source3/auth/auth_util.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    Authentication utility functions
   5    Copyright (C) Andrew Tridgell 1992-1998
   6    Copyright (C) Andrew Bartlett 2001
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  21 */
  22
  23 #include "includes.h"
  24
  25 /* Data to do lanman1/2 password challenge. */
  26 static unsigned char saved_challenge[8];
  27 static BOOL challenge_sent=False;
  28 extern fstring remote_machine;
  29 extern pstring global_myname;
  30
  31 /*******************************************************************
  32 Get the next challenge value - no repeats.
  33 ********************************************************************/
  34 void generate_next_challenge(char *challenge)
  35 {
  36         unsigned char buf[8];
  37
  38         generate_random_buffer(buf,8,False);
  39         memcpy(saved_challenge, buf, 8);
  40         memcpy(challenge,buf,8);
  41         challenge_sent = True;
  42 }
  43
  44 /*******************************************************************
  45 set the last challenge sent, usually from a password server
  46 ********************************************************************/
  47 BOOL set_challenge(unsigned char *challenge)
  48 {
  49         memcpy(saved_challenge,challenge,8);
  50         challenge_sent = True;
  51         return(True);
  52 }
  53
  54 /*******************************************************************
  55 get the last challenge sent
  56 ********************************************************************/
  57 BOOL last_challenge(unsigned char *challenge)
  58 {
  59         if (!challenge_sent) return(False);
  60         memcpy(challenge,saved_challenge,8);
  61         return(True);
  62 }
  63
  64
  65 /****************************************************************************
  66  Create a UNIX user on demand.
  67 ****************************************************************************/
  68
  69 static int smb_create_user(const char *unix_user, const char *homedir)
  70 {
  71         pstring add_script;
  72         int ret;
  73
  74         pstrcpy(add_script, lp_adduser_script());
  75         if (! *add_script) return -1;
  76         all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
  77         if (homedir)
  78                 all_string_sub(add_script, "%H", homedir, sizeof(pstring));
  79         ret = smbrun(add_script,NULL);
  80         DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
  81         return ret;
  82 }
  83
  84 /****************************************************************************
  85  Delete a UNIX user on demand.
  86 ****************************************************************************/
  87
  88 static int smb_delete_user(char *unix_user)
  89 {
  90         pstring del_script;
  91         int ret;
  92
  93         pstrcpy(del_script, lp_deluser_script());
  94         if (! *del_script) return -1;
  95         all_string_sub(del_script, "%u", unix_user, sizeof(pstring));
  96         ret = smbrun(del_script,NULL);
  97         DEBUG(3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
  98         return ret;
  99 }
 100
 101 /****************************************************************************
 102  Add and Delete UNIX users on demand, based on NTSTATUS codes.
 103 ****************************************************************************/
 104
 105 void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
 106 {
 107         struct passwd *pwd=NULL;
 108
 109         if (NT_STATUS_IS_OK(nt_status)) {
 110
 111                 if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
 112
 113                         /*
 114                          * User validated ok against Domain controller.
 115                          * If the admin wants us to try and create a UNIX
 116                          * user on the fly, do so.
 117                          */
 118
 119                         if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
 120                                 smb_create_user(user_info->internal_username.str, NULL);
 121                         }
 122                 } else {
 123                         if(lp_adduser_script()) {
 124                                 SMB_STRUCT_STAT st;
 125                                 const char *home_dir = pdb_get_homedir(server_info->sam_account);
 126                                 /*
 127                                  * Also call smb_create_user if the users home directory
 128                                  * doesn't exist. Used with winbindd to allow the script to
 129                                  * create the home directory for a user mapped with winbindd.
 130                                  */
 131
 132                                 if (home_dir &&
 133                                     (sys_stat(home_dir, &st) == -1) && (errno == ENOENT)) {
 134                                         smb_create_user(user_info->internal_username.str, home_dir);
 135                                 }
 136                         }
 137                 }
 138         } else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
 139                 /*
 140                  * User failed to validate ok against Domain controller.
 141                  * If the failure was "user doesn't exist" and admin
 142                  * wants us to try and delete that UNIX user on the fly,
 143                  * do so.
 144                  */
 145                 if (lp_deluser_script()) {
 146                         smb_delete_user(user_info->internal_username.str);
 147                 }
 148         }
 149 }
 150
 151 /****************************************************************************
 152  Create an auth_usersupplied_data structure
 153 ****************************************************************************/
 154
 155 BOOL make_user_info(auth_usersupplied_info **user_info,
 156                     char *smb_name, char *internal_username,
 157                     char *client_domain, char *domain,
 158                     char *wksta_name, DATA_BLOB sec_blob,
 159                     DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
 160                     DATA_BLOB plaintext,
 161                     uint32 ntlmssp_flags, BOOL encrypted)
 162 {
 163
 164         DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
 165
 166         *user_info = malloc(sizeof(**user_info));
 167         if (!user_info) {
 168                 DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info)));
 169                 return False;
 170         }
 171
 172         ZERO_STRUCTP(*user_info);
 173
 174         DEBUG(5,("makeing strings for %s's user_info struct\n", internal_username));
 175
 176         (*user_info)->smb_name.str = strdup(smb_name);
 177         if ((*user_info)->smb_name.str) {
 178                 (*user_info)->smb_name.len = strlen(smb_name);
 179         } else {
 180                 free_user_info(user_info);
 181                 return False;
 182         }
 183
 184         (*user_info)->internal_username.str = strdup(internal_username);
 185         if ((*user_info)->internal_username.str) {
 186                 (*user_info)->internal_username.len = strlen(internal_username);
 187         } else {
 188                 free_user_info(user_info);
 189                 return False;
 190         }
 191
 192         (*user_info)->domain.str = strdup(domain);
 193         if ((*user_info)->domain.str) {
 194                 (*user_info)->domain.len = strlen(domain);
 195         } else {
 196                 free_user_info(user_info);
 197                 return False;
 198         }
 199
 200         (*user_info)->client_domain.str = strdup(client_domain);
 201         if ((*user_info)->client_domain.str) {
 202                 (*user_info)->client_domain.len = strlen(client_domain);
 203         } else {
 204                 free_user_info(user_info);
 205                 return False;
 206         }
 207
 208         (*user_info)->wksta_name.str = strdup(wksta_name);
 209         if ((*user_info)->wksta_name.str) {
 210                 (*user_info)->wksta_name.len = strlen(wksta_name);
 211         } else {
 212                 free_user_info(user_info);
 213                 return False;
 214         }
 215
 216         DEBUG(5,("makeing blobs for %s's user_info struct\n", internal_username));
 217
 218         (*user_info)->sec_blob = data_blob(sec_blob.data, sec_blob.length);
 219         (*user_info)->lm_resp = data_blob(lm_pwd.data, lm_pwd.length);
 220         (*user_info)->nt_resp = data_blob(nt_pwd.data, nt_pwd.length);
 221         (*user_info)->plaintext_password = data_blob(plaintext.data, plaintext.length);
 222
 223         (*user_info)->encrypted = encrypted;
 224         (*user_info)->ntlmssp_flags = ntlmssp_flags;
 225
 226         DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
 227
 228         return True;
 229 }
 230
 231 /****************************************************************************
 232  Create an auth_usersupplied_data structure after appropriate mapping.
 233 ****************************************************************************/
 234
 235 BOOL make_user_info_map(auth_usersupplied_info **user_info,
 236                         char *smb_name,
 237                         char *client_domain,
 238                         char *wksta_name, DATA_BLOB sec_blob,
 239                         DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
 240                         DATA_BLOB plaintext,
 241                         uint32 ntlmssp_flags, BOOL encrypted)
 242 {
 243         char *domain;
 244         fstring internal_username;
 245         fstrcpy(internal_username, smb_name);
 246         map_username(internal_username);
 247
 248         if (lp_allow_trusted_domains()) {
 249                 domain = client_domain;
 250         } else {
 251                 domain = lp_workgroup();
 252         }
 253
 254         return make_user_info(user_info,
 255                               smb_name, internal_username,
 256                               client_domain, domain,
 257                               wksta_name, sec_blob,
 258                               lm_pwd, nt_pwd,
 259                               plaintext,
 260                               ntlmssp_flags, encrypted);
 261
 262 }
 263
 264 /****************************************************************************
 265  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 266  Decrupt and encrypt the passwords.
 267 ****************************************************************************/
 268
 269 BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
 270                                      char *smb_name,
 271                                      char *client_domain,
 272                                      char *wksta_name, uchar chal[8],
 273                                      uchar *lm_network_pwd, int lm_pwd_len,
 274                                      uchar *nt_network_pwd, int nt_pwd_len)
 275 {
 276         BOOL ret;
 277         DATA_BLOB sec_blob = data_blob(chal, sizeof(chal));
 278         DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
 279         DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
 280         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 281         uint32 ntlmssp_flags = 0;
 282
 283         if (lm_pwd_len)
 284                 ntlmssp_flags |= NTLMSSP_NEGOTIATE_OEM;
 285         if (nt_pwd_len)
 286                 ntlmssp_flags |= NTLMSSP_NEGOTIATE_NTLM;
 287
 288         ret = make_user_info_map(user_info,
 289                                  smb_name, client_domain,
 290                                  wksta_name, sec_blob,
 291                                  nt_blob, lm_blob,
 292                                  plaintext_blob,
 293                                  ntlmssp_flags, True);
 294
 295         data_blob_free(&lm_blob);
 296         data_blob_free(&nt_blob);
 297         return ret;
 298 }
 299
 300 /****************************************************************************
 301  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 302  Decrupt and encrypt the passwords.
 303 ****************************************************************************/
 304
 305 BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
 306                                 char *smb_name,
 307                                 char *client_domain,
 308                                 char *wksta_name,
 309                                 uchar *lm_interactive_pwd, int lm_pwd_len,
 310                                 uchar *nt_interactive_pwd, int nt_pwd_len,
 311                                 uchar *dc_sess_key)
 312 {
 313         char nt_pwd[16];
 314         char lm_pwd[16];
 315         unsigned char local_lm_response[24];
 316         unsigned char local_nt_response[24];
 317         unsigned char key[16];
 318         uint8 chal[8];
 319         uint32 ntlmssp_flags = 0;
 320
 321         generate_random_buffer(chal, 8, False);
 322
 323         memset(key, 0, 16);
 324         memcpy(key, dc_sess_key, 8);
 325
 326         memcpy(lm_pwd, lm_interactive_pwd, 16);
 327         memcpy(nt_pwd, nt_interactive_pwd, 16);
 328
 329 #ifdef DEBUG_PASSWORD
 330         DEBUG(100,("key:"));
 331         dump_data(100, (char *)key, 16);
 332
 333         DEBUG(100,("lm owf password:"));
 334         dump_data(100, lm_pwd, 16);
 335
 336         DEBUG(100,("nt owf password:"));
 337         dump_data(100, nt_pwd, 16);
 338 #endif
 339
 340         SamOEMhash((uchar *)lm_pwd, key, 16);
 341         SamOEMhash((uchar *)nt_pwd, key, 16);
 342
 343 #ifdef DEBUG_PASSWORD
 344         DEBUG(100,("decrypt of lm owf password:"));
 345         dump_data(100, lm_pwd, 16);
 346
 347         DEBUG(100,("decrypt of nt owf password:"));
 348         dump_data(100, nt_pwd, 16);
 349 #endif
 350
 351         generate_random_buffer(chal, 8, False);
 352         SMBOWFencrypt((const unsigned char *)lm_pwd, chal, local_lm_response);
 353         SMBOWFencrypt((const unsigned char *)nt_pwd, chal, local_nt_response);
 354
 355         /* Password info parinoia */
 356         ZERO_STRUCT(lm_pwd);
 357         ZERO_STRUCT(nt_pwd);
 358         ZERO_STRUCT(key);
 359
 360         {
 361                 BOOL ret;
 362                 DATA_BLOB sec_blob = data_blob(chal, sizeof(chal));
 363                 DATA_BLOB local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
 364                 DATA_BLOB local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
 365                 DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 366
 367                 ntlmssp_flags = NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_NTLM;
 368                 ret = make_user_info_map(user_info,
 369                                          smb_name, client_domain,
 370                                          wksta_name, sec_blob,
 371                                          local_nt_blob,
 372                                          local_lm_blob,
 373                                          plaintext_blob,
 374                                          ntlmssp_flags, True);
 375
 376                 data_blob_free(&local_lm_blob);
 377                 data_blob_free(&local_nt_blob);
 378                 return ret;
 379         }
 380 }
 381
 382 /****************************************************************************
 383  Create an auth_usersupplied_data structure
 384 ****************************************************************************/
 385
 386 BOOL make_user_info_for_winbind(auth_usersupplied_info **user_info,
 387                                 char *username,
 388                                 char *domain,
 389                                 char *password)
 390 {
 391         unsigned char local_lm_response[24];
 392         unsigned char local_nt_response[24];
 393         char chal[8];
 394         DATA_BLOB local_lm_blob;
 395         DATA_BLOB local_nt_blob;
 396         DATA_BLOB plaintext_blob;
 397         uint32 ntlmssp_flags = 0;
 398
 399         /*
 400          * Not encrypted - do so.
 401          */
 402
 403         DEBUG(5,("pass_check_smb: User passwords not in encrypted format.\n"));
 404
 405         generate_random_buffer(chal, 8, False);
 406
 407         if (*password) {
 408                 SMBencrypt( (uchar *)password, chal, local_lm_response);
 409
 410                 /* This encrypts the lm_pwd feild, which actualy contains the password
 411                    rather than the nt_pwd field becouse that contains nothing */
 412
 413                 /* WATCH OUT. This doesn't work if the incoming password is incorrectly cased.
 414                    We might want to add a check here and only do an LM in that case */
 415
 416                 SMBNTencrypt((uchar *)password, chal, local_nt_response);
 417
 418                 local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
 419                 local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
 420                 plaintext_blob = data_blob(password, strlen(password)+1);
 421                 if ((!local_lm_blob.data) || (!local_nt_blob.data)|| (!plaintext_blob.data)) {
 422                         data_blob_free(&local_lm_blob);
 423                         data_blob_free(&local_nt_blob);
 424                         data_blob_clear_free(&plaintext_blob);
 425                         return False;
 426                 }
 427                 ntlmssp_flags = NTLMSSP_NEGOTIATE_OEM | NTLMSSP_NEGOTIATE_NTLM;
 428         } else {
 429                 local_lm_blob = data_blob(NULL, 0);
 430                 local_nt_blob = data_blob(NULL, 0);
 431                 plaintext_blob = data_blob(NULL, 0);
 432         }
 433
 434         {
 435                 BOOL ret;
 436                 DATA_BLOB sec_blob = data_blob(chal, sizeof(chal));
 437
 438                 if (!sec_blob.data) {
 439                         return False;
 440                 }
 441
 442                 ret = make_user_info(user_info,
 443                                      username, username,
 444                                      domain, domain,
 445                                      global_myname, sec_blob,
 446                                      local_nt_blob,
 447                                      local_lm_blob,
 448                                      plaintext_blob,
 449                                      ntlmssp_flags, False);
 450
 451                 data_blob_free(&local_lm_blob);
 452                 data_blob_free(&local_nt_blob);
 453                 data_blob_clear_free(&plaintext_blob);
 454                 return ret;
 455         }
 456 }
 457
 458 /****************************************************************************
 459  Create an auth_usersupplied_data, making the DATA_BLOBs here.
 460  Decrupt and encrypt the passwords.
 461 ****************************************************************************/
 462
 463 BOOL make_user_info_winbind_crap(auth_usersupplied_info **user_info,
 464                                  char *smb_name,
 465                                  char *client_domain,
 466                                  uchar chal[8],
 467                                  uchar *lm_network_pwd, int lm_pwd_len,
 468                                  uchar *nt_network_pwd, int nt_pwd_len)
 469 {
 470         BOOL ret;
 471         DATA_BLOB sec_blob = data_blob(chal, sizeof(chal));
 472         DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
 473         DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
 474         DATA_BLOB plaintext_blob = data_blob(NULL, 0);
 475         uint32 ntlmssp_flags = 0;
 476
 477         if (lm_pwd_len)
 478                 ntlmssp_flags |= NTLMSSP_NEGOTIATE_OEM;
 479         if (nt_pwd_len)
 480                 ntlmssp_flags |= NTLMSSP_NEGOTIATE_NTLM;
 481
 482         ret = make_user_info(user_info,
 483                              smb_name, smb_name,
 484                              client_domain, client_domain,
 485                              global_myname, sec_blob,
 486                              nt_blob, lm_blob,
 487                              plaintext_blob,
 488                              ntlmssp_flags, True);
 489
 490         data_blob_free(&lm_blob);
 491         data_blob_free(&nt_blob);
 492         return ret;
 493 }
 494
 495 /****************************************************************************
 496  Create an auth_usersupplied_data structure
 497 ****************************************************************************/
 498
 499 BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
 500                               char *smb_name,
 501                               char *client_domain,
 502                               DATA_BLOB lm_resp, DATA_BLOB nt_resp,
 503                               DATA_BLOB plaintext_password,
 504                               BOOL encrypted)
 505 {
 506         uchar chal[8];
 507
 508         DATA_BLOB local_lm_blob;
 509         DATA_BLOB local_nt_blob;
 510         DATA_BLOB sec_blob;
 511         BOOL ret = False;
 512         uint32 ntlmssp_flags = 0;
 513
 514         if (encrypted) {
 515                 DATA_BLOB no_plaintext_blob = data_blob(NULL, 0);
 516                 if (!last_challenge(chal)) {
 517                         DEBUG(0,("Encrypted login but no challange set!\n"));
 518                         return False;
 519                 }
 520                 sec_blob = data_blob(chal, 8);
 521
 522                 if (lm_resp.length == 24) {
 523                         ntlmssp_flags |= NTLMSSP_NEGOTIATE_OEM;
 524                 }
 525                 if (nt_resp.length == 0) {
 526                 } else if (nt_resp.length == 24) {
 527                         ntlmssp_flags |= NTLMSSP_NEGOTIATE_NTLM;
 528                 } else {
 529                         ntlmssp_flags |= NTLMSSP_NEGOTIATE_NTLM2;
 530                 }
 531
 532                 return make_user_info_map(user_info, smb_name,
 533                                           client_domain,
 534                                           remote_machine, sec_blob,
 535                                           lm_resp,
 536                                           nt_resp,
 537                                           no_plaintext_blob,
 538                                           ntlmssp_flags, encrypted);
 539         }
 540
 541         generate_random_buffer(chal, 8, False);
 542
 543         sec_blob = data_blob(chal, 8);
 544
 545         /*
 546          * Not encrypted - do so.
 547          */
 548
 549         DEBUG(5,("pass_check_smb: User passwords not in encrypted format.\n"));
 550
 551         if (plaintext_password.data) {
 552                 unsigned char local_lm_response[24];
 553
 554                 SMBencrypt( (uchar *)plaintext_password.data, chal, local_lm_response);
 555                 local_lm_blob = data_blob(local_lm_response, 24);
 556
 557                 /* We can't do an NT hash here, as the password needs to be case insensitive */
 558                 local_nt_blob = data_blob(NULL, 0);
 559
 560                 ntlmssp_flags = NTLMSSP_NEGOTIATE_OEM;
 561         } else {
 562                 local_lm_blob = data_blob(NULL, 0);
 563                 local_nt_blob = data_blob(NULL, 0);
 564         }
 565
 566         ret = make_user_info_map(user_info, smb_name,
 567                                  client_domain,
 568                                  remote_machine,
 569                                  sec_blob,
 570                                  local_lm_blob,
 571                                  local_nt_blob,
 572                                  plaintext_password,
 573                                  ntlmssp_flags, encrypted);
 574
 575         data_blob_free(&local_lm_blob);
 576         return ret;
 577 }
 578
 579 BOOL make_server_info(auth_serversupplied_info **server_info)
 580 {
 581         *server_info = malloc(sizeof(**server_info));
 582         if (!*server_info) {
 583                 DEBUG(0,("make_server_info_sam: malloc failed!\n"));
 584                 return False;
 585         }
 586         ZERO_STRUCTP(*server_info);
 587         return True;
 588 }
 589
 590 BOOL make_server_info_sam(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
 591 {
 592         if (!make_server_info(server_info)) {
 593                 return False;
 594         }
 595
 596         (*server_info)->sam_fill_level = SAM_FILL_ALL;
 597         (*server_info)->sam_account = sampass;
 598
 599         DEBUG(5,("make_server_info_sam: made sever info for user %s\n",
 600                  pdb_get_username((*server_info)->sam_account)));
 601         return True;
 602 }
 603
 604 BOOL make_server_info_pw(auth_serversupplied_info **server_info, struct passwd *pwd)
 605 {
 606         SAM_ACCOUNT *sampass = NULL;
 607         if (!pdb_init_sam_pw(&sampass, pwd)) {
 608                 return False;
 609         }
 610         return make_server_info_sam(server_info, sampass);
 611 }
 612
 613 void free_user_info(auth_usersupplied_info **user_info)
 614 {
 615         DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
 616         if (*user_info != NULL) {
 617                 if ((*user_info)->smb_name.str) {
 618                         DEBUG(10,("structure was created for %s\n", (*user_info)->smb_name.str));
 619                 }
 620                 SAFE_FREE((*user_info)->smb_name.str);
 621                 SAFE_FREE((*user_info)->internal_username.str);
 622                 SAFE_FREE((*user_info)->client_domain.str);
 623                 SAFE_FREE((*user_info)->domain.str);
 624                 data_blob_free(&(*user_info)->sec_blob);
 625                 data_blob_free(&(*user_info)->lm_resp);
 626                 data_blob_free(&(*user_info)->nt_resp);
 627                 SAFE_FREE((*user_info)->interactive_password);
 628                 data_blob_clear_free(&(*user_info)->plaintext_password);
 629                 ZERO_STRUCT(**user_info);
 630         }
 631         SAFE_FREE(*user_info);
 632 }
 633
 634 /***************************************************************************
 635  Clear out a server_info struct that has been allocated
 636 ***************************************************************************/
 637 void free_server_info(auth_serversupplied_info **server_info)
 638 {
 639         if (*server_info != NULL) {
 640                 pdb_free_sam(&(*server_info)->sam_account);
 641
 642                 /* call pam_end here, unless we know we are keeping it */
 643                 SAFE_FREE((*server_info)->group_rids);
 644
 645                 ZERO_STRUCT(**server_info);
 646         }
 647         SAFE_FREE(*server_info);
 648 }
 649
 650 /***************************************************************************
 651  Make a server_info struct for a guest user
 652 ***************************************************************************/
 653 void make_server_info_guest(auth_serversupplied_info **server_info)
 654 {
 655         struct passwd *pass = sys_getpwnam(lp_guestaccount(-1));
 656
 657         if (pass) {
 658                 make_server_info_pw(server_info, pass);
 659         }
 660 }
 661