This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
-static struct nt_user_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
- const DOM_SID *user_sid,
- BOOL is_guest,
- int num_groupsids,
- const DOM_SID *groupsids);
-
/****************************************************************************
Create a UNIX user on demand.
****************************************************************************/
const uchar nt_interactive_pwd[16],
const uchar *dc_sess_key)
{
- char lm_pwd[16];
- char nt_pwd[16];
+ unsigned char lm_pwd[16];
+ unsigned char nt_pwd[16];
unsigned char local_lm_response[24];
unsigned char local_nt_response[24];
unsigned char key[16];
#ifdef DEBUG_PASSWORD
DEBUG(100,("key:"));
- dump_data(100, (char *)key, sizeof(key));
+ dump_data(100, key, sizeof(key));
DEBUG(100,("lm owf password:"));
dump_data(100, lm_pwd, sizeof(lm_pwd));
#endif
if (lm_interactive_pwd)
- SamOEMhash((uchar *)lm_pwd, key, sizeof(lm_pwd));
+ SamOEMhash(lm_pwd, key, sizeof(lm_pwd));
if (nt_interactive_pwd)
- SamOEMhash((uchar *)nt_pwd, key, sizeof(nt_pwd));
+ SamOEMhash(nt_pwd, key, sizeof(nt_pwd));
#ifdef DEBUG_PASSWORD
DEBUG(100,("decrypt of lm owf password:"));
#endif
if (lm_interactive_pwd)
- SMBOWFencrypt((const unsigned char *)lm_pwd, chal,
+ SMBOWFencrypt(lm_pwd, chal,
local_lm_response);
if (nt_interactive_pwd)
- SMBOWFencrypt((const unsigned char *)nt_pwd, chal,
+ SMBOWFencrypt(nt_pwd, chal,
local_nt_response);
/* Password info paranoia */
#ifdef DEBUG_PASSWORD
DEBUG(10,("Unencrypted password (len %d):\n",
(int)plaintext_password.length));
- dump_data(100, (const char *)plaintext_password.data,
+ dump_data(100, plaintext_password.data,
plaintext_password.length);
#endif
/* We can't do an NT hash here, as the password needs to be
case insensitive */
- local_nt_blob = data_blob(NULL, 0);
+ local_nt_blob = data_blob_null;
} else {
- local_lm_blob = data_blob(NULL, 0);
- local_nt_blob = data_blob(NULL, 0);
+ local_lm_blob = data_blob_null;
+ local_nt_blob = data_blob_null;
}
ret = make_user_info_map(
return NT_STATUS_IS_OK(nt_status) ? True : False;
}
-/****************************************************************************
- prints a NT_USER_TOKEN to debug output.
-****************************************************************************/
-
-void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
+static int server_info_dtor(auth_serversupplied_info *server_info)
{
- size_t i;
-
- if (!token) {
- DEBUGC(dbg_class, dbg_lev, ("NT user token: (NULL)\n"));
- return;
- }
-
- DEBUGC(dbg_class, dbg_lev,
- ("NT user token of user %s\n",
- sid_string_static(&token->user_sids[0]) ));
- DEBUGADDC(dbg_class, dbg_lev,
- ("contains %lu SIDs\n", (unsigned long)token->num_sids));
- for (i = 0; i < token->num_sids; i++)
- DEBUGADDC(dbg_class, dbg_lev,
- ("SID[%3lu]: %s\n", (unsigned long)i,
- sid_string_static(&token->user_sids[i])));
-
- dump_se_priv( dbg_class, dbg_lev, &token->privileges );
-}
-
-/****************************************************************************
- prints a UNIX 'token' to debug output.
-****************************************************************************/
-
-void debug_unix_user_token(int dbg_class, int dbg_lev, uid_t uid, gid_t gid,
- int n_groups, gid_t *groups)
-{
- int i;
- DEBUGC(dbg_class, dbg_lev,
- ("UNIX token of user %ld\n", (long int)uid));
-
- DEBUGADDC(dbg_class, dbg_lev,
- ("Primary group is %ld and contains %i supplementary "
- "groups\n", (long int)gid, n_groups));
- for (i = 0; i < n_groups; i++)
- DEBUGADDC(dbg_class, dbg_lev, ("Group[%3i]: %ld\n", i,
- (long int)groups[i]));
-}
-
-/******************************************************************************
- Create a token for the root user to be used internally by smbd.
- This is similar to running under the context of the LOCAL_SYSTEM account
- in Windows. This is a read-only token. Do not modify it or free() it.
- Create a copy if your need to change it.
-******************************************************************************/
-
-NT_USER_TOKEN *get_root_nt_token( void )
-{
- static NT_USER_TOKEN *token = NULL;
- DOM_SID u_sid, g_sid;
- struct passwd *pw;
-
- if ( token )
- return token;
-
- if ( !(pw = sys_getpwnam( "root" )) ) {
- DEBUG(0,("get_root_nt_token: getpwnam\"root\") failed!\n"));
- return NULL;
- }
-
- /* get the user and primary group SIDs; although the
- BUILTIN\Administrators SId is really the one that matters here */
-
- uid_to_sid(&u_sid, pw->pw_uid);
- gid_to_sid(&g_sid, pw->pw_gid);
-
- token = create_local_nt_token(NULL, &u_sid, False,
- 1, &global_sid_Builtin_Administrators);
- return token;
-}
-
-static int server_info_dtor(void *p)
-{
- auth_serversupplied_info *server_info =
- talloc_get_type_abort(p, auth_serversupplied_info);
-
- if (server_info->sam_account != NULL) {
- TALLOC_FREE(server_info->sam_account);
- }
-
+ TALLOC_FREE(server_info->sam_account);
ZERO_STRUCTP(server_info);
return 0;
}
struct passwd *pwd;
gid_t *gids;
auth_serversupplied_info *result;
+ int i;
+ size_t num_gids;
+ DOM_SID unix_group_sid;
+
- if ( !(pwd = getpwnam_alloc(NULL, pdb_get_username(sampass))) ) {
+ if ( !(result = make_server_info(NULL)) ) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if ( !(pwd = getpwnam_alloc(result, pdb_get_username(sampass))) ) {
DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
pdb_get_username(sampass)));
+ TALLOC_FREE(result);
return NT_STATUS_NO_SUCH_USER;
}
- if ( !(result = make_server_info(NULL)) ) {
- TALLOC_FREE(pwd);
- return NT_STATUS_NO_MEMORY;
- }
-
result->sam_account = sampass;
- result->unix_name = talloc_strdup(result, pwd->pw_name);
+ /* Ensure thaat the sampass will be freed with the result */
+ talloc_steal(result, sampass);
+ result->unix_name = pwd->pw_name;
+ /* Ensure that we keep pwd->pw_name, because we will free pwd below */
+ talloc_steal(result, pwd->pw_name);
result->gid = pwd->pw_gid;
result->uid = pwd->pw_uid;
TALLOC_FREE(result);
return status;
}
+
+ /* Add the "Unix Group" SID for each gid to catch mapped groups
+ and their Unix equivalent. This is to solve the backwards
+ compatibility problem of 'valid users = +ntadmin' where
+ ntadmin has been paired with "Domain Admins" in the group
+ mapping table. Otherwise smb.conf would need to be changed
+ to 'valid user = "Domain Admins"'. --jerry */
+
+ num_gids = result->num_sids;
+ for ( i=0; i<num_gids; i++ ) {
+ if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
+ DEBUG(1,("make_server_info_sam: Failed to create SID "
+ "for gid %d!\n", gids[i]));
+ continue;
+ }
+ if (!add_sid_to_array_unique( result, &unix_group_sid,
+ &result->sids, &result->num_sids )) {
+ result->sam_account = NULL; /* Don't free on error exit. */
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
/* For now we throw away the gids and convert via sid_to_gid
* later. This needs fixing, but I'd like to get the code straight and
* simple first. */
+
TALLOC_FREE(gids);
DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
return NT_STATUS_OK;
}
-/*
- * Add alias SIDs from memberships within the partially created token SID list
- */
-
-static NTSTATUS add_aliases(const DOM_SID *domain_sid,
- struct nt_user_token *token)
-{
- uint32 *aliases;
- size_t i, num_aliases;
- NTSTATUS status;
- TALLOC_CTX *tmp_ctx;
-
- if (!(tmp_ctx = talloc_init("add_aliases"))) {
- return NT_STATUS_NO_MEMORY;
- }
-
- aliases = NULL;
- num_aliases = 0;
-
- status = pdb_enum_alias_memberships(tmp_ctx, domain_sid,
- token->user_sids,
- token->num_sids,
- &aliases, &num_aliases);
-
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(10, ("pdb_enum_alias_memberships failed: %s\n",
- nt_errstr(status)));
- TALLOC_FREE(tmp_ctx);
- return status;
- }
-
- for (i=0; i<num_aliases; i++) {
- DOM_SID alias_sid;
- sid_compose(&alias_sid, domain_sid, aliases[i]);
- add_sid_to_array_unique(token, &alias_sid,
- &token->user_sids,
- &token->num_sids);
- if (token->user_sids == NULL) {
- DEBUG(0, ("add_sid_to_array failed\n"));
- TALLOC_FREE(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
- }
-
- TALLOC_FREE(tmp_ctx);
- return NT_STATUS_OK;
-}
-
static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
{
char *command;
return NT_STATUS_OK;
}
-/*******************************************************************
-*******************************************************************/
-
-static NTSTATUS add_builtin_administrators( struct nt_user_token *token )
-{
- DOM_SID domadm;
-
- /* nothing to do if we aren't in a domain */
-
- if ( !(IS_DC || lp_server_role()==ROLE_DOMAIN_MEMBER) ) {
- return NT_STATUS_OK;
- }
-
- /* Find the Domain Admins SID */
-
- if ( IS_DC ) {
- sid_copy( &domadm, get_global_sam_sid() );
- } else {
- if ( !secrets_fetch_domain_sid( lp_workgroup(), &domadm ) )
- return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
- }
- sid_append_rid( &domadm, DOMAIN_GROUP_RID_ADMINS );
-
- /* Add Administrators if the user beloongs to Domain Admins */
-
- if ( nt_token_check_sid( &domadm, token ) ) {
- add_sid_to_array(token, &global_sid_Builtin_Administrators,
- &token->user_sids, &token->num_sids);
- }
-
- return NT_STATUS_OK;
-}
-
-/*******************************************************************
-*******************************************************************/
-
-static NTSTATUS create_builtin_users( void )
-{
- NTSTATUS status;
- DOM_SID dom_users;
-
- status = pdb_create_builtin_alias( BUILTIN_ALIAS_RID_USERS );
- if ( !NT_STATUS_IS_OK(status) ) {
- DEBUG(0,("create_builtin_users: Failed to create Users\n"));
- return status;
- }
-
- /* add domain users */
- if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
- && secrets_fetch_domain_sid(lp_workgroup(), &dom_users))
- {
- sid_append_rid(&dom_users, DOMAIN_GROUP_RID_USERS );
- status = pdb_add_aliasmem( &global_sid_Builtin_Users, &dom_users);
- if ( !NT_STATUS_IS_OK(status) ) {
- DEBUG(0,("create_builtin_administrators: Failed to add Domain Users to"
- " Users\n"));
- return status;
- }
- }
-
- return NT_STATUS_OK;
-}
-
-/*******************************************************************
-*******************************************************************/
-
-static NTSTATUS create_builtin_administrators( void )
-{
- NTSTATUS status;
- DOM_SID dom_admins, root_sid;
- fstring root_name;
- enum SID_NAME_USE type;
- TALLOC_CTX *ctx;
- BOOL ret;
-
- status = pdb_create_builtin_alias( BUILTIN_ALIAS_RID_ADMINS );
- if ( !NT_STATUS_IS_OK(status) ) {
- DEBUG(0,("create_builtin_administrators: Failed to create Administrators\n"));
- return status;
- }
-
- /* add domain admins */
- if ((IS_DC || (lp_server_role() == ROLE_DOMAIN_MEMBER))
- && secrets_fetch_domain_sid(lp_workgroup(), &dom_admins))
- {
- sid_append_rid(&dom_admins, DOMAIN_GROUP_RID_ADMINS);
- status = pdb_add_aliasmem( &global_sid_Builtin_Administrators, &dom_admins );
- if ( !NT_STATUS_IS_OK(status) ) {
- DEBUG(0,("create_builtin_administrators: Failed to add Domain Admins"
- " Administrators\n"));
- return status;
- }
- }
-
- /* add root */
- if ( (ctx = talloc_init("create_builtin_administrators")) == NULL ) {
- return NT_STATUS_NO_MEMORY;
- }
- fstr_sprintf( root_name, "%s\\root", get_global_sam_name() );
- ret = lookup_name( ctx, root_name, 0, NULL, NULL, &root_sid, &type );
- TALLOC_FREE( ctx );
-
- if ( ret ) {
- status = pdb_add_aliasmem( &global_sid_Builtin_Administrators, &root_sid );
- if ( !NT_STATUS_IS_OK(status) ) {
- DEBUG(0,("create_builtin_administrators: Failed to add root"
- " Administrators\n"));
- return status;
- }
- }
-
- return NT_STATUS_OK;
-}
-
-/*******************************************************************
- Create a NT token for the user, expanding local aliases
-*******************************************************************/
-
-static struct nt_user_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
- const DOM_SID *user_sid,
- BOOL is_guest,
- int num_groupsids,
- const DOM_SID *groupsids)
-{
- struct nt_user_token *result = NULL;
- int i;
- NTSTATUS status;
- gid_t gid;
-
- if (!(result = TALLOC_ZERO_P(mem_ctx, NT_USER_TOKEN))) {
- DEBUG(0, ("talloc failed\n"));
- return NULL;
- }
-
- /* Add the user and primary group sid */
-
- add_sid_to_array(result, user_sid,
- &result->user_sids, &result->num_sids);
-
- SMB_ASSERT(num_groupsids > 0);
- add_sid_to_array(result, &groupsids[0],
- &result->user_sids, &result->num_sids);
-
- /* Add in BUILTIN sids */
-
- add_sid_to_array(result, &global_sid_World,
- &result->user_sids, &result->num_sids);
- add_sid_to_array(result, &global_sid_Network,
- &result->user_sids, &result->num_sids);
-
- if (is_guest) {
- add_sid_to_array(result, &global_sid_Builtin_Guests,
- &result->user_sids, &result->num_sids);
- } else {
- add_sid_to_array(result, &global_sid_Authenticated_Users,
- &result->user_sids, &result->num_sids);
- }
-
- /* Now the SIDs we got from authentication. These are the ones from
- * the info3 struct or from the pdb_enum_group_memberships, depending
- * on who authenticated the user.
- * Note that we start the for loop at "1" here, we already added the
- * first group sid as primary above. */
-
- for (i=1; i<num_groupsids; i++) {
- add_sid_to_array_unique(result, &groupsids[i],
- &result->user_sids, &result->num_sids);
- }
-
- /* Deal with the BUILTIN\Administrators group. If the SID can
- be resolved then assume that the add_aliasmem( S-1-5-32 )
- handled it. */
-
- if ( !sid_to_gid( &global_sid_Builtin_Administrators, &gid ) ) {
- /* We can only create a mapping if winbind is running
- and the nested group functionality has been enabled */
-
- if ( lp_winbind_nested_groups() && winbind_ping() ) {
- become_root();
- status = create_builtin_administrators( );
- if ( !NT_STATUS_IS_OK(status) ) {
- DEBUG(0,("create_local_nt_token: Failed to create BUILTIN\\Administrators group!\n"));
- /* don't fail, just log the message */
- }
- unbecome_root();
- }
- else {
- status = add_builtin_administrators( result );
- if ( !NT_STATUS_IS_OK(status) ) {
- /* just log a complaint but do not fail */
- DEBUG(3,("create_local_nt_token: failed to check for local Administrators"
- " membership (%s)\n", nt_errstr(status)));
- }
- }
- }
-
- /* Deal with the BUILTIN\Users group. If the SID can
- be resolved then assume that the add_aliasmem( S-1-5-32 )
- handled it. */
-
- if ( !sid_to_gid( &global_sid_Builtin_Users, &gid ) ) {
- /* We can only create a mapping if winbind is running
- and the nested group functionality has been enabled */
-
- if ( lp_winbind_nested_groups() && winbind_ping() ) {
- become_root();
- status = create_builtin_users( );
- if ( !NT_STATUS_IS_OK(status) ) {
- DEBUG(0,("create_local_nt_token: Failed to create BUILTIN\\Users group!\n"));
- /* don't fail, just log the message */
- }
- unbecome_root();
- }
- }
-
- /* Deal with local groups */
-
- if (lp_winbind_nested_groups()) {
-
- /* Now add the aliases. First the one from our local SAM */
-
- status = add_aliases(get_global_sam_sid(), result);
-
- if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(result);
- return NULL;
- }
-
- /* Finally the builtin ones */
-
- status = add_aliases(&global_sid_Builtin, result);
-
- if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(result);
- return NULL;
- }
- }
-
-
- get_privileges_for_sids(&result->privileges, result->user_sids,
- result->num_sids);
- return result;
-}
-
/*
* Create the token to use from server_info->sam_account and
* server_info->sids (the info3/sam groups). Find the unix gids.
NTSTATUS result = NT_STATUS_NO_SUCH_USER;
TALLOC_CTX *tmp_ctx;
DOM_SID user_sid;
- enum SID_NAME_USE type;
+ enum lsa_SidType type;
gid_t *gids;
- DOM_SID primary_group_sid;
DOM_SID *group_sids;
+ DOM_SID unix_group_sid;
size_t num_group_sids;
+ size_t num_gids;
+ size_t i;
tmp_ctx = talloc_new(NULL);
if (tmp_ctx == NULL) {
return NT_STATUS_NO_MEMORY;
}
- if (!lookup_name(tmp_ctx, username, LOOKUP_NAME_ALL,
+ if (!lookup_name_smbconf(tmp_ctx, username, LOOKUP_NAME_ALL,
NULL, NULL, &user_sid, &type)) {
- DEBUG(1, ("lookup_name for %s failed\n", username));
+ DEBUG(1, ("lookup_name_smbconf for %s failed\n", username));
goto done;
}
SMB_ASSERT(num_group_sids > 0);
*gid = gids[0];
+
+ /* Ensure we're returning the found_username on the right context. */
*found_username = talloc_strdup(mem_ctx,
pdb_get_username(sam_acct));
* directly, without consulting passdb */
struct passwd *pass;
- size_t i;
/*
* This goto target is used as a fallback for the passdb
goto done;
}
- group_sids = talloc_array(tmp_ctx, DOM_SID, num_group_sids);
- if (group_sids == NULL) {
- DEBUG(1, ("talloc_array failed\n"));
- result = NT_STATUS_NO_MEMORY;
- goto done;
+ if (num_group_sids) {
+ group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
+ if (group_sids == NULL) {
+ DEBUG(1, ("TALLOC_ARRAY failed\n"));
+ result = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ } else {
+ group_sids = NULL;
}
for (i=0; i<num_group_sids; i++) {
SMB_ASSERT(num_group_sids > 0);
*gid = gids[0];
- *found_username = talloc_strdup(mem_ctx, pass->pw_name);
+ /* Ensure we're returning the found_username on the right context. */
+ *found_username = talloc_strdup(mem_ctx, pass->pw_name);
} else {
/* This user is from winbind, force the primary gid to the
uint32 dummy;
- sid_copy(&primary_group_sid, &user_sid);
- sid_split_rid(&primary_group_sid, &dummy);
- sid_append_rid(&primary_group_sid, DOMAIN_GROUP_RID_USERS);
+ num_group_sids = 1;
+ group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
+ if (group_sids == NULL) {
+ DEBUG(1, ("TALLOC_ARRAY failed\n"));
+ result = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ sid_copy(&group_sids[0], &user_sid);
+ sid_split_rid(&group_sids[0], &dummy);
+ sid_append_rid(&group_sids[0], DOMAIN_GROUP_RID_USERS);
- if (!sid_to_gid(&primary_group_sid, gid)) {
+ if (!sid_to_gid(&group_sids[0], gid)) {
DEBUG(1, ("sid_to_gid(%s) failed\n",
- sid_string_static(&primary_group_sid)));
+ sid_string_static(&group_sids[0])));
goto done;
}
- num_group_sids = 1;
- group_sids = &primary_group_sid;
+ gids = gid;
+ /* Ensure we're returning the found_username on the right context. */
*found_username = talloc_strdup(mem_ctx, username);
}
+ /* Add the "Unix Group" SID for each gid to catch mapped groups
+ and their Unix equivalent. This is to solve the backwards
+ compatibility problem of 'valid users = +ntadmin' where
+ ntadmin has been paired with "Domain Admins" in the group
+ mapping table. Otherwise smb.conf would need to be changed
+ to 'valid user = "Domain Admins"'. --jerry */
+
+ num_gids = num_group_sids;
+ for ( i=0; i<num_gids; i++ ) {
+ gid_t high, low;
+
+ /* don't pickup anything managed by Winbind */
+
+ if ( lp_idmap_gid(&low, &high) && (gids[i] >= low) && (gids[i] <= high) )
+ continue;
+
+ if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
+ DEBUG(1,("create_token_from_username: Failed to create SID "
+ "for gid %d!\n", gids[i]));
+ continue;
+ }
+ if (!add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
+ &group_sids, &num_group_sids )) {
+ result = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ }
+
+ /* Ensure we're creating the nt_token on the right context. */
*token = create_local_nt_token(mem_ctx, &user_sid,
is_guest, num_group_sids, group_sids);
Expensive helper function to figure out whether a user given its name is
member of a particular group.
***************************************************************************/
+
BOOL user_in_group_sid(const char *username, const DOM_SID *group_sid)
{
NTSTATUS status;
NTSTATUS status;
struct samu *sampass = NULL;
gid_t *gids;
+ char *qualified_name = NULL;
+ TALLOC_CTX *mem_ctx = NULL;
+ DOM_SID u_sid;
+ enum lsa_SidType type;
auth_serversupplied_info *result;
if ( !(sampass = samu_new( NULL )) ) {
return status;
}
+ /*
+ * The SID returned in server_info->sam_account is based
+ * on our SAM sid even though for a pure UNIX account this should
+ * not be the case as it doesn't really exist in the SAM db.
+ * This causes lookups on "[in]valid users" to fail as they
+ * will lookup this name as a "Unix User" SID to check against
+ * the user token. Fix this by adding the "Unix User"\unix_username
+ * SID to the sid array. The correct fix should probably be
+ * changing the server_info->sam_account user SID to be a
+ * S-1-22 Unix SID, but this might break old configs where
+ * plaintext passwords were used with no SAM backend.
+ */
+
+ mem_ctx = talloc_init("make_server_info_pw_tmp");
+ if (!mem_ctx) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
+ unix_users_domain_name(),
+ unix_username );
+ if (!qualified_name) {
+ TALLOC_FREE(result);
+ TALLOC_FREE(mem_ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
+ NULL, NULL,
+ &u_sid, &type)) {
+ TALLOC_FREE(result);
+ TALLOC_FREE(mem_ctx);
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ TALLOC_FREE(mem_ctx);
+
+ if (type != SID_NAME_USER) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ if (!add_sid_to_array_unique(result, &u_sid,
+ &result->sids,
+ &result->num_sids)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
/* For now we throw away the gids and convert via sid_to_gid
* later. This needs fixing, but I'd like to get the code straight and
* simple first. */
struct samu *sampass = NULL;
DOM_SID guest_sid;
BOOL ret;
- static const char zeros[16];
+ static const char zeros[16] = { 0, };
if ( !(sampass = samu_new( NULL )) ) {
return NT_STATUS_NO_MEMORY;
dst->gid = src->gid;
dst->n_groups = src->n_groups;
if (src->n_groups != 0) {
- dst->groups = talloc_memdup(dst, src->groups,
- sizeof(gid_t)*dst->n_groups);
+ dst->groups = (gid_t *)TALLOC_MEMDUP(
+ dst, src->groups, sizeof(gid_t)*dst->n_groups);
} else {
dst->groups = NULL;
}
gid_t *groups;
NT_USER_TOKEN *nt_token;
- groups = memdup(src->ut.groups, sizeof(gid_t) * src->ut.ngroups);
+ groups = (gid_t *)memdup(src->ut.groups,
+ sizeof(gid_t) * src->ut.ngroups);
if ((src->ut.ngroups != 0) && (groups == NULL)) {
return False;
}
gid_t *groups;
NT_USER_TOKEN *nt_token;
- groups = memdup(guest_info->groups,
- sizeof(gid_t) * guest_info->n_groups);
+ groups = (gid_t *)memdup(guest_info->groups,
+ sizeof(gid_t) * guest_info->n_groups);
if (groups == NULL) {
return False;
}
auth_serversupplied_info **server_info,
NET_USER_INFO_3 *info3)
{
- static const char zeros[16];
+ static const char zeros[16] = { 0, };
NTSTATUS nt_status = NT_STATUS_OK;
char *found_username;
return NT_STATUS_NO_MEMORY;
}
+ if (!pdb_set_pass_last_set_time(
+ sam_account,
+ nt_time_to_unix(info3->pass_last_set_time),
+ PDB_CHANGED)) {
+ TALLOC_FREE(sam_account);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_pass_can_change_time(
+ sam_account,
+ nt_time_to_unix(info3->pass_can_change_time),
+ PDB_CHANGED)) {
+ TALLOC_FREE(sam_account);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_pass_must_change_time(
+ sam_account,
+ nt_time_to_unix(info3->pass_must_change_time),
+ PDB_CHANGED)) {
+ TALLOC_FREE(sam_account);
+ return NT_STATUS_NO_MEMORY;
+ }
+
result = make_server_info(NULL);
if (result == NULL) {
DEBUG(4, ("make_server_info failed!\n"));
TALLOC_FREE(result);
return NT_STATUS_INVALID_PARAMETER;
}
- add_sid_to_array(result, &sid, &result->sids,
- &result->num_sids);
+ if (!add_sid_to_array(result, &sid, &result->sids,
+ &result->num_sids)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
}
/* Copy 'other' sids. We need to do sid filtering here to
*/
for (i = 0; i < info3->num_other_sids; i++) {
- add_sid_to_array(result, &info3->other_sids[i].sid,
- &result->sids,
- &result->num_sids);
+ if (!add_sid_to_array(result, &info3->other_sids[i].sid,
+ &result->sids,
+ &result->num_sids)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
}
result->login_server = unistr2_tdup(result,
/* ensure we are never given NULL session keys */
if (memcmp(info3->user_sess_key, zeros, sizeof(zeros)) == 0) {
- result->user_session_key = data_blob(NULL, 0);
+ result->user_session_key = data_blob_null;
} else {
result->user_session_key = data_blob_talloc(
result, info3->user_sess_key,
}
if (memcmp(info3->lm_sess_key, zeros, 8) == 0) {
- result->lm_session_key = data_blob(NULL, 0);
+ result->lm_session_key = data_blob_null;
} else {
result->lm_session_key = data_blob_talloc(
result, info3->lm_sess_key,
return True;
}
-/****************************************************************************
- Duplicate a SID token.
-****************************************************************************/
-
-NT_USER_TOKEN *dup_nt_token(TALLOC_CTX *mem_ctx, NT_USER_TOKEN *ptoken)
-{
- NT_USER_TOKEN *token;
-
- if (!ptoken)
- return NULL;
-
- token = TALLOC_P(mem_ctx, NT_USER_TOKEN);
- if (token == NULL) {
- DEBUG(0, ("talloc failed\n"));
- return NULL;
- }
-
- token->user_sids = talloc_memdup(token, ptoken->user_sids,
- sizeof(DOM_SID) * ptoken->num_sids );
-
- if ((ptoken->user_sids != NULL) && (token->user_sids == NULL)) {
- DEBUG(0, ("talloc_memdup failed\n"));
- TALLOC_FREE(token);
- return NULL;
- }
-
- token->num_sids = ptoken->num_sids;
-
- /* copy the privileges; don't consider failure to be critical here */
-
- if ( !se_priv_copy( &token->privileges, &ptoken->privileges ) ) {
- DEBUG(0,("dup_nt_token: Failure to copy SE_PRIV!. "
- "Continuing with 0 privileges assigned.\n"));
- }
-
- return token;
-}
-
-/****************************************************************************
- Check for a SID in an NT_USER_TOKEN
-****************************************************************************/
-
-BOOL nt_token_check_sid ( const DOM_SID *sid, const NT_USER_TOKEN *token )
-{
- int i;
-
- if ( !sid || !token )
- return False;
-
- for ( i=0; i<token->num_sids; i++ ) {
- if ( sid_equal( sid, &token->user_sids[i] ) )
- return True;
- }
-
- return False;
-}
-
-BOOL nt_token_check_domain_rid( NT_USER_TOKEN *token, uint32 rid )
-{
- DOM_SID domain_sid;
-
- /* if we are a domain member, the get the domain SID, else for
- a DC or standalone server, use our own SID */
-
- if ( lp_server_role() == ROLE_DOMAIN_MEMBER ) {
- if ( !secrets_fetch_domain_sid( lp_workgroup(),
- &domain_sid ) ) {
- DEBUG(1,("nt_token_check_domain_rid: Cannot lookup "
- "SID for domain [%s]\n", lp_workgroup()));
- return False;
- }
- }
- else
- sid_copy( &domain_sid, get_global_sam_sid() );
-
- sid_append_rid( &domain_sid, rid );
-
- return nt_token_check_sid( &domain_sid, token );\
-}
-
/**
* Verify whether or not given domain is trusted.
*
become_root();
DEBUG (5,("is_trusted_domain: Checking for domain trust with "
"[%s]\n", dom_name ));
- ret = secrets_fetch_trusted_domain_password(dom_name, NULL,
- NULL, NULL);
+ ret = pdb_get_trusteddom_pw(dom_name, NULL, NULL, NULL);
unbecome_root();
if (ret)
return True;