validate.c File Reference

#include "validate.h"
#include <lmaccess.h>
#include <shlwapi.h>
#include <pathcch.h>
#include <lm.h>

Include dependency graph for validate.c:

Go to the source code of this file.

Functions
static BOOL	IsUserInGroup (PSID sid, const PTOKEN_GROUPS token_groups, const WCHAR *group_name)
	User is in group if the token groups contain the SID of the group of if the user is a direct member of the group.
static PTOKEN_GROUPS	GetTokenGroups (const HANDLE token)
	Get a list of groups in token.
static BOOL	CheckConfigPath (const WCHAR *workdir, const WCHAR *fname, const settings_t *s)
static int	OptionLookup (const WCHAR *name, const WCHAR *white_list[])
static BOOL	GetBuiltinAdminGroupName (WCHAR *name, DWORD nlen)
BOOL	IsAuthorizedUser (PSID sid, const HANDLE token, const WCHAR *ovpn_admin_group, const WCHAR *ovpn_service_user)
static BOOL	LookupSID (const WCHAR *name, PSID sid, DWORD sid_size)
BOOL	CheckOption (const WCHAR *workdir, int argc, WCHAR *argv[], const settings_t *s)

Variables
static const WCHAR *	global_white_list []

Function Documentation

CheckConfigPath()

BOOL CheckConfigPath ( const WCHAR * workdir, const WCHAR * fname, const settings_t * s )

static

Definition at line 61 of file validate.c.

References settings_t::config_dir.

Referenced by CheckOption().

CheckOption()

BOOL CheckOption	(	const WCHAR *	workdir,
		int	argc,
		WCHAR *	argv[],
		const settings_t *	s )

Definition at line 328 of file validate.c.

References CheckConfigPath(), global_white_list, and OptionLookup().

Referenced by ValidateOptions().

GetBuiltinAdminGroupName()

BOOL GetBuiltinAdminGroupName ( WCHAR * name, DWORD nlen )

static

Definition at line 121 of file validate.c.

References MAX_NAME.

Referenced by IsAuthorizedUser().

GetTokenGroups()

PTOKEN_GROUPS GetTokenGroups ( const HANDLE token )

static

Get a list of groups in token.

Returns a pointer to TOKEN_GROUPS struct or NULL on error. The caller should free the returned pointer.

Definition at line 212 of file validate.c.

References M_SYSERR, and MsgToEventLog().

Referenced by IsAuthorizedUser().

IsAuthorizedUser()

BOOL IsAuthorizedUser	(	PSID	sid,
		const HANDLE	token,
		const WCHAR *	ovpn_admin_group,
		const WCHAR *	ovpn_service_user )

Definition at line 149 of file validate.c.

References GetBuiltinAdminGroupName(), GetTokenGroups(), IsUserInGroup(), M_INFO, M_SYSERR, MAX_NAME, MsgToEventLog(), and SYSTEM_ADMIN_GROUP.

Referenced by RunOpenvpn().

IsUserInGroup()

BOOL IsUserInGroup ( PSID sid, const PTOKEN_GROUPS token_groups, const WCHAR * group_name )

static

User is in group if the token groups contain the SID of the group of if the user is a direct member of the group.

The latter check catches dynamic changes in group membership in the local user database not reflected in the token. If token_groups or sid is NULL the corresponding check is skipped.

Using sid and list of groups in token avoids reference to domains so that this could be completed without access to a Domain Controller.

Returns true if the user is in the group, false otherwise.

Definition at line 268 of file validate.c.

References LookupSID(), M_SYSERR, and MsgToEventLog().

Referenced by IsAuthorizedUser().

LookupSID()

BOOL LookupSID ( const WCHAR * name, PSID sid, DWORD sid_size )

static

Definition at line 242 of file validate.c.

References MAX_NAME.

Referenced by IsUserInGroup().

OptionLookup()

int OptionLookup ( const WCHAR * name, const WCHAR * white_list[] )

static

Definition at line 101 of file validate.c.

Referenced by CheckOption().

Variable Documentation

global_white_list

const WCHAR* global_white_list[]

static

Initial value:

= {
    L"auth-retry",
    L"config",
    L"log",
    L"log-append",
    L"management",
    L"management-forget-disconnect",
    L"management-hold",
    L"management-query-passwords",
    L"management-query-proxy",
    L"management-signal",
    L"management-up-down",
    L"mute",
    L"setenv",
    L"service",
    L"verb",
    L"pull-filter",
    L"script-security",
 
    NULL 
}

Definition at line 30 of file validate.c.

Referenced by CheckOption().