windows-xp/Source/XPSP1/NT/ds/nw/rdr/ndsread.c

/*++

Copyright (c) 1995  Microsoft Corporation

Module Name:

    NdsRead.c

Abstract:

    This module implements the NDS read and request routines called
    by the redirector natively and the support routines that go with
    them.

Author:

    Cory West    [CoryWest]    23-Feb-1995

--*/

#include "Procs.h"

#define Dbg (DEBUG_TRACE_NDS)

#pragma alloc_text( PAGE, NdsResolveNameKm )
#pragma alloc_text( PAGE, NdsReadStringAttribute )
#pragma alloc_text( PAGE, NdsReadAttributesKm )
#pragma alloc_text( PAGE, NdsCompletionCodetoNtStatus )
#pragma alloc_text( PAGE, FreeNdsContext )
#pragma alloc_text( PAGE, NdsPing )
#pragma alloc_text( PAGE, NdsGetUserName )
#pragma alloc_text( PAGE, NdsGetServerBasicName )
#pragma alloc_text( PAGE, NdsGetServerName )
#pragma alloc_text( PAGE, NdsReadPublicKey )
#pragma alloc_text( PAGE, NdsCheckGroupMembership )
#pragma alloc_text( PAGE, NdsAllocateLockedBuffer )
#pragma alloc_text( PAGE, NdsFreeLockedBuffer )

NTSTATUS
NdsResolveNameKm (
    PIRP_CONTEXT       pIrpContext,
    IN PUNICODE_STRING puObjectName,
    OUT DWORD          *dwObjectId,
    BOOLEAN            AllowDsJump,
    DWORD              dwFlags
)
/*++

Description:

    This is a wrapper routine to the browser routine NdsResolveName
    for kernel components that need to resolve NDS names.

Arguments:

    pIrpContext  - must point to the dir server that we should query
    puObjectName - what we want to resolve
    *dwObjectId  - where to report the result
    AllowDsJump  - if we are referred to another dir server, can we jump?

--*/
{

    NTSTATUS Status;

    PNWR_NDS_REQUEST_PACKET Rrp;

    PNDS_RESPONSE_RESOLVE_NAME Rsp;
    LOCKED_BUFFER NdsRequestBuffer;

    PSCB Scb, OldScb;
    UNICODE_STRING ReferredServer;
    BOOL fReleasedCredentials = FALSE;
    PLOGON pLogon;

    PAGED_CODE();

    //
    // Note: If you are holding the credential resource coming in, then you 
    // need to be at the head of the queue.
    //

    //
    // Prepare the request and response buffers.
    //

    Rrp = ALLOCATE_POOL( PagedPool, NDS_BUFFER_SIZE );

    if ( !Rrp ) {
       return STATUS_INSUFFICIENT_RESOURCES;
    }

    Status = NdsAllocateLockedBuffer( &NdsRequestBuffer, NDS_BUFFER_SIZE );

    if ( !NT_SUCCESS( Status ) ) {
        FREE_POOL( Rrp );
        return Status;
    }

    //
    // Set up the request packet.
    //

    RtlZeroMemory( Rrp, NDS_BUFFER_SIZE );

    Rrp->Version = 0;
    Rrp->Parameters.ResolveName.ObjectNameLength = puObjectName->Length;
    Rrp->Parameters.ResolveName.ResolverFlags = dwFlags;

    RtlCopyMemory( Rrp->Parameters.ResolveName.ObjectName,
                   puObjectName->Buffer,
                   puObjectName->Length );

    //
    // Do the resolve.
    //

    Status = NdsResolveName( pIrpContext, Rrp, NDS_BUFFER_SIZE, &NdsRequestBuffer );

    if ( !NT_SUCCESS( Status ) ) {
        goto ExitWithCleanup;
    }

    Status = NdsCompletionCodetoNtStatus( &NdsRequestBuffer );

    if ( !NT_SUCCESS( Status ) ) {
        goto ExitWithCleanup;
    }

    Rsp = ( PNDS_RESPONSE_RESOLVE_NAME ) NdsRequestBuffer.pRecvBufferVa;

    if ( ( Rsp->RemoteEntry == RESOLVE_NAME_REFER_REMOTE ) &&
         ( AllowDsJump ) ) {

        //
        // We need to queue this request to another server
        // since this server doesn't have any details about
        // the object.
        //

        ReferredServer.Length = (USHORT) Rsp->ServerNameLength;
        ReferredServer.MaximumLength = ReferredServer.Length;
        ReferredServer.Buffer = Rsp->ReferredServer;

        OldScb = pIrpContext->pScb;
        ASSERT( OldScb != NULL );

        //
        // If you hold the credential lock, this is the time to let go of it or
        // we might deadlock. We can reclaim it after we are at the head of the
        // new SCB queue
        //

        if (BooleanFlagOn (pIrpContext->Flags, IRP_FLAG_HAS_CREDENTIAL_LOCK)) {

           PSCB pScb;

           pScb = pIrpContext->pNpScb->pScb;

           NwAcquireExclusiveRcb( &NwRcb, TRUE );
           pLogon = FindUser( &pScb->UserUid, FALSE );
           NwReleaseRcb( &NwRcb );

           NwReleaseCredList( pLogon, pIrpContext );
           fReleasedCredentials = TRUE;
        }

        NwDequeueIrpContext( pIrpContext, FALSE );

        Status = CreateScb( &Scb,
                            pIrpContext,
                            &ReferredServer,
                            NULL,
                            NULL,
                            NULL,
                            TRUE,
                            FALSE );

        if (fReleasedCredentials == TRUE) {

           //
           // You have to be at the head of the queue before you 
           // grab the resource
           //

           if ( pIrpContext->pNpScb->Requests.Flink != &pIrpContext->NextRequest )
           {
              NwAppendToQueueAndWait( pIrpContext );
           }
           NwAcquireExclusiveCredList( pLogon, pIrpContext );
        }

        if ( !NT_SUCCESS( Status ) ) {
            goto ExitWithCleanup;
        }

        //
        // Since we've jumped servers, dereference the old host
        // server.  The new one was referenced in CreateScb().
        //

        NwDereferenceScb( OldScb->pNpScb );

    }

    *dwObjectId = Rsp->EntryId;

ExitWithCleanup:

    NdsFreeLockedBuffer( &NdsRequestBuffer );
    FREE_POOL( Rrp );
    return Status;

}

NTSTATUS
NdsReadStringAttribute(
    PIRP_CONTEXT        pIrpContext,
    IN DWORD            dwObjectId,
    IN PUNICODE_STRING  puAttributeName,
    OUT PUNICODE_STRING puAttributeVal
)
/*++

Description:

    This is a wrapper routine to the browser routine NdsReadAttributes
    for kernel components that need to read NDS string attributes.

Arguments:

    pIrpContext     - must point to the dir server that we should query
    dwObjectId      - oid of the object to query
    puAttributeName - attribute that we want
    puAttributeVal  - value of the attribute

--*/
{

    NTSTATUS Status;
    PNWR_NDS_REQUEST_PACKET Rrp;
    DWORD dwRequestSize, dwAttributeCount;
    LOCKED_BUFFER NdsRequest;

    PAGED_CODE();

    //
    // Set up the request and response buffers.
    //

    dwRequestSize = sizeof( NWR_NDS_REQUEST_PACKET ) + puAttributeName->Length;

    Rrp = ( PNWR_NDS_REQUEST_PACKET ) ALLOCATE_POOL( PagedPool, dwRequestSize );

    if ( !Rrp ) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );

    if ( !NT_SUCCESS( Status ) ) {
        FREE_POOL( Rrp );
        return Status;
    }

    //
    // Prepare the request packet.
    //

    RtlZeroMemory( (BYTE *)Rrp, dwRequestSize );

    Rrp->Version = 0;
    Rrp->Parameters.ReadAttribute.ObjectId = dwObjectId;
    Rrp->Parameters.ReadAttribute.IterHandle = DUMMY_ITER_HANDLE;
    Rrp->Parameters.ReadAttribute.AttributeNameLength = puAttributeName->Length;

    RtlCopyMemory( Rrp->Parameters.ReadAttribute.AttributeName,
                   puAttributeName->Buffer,
                   puAttributeName->Length );

    //
    // Make the request.
    //

    Status = NdsReadAttributes( pIrpContext, Rrp, NDS_BUFFER_SIZE, &NdsRequest );

    if ( !NT_SUCCESS( Status ) ) {
        goto ExitWithCleanup;
    }

    //
    // Dig out the string attribute and return it.
    //

    Status = ParseResponse( NULL,
                            NdsRequest.pRecvBufferVa,
                            NdsRequest.dwBytesWritten,
                            "G___D_S_T",
                            sizeof( DWORD ),   // completion code
                            sizeof( DWORD ),   // iter handle
                            sizeof( DWORD ),   // info type
                            &dwAttributeCount, // attribute count
                            sizeof( DWORD ),   // syntax id
                            NULL,              // attribute name
                            sizeof( DWORD ),   // number of values
                            puAttributeVal );  // attribute string

    if ( !NT_SUCCESS( Status ) ) {
        goto ExitWithCleanup;
    }


ExitWithCleanup:

    FREE_POOL( Rrp );
    NdsFreeLockedBuffer( &NdsRequest );
    return Status;

}

NTSTATUS
NdsReadAttributesKm(
    PIRP_CONTEXT pIrpContext,
    IN DWORD dwObjectId,
    IN PUNICODE_STRING puAttributeName,
    IN OUT PLOCKED_BUFFER pNdsRequest
)
/*++

Description:

    This is a wrapper routine to the browser routine NdsReadAttributes
    for kernel components that need to read NDS string attributes and
    get back the raw response.

Arguments:

    pIrpContext     - must point to the dir server that we should query
    dwObjectId      - oid of the object to query
    puAttributeName - attribute that we want
    puAttributeVal  - value of the attribute

--*/
{

    NTSTATUS Status;
    PNWR_NDS_REQUEST_PACKET Rrp;
    DWORD dwRequestSize;

    PAGED_CODE();

    //
    // Set up the request.
    //

    dwRequestSize = sizeof( NWR_NDS_REQUEST_PACKET ) + puAttributeName->Length;

    Rrp = ( PNWR_NDS_REQUEST_PACKET ) ALLOCATE_POOL( PagedPool, dwRequestSize );

    if ( !Rrp ) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    RtlZeroMemory( (BYTE *)Rrp, dwRequestSize );

    Rrp->Version = 0;
    Rrp->Parameters.ReadAttribute.ObjectId = dwObjectId;
    Rrp->Parameters.ReadAttribute.IterHandle = DUMMY_ITER_HANDLE;
    Rrp->Parameters.ReadAttribute.AttributeNameLength = puAttributeName->Length;

    RtlCopyMemory( Rrp->Parameters.ReadAttribute.AttributeName,
                   puAttributeName->Buffer,
                   puAttributeName->Length );

    Status = NdsReadAttributes( pIrpContext, Rrp, NDS_BUFFER_SIZE, pNdsRequest );

    FREE_POOL( Rrp );
    return Status;

}

//
// Frosting and other helper wrapper functions.
//

NTSTATUS
NdsCompletionCodetoNtStatus(
    IN PLOCKED_BUFFER pLockedBuffer
)
/*+++

Description:

   Translates the completion code of an NDS transaction into
   an NTSTATUS error code.

Arguments:

   pLockedBuffer - describes the locked reply buffer that contains
                   the response.

---*/
{
    NTSTATUS Status;

    PAGED_CODE();

    //
    // Try to get the completion code from the user's buffer.
    //

    try {

        Status = *((DWORD *)pLockedBuffer->pRecvBufferVa);

    } except ( EXCEPTION_EXECUTE_HANDLER ) {

        return STATUS_UNSUCCESSFUL;

    }

    //
    // Decode it.
    //

    if ( Status != STATUS_SUCCESS ) {

        DebugTrace( 0, Dbg, "NDS Error Code: %08lx\n", Status );

        switch ( Status ) {

            case -601:                   // No such entry.
            case -602:                   // No such value.
            case -603:                   // No such attribute.
            case -607:                   // Illegal attribute.
            case -610:                   // Illegal ds name.

                Status = STATUS_BAD_NETWORK_PATH;
                break;

            //
            // These may only come on a VERIFY_PASSWORD verb, which
            // we do not support.  I'm not sure, though.
            //

            case -216:                   // Password too short.
            case -215:                   // Duplicate password.

                Status = STATUS_PASSWORD_RESTRICTION;
                break;

            case -222:                   // Expired password (and no grace logins left).

                Status = STATUS_PASSWORD_EXPIRED;
                break;

            case -223:                   // Expired password; this is a successful grace login.

               Status = NWRDR_PASSWORD_HAS_EXPIRED;
               break;

            case -639:                   // Incomplete authentication.
            case -672:                   // No access.
            case -677:                   // Invalid identity.
            case -669:                   // Wrong password.

                Status = STATUS_WRONG_PASSWORD;
                break;

            case -197:                   // Intruder lockout active.
            case -220:                   // Account expired or disabled.

                Status = STATUS_ACCOUNT_DISABLED;
                break;

            case -218:                   // Login time restrictions.

                Status = STATUS_LOGIN_TIME_RESTRICTION;
                break;

            case -217:                   // Maximum logins exceeded.

                Status = STATUS_CONNECTION_COUNT_LIMIT;
                break;

            case -630:                   // We get this back for bogus resolve
                                         // name calls.  Glenn prefers this error.

                Status = STATUS_OBJECT_NAME_NOT_FOUND;
                break;

            default:

                Status = STATUS_UNSUCCESSFUL;
        }

    }

    return Status;
}

VOID
FreeNdsContext(
    IN PNDS_SECURITY_CONTEXT pNdsSecContext
)
/*++

Routine Description:

    Free the referenced NDS context.

--*/
{
    PAGED_CODE();

    //
    // Make sure this is a valid thing to be mucking with.
    //

    if ( !pNdsSecContext ||
         pNdsSecContext->ntc != NW_NTC_NDS_CREDENTIAL ) {

        DebugTrace( 0, Dbg, "FreeNdsContext didn't get an NDS context.\n", 0 );
        return;
    }

    if ( pNdsSecContext->Credential ) {
        FREE_POOL( pNdsSecContext->Credential );
    }

    if ( pNdsSecContext->Signature ) {
        FREE_POOL( pNdsSecContext->Signature );
    }

    if ( pNdsSecContext->PublicNdsKey ) {
        FREE_POOL( pNdsSecContext->PublicNdsKey );
    }

    if ( pNdsSecContext->Password.Buffer ) {
        FREE_POOL( pNdsSecContext->Password.Buffer );
    }

    DebugTrace( 0, Dbg, "Freeing NDS security context at 0x%08lx\n", pNdsSecContext );

    FREE_POOL( pNdsSecContext );

    return;
}

VOID
NdsPing(
    IN PIRP_CONTEXT pIrpContext,
    IN PSCB pScb
)
/*++

Routine Description:

    Examine the server for NDS support and record the NDS tree
    name in the SCB for later reference.

Routine Arguments:

    pIrpContext    - A pointer to the IRP context for this transaction.
    pScb           - The SCB for the server.

Return Value:

    NTSTATUS - Status of the operation.

--*/
{

   NTSTATUS Status;

   OEM_STRING OemTreeName;
   BYTE OemBuffer[NDS_TREE_NAME_LEN];

   UNICODE_STRING TreeName;
   WCHAR WBuffer[NDS_TREE_NAME_LEN];

   UNICODE_STRING CredentialName;

   PAGED_CODE();

   pScb->NdsTreeName.Length = 0;

   OemTreeName.Length = NDS_TREE_NAME_LEN;
   OemTreeName.MaximumLength = NDS_TREE_NAME_LEN;
   OemTreeName.Buffer = OemBuffer;

   Status = ExchangeWithWait( pIrpContext,
                              SynchronousResponseCallback,
                              "N",
                              NDS_REQUEST,         // NDS Function 104
                              NDS_PING );          // NDS Subfunction 1

   if ( !NT_SUCCESS( Status ) ) {
       return;
   }

   //
   // Pull out the padded NDS name
   //

   Status = ParseResponse( pIrpContext,
                           pIrpContext->rsp,
                           pIrpContext->ResponseLength,
                           "N_r",
                           2 * sizeof( DWORD ),
                           OemBuffer,
                           NDS_TREE_NAME_LEN );

   if ( !NT_SUCCESS( Status ) ) {
       return;
   }

   //
   //  Strip off the padding and convert to unicode.
   //

   while ( OemTreeName.Length > 0 &&
           OemBuffer[OemTreeName.Length - 1] == '_' ) {
       OemTreeName.Length--;
   }

   //
   // Copy or munge the tree name, depending on the create type.
   //

   if ( pIrpContext->Specific.Create.fExCredentialCreate ) {

       TreeName.Length = 0;
       TreeName.MaximumLength = sizeof( WBuffer );
       TreeName.Buffer = WBuffer;

       Status = RtlOemStringToUnicodeString( &TreeName,
                                             &OemTreeName,
                                             FALSE );

       if ( !NT_SUCCESS( Status ) ) {
           pScb->NdsTreeName.Length = 0;
           return;
       }

       Status = BuildExCredentialServerName( &TreeName,
                                             pIrpContext->Specific.Create.puCredentialName,
                                             &CredentialName );

       if ( !NT_SUCCESS( Status ) ) {
           return;
       }

       RtlCopyUnicodeString( &pScb->NdsTreeName, &CredentialName );

       FREE_POOL( CredentialName.Buffer );

   } else {

       Status = RtlOemStringToUnicodeString( &pScb->NdsTreeName,
                                             &OemTreeName,
                                             FALSE );

       if ( !NT_SUCCESS( Status ) ) {
           pScb->NdsTreeName.Length = 0;
           return;
       }

   }

   DebugTrace( 0, Dbg, "Nds Ping: Tree is ""%wZ""\n", &pScb->NdsTreeName);
   return;

}

NTSTATUS
NdsGetUserName(
    IN PIRP_CONTEXT pIrpContext,
    IN DWORD dwUserOid,
    OUT PUNICODE_STRING puUserName
)
/*++

Description:

    Get the fully distinguished name of the user referred to
    by the provided oid.

--*/
{
    NTSTATUS Status;
    LOCKED_BUFFER NdsRequest;

    PAGED_CODE();

    //
    // Allocate buffer space.
    //

    Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );

    if ( !NT_SUCCESS( Status ) ) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    //
    // Make the request.
    //

    Status = FragExWithWait( pIrpContext,
                             NDSV_READ_ENTRY_INFO,
                             &NdsRequest,
                             "DD",
                             0,
                             dwUserOid );

    if ( !NT_SUCCESS(Status) ) {
        goto ExitWithCleanup;
    }

    Status = NdsCompletionCodetoNtStatus( &NdsRequest );

    if ( !NT_SUCCESS( Status ) ) {
        goto ExitWithCleanup;
    }

    Status = ParseResponse( NULL,
                            NdsRequest.pRecvBufferVa,
                            NdsRequest.dwBytesWritten,
                            "G_St",
                            sizeof( NDS_RESPONSE_GET_OBJECT_INFO ),
                            NULL,
                            puUserName );

    //
    // We either got it or we didn't.
    //

ExitWithCleanup:

    NdsFreeLockedBuffer( &NdsRequest );
    return Status;

}

NTSTATUS
NdsGetServerBasicName(
    IN PUNICODE_STRING pServerX500Name,
    IN OUT PUNICODE_STRING pServerName
) {

   //
   // Dig out the first component of the server's X.500 name.
   // We count on the X500 prefix for the server object being "CN=",
   // which might be unwise.
   //

   USHORT usPrefixSize, usSrv;

   PAGED_CODE();

   usPrefixSize = sizeof( "CN=" ) - sizeof( "" );
   usSrv = 0;

   if ( ( pServerX500Name->Buffer[0] != L'C' ) ||
        ( pServerX500Name->Buffer[1] != L'N' ) ||
        ( pServerX500Name->Buffer[2] != L'=' ) ) {

       DebugTrace( 0, Dbg, "NdsGetServerBasicName: Bad prefix.\n", 0 );
       return STATUS_INVALID_PARAMETER;
   }

   if ( pServerX500Name->Length <= usPrefixSize ) {

      DebugTrace( 0, Dbg, "NdsGetServerBasicName: Bad string length.\n", 0 );
      return STATUS_INVALID_PARAMETER;
   }

   pServerName->Buffer = pServerX500Name->Buffer + usPrefixSize;
   pServerName->Length = 0;

   while ( ( usSrv < MAX_SERVER_NAME_LENGTH ) &&
           ( pServerName->Buffer[usSrv++] != L'.' ) ) {

       pServerName->Length += sizeof( WCHAR );
   }

   if ( usSrv == MAX_SERVER_NAME_LENGTH ) {

       DebugTrace( 0, Dbg, "NdsGetServerBasicName: Bad server name response.\n", 0 );
       return STATUS_BAD_NETWORK_PATH;
   }

   pServerName->MaximumLength = pServerName->Length;
   return STATUS_SUCCESS;

}

NTSTATUS
NdsGetServerName(
    IN PIRP_CONTEXT pIrpContext,
    OUT PUNICODE_STRING puServerName
)
/*++

Description:

    Get the fully distinguished name of the server that we
    are connected to.

--*/
{

    NTSTATUS Status;
    LOCKED_BUFFER NdsRequest;

    PAGED_CODE();

    //
    // Make the request.
    //

    Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );

    if ( !NT_SUCCESS( Status ) ) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    Status = FragExWithWait( pIrpContext,
                             NDSV_GET_SERVER_ADDRESS,
                             &NdsRequest,
                             NULL );

    if ( !NT_SUCCESS(Status) ) {
        goto ExitWithCleanup;
    }

    Status = NdsCompletionCodetoNtStatus( &NdsRequest );

    if ( !NT_SUCCESS( Status ) ) {
        goto ExitWithCleanup;
    }

    //
    // Get the server name from the response.
    //

    Status = ParseResponse( NULL,
                            NdsRequest.pRecvBufferVa,
                            NdsRequest.dwBytesWritten,
                            "G_T",
                            sizeof( DWORD ),
                            puServerName );

    if ( !NT_SUCCESS(Status) ) {
       goto ExitWithCleanup;
    }

ExitWithCleanup:

    NdsFreeLockedBuffer( &NdsRequest );
    return Status;

}

NTSTATUS
NdsReadPublicKey(
    IN PIRP_CONTEXT pIrpContext,
    IN DWORD        dwEntryId,
    OUT BYTE        *pPubKeyVal,
    IN OUT DWORD    *pPubKeyLen
)
/*++

Routine Description:

    Read the public key referenced by the given entry id.

Routine Arguments:

    pIrpContext    - The IRP context for this connection.
    dwEntryId      - The entry id of the key.
    pPubKeyVal     - The destination buffer for the public key.
    pPubKeyLen     - The length of the public key destination buffer.

Return Value:

    The length of the key.

--*/
{
    NTSTATUS Status;

    LOCKED_BUFFER NdsRequest;

    PNWR_NDS_REQUEST_PACKET Rrp;

    DWORD dwAttrNameLen, dwAttrLen, dwRcvLen, dwNumEntries;
    BYTE *pRcv;

    PAGED_CODE();

    //
    // Allocate and zero send and receive space.
    //

    Rrp = ALLOCATE_POOL( PagedPool, NDS_BUFFER_SIZE );

    if ( !Rrp ) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );

    if ( !NT_SUCCESS( Status ) ) {
        FREE_POOL( Rrp );
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    //
    // Fill in and prepare the request buffer.
    //

    RtlZeroMemory( Rrp, NDS_BUFFER_SIZE );

    Rrp->Version = 0;
    Rrp->Parameters.ReadAttribute.ObjectId = dwEntryId;
    Rrp->Parameters.ReadAttribute.IterHandle = DUMMY_ITER_HANDLE;
    Rrp->Parameters.ReadAttribute.AttributeNameLength =
        sizeof( PUBLIC_KEY_ATTRIBUTE ) - sizeof( WCHAR );

    RtlCopyMemory( Rrp->Parameters.ReadAttribute.AttributeName,
                   PUBLIC_KEY_ATTRIBUTE,
                   sizeof( PUBLIC_KEY_ATTRIBUTE ) - sizeof( WCHAR ) );

    //
    // Do the exchange.
    //

    Status = NdsReadAttributes( pIrpContext,
                                Rrp,
                                NDS_BUFFER_SIZE,
                                &NdsRequest );

    if ( !NT_SUCCESS( Status ) ) {
        goto ExitWithCleanup;
    }

    //
    // Skip over the attribute header and name.
    //

    Status = ParseResponse( NULL,
                            NdsRequest.pRecvBufferVa,
                            NdsRequest.dwBytesWritten,
                            "G_D",
                            5 * sizeof( DWORD ),
                            &dwAttrNameLen );

    if ( !NT_SUCCESS( Status ) ) {

        Status = STATUS_UNSUCCESSFUL;
        goto ExitWithCleanup;
    }

    //
    // Skip over the part we've parsed and pull out the attribute.
    //

    pRcv = (PBYTE)NdsRequest.pRecvBufferVa +
               ( 6 * sizeof( DWORD ) ) +
               ROUNDUP4(dwAttrNameLen);

    dwRcvLen = NdsRequest.dwBytesWritten -
                   ( 6 * sizeof( DWORD ) ) +
                   ROUNDUP4(dwAttrNameLen);

    Status = ParseResponse( NULL,
                            pRcv,
                            dwRcvLen,
                            "GDD",
                            &dwNumEntries,
                            &dwAttrLen );

    if ( !NT_SUCCESS( Status ) ||
         dwNumEntries != 1 ) {

        Status = STATUS_UNSUCCESSFUL;
        goto ExitWithCleanup;
    }

    DebugTrace( 0, Dbg, "Public Key Length: %d\n", dwAttrLen );
    pRcv += ( 2 * sizeof( DWORD ) );

    if ( dwAttrLen <= *pPubKeyLen ) {

        RtlCopyMemory( pPubKeyVal, pRcv, dwAttrLen );
        *pPubKeyLen = dwAttrLen;
        Status = STATUS_SUCCESS;

    } else {

        DebugTrace( 0, Dbg, "Public key buffer is too small.\n", 0 );
        Status = STATUS_BUFFER_TOO_SMALL;
    }

ExitWithCleanup:

    NdsFreeLockedBuffer( &NdsRequest );
    FREE_POOL( Rrp );
    return Status;

}

NTSTATUS
NdsCheckGroupMembership(
    PIRP_CONTEXT pIrpContext,
    DWORD dwUserOid,
    PUNICODE_STRING puGroupName
) {

    NTSTATUS Status;
    UNICODE_STRING GroupListAttribute;
    LOCKED_BUFFER NdsRequest;

    PNDS_RESPONSE_READ_ATTRIBUTE pAttributeResponse;
    PNDS_ATTRIBUTE pAttribute;
    PBYTE pAttribData;
    DWORD dwAttribLength, dwCurrentLength;
    DWORD dwNumAttributes, dwCurrentAttribute;
    UNICODE_STRING Group;
    USHORT GroupLength;

    PAGED_CODE();

    RtlInitUnicodeString( &GroupListAttribute, GROUPS_ATTRIBUTE );

    Status = NdsAllocateLockedBuffer( &NdsRequest, NDS_BUFFER_SIZE );

    if ( !NT_SUCCESS( Status ) ) {
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    Status = NdsReadAttributesKm( pIrpContext,
                                  dwUserOid,
                                  &GroupListAttribute,
                                  &NdsRequest );

    if ( !NT_SUCCESS( Status ) ) {
        goto ExitWithCleanup;
    }

    pAttributeResponse = ( PNDS_RESPONSE_READ_ATTRIBUTE ) NdsRequest.pRecvBufferVa;
    ASSERT( pAttributeResponse->NumAttributes > 0 );

    //
    // Skip over the response header and walk down the attribute
    // until we get to the data.  This is a little clunky.
    //

    pAttribute = ( PNDS_ATTRIBUTE ) ( pAttributeResponse + 1 );
    dwCurrentLength = sizeof( NDS_RESPONSE_READ_ATTRIBUTE );

    dwAttribLength = ROUNDUP4( pAttribute->AttribNameLength );
    dwAttribLength += ( 2 * sizeof( DWORD ) );

    //
    // Make sure we don't walk past the end of the buffer because
    // of a bad packet from the server.
    //

    if ( ( dwCurrentLength + dwAttribLength ) > NDS_BUFFER_SIZE ) {
        return STATUS_UNSUCCESSFUL;
    }

    pAttribData = ( ( BYTE * )pAttribute ) + dwAttribLength;
    dwCurrentLength += dwAttribLength;

    //
    // This is DWORD aligned for four byte DWORDs.
    //

    if ( ( NDS_BUFFER_SIZE - dwCurrentLength ) < sizeof( DWORD ) ) {
        return STATUS_UNSUCCESSFUL;
    }

    dwNumAttributes = * ( ( DWORD * ) pAttribData );

    if ( dwNumAttributes == 0 ) {
        Status = STATUS_UNSUCCESSFUL;
        goto ExitWithCleanup;
    }

    //
    // Each attribute is an NDS string DWORD aligned.
    //

    Status = STATUS_UNSUCCESSFUL;

    pAttribData += sizeof( DWORD );
    dwCurrentLength += sizeof( DWORD );

    for ( dwCurrentAttribute = 0;
          dwCurrentAttribute < dwNumAttributes ;
          dwCurrentAttribute++ ) {

        Group.Length = Group.MaximumLength =
            ( USHORT )( * ( ( DWORD * ) pAttribData ) ) - sizeof( WCHAR );
        Group.Buffer = ( PWCHAR ) ( pAttribData + sizeof( DWORD ) );

        if ( ( Group.Length + dwCurrentLength ) > NDS_BUFFER_SIZE ) {
            return STATUS_UNSUCCESSFUL;
        }

        //
        // Strip off the X500 prefix and the context.
        //

        GroupLength = 0;

        while ( GroupLength < ( Group.Length / sizeof( WCHAR ) ) ) {

            if ( Group.Buffer[GroupLength++] == L'=' ) {

               Group.Buffer += 1;
               Group.Length -= sizeof( WCHAR );
               Group.MaximumLength -= sizeof( WCHAR );

               GroupLength = ( Group.Length / sizeof( WCHAR ) );
            }

            Group.Buffer += 1;
            Group.Length -= sizeof( WCHAR );
            Group.MaximumLength -= sizeof( WCHAR );
        }

        GroupLength = 0;

        while ( GroupLength < ( Group.Length / sizeof( WCHAR ) ) ) {

            if ( Group.Buffer[GroupLength++] == L'.' ) {
                Group.Length = ( GroupLength - 1 ) * sizeof( WCHAR );
                Group.MaximumLength = Group.Length;
                break;
            }
        }

        if ( RtlEqualUnicodeString( puGroupName, &Group, TRUE ) ) {

            DebugTrace( 0, Dbg, "Group check for %wZ succeeded.\n", &Group );
            Status = STATUS_SUCCESS;
            goto ExitWithCleanup;
        }

        //
        // Dig out the attribute size and process the next entry.
        //

        dwAttribLength = ROUNDUP4( * ( ( DWORD * ) pAttribData ) );
        dwAttribLength += sizeof( DWORD );
        pAttribData += dwAttribLength;
        dwCurrentLength += dwAttribLength;

    }

ExitWithCleanup:

    NdsFreeLockedBuffer( &NdsRequest );
    return Status;
}


NTSTATUS
NdsAllocateLockedBuffer(
    PLOCKED_BUFFER NdsRequest,
    DWORD BufferSize
)
/*++

Description:

    Allocate a buffer for io.  Lock it down and fill in the
    buffer data structure that we pass around.

--*/
{

    PAGED_CODE();

    NdsRequest->pRecvBufferVa = ALLOCATE_POOL( PagedPool, BufferSize );

    if ( !NdsRequest->pRecvBufferVa ) {
        DebugTrace( 0, Dbg, "Couldn't allocate locked io buffer.\n", 0 );
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    NdsRequest->dwRecvLen = BufferSize;
    NdsRequest->pRecvMdl = ALLOCATE_MDL( NdsRequest->pRecvBufferVa,
                                         BufferSize,
                                         FALSE,
                                         FALSE,
                                         NULL );

    if ( !NdsRequest->pRecvMdl ) {
        DebugTrace( 0, Dbg, "Couldn't allocate mdl for locked io buffer.\n", 0 );
        FREE_POOL( NdsRequest->pRecvBufferVa );
        return STATUS_INSUFFICIENT_RESOURCES;
    }

    MmProbeAndLockPages( NdsRequest->pRecvMdl,
                         KernelMode,
                         IoWriteAccess );

    return STATUS_SUCCESS;

}

NTSTATUS
NdsFreeLockedBuffer(
    PLOCKED_BUFFER NdsRequest
)
/*++

Description:

    Free a buffer allocated for io.

--*/
{

    PAGED_CODE();

    MmUnlockPages( NdsRequest->pRecvMdl );
    FREE_MDL( NdsRequest->pRecvMdl );
    FREE_POOL( NdsRequest->pRecvBufferVa );
    return STATUS_SUCCESS;

}