backup or restore
// operation, do the special case work
//
AccessState->RemainingDesiredAccess = 0; AccessState->PreviouslyGrantedAccess = 0;
mode = KeGetPreviousMode();
if (SeSinglePrivilegeCheck(SeBackupPrivilege, mode)) { AccessState->PreviouslyGrantedAccess |= KEY_READ | ACCESS_SYSTEM_SECURITY; }
if (SeSinglePrivilegeCheck(SeRestorePrivilege, mode)) { AccessState->PreviouslyGrantedAccess |= KEY_WRITE | ACCESS_SYSTEM_SECURITY | WRITE_DAC | WRITE_OWNER; }
if (AccessState->PreviouslyGrantedAccess == 0) { //
// relevent privileges not asserted/possessed, so
// deref (which will cause CmpDeleteKeyObject to clean up)
// and return an error.
//
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpDoOpen for backup restore: access denied\n"));#ifdef CM_CHECK_FOR_ORPHANED_KCBS
//DbgPrint("CmpDoOpen for backup restore: access denied , hive = %p\n",Hive);
#endif //CM_CHECK_FOR_ORPHANED_KCBS
ObDereferenceObject(*Object); return STATUS_ACCESS_DENIED; }
} else {
if (!ObCheckObjectAccess(*Object, AccessState, TRUE, // Type mutex already locked
AccessMode, &status)) { //
// Access denied, so deref object, will cause CmpDeleteKeyObject
// to be called, it will clean up.
//
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpDoOpen: access denied\n"));#ifdef CM_CHECK_FOR_ORPHANED_KCBS
//DbgPrint("CmpDoOpen: access denied , hive = %p\n",Hive);
#endif //CM_CHECK_FOR_ORPHANED_KCBS
ObDereferenceObject(*Object); } }
return status;}
#ifdef CM_CHECK_FOR_ORPHANED_KCBS
ULONG CmpCheckOrphanedKcbFix = 0;#endif //CM_CHECK_FOR_ORPHANED_KCBS
NTSTATUSCmpCreateLinkNode( IN PHHIVE Hive, IN HCELL_INDEX Cell, IN PACCESS_STATE AccessState, IN UNICODE_STRING Name, IN KPROCESSOR_MODE AccessMode, IN ULONG Attributes, IN PCM_PARSE_CONTEXT Context, IN PCM_KEY_CONTROL_BLOCK ParentKcb, OUT PVOID *Object )/*++
Routine Description:
Perform the creation of a link node. Allocate all components, and attach to parent key. Calls CmpDoCreate or CmpDoOpen to create or open the root node of the hive as appropriate.
Note that you can only create link nodes in the master hive.
Arguments:
Hive - supplies a pointer to the hive control structure for the hive
Cell - supplies index of node to create child under
Name - supplies pointer to a UNICODE string which is the name of the child to be created.
AccessMode - Access mode of the original caller.
Attributes - Attributes to be applied to the object.
Context - pointer to CM_PARSE_CONTEXT structure passed through the object manager
BaseName - Name of object create is relative to
KeyName - Relative name (to BaseName)
Object - The address of a variable to receive the created key object, if any.
Return Value:
NTSTATUS
--*/{ NTSTATUS Status; PCELL_DATA Parent; PCELL_DATA Link; PCELL_DATA CellData; HCELL_INDEX LinkCell; HCELL_INDEX KeyCell; HCELL_INDEX ChildCell; PCM_KEY_CONTROL_BLOCK kcb = ParentKcb; PCM_KEY_BODY KeyBody; LARGE_INTEGER systemtime; PCM_KEY_NODE TempNode; LARGE_INTEGER TimeStamp;
ASSERT_CM_LOCK_OWNED_EXCLUSIVE();
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpCreateLinkNode:\n"));
if (Hive != &CmpMasterHive->Hive) { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpCreateLinkNode: attempt to create link node in\n")); CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE," non-master hive %p\n", Hive)); return(STATUS_ACCESS_DENIED); }
#if DBG
//
// debug only code
//
*Object = NULL;#endif
//
// this is a create, so we need exclusive access on the registry
// first get the time stamp to see if somebody messed with this key
// this might be more easier if we decide to cache the LastWriteTime
// in the KCB ; now it IS !!!
//
if( CmIsKcbReadOnly(ParentKcb) ) { //
// key is protected
//
return STATUS_ACCESS_DENIED; }
TimeStamp = ParentKcb->KcbLastWriteTime;
CmpUnlockRegistry(); CmpLockRegistryExclusive();
#ifdef CHECK_REGISTRY_USECOUNT
CmpCheckRegistryUseCount();#endif //CHECK_REGISTRY_USECOUNT
//
// make sure nothing changed in between:
// 1. ParentKcb is still valid
// 2. Child was not already added by somebody else
//
if( ParentKcb->Delete ) { //
// key was deleted in between
//
return STATUS_OBJECT_NAME_NOT_FOUND; }
if( TimeStamp.QuadPart != ParentKcb->KcbLastWriteTime.QuadPart ) { //
// key was changed in between; possibly this key was already created ==> reparse
//
return STATUS_REPARSE; }
//
// Allocate link node
//
// Link nodes are always in the master hive, so their storage type is
// mostly irrelevent.
//
LinkCell = HvAllocateCell(Hive, CmpHKeyNodeSize(Hive, &Name), Stable,HCELL_NIL); if (LinkCell == HCELL_NIL) { return STATUS_INSUFFICIENT_RESOURCES; }
KeyCell = Context->ChildHive.KeyCell;
if (KeyCell != HCELL_NIL) {
//
// This hive already exists, so we just need to open the root node.
//
ChildCell=KeyCell;
//
// The root cell in the hive does not has the Name buffer
// space reseverd. This is why we need to pass in the Name for creating KCB
// instead of using the name in the keynode.
//
CellData = HvGetCell(Context->ChildHive.KeyHive, ChildCell); if( CellData == NULL ) { //
// we couldn't map the bin contianing this cell
//
HvFreeCell(Hive, LinkCell); return STATUS_INSUFFICIENT_RESOURCES; } // release the cell right here as we are holding the reglock exclusive
HvReleaseCell(Context->ChildHive.KeyHive, ChildCell);
CellData->u.KeyNode.Parent = LinkCell; CellData->u.KeyNode.Flags |= KEY_HIVE_ENTRY | KEY_NO_DELETE;
TempNode = (PCM_KEY_NODE)HvGetCell(Context->ChildHive.KeyHive,KeyCell); if( TempNode == NULL ) { //
// we couldn't map the bin contianing this cell
//
HvFreeCell(Hive, LinkCell); return STATUS_INSUFFICIENT_RESOURCES; }
// release the cell right here as we are holding the reglock exclusive
HvReleaseCell(Context->ChildHive.KeyHive,KeyCell);
Status = CmpDoOpen( Context->ChildHive.KeyHive, KeyCell, TempNode, AccessState, AccessMode, Attributes, NULL, FALSE, &kcb, &Name, CmpParseGetOriginatingPoint(Context), Object, NULL); } else {
//
// This is a newly created hive, so we must allocate and initialize
// the root node.
//
Status = CmpDoCreateChild( Context->ChildHive.KeyHive, Cell, NULL, AccessState, &Name, AccessMode, Context, ParentKcb, KEY_HIVE_ENTRY | KEY_NO_DELETE, &ChildCell, Object );
if (NT_SUCCESS(Status)) {
//
// Initialize hive root cell pointer.
//
Context->ChildHive.KeyHive->BaseBlock->RootCell = ChildCell; }
} if (NT_SUCCESS(Status)) {
#ifdef CM_CHECK_FOR_ORPHANED_KCBS
if(CmpCheckOrphanedKcbFix) { DbgPrint("CmpCreateLinkNode: Force return with STATUS_NO_LOG_SPACE\n"); Status = STATUS_NO_LOG_SPACE; goto Cleanup; }#endif //CM_CHECK_FOR_ORPHANED_KCBS
//
// Initialize parent and flags. Note that we do this whether the
// root has been created or opened, because we are not guaranteed
// that the link node is always the same cell in the master hive.
//
if (!HvMarkCellDirty(Context->ChildHive.KeyHive, ChildCell)) { Status = STATUS_NO_LOG_SPACE; goto Cleanup; } CellData = HvGetCell(Context->ChildHive.KeyHive, ChildCell); if( CellData == NULL ) { //
// we couldn't map the bin contianing this cell
//
HvFreeCell(Hive, LinkCell); Status = STATUS_INSUFFICIENT_RESOURCES; goto Cleanup; } // release the cell right here as we are holding the reglock exclusive
HvReleaseCell(Context->ChildHive.KeyHive, ChildCell);
CellData->u.KeyNode.Parent = LinkCell; CellData->u.KeyNode.Flags |= KEY_HIVE_ENTRY | KEY_NO_DELETE;
//
// Initialize special link node flags and data
//
Link = HvGetCell(Hive, LinkCell); if( Link == NULL ) { //
// we couldn't map the bin contianing this cell
// this shouldn't happen as we just allocated this cell
// (i.e. it should be PINNED in memory at this point)
//
ASSERT( FALSE ); HvFreeCell(Hive, LinkCell); Status = STATUS_INSUFFICIENT_RESOURCES; goto Cleanup; }
// release the cell right here as we are holding the reglock exclusive
HvReleaseCell(Hive,LinkCell);
Link->u.KeyNode.Signature = CM_LINK_NODE_SIGNATURE; Link->u.KeyNode.Flags = KEY_HIVE_EXIT | KEY_NO_DELETE; Link->u.KeyNode.Parent = Cell; Link->u.KeyNode.NameLength = CmpCopyName(Hive, Link->u.KeyNode.Name, &Name); if (Link->u.KeyNode.NameLength < Name.Length) { Link->u.KeyNode.Flags |= KEY_COMP_NAME; }
KeQuerySystemTime(&systemtime); Link->u.KeyNode.LastWriteTime = systemtime;
//
// Zero out unused fields.
//
Link->u.KeyNode.SubKeyCounts[Stable] = 0; Link->u.KeyNode.SubKeyCounts[Volatile] = 0; Link->u.KeyNode.SubKeyLists[Stable] = HCELL_NIL; Link->u.KeyNode.SubKeyLists[Volatile] = HCELL_NIL; Link->u.KeyNode.ValueList.Count = 0; Link->u.KeyNode.ValueList.List = HCELL_NIL; Link->u.KeyNode.ClassLength = 0;
//
// Fill in the link node's pointer to the root node
//
Link->u.KeyNode.ChildHiveReference.KeyHive = Context->ChildHive.KeyHive; Link->u.KeyNode.ChildHiveReference.KeyCell = ChildCell;
//
// get the parent first, we don't need to do unneccessary cleanup
//
Parent = HvGetCell(Hive, Cell); if( Parent == NULL ) { //
// we couldn't map the bin contianing this cell
//
HvFreeCell(Hive, LinkCell); Status = STATUS_INSUFFICIENT_RESOURCES; goto Cleanup; }
// release the cell right here as we are holding the reglock exclusive
HvReleaseCell(Hive,Cell);
//
// Fill in the parent cell's child list
//
if (! CmpAddSubKey(Hive, Cell, LinkCell)) { HvFreeCell(Hive, LinkCell); Status = STATUS_INSUFFICIENT_RESOURCES; goto Cleanup; }
//
// If the parent has the subkey info or hint cached, free it.
//
ASSERT_CM_LOCK_OWNED_EXCLUSIVE(); KeyBody = (PCM_KEY_BODY)(*Object); CmpCleanUpSubKeyInfo (KeyBody->KeyControlBlock->ParentKcb);
//
// Update max keyname and class name length fields
//
//
// It seems to me that the original code is wrong.
// Isn't the definition of MaxNameLen just the length of the subkey?
//
// some sanity asserts
ASSERT( KeyBody->KeyControlBlock->ParentKcb->KeyCell == Cell ); ASSERT( KeyBody->KeyControlBlock->ParentKcb->KeyHive == Hive ); ASSERT( KeyBody->KeyControlBlock->ParentKcb->KcbMaxNameLen == Parent->u.KeyNode.MaxNameLen ); //
// update the LastWriteTime on both keynode and kcb;
//
KeQuerySystemTime(&systemtime); Parent->u.KeyNode.LastWriteTime = systemtime; KeyBody->KeyControlBlock->ParentKcb->KcbLastWriteTime = systemtime;
if (Parent->u.KeyNode.MaxNameLen < Name.Length) { Parent->u.KeyNode.MaxNameLen = Name.Length; KeyBody->KeyControlBlock->ParentKcb->KcbMaxNameLen = Name.Length; }
if (Parent->u.KeyNode.MaxClassLen < Context->Class.Length) { Parent->u.KeyNode.MaxClassLen = Context->Class.Length; }Cleanup: if( !NT_SUCCESS(Status) ) { ASSERT( (*Object) != NULL ); //
// mark the kcb as "no-delay-close" so it gets kicked out of cache when
// refcount goes down to 0
//
KeyBody = (PCM_KEY_BODY)(*Object); ASSERT( KeyBody->KeyControlBlock ); ASSERT_KCB( KeyBody->KeyControlBlock ); KeyBody->KeyControlBlock->ExtFlags |= CM_KCB_NO_DELAY_CLOSE; ObDereferenceObject(*Object); }
} else { HvFreeCell(Hive, LinkCell); }
return(Status);} BOOLEANCmpGetSymbolicLink( IN PHHIVE Hive, IN OUT PUNICODE_STRING ObjectName, IN OUT PCM_KEY_CONTROL_BLOCK SymbolicKcb, IN PUNICODE_STRING RemainingName OPTIONAL )
/*++
Routine Description:
This routine extracts the symbolic link name from a key, if it is marked as a symbolic link.
Arguments:
Hive - Supplies the hive of the key.
ObjectName - Supplies the current ObjectName. Returns the new ObjectName. If the new name is longer than the maximum length of the current ObjectName, the old buffer will be freed and a new buffer allocated.
RemainingName - Supplies the remaining path. If present, this will be concatenated with the symbolic link to form the new objectname.
Return Value:
TRUE - symbolic link succesfully found
FALSE - Key is not a symbolic link, or an error occurred
--*/
{ NTSTATUS Status; HCELL_INDEX LinkCell = HCELL_NIL; PCM_KEY_VALUE LinkValue = NULL; PWSTR LinkName = NULL; BOOLEAN LinkNameAllocated = FALSE; PWSTR NewBuffer; ULONG Length = 0; ULONG ValueLength = 0; extern ULONG CmpHashTableSize; extern PCM_KEY_HASH *CmpCacheTable; PUNICODE_STRING ConstructedName = NULL; ULONG ConvKey=0; PCM_KEY_HASH KeyHash; PCM_KEY_CONTROL_BLOCK RealKcb; BOOLEAN KcbFound = FALSE; ULONG Cnt; WCHAR *Cp; WCHAR *Cp2; ULONG TotalLevels; BOOLEAN FreeConstructedName = FALSE; BOOLEAN Result = TRUE; HCELL_INDEX CellToRelease = HCELL_NIL;#ifdef CM_DYN_SYM_LINK
BOOLEAN DynamicLink = FALSE; PWSTR ExpandedLinkName = NULL;#endif //CM_DYN_SYM_LINK
BEGIN_KCB_LOCK_GUARD; CmpLockKCBTree(); if (SymbolicKcb->ExtFlags & CM_KCB_SYM_LINK_FOUND) { //
// First see of the real kcb for this symbolic name has been found
//
ConstructedName = CmpConstructName(SymbolicKcb->ValueCache.RealKcb); if (ConstructedName) { FreeConstructedName = TRUE; LinkName = ConstructedName->Buffer; ValueLength = ConstructedName->Length; Length = (USHORT)ValueLength + sizeof(WCHAR); } } CmpUnlockKCBTree(); END_KCB_LOCK_GUARD;
if (FreeConstructedName == FALSE) { PCM_KEY_NODE Node; //
// Find the SymbolicLinkValue value. This is the name of the symbolic link.
//
Node = (PCM_KEY_NODE)HvGetCell(SymbolicKcb->KeyHive,SymbolicKcb->KeyCell); if( Node == NULL ) { //
// we couldn't map the bin containing this cell
//
Result = FALSE; goto Exit; }
LinkCell = CmpFindValueByName(Hive, Node, &CmSymbolicLinkValueName); // release the node here as we don't need it anymore
HvReleaseCell(SymbolicKcb->KeyHive,SymbolicKcb->KeyCell); if (LinkCell == HCELL_NIL) { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpGetSymbolicLink: couldn't open symbolic link\n")); Result = FALSE; goto Exit; } LinkValue = (PCM_KEY_VALUE)HvGetCell(Hive, LinkCell); if( LinkValue == NULL ) { //
// we couldn't map the bin containing this cell
//
Result = FALSE; goto Exit; } #ifdef CM_DYN_SYM_LINK
if( LinkValue->Type == REG_DYN_LINK ) { //
// we have found a dynamic link
//
DynamicLink = TRUE; } else #endif //CM_DYN_SYM_LINK
if (LinkValue->Type != REG_LINK) { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpGetSymbolicLink: link value is wrong type: %08lx", LinkValue->Type)); Result = FALSE; goto Exit; }
if( CmpGetValueData(Hive,LinkValue,&ValueLength,&LinkName,&LinkNameAllocated,&CellToRelease) == FALSE ) { //
// insufficient resources; return NULL
//
ASSERT( LinkNameAllocated == FALSE ); ASSERT( LinkName == NULL ); Result = FALSE; goto Exit; } #ifdef CM_DYN_SYM_LINK
if( DynamicLink == TRUE ) { ULONG DestLength; ExpandedLinkName = CmpExpandEnvVars(LinkName,ValueLength,&DestLength); if( ExpandedLinkName == NULL ) { CmKdPrintEx((DPFLTR_CONFIG_ID,DPFLTR_ERROR_LEVEL,"Dynamic link not resolved !\n")); Result = FALSE; goto Exit; } CmKdPrintEx((DPFLTR_CONFIG_ID,DPFLTR_ERROR_LEVEL,"Dynamic link resolved to: (%.*S)\n",DestLength/sizeof(WCHAR),ExpandedLinkName)); //
// if we are here, we successfully resolved the link
//
LinkName = ExpandedLinkName; ValueLength = DestLength; }#endif //CM_DYN_SYM_LINK
Length = (USHORT)ValueLength + sizeof(WCHAR);
#ifdef CM_DYN_SYM_LINK
if( DynamicLink == FALSE ) {#endif //CM_DYN_SYM_LINK
//
// Now see if we have this kcb cached.
//
Cp = LinkName; //
// first char SHOULD be OBJ_NAME_PATH_SEPARATOR, otherwise we could get into real trouble!!!
//
if( *Cp != OBJ_NAME_PATH_SEPARATOR ) { Result = FALSE; goto Exit; }
TotalLevels = 0; for (Cnt=0; Cnt<ValueLength; Cnt += sizeof(WCHAR)) { if (*Cp != OBJ_NAME_PATH_SEPARATOR) { ConvKey = 37 * ConvKey + (ULONG) CmUpcaseUnicodeChar(*Cp); } else { TotalLevels++; } ++Cp; }
BEGIN_KCB_LOCK_GUARD; CmpLockKCBTreeExclusive();
KeyHash = GET_HASH_ENTRY(CmpCacheTable, ConvKey);
while (KeyHash) { RealKcb = CONTAINING_RECORD(KeyHash, CM_KEY_CONTROL_BLOCK, KeyHash); if ((ConvKey == KeyHash->ConvKey) && (TotalLevels == RealKcb->TotalLevels) && (!(RealKcb->ExtFlags & CM_KCB_KEY_NON_EXIST)) ) { ConstructedName = CmpConstructName(RealKcb); if (ConstructedName) { FreeConstructedName = TRUE; if (ConstructedName->Length == ValueLength) { KcbFound = TRUE; Cp = LinkName; Cp2 = ConstructedName->Buffer; for (Cnt=0; Cnt<ConstructedName->Length; Cnt += sizeof(WCHAR)) { if (CmUpcaseUnicodeChar(*Cp) != CmUpcaseUnicodeChar(*Cp2)) { KcbFound = FALSE; break; } ++Cp; ++Cp2; } if (KcbFound) { //
// Now the RealKcb is also pointed to by its symbolic link Kcb,
// Increase the reference count.
// Need to dereference the realkcb when the symbolic kcb is removed.
// Do this in CmpCleanUpKcbCacheWithLock();
//
if (CmpReferenceKeyControlBlock(RealKcb)) { if( CmpOKToFollowLink( (((PCMHIVE)(SymbolicKcb->KeyHive))->Flags&CM_CMHIVE_FLAG_UNTRUSTED)?(PCMHIVE)(SymbolicKcb->KeyHive):NULL, (PCMHIVE)(RealKcb->KeyHive))) { //
// This symbolic kcb may have value lookup for the path
// Cleanup the value cache.
//
CmpCleanUpKcbValueCache(SymbolicKcb); SymbolicKcb->ExtFlags |= CM_KCB_SYM_LINK_FOUND; SymbolicKcb->ValueCache.RealKcb = RealKcb; } else { //
// let go of the extra ref and break
//
CmpDereferenceKeyControlBlockWithLock(RealKcb); break; } } else { //
// We have maxed out the ref count on the real kcb.
// do not cache the symbolic link.
//
} break; } } } else { break; } } if (FreeConstructedName) { ExFreePoolWithTag(ConstructedName, CM_NAME_TAG | PROTECTED_POOL); FreeConstructedName = FALSE; } KeyHash = KeyHash->NextHash; } CmpUnlockKCBTree(); END_KCB_LOCK_GUARD; #ifdef CM_DYN_SYM_LINK
}#endif //CM_DYN_SYM_LINK
} if (ARGUMENT_PRESENT(RemainingName)) { Length += RemainingName->Length + sizeof(WCHAR); }
//
// Overflow test: If Length overflows the USHRT_MAX value
// cleanup and return FALSE
//
if( Length>0xFFFF ) { Result = FALSE; goto Exit; }
if (Length > ObjectName->MaximumLength) { UNICODE_STRING NewObjectName;
//
// The new name is too long to fit in the existing ObjectName buffer,
// so allocate a new buffer.
//
NewBuffer = ExAllocatePool(PagedPool, Length); if (NewBuffer == NULL) { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpGetSymbolicLink: couldn't allocate new name buffer\n")); Result = FALSE; goto Exit; }
NewObjectName.Buffer = NewBuffer; NewObjectName.MaximumLength = (USHORT)Length; NewObjectName.Length = (USHORT)ValueLength; RtlCopyMemory(NewBuffer, LinkName, ValueLength);#if DBG
CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE,"CmpGetSymbolicLink: LinkName is %wZ\n", ObjectName)); if (ARGUMENT_PRESENT(RemainingName)) { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE," RemainingName is %wZ\n", RemainingName)); } else { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_PARSE," RemainingName is NULL\n")); }#endif
if (ARGUMENT_PRESENT(RemainingName)) { NewBuffer[ ValueLength / sizeof(WCHAR) ] = OBJ_NAME_PATH_SEPARATOR; NewObjectName.Length += sizeof(WCHAR); Status = RtlAppendUnicodeStringToString(&NewObjectName, RemainingName); ASSERT(NT_SUCCESS(Status)); }
ExFreePool(ObjectName->Buffer); *ObjectName = NewObjectName; } else { //
// The new name will fit within the maximum length of the existing
// ObjectName, so do the expansion in-place. Note that the remaining
// name must be moved into its new position first since the symbolic
// link may or may not overlap it.
//
ObjectName->Length = (USHORT)ValueLength; if (ARGUMENT_PRESENT(RemainingName)) { RtlMoveMemory(&ObjectName->Buffer[(ValueLength / sizeof(WCHAR)) + 1], RemainingName->Buffer, RemainingName->Length); ObjectName->Buffer[ValueLength / sizeof(WCHAR)] = OBJ_NAME_PATH_SEPARATOR; ObjectName->Length += RemainingName->Length + sizeof(WCHAR); } RtlCopyMemory(ObjectName->Buffer, LinkName, ValueLength); } ObjectName->Buffer[ObjectName->Length / sizeof(WCHAR)] = UNICODE_NULL;
Exit: if( LinkNameAllocated ) { ExFreePool(LinkName); } if (FreeConstructedName) { ExFreePoolWithTag(ConstructedName, CM_NAME_TAG | PROTECTED_POOL); }#ifdef CM_DYN_SYM_LINK
if( ExpandedLinkName ) { ExFreePool(ExpandedLinkName); }#endif //CM_DYN_SYM_LINK
if( LinkValue != NULL ) { ASSERT( LinkCell != HCELL_NIL ); HvReleaseCell(Hive,LinkCell); } if( CellToRelease != HCELL_NIL ) { HvReleaseCell(Hive,CellToRelease); } return Result;}
ULONGCmpComputeHashValue( IN PCM_HASH_ENTRY HashStack, IN OUT ULONG *TotalSubkeys, IN ULONG BaseConvKey, IN PUNICODE_STRING RemainingName )
/*++
Routine Description:
This routine parses the complete path of a request registry key and calculate the hash value at each level.
Arguments:
HashStack - Array for filling the hash value of each level.
TotalSubkeys - a pointer to fill the total number of subkeys
BaseConvKey - Supplies the convkey for the base key.
RemainingName - supplies pointer to a unicode_string for RemainingName.
Return Value:
Number of Levels in RemainingName
--*/
{ ULONG TotalRemainingSubkeys=0; ULONG TotalKeys=0; ULONG ConvKey=BaseConvKey; USHORT Cnt; WCHAR *Cp; WCHAR *Begin; USHORT Length;
if (RemainingName->Length) { Cp = RemainingName->Buffer; Cnt = RemainingName->Length;
//Skip the leading OBJ_NAME_PATH_SEPARATOR
while (*Cp == OBJ_NAME_PATH_SEPARATOR) { Cp++; Cnt -= sizeof(WCHAR); } Begin = Cp; Length = 0;
HashStack[TotalRemainingSubkeys].KeyName.Buffer = Cp;
while (Cnt) { if (*Cp == OBJ_NAME_PATH_SEPARATOR) { if (TotalRemainingSubkeys < CM_HASH_STACK_SIZE) { HashStack[TotalRemainingSubkeys].ConvKey = ConvKey; //
// Due to the changes in KCB structure, we now only have the subkey name
// in the kcb (not the full path). Change the name in the stack to store
// the parse element (each subkey) only.
//
HashStack[TotalRemainingSubkeys].KeyName.Length = Length; Length = 0; TotalRemainingSubkeys++; }
TotalKeys++;
//
// Now skip over leading path separators
// Just in case someone has a RemainingName '..A\\\\B..'
//
//
// We are stripping all OBJ_NAME_PATH_SEPARATOR (The origainl code keep the first one).
// so the KeyName.Buffer is set properly.
//
while(*Cp == OBJ_NAME_PATH_SEPARATOR) { Cp++; Cnt -= sizeof(WCHAR); } if (TotalRemainingSubkeys < CM_HASH_STACK_SIZE) { HashStack[TotalRemainingSubkeys].KeyName.Buffer = Cp; }
} else { ConvKey = 37 * ConvKey + (ULONG) CmUpcaseUnicodeChar(*Cp); //
// We are stripping all OBJ_NAME_PATH_SEPARATOR in the above code,
// we should only move to the next char in the else case.
//
Cp++; Cnt -= sizeof(WCHAR); Length += sizeof(WCHAR); }
}
//
// Since we have stripped off all trailing path separators in CmpParseKey routine,
// the last char will not be OBJ_NAME_PATH_SEPARATOR.
//
if (TotalRemainingSubkeys < CM_HASH_STACK_SIZE) { HashStack[TotalRemainingSubkeys].ConvKey = ConvKey; HashStack[TotalRemainingSubkeys].KeyName.Length = Length; TotalRemainingSubkeys++; } TotalKeys++;
(*TotalSubkeys) = TotalKeys; }
return(TotalRemainingSubkeys);}NTSTATUSCmpCacheLookup( IN PCM_HASH_ENTRY HashStack, IN ULONG TotalRemainingSubkeys, OUT ULONG *MatchRemainSubkeyLevel, IN OUT PCM_KEY_CONTROL_BLOCK *Kcb, OUT PUNICODE_STRING RemainingName, OUT PHHIVE *Hive, OUT HCELL_INDEX *Cell )/*++
Routine Description:
This routine Search the cache to find the matching path in the Cache.
Arguments:
HashStack - Array that has the hash value of each level.
TotalRemainingSubkeys - Total Subkey counts from base.
MatchRemainSubkeyLevel - Number of Levels in RemaingName that matches. (0 if not found)
kcb - Pointer to the kcb of the basename. Will be changed to the kcb for the new basename.
RemainingName - Returns remaining name
Hive - Returns the hive of the cache entry found (if any)
Cell - Returns the cell of the cache entry found (if any)
Return Value:
Status
--*/
{ LONG i; LONG j; NTSTATUS status = STATUS_SUCCESS; ULONG CurrentLevel; PCM_KEY_HASH Current; PCM_KEY_CONTROL_BLOCK BaseKcb; PCM_KEY_CONTROL_BLOCK CurrentKcb; PCM_KEY_CONTROL_BLOCK ParentKcb; BOOLEAN Found = FALSE;
BaseKcb = *Kcb; CurrentLevel = TotalRemainingSubkeys + BaseKcb->TotalLevels + 1;
for(i = TotalRemainingSubkeys-1; i>=0; i--) { //
// Try to find the longest path in the cache.
//
// First, find the kcb that match the hash value.
//
CurrentLevel--;
RetryLevel: Current = GET_HASH_ENTRY(CmpCacheTable, HashStack[i].ConvKey);
while (Current) { ASSERT_KEY_HASH(Current);
//
// Check against both the ConvKey and total levels;
//
CurrentKcb = (CONTAINING_RECORD(Current, CM_KEY_CONTROL_BLOCK, KeyHash));
if (CurrentKcb->TotalLevels == CurrentLevel) { //
// The total subkey levels match.
// Iterate through the kcb path and compare each subkey.
//
Found = TRUE; ParentKcb = CurrentKcb; for (j=i; j>=0; j--) { if (HashStack[j].ConvKey == ParentKcb->ConvKey) { //
// Convkey matches, compare the string
//
LONG Result; UNICODE_STRING TmpNodeName;
if (ParentKcb->NameBlock->Compressed) { Result = CmpCompareCompressedName(&(HashStack[j].KeyName), ParentKcb->NameBlock->Name, ParentKcb->NameBlock->NameLength, CMP_DEST_UP // name block is always UPPERCASE!!!
); } else { TmpNodeName.Buffer = ParentKcb->NameBlock->Name; TmpNodeName.Length = ParentKcb->NameBlock->NameLength; TmpNodeName.MaximumLength = ParentKcb->NameBlock->NameLength;
//
// use the cmp compare variant as we know the destination is already uppercased.
//
Result = CmpCompareUnicodeString(&(HashStack[j].KeyName), &TmpNodeName, CMP_DEST_UP); }
if (Result) { Found = FALSE; break; } ParentKcb = ParentKcb->ParentKcb; } else { Found = FALSE; break; } } if (Found) { //
// All remaining key matches. Now compare the BaseKcb.
//
if (BaseKcb == ParentKcb) { // if neither of these, don't need to ugrade KCB lock
if (CurrentKcb->ParentKcb->Delete || CurrentKcb->Delete) { if (CmpKcbOwner != KeGetCurrentThread()) { InterlockedIncrement( (PLONG)&CurrentKcb->RefCount ); CmpUnlockKCBTree(); CmpLockKCBTreeExclusive(); InterlockedDecrement( (PLONG)&CurrentKcb->RefCount ); goto RetryLevel; }
if (CurrentKcb->ParentKcb->Delete) { //
// The parentkcb is marked deleted.
// So this must be a fake key created when the parent still existed.
// Otherwise it cannot be in the cache
//
ASSERT (CurrentKcb->ExtFlags & CM_KCB_KEY_NON_EXIST);
//
// It is possible that the parent key was deleted but now recreated.
// In that case this fake key is not longer valid for the ParentKcb is bad.
// We must now remove this fake key out of cache so, if this is a
// create operation, we do get hit this kcb in CmpCreateKeyControlBlock.
//
if (CurrentKcb->RefCount == 0) { //
// No one is holding this fake kcb, just delete it.
//
CmpRemoveFromDelayedClose(CurrentKcb); CmpCleanUpKcbCacheWithLock(CurrentKcb); } else { //
// Someone is still holding this fake kcb,
// Mark it as delete and remove it out of cache.
//
CurrentKcb->Delete = TRUE; CmpRemoveKeyControlBlock(CurrentKcb); } Found = FALSE; break; } else if(CurrentKcb->Delete) { //
// the key has been deleted, but still kept in the cache for
// this kcb does not belong here
//
CmpRemoveKeyControlBlock(CurrentKcb); return STATUS_OBJECT_NAME_NOT_FOUND; } } //
// We have a match, update the RemainingName.
//
//
// Skip the leading OBJ_NAME_PATH_SEPARATOR
//
while ((RemainingName->Length > 0) && (RemainingName->Buffer[0] == OBJ_NAME_PATH_SEPARATOR)) { RemainingName->Buffer++; RemainingName->Length -= sizeof(WCHAR); }
//
// Skip all subkeys plus OBJ_NAME_PATH_SEPARATOR
//
for(j=0; j<=i; j++) { RemainingName->Buffer += HashStack[j].KeyName.Length/sizeof(WCHAR) + 1; RemainingName->Length -= HashStack[j].KeyName.Length + sizeof(WCHAR); }
//
// Update the KCB, Hive and Cell.
//
*Kcb = CurrentKcb; *Hive = CurrentKcb->KeyHive; *Cell = CurrentKcb->KeyCell; break; } else { Found = FALSE; } } } Current = Current->NextHash; }
if (Found) { break; } } if((*Kcb)->Delete) { //
// the key has been deleted, but still kept in the cache for
// this kcb does not belong here
//
return STATUS_OBJECT_NAME_NOT_FOUND; }
//
// Now the kcb will be used in the parse routine.
// Increase its reference count.
// Make sure we remember to dereference it at the parse routine.
//
if (!CmpReferenceKeyControlBlock(*Kcb)) { status = STATUS_INSUFFICIENT_RESOURCES; } *MatchRemainSubkeyLevel = i+1; return status;}
PCM_KEY_CONTROL_BLOCKCmpAddInfoAfterParseFailure( PHHIVE Hive, HCELL_INDEX Cell, PCM_KEY_NODE Node, PCM_KEY_CONTROL_BLOCK kcb, PUNICODE_STRING NodeName )/*++
Routine Description:
This routine builds up further information in the cache when parse fails. The additional information can be 1. The key is has no subkey (CM_KCB_NO_SUBKEY). 2. The key has a few subkeys, then build the index hint in the cache. 3. If lookup failed even we have index hint cached, then create a fake key so we do not fail again. This is very usful for lookup failure under keys like \registry\machine\software\classes\clsid, which have 1500+ subkeys and lots of them have the smae first four chars. NOTE. Currently we are not seeing too many fake keys being created. We need to monitor this periodly and work out a way to work around if we do create too many fake keys. One solution is to use hash value for index hint (We can do it in the cache only if we need to be backward comparible). Arguments:
Hive - Supplies Hive that holds the key we are creating a KCB for.
Cell - Supplies Cell that contains the key we are creating a KCB for.
Node - Supplies pointer to key node.
KeyName - The KeyName.
Return Value:
The KCB that CmpParse need to dereference at the end.
If resources problem, it returns NULL, and the caller is responsible for cleanup--*/{
ULONG TotalSubKeyCounts; BOOLEAN CreateFakeKcb = FALSE; BOOLEAN HintCached; PCM_KEY_CONTROL_BLOCK ParentKcb; USHORT i,j; HCELL_INDEX CellToRelease; ULONG HashKey;
if (!UseFastIndex(Hive)) { //
// Older version of hive, do not bother to cache hint.
//
return (kcb); }
TotalSubKeyCounts = Node->SubKeyCounts[Stable] + Node->SubKeyCounts[Volatile];
if (TotalSubKeyCounts == 0) { BEGIN_KCB_LOCK_GUARD; CmpLockKCBTreeExclusive(); kcb->ExtFlags |= CM_KCB_NO_SUBKEY; // clean up the invalid flag (if any)
kcb->ExtFlags &= ~CM_KCB_INVALID_CACHED_INFO; CmpUnlockKCBTree(); END_KCB_LOCK_GUARD; } else if (TotalSubKeyCounts == 1) { BEGIN_KCB_LOCK_GUARD; CmpLockKCBTreeExclusive(); if (!(kcb->ExtFlags & CM_KCB_SUBKEY_ONE)) { //
// Build the subkey hint to avoid unnecessary lookups in the index leaf
//
PCM_KEY_INDEX Index; HCELL_INDEX SubKeyCell = 0; PCM_KEY_NODE SubKeyNode; UNICODE_STRING TmpStr;
if (Node->SubKeyCounts[Stable] == 1) { CellToRelease = Node->SubKeyLists[Stable]; Index = (PCM_KEY_INDEX)HvGetCell(Hive, CellToRelease); } else { CellToRelease = Node->SubKeyLists[Volatile]; Index = (PCM_KEY_INDEX)HvGetCell(Hive, CellToRelease); } if( Index == NULL ) { //
// we couldn't map the bin containing this cell
// return NULL; The caller must handle this gracefully!
//
CmpUnlockKCBTree(); return NULL; }
if( Index->Signature == CM_KEY_INDEX_ROOT ) { //
// don't cache root indexes; they are too big
//
HvReleaseCell(Hive,CellToRelease); CmpUnlockKCBTree(); return NULL; }
HashKey = 0; if ( Index->Signature == CM_KEY_HASH_LEAF ) { PCM_KEY_FAST_INDEX FastIndex; FastIndex = (PCM_KEY_FAST_INDEX)Index; //
// we already have the hash key handy; preserve it for the kcb hint
//
HashKey = FastIndex->List[0].HashKey; } else if(Index->Signature == CM_KEY_FAST_LEAF) { PCM_KEY_FAST_INDEX FastIndex; FastIndex = (PCM_KEY_FAST_INDEX)Index; SubKeyCell = FastIndex->List[0].Cell;
} else { SubKeyCell = Index->List[0]; } //DbgPrint("CmpAddInfoAfterParseFailure [0]\n");
if( HashKey != 0 ) { kcb->HashKey = HashKey; kcb->ExtFlags |= CM_KCB_SUBKEY_ONE; // clean up the invalid flag (if any)
kcb->ExtFlags &= ~CM_KCB_INVALID_CACHED_INFO; } else { SubKeyNode = (PCM_KEY_NODE)HvGetCell(Hive,SubKeyCell); if( SubKeyNode != NULL ) { if (SubKeyNode->Flags & KEY_COMP_NAME) { kcb->HashKey = CmpComputeHashKeyForCompressedName(SubKeyNode->Name,SubKeyNode->NameLength); } else { TmpStr.Buffer = SubKeyNode->Name; TmpStr.Length = SubKeyNode->NameLength; kcb->HashKey = CmpComputeHashKey(&TmpStr); } HvReleaseCell(Hive,SubKeyCell); kcb->ExtFlags |= CM_KCB_SUBKEY_ONE; // clean up the invalid flag (if any)
kcb->ExtFlags &= ~CM_KCB_INVALID_CACHED_INFO; } else { //
// we couldn't map the bin containing this cell
// return NULL; The caller must handle this gracefully!
//
HvReleaseCell(Hive,CellToRelease); CmpUnlockKCBTree(); return NULL; } } HvReleaseCell(Hive,CellToRelease); } else { //
// The name hint does not prevent from this look up
// Create the fake Kcb.
//
CreateFakeKcb = TRUE; } CmpUnlockKCBTree(); END_KCB_LOCK_GUARD; } else if (TotalSubKeyCounts < CM_MAX_CACHE_HINT_SIZE) { BEGIN_KCB_LOCK_GUARD; CmpLockKCBTreeExclusive(); if (!(kcb->ExtFlags & CM_KCB_SUBKEY_HINT)) { //
// Build the index leaf info in the parent KCB
// How to sync the cache with the registry data is a problem to be resolved.
//
ULONG Size; PCM_KEY_INDEX Index; PCM_KEY_FAST_INDEX FastIndex; HCELL_INDEX SubKeyCell = 0; PCM_KEY_NODE SubKeyNode; ULONG HintCrt; UNICODE_STRING TmpStr;
Size = sizeof(ULONG) * (Node->SubKeyCounts[Stable] + Node->SubKeyCounts[Volatile] + 1);
kcb->IndexHint = ExAllocatePoolWithTag(PagedPool, Size, CM_CACHE_INDEX_TAG | PROTECTED_POOL);
HintCached = TRUE; if (kcb->IndexHint) { kcb->IndexHint->Count = Node->SubKeyCounts[Stable] + Node->SubKeyCounts[Volatile];
HintCrt = 0;
//DbgPrint("CmpAddInfoAfterParseFailure [1]\n");
for (i = 0; i < Hive->StorageTypeCount; i++) { if(Node->SubKeyCounts[i]) { CellToRelease = Node->SubKeyLists[i]; Index = (PCM_KEY_INDEX)HvGetCell(Hive, CellToRelease); if( Index == NULL ) { //
// we couldn't map the bin containing this cell
// return NULL; The caller must handle this gracefully!
//
CmpUnlockKCBTree(); return NULL; } if( Index->Signature == CM_KEY_INDEX_ROOT ) { HvReleaseCell(Hive,CellToRelease); HintCached = FALSE; break; } else { for (j=0; j<Node->SubKeyCounts[i]; j++) { HashKey = 0;
if ( Index->Signature == CM_KEY_HASH_LEAF ) { FastIndex = (PCM_KEY_FAST_INDEX)Index; //
// preserve the hash key for the kcb hint
//
HashKey = FastIndex->List[j].HashKey; } else if( Index->Signature == CM_KEY_FAST_LEAF ) { FastIndex = (PCM_KEY_FAST_INDEX)Index; SubKeyCell = FastIndex->List[j].Cell; } else { SubKeyCell = Index->List[j]; } if( HashKey != 0 ) { kcb->IndexHint->HashKey[HintCrt] = HashKey; } else { SubKeyNode = (PCM_KEY_NODE)HvGetCell(Hive,SubKeyCell); if( SubKeyNode == NULL ) { //
// couldn't map view; bad luck; don't cache hint for this kcb
//
HintCached = FALSE; break; }
if (SubKeyNode->Flags & KEY_COMP_NAME) { kcb->IndexHint->HashKey[HintCrt] = CmpComputeHashKeyForCompressedName(SubKeyNode->Name,SubKeyNode->NameLength); } else { TmpStr.Buffer = SubKeyNode->Name; TmpStr.Length = SubKeyNode->NameLength; kcb->IndexHint->HashKey[HintCrt] = CmpComputeHashKey(&TmpStr); }
HvReleaseCell(Hive,SubKeyCell); } //
// advance to the new hint
//
HintCrt++; } }
HvReleaseCell(Hive,CellToRelease); } }
if (HintCached) { kcb->ExtFlags |= CM_KCB_SUBKEY_HINT; // clean up the invalid flag (if any)
kcb->ExtFlags &= ~CM_KCB_INVALID_CACHED_INFO; } else { //
// Do not have a FAST_LEAF, free the allocation.
//
ExFreePoolWithTag(kcb->IndexHint, CM_CACHE_INDEX_TAG | PROTECTED_POOL); } } } else { //
// The name hint does not prevent from this look up
// Create the fake Kcb.
//
CreateFakeKcb = TRUE; } CmpUnlockKCBTree(); END_KCB_LOCK_GUARD; } else { CreateFakeKcb = TRUE; }
ParentKcb = kcb;
if (CreateFakeKcb && (CmpCacheOnFlag & CM_CACHE_FAKE_KEY)) { //
// It has more than a few children but not the one we are interested.
// Create a kcb for this non-existing key so we do not try to find it
// again. Use the cell and node from the parent.
//
// Before we create a new one. Dereference the current kcb.
//
// CmpCacheOnFlag is for us to turn it on/off easily.
//
kcb = CmpCreateKeyControlBlock(Hive, Cell, Node, ParentKcb, TRUE, NodeName);
if (kcb) { CmpDereferenceKeyControlBlock(ParentKcb); ParentKcb = kcb; } }
return (ParentKcb);}
#ifdef CM_DYN_SYM_LINK
//
// this code is commented out of the current builds;
// there is a potential security breach in the way RtlAcquirePebLock()
// works by calling a user mode routine (stored in the PEB) to lock the PEB
// We need to find a way to work around that before enabling this code
//
//
// Commenting the body of this function, to make sure code will not go in without
// fixing the above problem
//
BOOLEANCmpCaptureProcessEnvironmentString( OUT PWSTR *ProcessEnvironment, OUT PULONG Length )/*++
Routine Description:
Captures the process environment; It first Probe the env, then captures its address. Parse the whole env to the end and count it's length. Then allocate a buffer for it and copy. All of these are done in try/except to protect for bogus user-mode data. We need to lock the teb while working on it. Arguments:
ProcessEnvironment - to receive the captured stuff
Length - length of the above - in bytes
Return Value:
TRUE or FALSE when TRUE, the caller is responsible of freeing ProcessEnvironment --*/{/*
BOOLEAN Result = TRUE; PPEB Peb; PWSTR LocalEnv; PWSTR p;
PAGED_CODE();
*ProcessEnvironment = NULL; *Length = 0;
try { //
// grab the peb lock and the peb
//
RtlAcquirePebLock(); Peb = PsGetCurrentProcess()->Peb;
//
// probe the env from peb
//
LocalEnv = (PWSTR)ProbeAndReadPointer((PVOID *)(&(Peb->ProcessParameters->Environment)));
//
// parse the env to find its length
//
//
// The environment variable block consists of zero or more null
// terminated UNICODE strings. Each string is of the form:
//
// name=value
//
// where the null termination is after the value.
//
p = LocalEnv; if (p != NULL) while (*p) { while (*p) { p++; *Length += sizeof(WCHAR); }
//
// Skip over the terminating null character for this name=value
// pair in preparation for the next iteration of the loop.
//
p++; *Length += sizeof(WCHAR); } //
// adjust the length to accomodate the last two UNICODE_NULL
//
*Length += 2*sizeof(WCHAR);
//
// allocate a buffer for the captured env and copy
//
*ProcessEnvironment = (PWSTR)ExAllocatePoolWithTag(PagedPool,*Length,CM_FIND_LEAK_TAG41); if( *ProcessEnvironment != NULL ) { RtlCopyMemory(*ProcessEnvironment,LocalEnv, *Length); } else { *Length = 0; }
//
// release the peb lock
//
RtlReleasePebLock(); } except (EXCEPTION_EXECUTE_HANDLER) { CmKdPrintEx((DPFLTR_CONFIG_ID,CML_EXCEPTION,"!!CmpCaptureProcessEnvironmentString: code:%08lx\n", GetExceptionCode())); Result = FALSE; if( *ProcessEnvironment != NULL) { ExFreePool(*ProcessEnvironment); *ProcessEnvironment = NULL; } *Length = 0; //
// release the peb lock
//
RtlReleasePebLock(); }
return Result;*/}
#define GROW_INCREMENT 64*sizeof(WCHAR) // grow 64 wide-chars at a time
PWSTRCmpExpandEnvVars( IN PWSTR StringToExpand, IN ULONG LengthToExpand, OUT PULONG ExpandedLength )/*++
Routine Description:
Replaces all env vars from StringToExpand with their values, from the process environment. Allocates a new buffer for the result and returns it. Arguments:
StringToExpand - to receive the captured stuff
LengthToExpand - length of the above - in bytes
ExpandedLength - the actual length of the expanded string
Return Value:
NULL - the string could not be expanded (or not all the env inside it could be resolved)
valid buffer - the expanded string, it is the caller's responsibility to free it. --*/{ PWSTR ProcessEnv; ULONG ProcessEnvLength; PWSTR ExpandedString; ULONG ExpandedStringSize; PWSTR CurrentEnvVar; ULONG CurrentEnvLength; PWSTR CurrentEnvValue; ULONG CurrentEnvValueLength;
PAGED_CODE();
*ExpandedLength = 0; if( !CmpCaptureProcessEnvironmentString(&ProcessEnv,&ProcessEnvLength) ) { //
// could not secure the process env
//
ASSERT( (ProcessEnv == NULL) && (ProcessEnvLength == 0) ); return NULL; }
//
// allocate a buffer twice as the unexpanded buffer; we shall grow it if it's not big enough
//
ExpandedStringSize = LengthToExpand * 2; ExpandedString = (PWSTR)ExAllocatePoolWithTag(PagedPool,ExpandedStringSize,CM_FIND_LEAK_TAG42); if( ExpandedString == NULL ) { goto JustReturn; }
//
// convert to number of WCHARs
//
LengthToExpand /= sizeof(WCHAR);
//
// iterate through the string to be expanded and copy everything that's not and env var
// expand the env vars and replace them with their value
//
while( LengthToExpand ) { //
// find a % sign
//
while( LengthToExpand && (*StringToExpand != L'%') ) { if( *ExpandedLength == ExpandedStringSize ) { //
// we need to grow the expanded string
//
if( !CmpGrowAndCopyString(&ExpandedString,&ExpandedStringSize,GROW_INCREMENT) ) { goto ErrorExit; } } ExpandedString[(*ExpandedLength) / sizeof(WCHAR)] = *StringToExpand; (*ExpandedLength) += sizeof(WCHAR); LengthToExpand--; StringToExpand++; }
if( LengthToExpand == 0 ) { if( *StringToExpand != L'%') { //
// we have exited the loop because of the end of the string
//
goto JustReturn; } else { //
// we have found a mismatched %
//
CmKdPrintEx((DPFLTR_CONFIG_ID,DPFLTR_ERROR_LEVEL,"CmpExpandEnvVars : mismatched % sign\n")); goto ErrorExit; } }
ASSERT( *StringToExpand == L'%' ); //
// skip it; then mark the beggining of an env var
//
StringToExpand++; LengthToExpand--; CurrentEnvVar = StringToExpand; CurrentEnvLength = 0;
//
// find a % match sign
//
while( LengthToExpand && (*StringToExpand != L'%') ) { LengthToExpand--; StringToExpand++;
CurrentEnvLength += sizeof(WCHAR); }
if( LengthToExpand == 0 ) { if( (*StringToExpand == L'%') && (CurrentEnvLength != 0) ) { //
// end of string and no empty env var; we'll return (exit the surrounding
// while loop) after expanding this string
//
} else { //
// we didn't find a matching % sign, or we are in the %% case
//
CmKdPrintEx((DPFLTR_CONFIG_ID,DPFLTR_ERROR_LEVEL,"CmpExpandEnvVars : mismatched % sign\n")); goto ErrorExit; } } else { //
// skip this % sign
//
StringToExpand++; LengthToExpand--; } //
// find the value for this env var
//
if( !CmpFindEnvVar(ProcessEnv,ProcessEnvLength,CurrentEnvVar,CurrentEnvLength,&CurrentEnvValue,&CurrentEnvValueLength) ) { //
// could not resolve this env var
//
ASSERT( CurrentEnvValue == NULL ); CmKdPrintEx((DPFLTR_CONFIG_ID,DPFLTR_ERROR_LEVEL,"CmpExpandEnvVars : could not resolve (%.*S)\n",CurrentEnvLength/sizeof(WCHAR),CurrentEnvVar)); goto ErrorExit; } ASSERT( (CurrentEnvValueLength % sizeof(WCHAR)) == 0 ); //
// found it; strcat it at the end of the expanded string
//
if( (*ExpandedLength + CurrentEnvValueLength) >= ExpandedStringSize ) { //
// we first need to grow the buffer
//
if( !CmpGrowAndCopyString(&ExpandedString,&ExpandedStringSize,CurrentEnvValueLength) ) { goto ErrorExit; } } ASSERT( (*ExpandedLength + CurrentEnvValueLength) < ExpandedStringSize ); RtlCopyMemory(((PUCHAR)ExpandedString) + (*ExpandedLength),CurrentEnvValue,CurrentEnvValueLength); *ExpandedLength += CurrentEnvValueLength; }
goto JustReturn;
ErrorExit: if( ExpandedString != NULL ) { ExFreePool(ExpandedString); ExpandedString = NULL; }
JustReturn: ExFreePool(ProcessEnv); return ExpandedString;}
BOOLEANCmpGrowAndCopyString( IN OUT PWSTR *OldString, IN OUT PULONG OldStringSize, IN ULONG GrowIncrements ) { PWSTR NewString;
PAGED_CODE();
ASSERT( (*OldStringSize % sizeof(WCHAR)) == 0 ); ASSERT( (GrowIncrements % sizeof(WCHAR)) == 0 );
NewString = (PWSTR)ExAllocatePoolWithTag(PagedPool,*OldStringSize + GrowIncrements,CM_FIND_LEAK_TAG42); if( NewString == NULL ) { return FALSE; } RtlCopyMemory(NewString,*OldString,*OldStringSize); ExFreePool(*OldString); *OldString = NewString; *OldStringSize = *OldStringSize + GrowIncrements; return TRUE;}
BOOLEANCmpFindEnvVar( IN PWSTR ProcessEnv, IN ULONG ProcessEnvLength, IN PWSTR CurrentEnvVar, IN ULONG CurrentEnvLength, OUT PWSTR *CurrentEnvValue, OUT PULONG CurrentEnvValueLength ) /*++
Routine Description:
finds a specified envvar in the env string; if found returns a pointer to it in the env string, along with its size Arguments:
ProcessEnvironment - to receive the captured stuff
Length - length of the above - in bytes
Return Value:
TRUE or FALSE when TRUE, the caller is responsible of freeing ProcessEnvironment --*/{ PWSTR p; UNICODE_STRING CurrentName; UNICODE_STRING CurrentValue; UNICODE_STRING SearchedName;
PAGED_CODE();
*CurrentEnvValue = NULL;
if( ProcessEnv == NULL ) { return FALSE; }
p = ProcessEnv; SearchedName.Buffer = CurrentEnvVar; SearchedName.Length = (USHORT)CurrentEnvLength; SearchedName.MaximumLength = (USHORT)CurrentEnvLength; //
// The environment variable block consists of zero or more null
// terminated UNICODE strings. Each string is of the form:
//
// name=value
//
// where the null termination is after the value.
//
while (ProcessEnvLength) { //
// Determine the size of the name and value portions of
// the current string of the environment variable block.
//
CurrentName.Buffer = p; CurrentName.Length = 0; CurrentName.MaximumLength = 0; while (*p) { //
// If we see an equal sign, then compute the size of
// the name portion and scan for the end of the value.
//
if (*p == L'=' && p != CurrentName.Buffer) { CurrentName.Length = (USHORT)(p - CurrentName.Buffer)*sizeof(WCHAR); CurrentName.MaximumLength = (USHORT)(CurrentName.Length+sizeof(WCHAR)); CurrentValue.Buffer = ++p; ProcessEnvLength -= sizeof(WCHAR);
while(*p) { p++; ProcessEnvLength -= sizeof(WCHAR); } CurrentValue.Length = (USHORT)(p - CurrentValue.Buffer)*sizeof(WCHAR); CurrentValue.MaximumLength = (USHORT)(CurrentValue.Length+sizeof(WCHAR));
//
// At this point we have the length of both the name
// and value portions, so exit the loop so we can
// do the compare.
//
break; } else { ProcessEnvLength -= sizeof(WCHAR); p++; } }
//
// Skip over the terminating null character for this name=value
// pair in preparation for the next iteration of the loop.
//
p++; ProcessEnvLength -= sizeof(WCHAR);
//
// Compare the current name with the one requested, ignore
// case.
//
if (RtlEqualUnicodeString( &SearchedName, &CurrentName, TRUE )) { //
// Names are equal. Always return the length of the
// value string, excluding the terminating null.
//
*CurrentEnvValue = CurrentValue.Buffer; *CurrentEnvValueLength = CurrentValue.Length; return TRUE;
} } return FALSE;}
#endif //CM_DYN_SYM_LINK
BOOLEANCmpOKToFollowLink( IN PCMHIVE OrigHive, IN PCMHIVE DestHive )/*++
Routine Description:
1. You can follow links from TRUSTED to anywhere. 2. You cannot follow links from UNTRUSTED to TRUSTED. 3. Inside the UNTRUSTED name space, you can only follow links inside the same class of trust.
OBS: OrigHive is just an address. It should not be dereferenced, as it may not be valid anymore (ie. hive could have been unloaded in between). We don't really care as if it was, it will not be in the trust list for the SourceKcb's hive If OrigHive == NULL it means we have originated in a trusted hive. Arguments:
Return Value:
TRUE or FALSE--*/{ PCMHIVE TmpHive; PLIST_ENTRY AnchorAddr; PAGED_CODE();
if( OrigHive == NULL ) { //
// OK to follow links from trusted to anywhere
//
return TRUE; } if( OrigHive == DestHive ) { //
// OK to follow links inside the same hive
//
return TRUE; } if( !(DestHive->Flags & CM_CMHIVE_FLAG_UNTRUSTED) ) { //
// fail to follow from untrusted to trusted
//
//return FALSE;
goto Fail; } //
// both untrusted; see if they are in the same class of trust
//
ASSERT( DestHive->Flags & CM_CMHIVE_FLAG_UNTRUSTED );
LOCK_HIVE_LIST(); //
// walk the TrustClassEntry list of SrcHive, to see if we can find DstSrc
//
AnchorAddr = &(DestHive->TrustClassEntry); TmpHive = (PCMHIVE)(DestHive->TrustClassEntry.Flink);
while ( TmpHive != (PCMHIVE)AnchorAddr ) { TmpHive = CONTAINING_RECORD( TmpHive, CMHIVE, TrustClassEntry ); if( TmpHive == OrigHive ) { //
// found it ==> same class of trust
//
UNLOCK_HIVE_LIST(); return TRUE; } //
// skip to the next element
//
TmpHive = (PCMHIVE)(TmpHive->TrustClassEntry.Flink); }
UNLOCK_HIVE_LIST();
Fail:/*
{ UNICODE_STRING Source = {0}, Dest = {0};
CmpGetHiveName(OrigHive,&Source); CmpGetHiveName(DestHive,&Dest); DbgPrint("\nAttempt to cross trust boundary:\n"); DbgPrint("\t FROM: %wZ \n",&Source); DbgPrint("\t TO: %wZ \n",&Dest); DbgPrint("This call will fail after we get the DCR ready\n"); RtlFreeUnicodeString(&Source); RtlFreeUnicodeString(&Dest);
DbgBreakPoint(); }*/ //
// returning TRUE here will disable the 'don't follow links outside class of trust' behavior
//
return FALSE;}
#ifdef ALLOC_DATA_PRAGMA
#pragma const_seg()
#endif
|
