r1019: Push the auth subsystem away from using typedef, and over to the 'all

goodness and light' struct ;-)

Break apart the auth subsystem's return strucutres, into the parts
that a netlogon call cares about, and the parts that are for a local
session.  This is the 'struct session_info' and it will almost
completly replace the current information stored on a vuid, but be
generic to all login methods (RPC over TCP, for example).

Andrew Bartlett
(This used to be commit d199697014d9562f9439a30b950fda798c5ef419)

diff --git a/source4/auth/auth.c b/source4/auth/auth.c
index 49480eeac43cf8754bf4c1b6e5d110600cda9663..f22ca348e60c17f520812242211da4c7c238231b 100644 (file)
--- a/source4/auth/auth.c
+++ b/source4/auth/auth.c
@@ -32,7 +32,7 @@ static const uint8_t *get_ntlm_challenge(struct auth_context *auth_context)
 {
        DATA_BLOB challenge = data_blob(NULL, 0);
        const char *challenge_set_by = NULL;
-       auth_methods *auth_method;
+       struct auth_methods *auth_method;
        TALLOC_CTX *mem_ctx;
 
        if (auth_context->challenge.length) {
@@ -158,7 +158,7 @@ static NTSTATUS check_ntlm_password(const struct auth_context *auth_context,
 {
        /* if all the modules say 'not for me' this is reasonable */
        NTSTATUS nt_status = NT_STATUS_NO_SUCH_USER;
-       auth_methods *auth_method;
+       struct auth_methods *auth_method;
        TALLOC_CTX *mem_ctx;
 
        if (!user_info || !auth_context || !server_info)
@@ -253,7 +253,7 @@ static NTSTATUS check_ntlm_password(const struct auth_context *auth_context,
 
 static void free_auth_context(struct auth_context **auth_context)
 {
-       auth_methods *auth_method;
+       struct auth_methods *auth_method;
 
        if (*auth_context) {
                /* Free private data of context's authentication methods */
@@ -301,8 +301,8 @@ static NTSTATUS make_auth_context(struct auth_context **auth_context)
 
 static NTSTATUS make_auth_context_text_list(struct auth_context **auth_context, char **text_list) 
 {
-       auth_methods *list = NULL;
-       auth_methods *t = NULL;
+       struct auth_methods *list = NULL;
+       struct auth_methods *t = NULL;
        int i;
        NTSTATUS nt_status;
 
@@ -342,7 +342,7 @@ static NTSTATUS make_auth_context_text_list(struct auth_context **auth_context,
                if (NT_STATUS_IS_OK(ops->init(*auth_context, module_params, &t))) {
                        DEBUG(5,("make_auth_context_text_list: auth method %s has a valid init\n",
                                                *text_list));
-                       DLIST_ADD_END(list, t, auth_methods *);
+                       DLIST_ADD_END(list, t, struct auth_methods *);
                } else {
                        DEBUG(0,("make_auth_context_text_list: auth method %s did not correctly init\n",
                                                *text_list));

diff --git a/source4/auth/auth.h b/source4/auth/auth.h
index c6a025dba85e10a40cabe5e6531a867923b209e0..c8347cad209b506b5cf7ebd58d38ad951c462289 100644 (file)
--- a/source4/auth/auth.h
+++ b/source4/auth/auth.h
@@ -37,7 +37,7 @@ typedef struct auth_str
        char *str;
 } AUTH_STR;
 
-typedef struct auth_usersupplied_info
+struct auth_usersupplied_info
 {
        
        DATA_BLOB lm_resp;
@@ -54,7 +54,7 @@ typedef struct auth_usersupplied_info
        AUTH_STR           smb_name;        /* username before mapping */
        AUTH_STR           wksta_name;           /* workstation name (netbios calling name) unicode string */
        
-} auth_usersupplied_info;
+};
 
 #define SAM_FILL_NAME  0x01
 #define SAM_FILL_INFO3 0x02
@@ -62,20 +62,34 @@ typedef struct auth_usersupplied_info
 #define SAM_FILL_UNIX  0x08
 #define SAM_FILL_ALL (SAM_FILL_NAME | SAM_FILL_INFO3 | SAM_FILL_SAM | SAM_FILL_UNIX)
 
-typedef struct auth_serversupplied_info 
+struct auth_serversupplied_info 
 {
        TALLOC_CTX *mem_ctx;
 
        BOOL guest;
        
-       /* NT group information taken from the info3 structure */
-       
-       NT_USER_TOKEN *ptok;
+       struct dom_sid *user_sid;
+       struct dom_sid *primary_group_sid;
+
+       size_t n_domain_groups;
+       struct dom_sid **domain_groups;
        
        DATA_BLOB user_session_key;
        DATA_BLOB lm_session_key;
        
-} auth_serversupplied_info;
+};
+
+struct auth_session_info 
+{
+       TALLOC_CTX *mem_ctx;
+       /* NT group information taken from the info3 structure */
+       
+       NT_USER_TOKEN *nt_user_token;
+
+       struct auth_serversupplied_info *server_info;
+
+       DATA_BLOB session_key;
+};
 
 struct auth_context {
        DATA_BLOB challenge; 
@@ -98,7 +112,7 @@ struct auth_context {
        void (*free)(struct auth_context **auth_context);
 };
 
-typedef struct auth_methods
+struct auth_methods
 {
        struct auth_methods *prev, *next;
        const char *name; /* What name got this module */
@@ -107,7 +121,7 @@ typedef struct auth_methods
                         void *my_private_data, 
                         TALLOC_CTX *mem_ctx,
                         const struct auth_usersupplied_info *user_info, 
-                        auth_serversupplied_info **server_info);
+                        struct auth_serversupplied_info **server_info);
 
        DATA_BLOB (*get_chal)(const struct auth_context *auth_context,
                              void **my_private_data, 
@@ -122,7 +136,7 @@ typedef struct auth_methods
        /* Function to send a keepalive message on the above structure */
        void (*send_keepalive)(void **private_data);
 
-} auth_methods;
+};
 
 typedef NTSTATUS (*auth_init_function)(struct auth_context *, const char *, struct auth_methods **);
 

diff --git a/source4/auth/auth_builtin.c b/source4/auth/auth_builtin.c
index b5f5a101f4a574671d1b3efe61d250f3586dac22..d890b0ec72ed714588fbfebad3e145c687b71615 100644 (file)
--- a/source4/auth/auth_builtin.c
+++ b/source4/auth/auth_builtin.c
@@ -35,8 +35,8 @@
 static NTSTATUS check_guest_security(const struct auth_context *auth_context,
                                     void *my_private_data, 
                                     TALLOC_CTX *mem_ctx,
-                                    const auth_usersupplied_info *user_info, 
-                                    auth_serversupplied_info **server_info)
+                                    const struct auth_usersupplied_info *user_info, 
+                                    struct auth_serversupplied_info **server_info)
 {
        /* mark this as 'not for me' */
        NTSTATUS nt_status = NT_STATUS_NOT_IMPLEMENTED;
@@ -51,7 +51,9 @@ static NTSTATUS check_guest_security(const struct auth_context *auth_context,
 
 /* Guest modules initialisation */
 
-static NTSTATUS auth_init_guest(struct auth_context *auth_context, const char *options, auth_methods **auth_method) 
+static NTSTATUS auth_init_guest(struct auth_context *auth_context, 
+                               const char *options, 
+                               struct auth_methods **auth_method) 
 {
        if (!make_auth_methods(auth_context, auth_method))
                return NT_STATUS_NO_MEMORY;
@@ -78,8 +80,8 @@ static NTSTATUS auth_init_guest(struct auth_context *auth_context, const char *o
 static NTSTATUS check_name_to_ntstatus_security(const struct auth_context *auth_context,
                                                void *my_private_data, 
                                                TALLOC_CTX *mem_ctx,
-                                               const auth_usersupplied_info *user_info, 
-                                               auth_serversupplied_info **server_info)
+                                               const struct auth_usersupplied_info *user_info, 
+                                               struct auth_serversupplied_info **server_info)
 {
        NTSTATUS nt_status;
        fstring user;
@@ -103,7 +105,9 @@ static NTSTATUS check_name_to_ntstatus_security(const struct auth_context *auth_
 
 /** Module initialisation function */
 
-static NTSTATUS auth_init_name_to_ntstatus(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
+static NTSTATUS auth_init_name_to_ntstatus(struct auth_context *auth_context, 
+                                          const char *param, 
+                                          struct auth_methods **auth_method) 
 {
        if (!make_auth_methods(auth_context, auth_method))
                return NT_STATUS_NO_MEMORY;
@@ -131,8 +135,8 @@ static NTSTATUS auth_init_name_to_ntstatus(struct auth_context *auth_context, co
 static NTSTATUS check_fixed_challenge_security(const struct auth_context *auth_context,
                                               void *my_private_data, 
                                               TALLOC_CTX *mem_ctx,
-                                              const auth_usersupplied_info *user_info, 
-                                              auth_serversupplied_info **server_info)
+                                              const struct auth_usersupplied_info *user_info, 
+                                              struct auth_serversupplied_info **server_info)
 {
        return NT_STATUS_NOT_IMPLEMENTED;
 }
@@ -152,7 +156,9 @@ static DATA_BLOB auth_get_fixed_challenge(const struct auth_context *auth_contex
 
 /** Module initailisation function */
 
-static NTSTATUS auth_init_fixed_challenge(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
+static NTSTATUS auth_init_fixed_challenge(struct auth_context *auth_context, 
+                                         const char *param, 
+                                         struct auth_methods **auth_method) 
 {
        if (!make_auth_methods(auth_context, auth_method))
                return NT_STATUS_NO_MEMORY;

diff --git a/source4/auth/auth_ntlmssp.c b/source4/auth/auth_ntlmssp.c
index 7e854359e0c29de37fd19fee04c6e3d03269a359..29bd92e7ef45c13963060f1ee7a2e8071c24419d 100644 (file)
--- a/source4/auth/auth_ntlmssp.c
+++ b/source4/auth/auth_ntlmssp.c
@@ -78,7 +78,7 @@ static NTSTATUS auth_ntlmssp_set_challenge(struct ntlmssp_state *ntlmssp_state,
 static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state *ntlmssp_state, DATA_BLOB *user_session_key, DATA_BLOB *lm_session_key) 
 {
        struct auth_ntlmssp_state *auth_ntlmssp_state = ntlmssp_state->auth_context;
-       auth_usersupplied_info *user_info = NULL;
+       struct auth_usersupplied_info *user_info = NULL;
        NTSTATUS nt_status;
 
 #if 0

diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c
index 3b51b2f3965a516595cfffebb880464699cd5417..5d6e0b22f6460f146a552dc497c690d8cb170dc4 100644 (file)
--- a/source4/auth/auth_sam.c
+++ b/source4/auth/auth_sam.c
@@ -33,8 +33,9 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
                                TALLOC_CTX *mem_ctx,
                                const char *username,
                                uint16_t acct_flags,
-                               const uint8_t lm_pw[16], const uint8_t nt_pw[16],
-                               const auth_usersupplied_info *user_info, 
+                               const struct samr_Password *lm_pwd, 
+                               const struct samr_Password *nt_pwd,
+                               const struct auth_usersupplied_info *user_info, 
                                DATA_BLOB *user_sess_key, 
                                DATA_BLOB *lm_sess_key)
 {
@@ -57,7 +58,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
                                   username, 
                                   user_info->smb_name.str, 
                                   user_info->client_domain.str, 
-                                  lm_pw, nt_pw, user_sess_key, lm_sess_key);
+                                  lm_pwd->hash, nt_pwd->hash, user_sess_key, lm_sess_key);
 }
 
 
@@ -73,7 +74,7 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
                               NTTIME *must_change_time,
                               NTTIME *last_set_time,
                               const char *workstation_list,
-                              const auth_usersupplied_info *user_info)
+                              const struct auth_usersupplied_info *user_info)
 {
        DEBUG(4,("sam_account_ok: Checking SMB password for user %s\n", username));
 
@@ -165,8 +166,8 @@ return an NT_STATUS constant.
 static NTSTATUS check_sam_security(const struct auth_context *auth_context,
                                   void *my_private_data, 
                                   TALLOC_CTX *mem_ctx,
-                                  const auth_usersupplied_info *user_info, 
-                                  auth_serversupplied_info **server_info)
+                                  const struct auth_usersupplied_info *user_info, 
+                                  struct auth_serversupplied_info **server_info)
 {
        struct ldb_message **msgs;
        struct ldb_message **msgs_domain;
@@ -187,7 +188,7 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
        NTSTATUS nt_status;
        DATA_BLOB user_sess_key = data_blob(NULL, 0);
        DATA_BLOB lm_sess_key = data_blob(NULL, 0);
-       uint8_t *lm_pwd, *nt_pwd;
+       struct samr_Password *lm_pwd, *nt_pwd;
 
        const char *attrs[] = {"unicodePwd", "lmPwdHash", "ntPwdHash", 
                               "userAccountControl",
@@ -311,7 +312,7 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
                /* find list of sids */
                struct dom_sid **groupSIDs = NULL;
                struct dom_sid *user_sid;
-               struct dom_sid *group_sid;
+               struct dom_sid *primary_group_sid;
                const char *sidstr;
                int i;
 
@@ -335,19 +336,16 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
                
                sidstr = ldb_msg_find_string(msgs[0], "objectSid", NULL);
                user_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
-               group_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
-               group_sid->sub_auths[group_sid->num_auths-1] 
+               primary_group_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, sidstr);
+               primary_group_sid->sub_auths[primary_group_sid->num_auths-1] 
                        = samdb_result_uint(msgs[0], "primaryGroupID", 0);
 
-               if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx, 
-                                                                    user_sid, group_sid, 
-                                                                    group_ret, groupSIDs, 
-                                                                    False, &(*server_info)->ptok))) {
-                       DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
-                       free_server_info(server_info);
-                       samdb_close(sam_ctx);
-                       return nt_status;
-               }
+               (*server_info)->user_sid = user_sid;
+               (*server_info)->primary_group_sid = primary_group_sid;
+               
+               (*server_info)->n_domain_groups = group_ret;
+               (*server_info)->domain_groups = groupSIDs;
+
        }
 
        (*server_info)->guest = False;
@@ -359,7 +357,9 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
 }
 
 /* module initialisation */
-static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
+static NTSTATUS auth_init_sam_ignoredomain(struct auth_context *auth_context, 
+                                          const char *param, 
+                                          struct auth_methods **auth_method) 
 {
        if (!make_auth_methods(auth_context, auth_method)) {
                return NT_STATUS_NO_MEMORY;
@@ -378,8 +378,8 @@ Check SAM security (above) but with a few extra checks.
 static NTSTATUS check_samstrict_security(const struct auth_context *auth_context,
                                         void *my_private_data, 
                                         TALLOC_CTX *mem_ctx,
-                                        const auth_usersupplied_info *user_info, 
-                                        auth_serversupplied_info **server_info)
+                                        const struct auth_usersupplied_info *user_info, 
+                                        struct auth_serversupplied_info **server_info)
 {
 
        if (!user_info || !auth_context) {
@@ -400,7 +400,9 @@ static NTSTATUS check_samstrict_security(const struct auth_context *auth_context
 }
 
 /* module initialisation */
-static NTSTATUS auth_init_sam(struct auth_context *auth_context, const char *param, auth_methods **auth_method) 
+static NTSTATUS auth_init_sam(struct auth_context *auth_context, 
+                             const char *param, 
+                             struct auth_methods **auth_method) 
 {
        if (!make_auth_methods(auth_context, auth_method)) {
                return NT_STATUS_NO_MEMORY;

diff --git a/source4/auth/auth_util.c b/source4/auth/auth_util.c
index bdbc81882227d9c1266f65e93511fe53b58af322..2044d246664d291a59dce8247333b0a0f2bda682 100644 (file)
--- a/source4/auth/auth_util.c
+++ b/source4/auth/auth_util.c
@@ -29,7 +29,7 @@
 /****************************************************************************
  Create an auth_usersupplied_data structure
 ****************************************************************************/
-static NTSTATUS make_user_info(auth_usersupplied_info **user_info, 
+static NTSTATUS make_user_info(struct auth_usersupplied_info **user_info, 
                                const char *smb_name, 
                                const char *internal_username,
                                const char *client_domain, 
@@ -118,7 +118,7 @@ static NTSTATUS make_user_info(auth_usersupplied_info **user_info,
  Create an auth_usersupplied_data structure after appropriate mapping.
 ****************************************************************************/
 
-NTSTATUS make_user_info_map(auth_usersupplied_info **user_info, 
+NTSTATUS make_user_info_map(struct auth_usersupplied_info **user_info, 
                            const char *smb_name, 
                            const char *client_domain, 
                            const char *wksta_name, 
@@ -157,7 +157,7 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
  Decrypt and encrypt the passwords.
 ****************************************************************************/
 
-BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info, 
+BOOL make_user_info_netlogon_network(struct auth_usersupplied_info **user_info, 
                                     const char *smb_name, 
                                     const char *client_domain, 
                                     const char *wksta_name, 
@@ -189,7 +189,7 @@ BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
  Decrypt and encrypt the passwords.
 ****************************************************************************/
 
-BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info, 
+BOOL make_user_info_netlogon_interactive(struct auth_usersupplied_info **user_info, 
                                         const char *smb_name, 
                                         const char *client_domain, 
                                         const char *wksta_name, 
@@ -289,7 +289,7 @@ BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
  Create an auth_usersupplied_data structure
 ****************************************************************************/
 
-BOOL make_user_info_for_reply(auth_usersupplied_info **user_info, 
+BOOL make_user_info_for_reply(struct auth_usersupplied_info **user_info, 
                              const char *smb_name, 
                              const char *client_domain,
                              const uint8_t chal[8],
@@ -343,7 +343,7 @@ BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
  Create an auth_usersupplied_data structure
 ****************************************************************************/
 
-NTSTATUS make_user_info_for_reply_enc(auth_usersupplied_info **user_info, 
+NTSTATUS make_user_info_for_reply_enc(struct auth_usersupplied_info **user_info, 
                                       const char *smb_name,
                                       const char *client_domain, 
                                       DATA_BLOB lm_resp, DATA_BLOB nt_resp)
@@ -361,7 +361,7 @@ NTSTATUS make_user_info_for_reply_enc(auth_usersupplied_info **user_info,
  Create a guest user_info blob, for anonymous authenticaion.
 ****************************************************************************/
 
-BOOL make_user_info_guest(auth_usersupplied_info **user_info) 
+BOOL make_user_info_guest(struct auth_usersupplied_info **user_info) 
 {
        NTSTATUS nt_status;
 
@@ -491,10 +491,11 @@ NTSTATUS create_nt_user_token(TALLOC_CTX *mem_ctx,
  Make a user_info struct
 ***************************************************************************/
 
-NTSTATUS make_server_info(auth_serversupplied_info **server_info, const char *username)
+NTSTATUS make_server_info(struct auth_serversupplied_info **server_info, 
+                         const char *username)
 {
        TALLOC_CTX *mem_ctx = talloc_init("auth subsystem: server_info for %s", username);
-       *server_info = talloc_p(mem_ctx, auth_serversupplied_info);
+       *server_info = talloc_p(mem_ctx, struct auth_serversupplied_info);
        if (!*server_info) {
                DEBUG(0,("make_server_info: malloc failed!\n"));
                talloc_destroy(mem_ctx);
@@ -508,12 +509,10 @@ NTSTATUS make_server_info(auth_serversupplied_info **server_info, const char *us
 /***************************************************************************
  Make (and fill) a user_info struct for a guest login.
 ***************************************************************************/
-NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
+NTSTATUS make_server_info_guest(struct auth_serversupplied_info **server_info)
 {
        NTSTATUS nt_status;
        static const char zeros[16];
-       struct dom_sid *sid_Anonymous;
-       struct dom_sid *sid_Builtin_Guests;
 
        nt_status = make_server_info(server_info, "");
 
@@ -523,17 +522,10 @@ NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
        
        (*server_info)->guest = True;
 
-       sid_Anonymous = dom_sid_parse_talloc((*server_info)->mem_ctx, SID_ANONYMOUS);
-       sid_Builtin_Guests = dom_sid_parse_talloc((*server_info)->mem_ctx, SID_BUILTIN_GUESTS);
-       
-       if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token((*server_info)->mem_ctx, 
-                                                             sid_Anonymous, sid_Builtin_Guests,
-                                                             0, NULL, 
-                                                             True, &(*server_info)->ptok))) {
-               DEBUG(1,("check_sam_security: create_nt_user_token failed with '%s'\n", nt_errstr(nt_status)));
-               free_server_info(server_info);
-               return nt_status;
-       }
+       (*server_info)->user_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, SID_ANONYMOUS);
+       (*server_info)->primary_group_sid = dom_sid_parse_talloc((*server_info)->mem_ctx, SID_BUILTIN_GUESTS);
+       (*server_info)->n_domain_groups = 0;
+       (*server_info)->domain_groups = NULL;
        
        /* annoying, but the Guest really does have a session key, 
           and it is all zeros! */
@@ -547,7 +539,7 @@ NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
  Free a user_info struct
 ***************************************************************************/
 
-void free_user_info(auth_usersupplied_info **user_info)
+void free_user_info(struct auth_usersupplied_info **user_info)
 {
        DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
        if (*user_info != NULL) {
@@ -571,7 +563,7 @@ void free_user_info(auth_usersupplied_info **user_info)
  Clear out a server_info struct that has been allocated
 ***************************************************************************/
 
-void free_server_info(auth_serversupplied_info **server_info)
+void free_server_info(struct auth_serversupplied_info **server_info)
 {
        DEBUG(5,("attempting to free a server_info structure\n"));
        if (!*server_info) {
@@ -584,7 +576,7 @@ void free_server_info(auth_serversupplied_info **server_info)
  Make an auth_methods struct
 ***************************************************************************/
 
-BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method) 
+BOOL make_auth_methods(struct auth_context *auth_context, struct auth_methods **auth_method) 
 {
        if (!auth_context) {
                smb_panic("no auth_context supplied to make_auth_methods()!\n");
@@ -604,18 +596,35 @@ BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_me
        return True;
 }
 
-/****************************************************************************
- Delete a SID token.
-****************************************************************************/
-
-void delete_nt_token(NT_USER_TOKEN **pptoken)
+NTSTATUS make_session_info(struct auth_serversupplied_info *server_info, 
+                          struct auth_session_info **session_info) 
 {
-    if (*pptoken) {
-           NT_USER_TOKEN *ptoken = *pptoken;
-           SAFE_FREE( ptoken->user_sids );
-           ZERO_STRUCTP(ptoken);
-    }
-    SAFE_FREE(*pptoken);
+       NTSTATUS nt_status;
+
+       *session_info = talloc_p(server_info->mem_ctx, struct auth_session_info);
+       if (!*session_info) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       
+       (*session_info)->mem_ctx = server_info->mem_ctx;
+       server_info->mem_ctx = NULL; /* make sure not to accidentily destory it, 
+                                       and this information is now constant */
+       (*session_info)->server_info = server_info;
+
+       /* unless set otherwise, the session key is the user session
+        * key from the auth subsystem */
+ 
+       (*session_info)->session_key = server_info->user_session_key;
+       
+       nt_status = create_nt_user_token((*session_info)->mem_ctx, 
+                                        server_info->user_sid, 
+                                        server_info->primary_group_sid, 
+                                        server_info->n_domain_groups, 
+                                        server_info->domain_groups,
+                                        False, 
+                                        &(*session_info)->nt_user_token);
+       
+       return nt_status;
 }
 
 /**

diff --git a/source4/include/smb.h b/source4/include/smb.h
index f0ddab65af93215b98ff91b809dbed8573108243..2b047f41ad377a1c035661ad0d472fae3fb75df8 100644 (file)
--- a/source4/include/smb.h
+++ b/source4/include/smb.h
@@ -873,13 +873,11 @@ typedef struct user_struct
        struct user_struct *next, *prev;
        uint16_t vuid; /* Tag for this entry. */
 
-       DATA_BLOB session_key;
-
        char *session_keystr; /* used by utmp and pam session code.  
                                 TDB key string */
        int homes_snum;
 
-       struct auth_serversupplied_info *server_info;
+       struct auth_session_info *session_info;
 
 } user_struct;
 

diff --git a/source4/ntvfs/ipc/vfs_ipc.c b/source4/ntvfs/ipc/vfs_ipc.c
index 9a2589a2eebc7d3b6afab9ef31efddc16e6f9d33..7ebf35d5cb4c84a0cc5d5880da8b2f2b7b2442a9 100644 (file)
--- a/source4/ntvfs/ipc/vfs_ipc.c
+++ b/source4/ntvfs/ipc/vfs_ipc.c
@@ -254,7 +254,9 @@ static NTSTATUS ipc_open_generic(struct request_context *req, const char *fname,
 
        /* tell the RPC layer the transport session key */
        if (req->user_ctx->vuser) {
-               dcesrv_set_session_key(p->dce_conn, req->user_ctx->vuser->session_key);
+               /* TODO: Fix this to push more than just a session key
+                * down - we need the entire session_info, reference counted... */
+               dcesrv_set_session_key(p->dce_conn, req->user_ctx->vuser->session_info->session_key);
        }
 
        return NT_STATUS_OK;

diff --git a/source4/smb_server/password.c b/source4/smb_server/password.c
index ca89003cf1c0407ad1988f43a0326452f87db849..075638852ca8acb1fa0572bf8da7f9cc051a8f82 100644 (file)
--- a/source4/smb_server/password.c
+++ b/source4/smb_server/password.c
@@ -55,12 +55,10 @@ void invalidate_vuid(struct server_context *smb, uint16_t vuid)
 
        if (vuser == NULL)
                return;
-       
-       data_blob_free(&vuser->session_key);
 
        session_yield(vuser);
 
-       free_server_info(&vuser->server_info);
+       talloc_destroy(vuser->session_info->mem_ctx);
 
        DLIST_REMOVE(smb->users.validated_users, vuser);
 
@@ -101,8 +99,7 @@ void invalidate_all_vuids(struct server_context *smb)
  */
 
 int register_vuid(struct server_context *smb,
-                 struct auth_serversupplied_info *server_info, 
-                 DATA_BLOB *session_key,
+                 struct auth_session_info *session_info,
                  const char *smb_name)
 {
        user_struct *vuser = NULL;
@@ -135,18 +132,8 @@ int register_vuid(struct server_context *smb,
 
        vuser->vuid = smb->users.next_vuid;
 
-       vuser->session_key = *session_key;
-
-       if (!server_info->ptok) {
-               DEBUG(1, ("server_info does not contain a user_token - cannot continue\n"));
-               free_server_info(&server_info);
-
-               SAFE_FREE(vuser);
-               return UID_FIELD_INVALID;
-       }
-
        /* use this to keep tabs on all our info from the authentication */
-       vuser->server_info = server_info;
+       vuser->session_info = session_info;
 
        smb->users.next_vuid++;
        smb->users.num_validated_vuids++;
@@ -156,7 +143,7 @@ int register_vuid(struct server_context *smb,
        if (!session_claim(smb, vuser)) {
                DEBUG(1,("Failed to claim session for vuid=%d\n", vuser->vuid));
                invalidate_vuid(smb, vuser->vuid);
-               return -1;
+               return UID_FIELD_INVALID;
        }
 
        return vuser->vuid;

diff --git a/source4/smb_server/sesssetup.c b/source4/smb_server/sesssetup.c
index fdcc1d298a6f2e2915c94ae69ef5064bc6c01084..12b17c366ab815c8cac9f6d8803416381701ed3b 100644 (file)
--- a/source4/smb_server/sesssetup.c
+++ b/source4/smb_server/sesssetup.c
@@ -41,10 +41,10 @@ static void sesssetup_common_strings(struct request_context *req,
 static NTSTATUS sesssetup_old(struct request_context *req, union smb_sesssetup *sess)
 {
        NTSTATUS status;
-       auth_usersupplied_info *user_info = NULL;
-       auth_serversupplied_info *server_info = NULL;
+       struct auth_usersupplied_info *user_info = NULL;
+       struct auth_serversupplied_info *server_info = NULL;
+       struct auth_session_info *session_info;
        DATA_BLOB null_blob;
-       DATA_BLOB session_key;
 
        if (!req->smb->negotiate.done_sesssetup) {
                req->smb->negotiate.max_send = sess->old.in.bufsize;
@@ -67,14 +67,13 @@ static NTSTATUS sesssetup_old(struct request_context *req, union smb_sesssetup *
                return nt_status_squash(status);
        }
 
-       if (server_info->user_session_key.data) {
-               session_key = data_blob(server_info->user_session_key.data, server_info->user_session_key.length);
-       } else {
-               session_key = data_blob(NULL, 0);
+       status = make_session_info(server_info, &session_info);
+       if (!NT_STATUS_IS_OK(status)) {
+               return nt_status_squash(status);
        }
 
        sess->old.out.action = 0;
-       sess->old.out.vuid = register_vuid(req->smb, server_info, &session_key, sess->old.in.user);
+       sess->old.out.vuid = register_vuid(req->smb, session_info, sess->old.in.user);
        sesssetup_common_strings(req, 
                                 &sess->old.out.os,
                                 &sess->old.out.lanman,
@@ -90,9 +89,9 @@ static NTSTATUS sesssetup_old(struct request_context *req, union smb_sesssetup *
 static NTSTATUS sesssetup_nt1(struct request_context *req, union smb_sesssetup *sess)
 {
        NTSTATUS status;
-       auth_usersupplied_info *user_info = NULL;
-       auth_serversupplied_info *server_info = NULL;
-       DATA_BLOB session_key;
+       struct auth_usersupplied_info *user_info = NULL;
+       struct auth_serversupplied_info *server_info = NULL;
+       struct auth_session_info *session_info;
 
        if (!req->smb->negotiate.done_sesssetup) {
                req->smb->negotiate.max_send = sess->nt1.in.bufsize;
@@ -114,21 +113,22 @@ static NTSTATUS sesssetup_nt1(struct request_context *req, union smb_sesssetup *
                return nt_status_squash(status);
        }
 
-       if (server_info->user_session_key.data) {
-               session_key = data_blob(server_info->user_session_key.data, server_info->user_session_key.length);
-       } else {
-               session_key = data_blob(NULL, 0);
+       status = make_session_info(server_info, &session_info);
+       if (!NT_STATUS_IS_OK(status)) {
+               return nt_status_squash(status);
        }
 
        sess->nt1.out.action = 0;
-       sess->nt1.out.vuid = register_vuid(req->smb, server_info, &session_key, sess->old.in.user);
+       sess->nt1.out.vuid = register_vuid(req->smb, session_info, sess->old.in.user);
+       if (sess->nt1.out.vuid == UID_FIELD_INVALID) {
+               return NT_STATUS_ACCESS_DENIED;
+       }
        sesssetup_common_strings(req, 
                                 &sess->nt1.out.os,
                                 &sess->nt1.out.lanman,
                                 &sess->nt1.out.domain);
-
-       srv_setup_signing(req->smb, &session_key, &sess->nt1.in.password2);
-
+       
+       srv_setup_signing(req->smb, &session_info->session_key, &sess->nt1.in.password2);
        return NT_STATUS_OK;
 }