Leaked source code of windows server 2003
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
 

1895 lines
46 KiB

//----------------------------------------------------------------------------
//
// Microsoft Windows
// Copyright (C) Microsoft Corporation, 2000.
//
// File: rules-d.c
//
// Contents: Rule management for directory.
//
//
// History: AbhisheV
//
//----------------------------------------------------------------------------
#include "precomp.h"
extern LPWSTR NFADNAttributes[];
extern LPWSTR PolicyDNAttributes[];
DWORD
DirEnumNFAData(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
GUID PolicyIdentifier,
PIPSEC_NFA_DATA ** pppIpsecNFAData,
PDWORD pdwNumNFAObjects
)
{
DWORD dwError = 0;
LPWSTR pszPolicyString = NULL;
PIPSEC_NFA_OBJECT * ppIpsecNFAObject = NULL;
DWORD dwNumNFAObjects = 0;
PIPSEC_NFA_DATA * ppIpsecNFAData = NULL;
DWORD i = 0;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
PIPSEC_NFA_DATA pIpsecNFAData = NULL;
DWORD j = 0;
dwError = GenerateSpecificPolicyQuery(
PolicyIdentifier,
&pszPolicyString
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = DirEnumNFAObjects(
hLdapBindHandle,
pszIpsecRootContainer,
pszPolicyString,
&ppIpsecNFAObject,
&dwNumNFAObjects
);
BAIL_ON_WIN32_ERROR(dwError);
if (dwNumNFAObjects) {
ppIpsecNFAData = (PIPSEC_NFA_DATA *)AllocPolMem(
sizeof(PIPSEC_NFA_DATA)*dwNumNFAObjects
);
if (!ppIpsecNFAData) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
}
for (i = 0; i < dwNumNFAObjects; i++) {
pIpsecNFAObject = *(ppIpsecNFAObject + i);
dwError = DirUnmarshallNFAData(
pIpsecNFAObject,
&pIpsecNFAData
);
if (!dwError) {
*(ppIpsecNFAData + j) = pIpsecNFAData;
j++;
}
}
if (j == 0) {
if (ppIpsecNFAData) {
FreePolMem(ppIpsecNFAData);
ppIpsecNFAData = NULL;
}
}
*pppIpsecNFAData = ppIpsecNFAData;
*pdwNumNFAObjects = j;
dwError = ERROR_SUCCESS;
cleanup:
if (ppIpsecNFAObject) {
FreeIpsecNFAObjects(
ppIpsecNFAObject,
dwNumNFAObjects
);
}
if (pszPolicyString) {
FreePolStr(pszPolicyString);
}
return(dwError);
error:
if (ppIpsecNFAData) {
FreeMulIpsecNFAData(
ppIpsecNFAData,
i
);
}
*pppIpsecNFAData = NULL;
*pdwNumNFAObjects = 0;
goto cleanup;
}
DWORD
DirEnumNFAObjects(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
LPWSTR pszIpsecPolicyName,
PIPSEC_NFA_OBJECT ** pppIpsecNFAObjects,
PDWORD pdwNumNFAObjects
)
{
DWORD dwError = 0;
LPWSTR * ppszNFADNs = NULL;
DWORD dwNumNFAObjects = 0;
LPWSTR pszFilterString = NULL;
LDAPMessage *res = NULL;
DWORD dwCount = 0;
PIPSEC_NFA_OBJECT * ppIpsecNFAObjects = NULL;
DWORD i = 0;
LDAPMessage *e = NULL;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
DWORD dwNumNFAObjectsReturned = 0;
LPWSTR pszFilterReference = NULL;
LPWSTR pszNegPolReference = NULL;
dwError = DirGetNFADNsForPolicy(
hLdapBindHandle,
pszIpsecRootContainer,
pszIpsecPolicyName,
&ppszNFADNs,
&dwNumNFAObjects
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = GenerateNFAQuery(
ppszNFADNs,
dwNumNFAObjects,
&pszFilterString
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = LdapSearchST(
hLdapBindHandle,
pszIpsecRootContainer,
LDAP_SCOPE_ONELEVEL,
pszFilterString,
NFADNAttributes,
0,
NULL,
&res
);
BAIL_ON_WIN32_ERROR(dwError);
dwCount = LdapCountEntries(
hLdapBindHandle,
res
);
if (!dwCount) {
dwError = ERROR_DS_NO_ATTRIBUTE_OR_VALUE;
BAIL_ON_WIN32_ERROR(dwError);
}
ppIpsecNFAObjects = (PIPSEC_NFA_OBJECT *)AllocPolMem(
sizeof(PIPSEC_NFA_OBJECT)*dwCount
);
if (!ppIpsecNFAObjects) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
for (i = 0; i < dwCount; i++) {
if (i == 0) {
dwError = LdapFirstEntry(
hLdapBindHandle,
res,
&e
);
BAIL_ON_WIN32_ERROR(dwError);
}
else {
dwError = LdapNextEntry(
hLdapBindHandle,
e,
&e
);
BAIL_ON_WIN32_ERROR(dwError);
}
dwError =UnMarshallNFAObject(
hLdapBindHandle,
e,
&pIpsecNFAObject,
&pszFilterReference,
&pszNegPolReference
);
if (dwError == ERROR_SUCCESS) {
*(ppIpsecNFAObjects + dwNumNFAObjectsReturned) = pIpsecNFAObject;
dwNumNFAObjectsReturned++;
if (pszFilterReference) {
FreePolStr(pszFilterReference);
pszFilterReference = NULL;
}
if (pszNegPolReference) {
FreePolStr(pszNegPolReference);
pszNegPolReference = NULL;
}
}
}
*pppIpsecNFAObjects = ppIpsecNFAObjects;
*pdwNumNFAObjects = dwNumNFAObjectsReturned;
dwError = ERROR_SUCCESS;
cleanup:
if (res) {
LdapMsgFree(res);
}
if (pszFilterString) {
FreePolStr(pszFilterString);
}
if (ppszNFADNs) {
FreeNFAReferences(
ppszNFADNs,
dwNumNFAObjects
);
}
return(dwError);
error:
if (ppIpsecNFAObjects) {
FreeIpsecNFAObjects(
ppIpsecNFAObjects,
dwNumNFAObjectsReturned
);
}
*pppIpsecNFAObjects = NULL;
*pdwNumNFAObjects = 0;
goto cleanup;
}
DWORD
DirGetNFADNsForPolicy(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
LPWSTR pszIpsecPolicyName,
LPWSTR ** pppszNFADNs,
PDWORD pdwNumNFAObjects
)
{
DWORD dwError = 0;
LDAPMessage * res = NULL;
DWORD dwCount = 0;
LDAPMessage * e = NULL;
PIPSEC_POLICY_OBJECT pIpsecPolicyObject = NULL;
LPWSTR * ppszNFADNs = NULL;
LPWSTR * ppszIpsecNFANames = NULL;
DWORD dwNumberOfRules = 0;
DWORD i = 0;
LPWSTR pszIpsecNFAName = NULL;
LPWSTR pszNFADN = NULL;
dwError = LdapSearchST(
hLdapBindHandle,
pszIpsecRootContainer,
LDAP_SCOPE_ONELEVEL,
pszIpsecPolicyName,
PolicyDNAttributes,
0,
NULL,
&res
);
BAIL_ON_WIN32_ERROR(dwError);
dwCount = LdapCountEntries(
hLdapBindHandle,
res
);
if (!dwCount) {
dwError = ERROR_DS_NO_ATTRIBUTE_OR_VALUE;
BAIL_ON_WIN32_ERROR(dwError);
}
dwError = LdapFirstEntry(
hLdapBindHandle,
res,
&e
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = UnMarshallPolicyObject2(
hLdapBindHandle,
e,
&pIpsecPolicyObject
);
BAIL_ON_WIN32_ERROR(dwError);
ppszIpsecNFANames = pIpsecPolicyObject->ppszIpsecNFAReferences;
dwNumberOfRules = pIpsecPolicyObject->NumberofRules;
if (!dwNumberOfRules) {
dwError = ERROR_INVALID_DATA;
BAIL_ON_WIN32_ERROR(dwError);
}
ppszNFADNs = (LPWSTR *)AllocPolMem(
sizeof(LPWSTR)*dwNumberOfRules
);
if (!ppszNFADNs) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
for (i = 0; i < dwNumberOfRules; i++) {
pszIpsecNFAName = *(ppszIpsecNFANames + i);
pszNFADN = AllocPolStr(pszIpsecNFAName);
if (!pszNFADN) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
*(ppszNFADNs + i) = pszNFADN;
}
*pppszNFADNs = ppszNFADNs;
*pdwNumNFAObjects = dwNumberOfRules;
cleanup:
if (res) {
LdapMsgFree(res);
}
if (pIpsecPolicyObject) {
FreeIpsecPolicyObject(pIpsecPolicyObject);
}
return(dwError);
error:
if (ppszNFADNs) {
FreeNFAReferences(
ppszNFADNs,
i
);
}
*pppszNFADNs = NULL;
*pdwNumNFAObjects = 0;
goto cleanup;
}
DWORD
DirUnmarshallNFAData(
PIPSEC_NFA_OBJECT pIpsecNFAObject,
PIPSEC_NFA_DATA * ppIpsecNFAData
)
{
DWORD dwError = 0;
dwError = UnmarshallNFAObject(
pIpsecNFAObject,
IPSEC_DIRECTORY_PROVIDER,
ppIpsecNFAData
);
BAIL_ON_WIN32_ERROR(dwError);
error:
return(dwError);
}
DWORD
DirCreateNFAData(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
GUID PolicyIdentifier,
PIPSEC_NFA_DATA pIpsecNFAData
)
{
DWORD dwError = 0;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
LPWSTR pszIpsecPolicyReference = NULL;
dwError = DirMarshallNFAObject(
pIpsecNFAData,
pszIpsecRootContainer,
&pIpsecNFAObject
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = ConvertGuidToDirPolicyString(
PolicyIdentifier,
pszIpsecRootContainer,
&pszIpsecPolicyReference
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = DirCreateNFAObject(
hLdapBindHandle,
pszIpsecRootContainer,
pIpsecNFAObject
);
BAIL_ON_WIN32_ERROR(dwError);
//
// Write the policy object reference.
//
dwError = DirAddNFAReferenceToPolicyObject(
hLdapBindHandle,
pszIpsecPolicyReference,
pIpsecNFAObject->pszDistinguishedName
);
BAIL_ON_WIN32_ERROR(dwError);
//
// Write the NFA object reference.
//
dwError = DirAddPolicyReferenceToNFAObject(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName,
pszIpsecPolicyReference
);
BAIL_ON_WIN32_ERROR(dwError);
//
// Write the filter object reference for the NFA
// only if the NFA is not a default rule.
//
if (pIpsecNFAObject->pszIpsecFilterReference) {
dwError = DirAddNFAReferenceToFilterObject(
hLdapBindHandle,
pIpsecNFAObject->pszIpsecFilterReference,
pIpsecNFAObject->pszDistinguishedName
);
BAIL_ON_WIN32_ERROR(dwError);
}
//
// Write the NFA object reference for the filter
// only if the NFA is not a default rule.
//
if (pIpsecNFAObject->pszIpsecFilterReference) {
dwError = DirAddFilterReferenceToNFAObject(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName,
pIpsecNFAObject->pszIpsecFilterReference
);
BAIL_ON_WIN32_ERROR(dwError);
}
//
// Write the negpol object reference for the NFA.
//
dwError = DirAddNFAReferenceToNegPolObject(
hLdapBindHandle,
pIpsecNFAObject->pszIpsecNegPolReference,
pIpsecNFAObject->pszDistinguishedName
);
BAIL_ON_WIN32_ERROR(dwError);
//
// Write the NFA object reference for the negpol.
//
dwError = DirAddNegPolReferenceToNFAObject(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName,
pIpsecNFAObject->pszIpsecNegPolReference
);
BAIL_ON_WIN32_ERROR(dwError);
error:
if (pIpsecNFAObject) {
FreeIpsecNFAObject(
pIpsecNFAObject
);
}
if (pszIpsecPolicyReference) {
FreePolStr(pszIpsecPolicyReference);
}
return(dwError);
}
DWORD
DirMarshallNFAObject(
PIPSEC_NFA_DATA pIpsecNFAData,
LPWSTR pszIpsecRootContainer,
PIPSEC_NFA_OBJECT * ppIpsecNFAObject
)
{
DWORD dwError = 0;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
WCHAR szGuid[MAX_PATH];
WCHAR szDistinguishedName[MAX_PATH];
LPBYTE pBuffer = NULL;
DWORD dwBufferLen = 0;
LPWSTR pszStringUuid = NULL;
LPWSTR pszIpsecFilterReference = NULL;
LPWSTR pszIpsecNegPolReference = NULL;
GUID ZeroGuid;
memset(&ZeroGuid, 0, sizeof(GUID));
szGuid[0] = L'\0';
szDistinguishedName[0] = L'\0';
pIpsecNFAObject = (PIPSEC_NFA_OBJECT)AllocPolMem(
sizeof(IPSEC_NFA_OBJECT)
);
if (!pIpsecNFAObject) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
dwError = UuidToString(
&pIpsecNFAData->NFAIdentifier,
&pszStringUuid
);
BAIL_ON_WIN32_ERROR(dwError);
wcscpy(szGuid, L"{");
wcscat(szGuid, pszStringUuid);
wcscat(szGuid, L"}");
//
// Fill in the distinguishedName
//
wcscpy(szDistinguishedName,L"CN=ipsecNFA");
wcscat(szDistinguishedName, szGuid);
wcscat(szDistinguishedName, L",");
SecStrCatW(szDistinguishedName, pszIpsecRootContainer, MAX_PATH);
pIpsecNFAObject->pszDistinguishedName = AllocPolStr(
szDistinguishedName
);
if (!pIpsecNFAObject->pszDistinguishedName) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
//
// Fill in the ipsecName
//
if (pIpsecNFAData->pszIpsecName &&
*pIpsecNFAData->pszIpsecName) {
pIpsecNFAObject->pszIpsecName = AllocPolStr(
pIpsecNFAData->pszIpsecName
);
if (!pIpsecNFAObject->pszIpsecName) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
}
if (pIpsecNFAData->pszDescription &&
*pIpsecNFAData->pszDescription) {
pIpsecNFAObject->pszDescription = AllocPolStr(
pIpsecNFAData->pszDescription
);
if (!pIpsecNFAObject->pszDescription) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
}
//
// Fill in the ipsecID
//
pIpsecNFAObject->pszIpsecID = AllocPolStr(
szGuid
);
if (!pIpsecNFAObject->pszIpsecID) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
//
// Fill in the ipsecDataType
//
pIpsecNFAObject->dwIpsecDataType = 0x100;
//
// Marshall the pIpsecDataBuffer and the Length
//
dwError = MarshallNFABuffer(
pIpsecNFAData,
&pBuffer,
&dwBufferLen
);
BAIL_ON_WIN32_ERROR(dwError);
pIpsecNFAObject->pIpsecData = pBuffer;
pIpsecNFAObject->dwIpsecDataLen = dwBufferLen;
//
// Marshall the Filter Reference.
// There's no filter reference for a default rule.
//
if (memcmp(
&pIpsecNFAData->FilterIdentifier,
&ZeroGuid,
sizeof(GUID))) {
dwError = ConvertGuidToDirFilterString(
pIpsecNFAData->FilterIdentifier,
pszIpsecRootContainer,
&pszIpsecFilterReference
);
BAIL_ON_WIN32_ERROR(dwError);
pIpsecNFAObject->pszIpsecFilterReference = pszIpsecFilterReference;
}
else {
pIpsecNFAObject->pszIpsecFilterReference = NULL;
}
//
// Marshall the NegPol Reference
//
dwError = ConvertGuidToDirNegPolString(
pIpsecNFAData->NegPolIdentifier,
pszIpsecRootContainer,
&pszIpsecNegPolReference
);
BAIL_ON_WIN32_ERROR(dwError);
pIpsecNFAObject->pszIpsecNegPolReference = pszIpsecNegPolReference;
pIpsecNFAObject->dwWhenChanged = 0;
*ppIpsecNFAObject = pIpsecNFAObject;
cleanup:
if (pszStringUuid) {
RpcStringFree(
&pszStringUuid
);
}
return(dwError);
error:
if (pIpsecNFAObject) {
FreeIpsecNFAObject(
pIpsecNFAObject
);
}
*ppIpsecNFAObject = NULL;
goto cleanup;
}
DWORD
ConvertGuidToDirFilterString(
GUID FilterIdentifier,
LPWSTR pszIpsecRootContainer,
LPWSTR * ppszIpsecFilterReference
)
{
DWORD dwError = 0;
LPWSTR pszStringUuid = NULL;
WCHAR szGuidString[MAX_PATH];
WCHAR szFilterReference[MAX_PATH];
LPWSTR pszIpsecFilterReference = NULL;
dwError = UuidToString(
&FilterIdentifier,
&pszStringUuid
);
BAIL_ON_WIN32_ERROR(dwError);
szGuidString[0] = L'\0';
wcscpy(szGuidString, L"{");
wcscat(szGuidString, pszStringUuid);
wcscat(szGuidString, L"}");
szFilterReference[0] = L'\0';
wcscpy(szFilterReference,L"CN=ipsecFilter");
wcscat(szFilterReference, szGuidString);
wcscat(szFilterReference, L",");
SecStrCatW(szFilterReference, pszIpsecRootContainer, MAX_PATH);
pszIpsecFilterReference = AllocPolStr(
szFilterReference
);
if (!pszIpsecFilterReference) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
*ppszIpsecFilterReference = pszIpsecFilterReference;
cleanup:
if (pszStringUuid) {
RpcStringFree(&pszStringUuid);
}
return(dwError);
error:
*ppszIpsecFilterReference = NULL;
goto cleanup;
}
DWORD
ConvertGuidToDirNegPolString(
GUID NegPolIdentifier,
LPWSTR pszIpsecRootContainer,
LPWSTR * ppszIpsecNegPolReference
)
{
DWORD dwError = 0;
LPWSTR pszStringUuid = NULL;
WCHAR szGuidString[MAX_PATH];
WCHAR szNegPolReference[MAX_PATH];
LPWSTR pszIpsecNegPolReference = NULL;
dwError = UuidToString(
&NegPolIdentifier,
&pszStringUuid
);
BAIL_ON_WIN32_ERROR(dwError);
szGuidString[0] = L'\0';
wcscpy(szGuidString, L"{");
wcscat(szGuidString, pszStringUuid);
wcscat(szGuidString, L"}");
szNegPolReference[0] = L'\0';
wcscpy(szNegPolReference,L"CN=ipsecNegotiationPolicy");
wcscat(szNegPolReference, szGuidString);
wcscat(szNegPolReference, L",");
SecStrCatW(szNegPolReference, pszIpsecRootContainer, MAX_PATH);
pszIpsecNegPolReference = AllocPolStr(
szNegPolReference
);
if (!pszIpsecNegPolReference) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
*ppszIpsecNegPolReference = pszIpsecNegPolReference;
cleanup:
if (pszStringUuid) {
RpcStringFree(&pszStringUuid);
}
return(dwError);
error:
*ppszIpsecNegPolReference = NULL;
goto cleanup;
}
DWORD
DirCreateNFAObject(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
PIPSEC_NFA_OBJECT pIpsecNFAObject
)
{
DWORD dwError = 0;
LDAPModW ** ppLDAPModW = NULL;
dwError = DirMarshallAddNFAObject(
hLdapBindHandle,
pszIpsecRootContainer,
pIpsecNFAObject,
&ppLDAPModW
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = LdapAddS(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName,
ppLDAPModW
);
BAIL_ON_WIN32_ERROR(dwError);
error:
//
// Free the amods structures.
//
if (ppLDAPModW) {
FreeLDAPModWs(
ppLDAPModW
);
}
return(dwError);
}
DWORD
DirMarshallAddNFAObject(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
PIPSEC_NFA_OBJECT pIpsecNFAObject,
LDAPModW *** pppLDAPModW
)
{
DWORD i = 0;
LDAPModW ** ppLDAPModW = NULL;
LDAPModW * pLDAPModW = NULL;
DWORD dwNumAttributes = 6;
DWORD dwError = 0;
WCHAR Buffer[64];
if (!pIpsecNFAObject->pszIpsecName ||
!*pIpsecNFAObject->pszIpsecName) {
dwNumAttributes--;
}
if (!pIpsecNFAObject->pszDescription ||
!*pIpsecNFAObject->pszDescription) {
dwNumAttributes--;
}
ppLDAPModW = (LDAPModW **) AllocPolMem(
(dwNumAttributes+1) * sizeof(LDAPModW*)
);
if (!ppLDAPModW) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
pLDAPModW = (LDAPModW *) AllocPolMem(
dwNumAttributes * sizeof(LDAPModW)
);
if (!pLDAPModW) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
//
// 0. objectClass
//
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"objectClass",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPStringValue(
L"ipsecNFA",
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
//
// 1. ipsecName
//
if (pIpsecNFAObject->pszIpsecName &&
*pIpsecNFAObject->pszIpsecName) {
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"ipsecName",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPStringValue(
pIpsecNFAObject->pszIpsecName,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
}
//
// 2. ipsecID
//
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"ipsecID",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPStringValue(
pIpsecNFAObject->pszIpsecID,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
//
// 3. ipsecDataType
//
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"ipsecDataType",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
_itow( pIpsecNFAObject->dwIpsecDataType, Buffer, 10 );
dwError = AllocateLDAPStringValue(
Buffer,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
//
// 4. ipsecData
//
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"ipsecData",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPBinaryValue(
pIpsecNFAObject->pIpsecData,
pIpsecNFAObject->dwIpsecDataLen,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW+i)->mod_op = LDAP_MOD_REPLACE | LDAP_MOD_BVALUES;
i++;
//
// 5. description
//
if (pIpsecNFAObject->pszDescription &&
*pIpsecNFAObject->pszDescription) {
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"description",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPStringValue(
pIpsecNFAObject->pszDescription,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
}
*pppLDAPModW = ppLDAPModW;
return(dwError);
error:
if (ppLDAPModW) {
FreeLDAPModWs(
ppLDAPModW
);
}
*pppLDAPModW = NULL;
return(dwError);
}
DWORD
DirSetNFAData(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
GUID PolicyIdentifier,
PIPSEC_NFA_DATA pIpsecNFAData
)
{
DWORD dwError = 0;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
LPWSTR pszOldIpsecFilterReference = NULL;
LPWSTR pszOldIpsecNegPolReference = NULL;
dwError = DirMarshallNFAObject(
pIpsecNFAData,
pszIpsecRootContainer,
&pIpsecNFAObject
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = DirGetNFAExistingFilterRef(
hLdapBindHandle,
pszIpsecRootContainer,
pIpsecNFAData,
&pszOldIpsecFilterReference
);
// BAIL_ON_WIN32_ERROR(dwError);
dwError = DirGetNFAExistingNegPolRef(
hLdapBindHandle,
pszIpsecRootContainer,
pIpsecNFAData,
&pszOldIpsecNegPolReference
);
// BAIL_ON_WIN32_ERROR(dwError);
dwError = DirSetNFAObject(
hLdapBindHandle,
pszIpsecRootContainer,
pIpsecNFAObject
);
BAIL_ON_WIN32_ERROR(dwError);
if (pszOldIpsecFilterReference) {
dwError = DirDeleteNFAReferenceInFilterObject(
hLdapBindHandle,
pszOldIpsecFilterReference,
pIpsecNFAObject->pszDistinguishedName
);
// BAIL_ON_WIN32_ERROR(dwError);
}
if (pIpsecNFAObject->pszIpsecFilterReference) {
dwError = DirAddNFAReferenceToFilterObject(
hLdapBindHandle,
pIpsecNFAObject->pszIpsecFilterReference,
pIpsecNFAObject->pszDistinguishedName
);
BAIL_ON_WIN32_ERROR(dwError);
}
//
// Update the NFA object reference for the filter.
//
if (pIpsecNFAObject->pszIpsecFilterReference) {
dwError = DirUpdateFilterReferenceInNFAObject(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName,
pszOldIpsecFilterReference,
pIpsecNFAObject->pszIpsecFilterReference
);
BAIL_ON_WIN32_ERROR(dwError);
}
else {
dwError = DirRemoveFilterReferenceInNFAObject(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName
);
// BAIL_ON_WIN32_ERROR(dwError);
}
if (pszOldIpsecNegPolReference) {
dwError = DirDeleteNFAReferenceInNegPolObject(
hLdapBindHandle,
pszOldIpsecNegPolReference,
pIpsecNFAObject->pszDistinguishedName
);
// BAIL_ON_WIN32_ERROR(dwError);
}
dwError = DirAddNFAReferenceToNegPolObject(
hLdapBindHandle,
pIpsecNFAObject->pszIpsecNegPolReference,
pIpsecNFAObject->pszDistinguishedName
);
BAIL_ON_WIN32_ERROR(dwError);
//
// Update the NFA object reference for the negpol.
//
dwError = DirUpdateNegPolReferenceInNFAObject(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName,
pszOldIpsecNegPolReference,
pIpsecNFAObject->pszIpsecNegPolReference
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = DirBackPropIncChangesForNFAToPolicy(
hLdapBindHandle,
pszIpsecRootContainer,
pIpsecNFAObject->pszDistinguishedName
);
BAIL_ON_WIN32_ERROR(dwError);
error:
if (pIpsecNFAObject) {
FreeIpsecNFAObject(pIpsecNFAObject);
}
if (pszOldIpsecFilterReference) {
FreePolStr(pszOldIpsecFilterReference);
}
if (pszOldIpsecNegPolReference) {
FreePolStr(pszOldIpsecNegPolReference);
}
return(dwError);
}
DWORD
DirSetNFAObject(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
PIPSEC_NFA_OBJECT pIpsecNFAObject
)
{
DWORD dwError = 0;
LDAPModW ** ppLDAPModW = NULL;
dwError = DirMarshallSetNFAObject(
hLdapBindHandle,
pszIpsecRootContainer,
pIpsecNFAObject,
&ppLDAPModW
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = LdapModifyS(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName,
ppLDAPModW
);
BAIL_ON_WIN32_ERROR(dwError);
error:
//
// Free the amods structures.
//
if (ppLDAPModW) {
FreeLDAPModWs(
ppLDAPModW
);
}
return(dwError);
}
DWORD
DirMarshallSetNFAObject(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
PIPSEC_NFA_OBJECT pIpsecNFAObject,
LDAPModW *** pppLDAPModW
)
{
DWORD i = 0;
LDAPModW ** ppLDAPModW = NULL;
LDAPModW * pLDAPModW = NULL;
DWORD dwNumAttributes = 5;
DWORD dwError = 0;
WCHAR Buffer[64];
if (!pIpsecNFAObject->pszIpsecName ||
!*pIpsecNFAObject->pszIpsecName) {
dwNumAttributes--;
}
if (!pIpsecNFAObject->pszDescription ||
!*pIpsecNFAObject->pszDescription) {
dwNumAttributes--;
}
ppLDAPModW = (LDAPModW **) AllocPolMem(
(dwNumAttributes+1) * sizeof(LDAPModW*)
);
if (!ppLDAPModW) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
pLDAPModW = (LDAPModW *) AllocPolMem(
dwNumAttributes * sizeof(LDAPModW)
);
if (!pLDAPModW) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
//
// 1. ipsecName
//
if (pIpsecNFAObject->pszIpsecName &&
*pIpsecNFAObject->pszIpsecName) {
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"ipsecName",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPStringValue(
pIpsecNFAObject->pszIpsecName,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
}
//
// 2. ipsecID
//
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"ipsecID",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPStringValue(
pIpsecNFAObject->pszIpsecID,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
//
// 3. ipsecDataType
//
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"ipsecDataType",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
_itow( pIpsecNFAObject->dwIpsecDataType, Buffer, 10 );
dwError = AllocateLDAPStringValue(
Buffer,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
//
// 4. ipsecData
//
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"ipsecData",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPBinaryValue(
pIpsecNFAObject->pIpsecData,
pIpsecNFAObject->dwIpsecDataLen,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW+i)->mod_op = LDAP_MOD_REPLACE | LDAP_MOD_BVALUES;
i++;
//
// 5. description
//
if (pIpsecNFAObject->pszDescription &&
*pIpsecNFAObject->pszDescription) {
ppLDAPModW[i] = pLDAPModW + i;
dwError = AllocatePolString(
L"description",
&(pLDAPModW +i)->mod_type
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = AllocateLDAPStringValue(
pIpsecNFAObject->pszDescription,
(PLDAPOBJECT *)&(pLDAPModW +i)->mod_values
);
BAIL_ON_WIN32_ERROR(dwError);
(pLDAPModW + i)->mod_op |= LDAP_MOD_REPLACE;
i++;
}
*pppLDAPModW = ppLDAPModW;
return(dwError);
error:
if (ppLDAPModW) {
FreeLDAPModWs(
ppLDAPModW
);
}
*pppLDAPModW = NULL;
return(dwError);
}
DWORD
DirDeleteNFAData(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
GUID PolicyIdentifier,
PIPSEC_NFA_DATA pIpsecNFAData
)
{
DWORD dwError = 0;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
LPWSTR pszIpsecPolicyReference = NULL;
dwError = DirMarshallNFAObject(
pIpsecNFAData,
pszIpsecRootContainer,
&pIpsecNFAObject
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = ConvertGuidToDirPolicyString(
PolicyIdentifier,
pszIpsecRootContainer,
&pszIpsecPolicyReference
);
BAIL_ON_WIN32_ERROR(dwError);
//
// Remove the NFA reference from the policy object.
//
dwError = DirRemoveNFAReferenceFromPolicyObject(
hLdapBindHandle,
pszIpsecPolicyReference,
pIpsecNFAObject->pszDistinguishedName
);
BAIL_ON_WIN32_ERROR(dwError);
//
// Remove the NFA Reference from the negpol object.
//
dwError = DirDeleteNFAReferenceInNegPolObject(
hLdapBindHandle,
pIpsecNFAObject->pszIpsecNegPolReference,
pIpsecNFAObject->pszDistinguishedName
);
// BAIL_ON_WIN32_ERROR(dwError);
//
// Remove the NFA Reference from the filter object.
//
if (pIpsecNFAObject->pszIpsecFilterReference) {
dwError = DirDeleteNFAReferenceInFilterObject(
hLdapBindHandle,
pIpsecNFAObject->pszIpsecFilterReference,
pIpsecNFAObject->pszDistinguishedName
);
// BAIL_ON_WIN32_ERROR(dwError);
}
dwError = LdapDeleteS(
hLdapBindHandle,
pIpsecNFAObject->pszDistinguishedName
);
BAIL_ON_WIN32_ERROR(dwError);
error:
if (pIpsecNFAObject) {
FreeIpsecNFAObject(pIpsecNFAObject);
}
if (pszIpsecPolicyReference) {
FreePolStr(pszIpsecPolicyReference);
}
return(dwError);
}
DWORD
DirGetNFAExistingFilterRef(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
PIPSEC_NFA_DATA pIpsecNFAData,
LPWSTR * ppszIpsecFilterName
)
{
DWORD dwError = 0;
LPWSTR pszNFAString = NULL;
LDAPMessage * res = NULL;
DWORD dwCount = 0;
LDAPMessage * e = NULL;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
LPWSTR pszIpsecFilterName = NULL;
LPWSTR pszFilterReference = NULL;
LPWSTR pszNegPolReference = NULL;
dwError = GenerateSpecificNFAQuery(
pIpsecNFAData->NFAIdentifier,
&pszNFAString
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = LdapSearchST(
hLdapBindHandle,
pszIpsecRootContainer,
LDAP_SCOPE_ONELEVEL,
pszNFAString,
NFADNAttributes,
0,
NULL,
&res
);
BAIL_ON_WIN32_ERROR(dwError);
dwCount = LdapCountEntries(
hLdapBindHandle,
res
);
if (!dwCount) {
dwError = ERROR_DS_NO_ATTRIBUTE_OR_VALUE;
BAIL_ON_WIN32_ERROR(dwError);
}
dwError = LdapFirstEntry(
hLdapBindHandle,
res,
&e
);
BAIL_ON_WIN32_ERROR(dwError);
dwError =UnMarshallNFAObject(
hLdapBindHandle,
e,
&pIpsecNFAObject,
&pszFilterReference,
&pszNegPolReference
);
BAIL_ON_WIN32_ERROR(dwError);
if (pszFilterReference) {
FreePolStr(pszFilterReference);
}
if (pszNegPolReference) {
FreePolStr(pszNegPolReference);
}
if (pIpsecNFAObject->pszIpsecFilterReference) {
pszIpsecFilterName = AllocPolStr(
pIpsecNFAObject->pszIpsecFilterReference
);
if (!pszIpsecFilterName) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
}
*ppszIpsecFilterName = pszIpsecFilterName;
dwError = ERROR_SUCCESS;
cleanup:
if (pszNFAString) {
FreePolMem(pszNFAString);
}
if (res) {
LdapMsgFree(res);
}
if (pIpsecNFAObject) {
FreeIpsecNFAObject(pIpsecNFAObject);
}
return(dwError);
error:
*ppszIpsecFilterName = NULL;
goto cleanup;
}
DWORD
GenerateSpecificNFAQuery(
GUID NFAIdentifier,
LPWSTR * ppszNFAString
)
{
DWORD dwError = ERROR_SUCCESS;
WCHAR szGuid[MAX_PATH];
WCHAR szCommonName[MAX_PATH];
LPWSTR pszStringUuid = NULL;
DWORD dwLength = 0;
LPWSTR pszNFAString = NULL;
szGuid[0] = L'\0';
szCommonName[0] = L'\0';
dwError = UuidToString(
&NFAIdentifier,
&pszStringUuid
);
BAIL_ON_WIN32_ERROR(dwError);
wcscpy(szGuid, L"{");
wcscat(szGuid, pszStringUuid);
wcscat(szGuid, L"}");
wcscpy(szCommonName, L"cn=ipsecNFA");
wcscat(szCommonName, szGuid);
//
// Compute Length of Buffer to be allocated
//
dwLength = wcslen(L"(&(objectclass=ipsecNFA)");
dwLength += wcslen(L"(");
dwLength += wcslen(szCommonName);
dwLength += wcslen(L"))");
pszNFAString = (LPWSTR) AllocPolMem((dwLength + 1)*sizeof(WCHAR));
if (!pszNFAString) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
wcscpy(pszNFAString, L"(&(objectclass=ipsecNFA)");
wcscat(pszNFAString, L"(");
wcscat(pszNFAString, szCommonName);
wcscat(pszNFAString, L"))");
*ppszNFAString = pszNFAString;
cleanup:
if (pszStringUuid) {
RpcStringFree(&pszStringUuid);
}
return(dwError);
error:
if (pszNFAString) {
FreePolMem(pszNFAString);
}
*ppszNFAString = NULL;
goto cleanup;
}
DWORD
DirGetNFAExistingNegPolRef(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
PIPSEC_NFA_DATA pIpsecNFAData,
LPWSTR * ppszIpsecNegPolName
)
{
DWORD dwError = 0;
LPWSTR pszNFAString = NULL;
LDAPMessage * res = NULL;
DWORD dwCount = 0;
LDAPMessage * e = NULL;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
LPWSTR pszIpsecNegPolName = NULL;
LPWSTR pszFilterReference = NULL;
LPWSTR pszNegPolReference = NULL;
dwError = GenerateSpecificNFAQuery(
pIpsecNFAData->NFAIdentifier,
&pszNFAString
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = LdapSearchST(
hLdapBindHandle,
pszIpsecRootContainer,
LDAP_SCOPE_ONELEVEL,
pszNFAString,
NFADNAttributes,
0,
NULL,
&res
);
BAIL_ON_WIN32_ERROR(dwError);
dwCount = LdapCountEntries(
hLdapBindHandle,
res
);
if (!dwCount) {
dwError = ERROR_DS_NO_ATTRIBUTE_OR_VALUE;
BAIL_ON_WIN32_ERROR(dwError);
}
dwError = LdapFirstEntry(
hLdapBindHandle,
res,
&e
);
BAIL_ON_WIN32_ERROR(dwError);
dwError =UnMarshallNFAObject(
hLdapBindHandle,
e,
&pIpsecNFAObject,
&pszFilterReference,
&pszNegPolReference
);
BAIL_ON_WIN32_ERROR(dwError);
if (pszFilterReference) {
FreePolStr(pszFilterReference);
}
if (pszNegPolReference) {
FreePolStr(pszNegPolReference);
}
pszIpsecNegPolName = AllocPolStr(
pIpsecNFAObject->pszIpsecNegPolReference
);
if (!pszIpsecNegPolName) {
dwError = ERROR_OUTOFMEMORY;
BAIL_ON_WIN32_ERROR(dwError);
}
*ppszIpsecNegPolName = pszIpsecNegPolName;
dwError = ERROR_SUCCESS;
cleanup:
if (pszNFAString) {
FreePolMem(pszNFAString);
}
if (res) {
LdapMsgFree(res);
}
if (pIpsecNFAObject) {
FreeIpsecNFAObject(pIpsecNFAObject);
}
return(dwError);
error:
*ppszIpsecNegPolName = NULL;
goto cleanup;
}
DWORD
DirGetNFAObject(
HLDAP hLdapBindHandle,
LPWSTR pszIpsecRootContainer,
GUID NFAGUID,
PIPSEC_NFA_OBJECT * ppIpsecNFAObject
)
{
DWORD dwError = 0;
LPWSTR pszNFAString = NULL;
LDAPMessage * res = NULL;
DWORD dwCount = 0;
LDAPMessage * e = NULL;
PIPSEC_NFA_OBJECT pIpsecNFAObject = NULL;
LPWSTR pszFilterReference = NULL;
LPWSTR pszNegPolReference = NULL;
dwError = GenerateSpecificNFAQuery(
NFAGUID,
&pszNFAString
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = LdapSearchST(
hLdapBindHandle,
pszIpsecRootContainer,
LDAP_SCOPE_ONELEVEL,
pszNFAString,
NFADNAttributes,
0,
NULL,
&res
);
BAIL_ON_WIN32_ERROR(dwError);
dwCount = LdapCountEntries(
hLdapBindHandle,
res
);
if (!dwCount) {
dwError = ERROR_DS_NO_ATTRIBUTE_OR_VALUE;
BAIL_ON_WIN32_ERROR(dwError);
}
dwError = LdapFirstEntry(
hLdapBindHandle,
res,
&e
);
BAIL_ON_WIN32_ERROR(dwError);
dwError = UnMarshallNFAObject(
hLdapBindHandle,
e,
&pIpsecNFAObject,
&pszFilterReference,
&pszNegPolReference
);
BAIL_ON_WIN32_ERROR(dwError);
if (pszFilterReference) {
FreePolStr(pszFilterReference);
}
if (pszNegPolReference) {
FreePolStr(pszNegPolReference);
}
*ppIpsecNFAObject = pIpsecNFAObject;
dwError = ERROR_SUCCESS;
cleanup:
if (pszNFAString) {
FreePolMem(pszNFAString);
}
if (res) {
LdapMsgFree(res);
}
return(dwError);
error:
if (pIpsecNFAObject) {
FreeIpsecNFAObject(
pIpsecNFAObject
);
}
*ppIpsecNFAObject = NULL;
goto cleanup;
}