s4:rpc_server: Find association groups through context callbacks

Split the association group management from the server code, the s3 and
s4 implementation will handle differently.

Signed-off-by: Samuel Cabrero <scabrero@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/source4/rpc_server/dcerpc_server.c b/source4/rpc_server/dcerpc_server.c
index 39a25241316405e972e7942b13ac96edffe969cd..e125f61cdee6638a7f2e8a713b6ea50858a3d887 100644 (file)
--- a/source4/rpc_server/dcerpc_server.c
+++ b/source4/rpc_server/dcerpc_server.c
@@ -127,6 +127,52 @@ static struct dcesrv_assoc_group *dcesrv_assoc_group_new(struct dcesrv_connectio
        return assoc_group;
 }
 
+NTSTATUS dcesrv_assoc_group_find(struct dcesrv_call_state *call)
+{
+       /*
+         if provided, check the assoc_group is valid
+        */
+       if (call->pkt.u.bind.assoc_group_id != 0) {
+               call->conn->assoc_group =
+                       dcesrv_assoc_group_reference(call->conn,
+                                       call->pkt.u.bind.assoc_group_id);
+       } else {
+               call->conn->assoc_group = dcesrv_assoc_group_new(call->conn);
+       }
+
+       /*
+        * The NETLOGON server does not use handles and so
+        * there is no need to support association groups, but
+        * we need to give back a number regardless.
+        *
+        * We have to do this when it is not run as a single process,
+        * because then it can't see the other valid association
+        * groups.  We handle this genericly for all endpoints not
+        * running in single process mode.
+        *
+        * We know which endpoint we are on even before checking the
+        * iface UUID, so for simplicity we enforce the same policy
+        * for all interfaces on the endpoint.
+        *
+        * This means that where NETLOGON
+        * shares an endpoint (such as ncalrpc or of 'lsa over
+        * netlogon' is set) we will still check association groups.
+        *
+        */
+
+       if (call->conn->assoc_group == NULL &&
+           !call->conn->endpoint->use_single_process) {
+               call->conn->assoc_group
+                       = dcesrv_assoc_group_new(call->conn);
+       }
+
+       if (call->conn->assoc_group == NULL) {
+               /* TODO Return correct status */
+               return NT_STATUS_UNSUCCESSFUL;
+       }
+
+       return NT_STATUS_OK;
+}
 
 /*
   see if two endpoints match
@@ -1032,42 +1078,10 @@ static NTSTATUS dcesrv_bind(struct dcesrv_call_state *call)
        call->conn->max_recv_frag = max_rep;
        call->conn->max_xmit_frag = max_rep;
 
-       /*
-         if provided, check the assoc_group is valid
-        */
-       if (call->pkt.u.bind.assoc_group_id != 0) {
-               call->conn->assoc_group = dcesrv_assoc_group_reference(call->conn,
-                                                                      call->pkt.u.bind.assoc_group_id);
-       } else {
-               call->conn->assoc_group = dcesrv_assoc_group_new(call->conn);
-       }
-
-       /*
-        * The NETLOGON server does not use handles and so
-        * there is no need to support association groups, but
-        * we need to give back a number regardless.
-        *
-        * We have to do this when it is not run as a single process,
-        * because then it can't see the other valid association
-        * groups.  We handle this genericly for all endpoints not
-        * running in single process mode.
-        *
-        * We know which endpoint we are on even before checking the
-        * iface UUID, so for simplicity we enforce the same policy
-        * for all interfaces on the endpoint.
-        *
-        * This means that where NETLOGON
-        * shares an endpoint (such as ncalrpc or of 'lsa over
-        * netlogon' is set) we will still check association groups.
-        *
-        */
-
-       if (call->conn->assoc_group == NULL &&
-           !call->conn->endpoint->use_single_process) {
-               call->conn->assoc_group
-                       = dcesrv_assoc_group_new(call->conn);
-       }
-       if (call->conn->assoc_group == NULL) {
+       status = call->conn->dce_ctx->callbacks.assoc_group.find(call);
+       if (!NT_STATUS_IS_OK(status)) {
+               DBG_NOTICE("Failed to find assoc_group 0x%08x: %s\n",
+                          call->pkt.u.bind.assoc_group_id, nt_errstr(status));
                return dcesrv_bind_nak(call, 0);
        }
 

diff --git a/source4/rpc_server/dcerpc_server.h b/source4/rpc_server/dcerpc_server.h
index 18956524f6fb78e398e78afb80df3c4378fc4ab7..3fc32750b44483b8132ba0311d12855b7f4fafd7 100644 (file)
--- a/source4/rpc_server/dcerpc_server.h
+++ b/source4/rpc_server/dcerpc_server.h
@@ -373,6 +373,9 @@ struct dcesrv_context_callbacks {
                                        struct dcesrv_call_state *call,
                                        struct gensec_security **out);
        } auth;
+       struct {
+               NTSTATUS (*find)(struct dcesrv_call_state *);
+       } assoc_group;
 };
 
 /* server-wide context information for the dcerpc server */

diff --git a/source4/rpc_server/service_rpc.c b/source4/rpc_server/service_rpc.c
index 778d7b964a9c5f478712f6389e215671508c48f0..ef4bfab237aac89b9ed965bb953ee8523cc3ccde 100644 (file)
--- a/source4/rpc_server/service_rpc.c
+++ b/source4/rpc_server/service_rpc.c
@@ -43,6 +43,7 @@
 struct dcesrv_context_callbacks srv_callbacks = {
        .log.successful_authz = log_successful_dcesrv_authz_event,
        .auth.gensec_prepare = dcesrv_gensec_prepare,
+       .assoc_group.find = dcesrv_assoc_group_find,
 };
 
 /*

diff --git a/source4/torture/rpc/spoolss_notify.c b/source4/torture/rpc/spoolss_notify.c
index 91f9f92b7d8f90756241b809a660c98cacd66a40..33d49c9092afbf2c813a6b97841318ecf32942be 100644 (file)
--- a/source4/torture/rpc/spoolss_notify.c
+++ b/source4/torture/rpc/spoolss_notify.c
@@ -37,6 +37,7 @@
 struct dcesrv_context_callbacks srv_cb = {
        .log.successful_authz = log_successful_dcesrv_authz_event,
        .auth.gensec_prepare = dcesrv_gensec_prepare,
+       .assoc_group.find = dcesrv_assoc_group_find,
 };
 
 static NTSTATUS spoolss__op_bind(struct dcesrv_connection_context *context,