91482e69f2e627acf88db00697f37599ff66ef17
[samba.git] / source3 / libnet / libnet_samsync_passdb.c
1 /*
2    Unix SMB/CIFS implementation.
3    dump the remote SAM using rpc samsync operations
4
5    Copyright (C) Andrew Tridgell 2002
6    Copyright (C) Tim Potter 2001,2002
7    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
8    Modified by Volker Lendecke 2002
9    Copyright (C) Jeremy Allison 2005.
10    Copyright (C) Guenther Deschner 2008.
11
12    This program is free software; you can redistribute it and/or modify
13    it under the terms of the GNU General Public License as published by
14    the Free Software Foundation; either version 3 of the License, or
15    (at your option) any later version.
16
17    This program is distributed in the hope that it will be useful,
18    but WITHOUT ANY WARRANTY; without even the implied warranty of
19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
20    GNU General Public License for more details.
21
22    You should have received a copy of the GNU General Public License
23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "system/passwd.h"
28 #include "libnet/libnet_samsync.h"
29 #include "../libcli/security/security.h"
30 #include "passdb.h"
31 #include "lib/util/base64.h"
32
33 /* Convert a struct samu_DELTA to a struct samu. */
34 #define STRING_CHANGED (old_string && !new_string) ||\
35                     (!old_string && new_string) ||\
36                 (old_string && new_string && (strcmp(old_string, new_string) != 0))
37
38 #define STRING_CHANGED_NC(s1,s2) ((s1) && !(s2)) ||\
39                     (!(s1) && (s2)) ||\
40                 ((s1) && (s2) && (strcmp((s1), (s2)) != 0))
41
42 /****************************************************************
43 ****************************************************************/
44
45 static NTSTATUS sam_account_from_delta(struct samu *account,
46                                        struct netr_DELTA_USER *r)
47 {
48         const char *old_string, *new_string;
49         time_t unix_time, stored_time;
50         uchar zero_buf[16];
51
52         memset(zero_buf, '\0', sizeof(zero_buf));
53
54         /* Username, fullname, home dir, dir drive, logon script, acct
55            desc, workstations, profile. */
56
57         if (r->account_name.string) {
58                 old_string = pdb_get_nt_username(account);
59                 new_string = r->account_name.string;
60
61                 if (STRING_CHANGED) {
62                         pdb_set_nt_username(account, new_string, PDB_CHANGED);
63                 }
64
65                 /* Unix username is the same - for sanity */
66                 old_string = pdb_get_username( account );
67                 if (STRING_CHANGED) {
68                         pdb_set_username(account, new_string, PDB_CHANGED);
69                 }
70         }
71
72         if (r->full_name.string) {
73                 old_string = pdb_get_fullname(account);
74                 new_string = r->full_name.string;
75
76                 if (STRING_CHANGED)
77                         pdb_set_fullname(account, new_string, PDB_CHANGED);
78         }
79
80         if (r->home_directory.string) {
81                 old_string = pdb_get_homedir(account);
82                 new_string = r->home_directory.string;
83
84                 if (STRING_CHANGED)
85                         pdb_set_homedir(account, new_string, PDB_CHANGED);
86         }
87
88         if (r->home_drive.string) {
89                 old_string = pdb_get_dir_drive(account);
90                 new_string = r->home_drive.string;
91
92                 if (STRING_CHANGED)
93                         pdb_set_dir_drive(account, new_string, PDB_CHANGED);
94         }
95
96         if (r->logon_script.string) {
97                 old_string = pdb_get_logon_script(account);
98                 new_string = r->logon_script.string;
99
100                 if (STRING_CHANGED)
101                         pdb_set_logon_script(account, new_string, PDB_CHANGED);
102         }
103
104         if (r->description.string) {
105                 old_string = pdb_get_acct_desc(account);
106                 new_string = r->description.string;
107
108                 if (STRING_CHANGED)
109                         pdb_set_acct_desc(account, new_string, PDB_CHANGED);
110         }
111
112         if (r->workstations.string) {
113                 old_string = pdb_get_workstations(account);
114                 new_string = r->workstations.string;
115
116                 if (STRING_CHANGED)
117                         pdb_set_workstations(account, new_string, PDB_CHANGED);
118         }
119
120         if (r->profile_path.string) {
121                 old_string = pdb_get_profile_path(account);
122                 new_string = r->profile_path.string;
123
124                 if (STRING_CHANGED)
125                         pdb_set_profile_path(account, new_string, PDB_CHANGED);
126         }
127
128         if (r->parameters.array) {
129                 DATA_BLOB mung;
130                 char *newstr = NULL;
131                 old_string = pdb_get_munged_dial(account);
132                 mung.length = r->parameters.length * 2;
133                 mung.data = (uint8_t *) r->parameters.array;
134
135                 if (mung.length != 0) {
136                         newstr = base64_encode_data_blob(talloc_tos(), mung);
137                         SMB_ASSERT(newstr != NULL);
138                 }
139
140                 if (STRING_CHANGED_NC(old_string, newstr))
141                         pdb_set_munged_dial(account, newstr, PDB_CHANGED);
142                 TALLOC_FREE(newstr);
143         }
144
145         /* User and group sid */
146         if (pdb_get_user_rid(account) != r->rid)
147                 pdb_set_user_sid_from_rid(account, r->rid, PDB_CHANGED);
148         if (pdb_get_group_rid(account) != r->primary_gid)
149                 pdb_set_group_sid_from_rid(account, r->primary_gid, PDB_CHANGED);
150
151         /* Logon and password information */
152         if (!nt_time_is_zero(&r->last_logon)) {
153                 unix_time = nt_time_to_unix(r->last_logon);
154                 stored_time = pdb_get_logon_time(account);
155                 if (stored_time != unix_time)
156                         pdb_set_logon_time(account, unix_time, PDB_CHANGED);
157         }
158
159         if (!nt_time_is_zero(&r->last_logoff)) {
160                 unix_time = nt_time_to_unix(r->last_logoff);
161                 stored_time = pdb_get_logoff_time(account);
162                 if (stored_time != unix_time)
163                         pdb_set_logoff_time(account, unix_time,PDB_CHANGED);
164         }
165
166         /* Logon Divs */
167         if (pdb_get_logon_divs(account) != r->logon_hours.units_per_week)
168                 pdb_set_logon_divs(account, r->logon_hours.units_per_week, PDB_CHANGED);
169
170 #if 0
171         /* no idea what to do with this one - gd */
172         /* Max Logon Hours */
173         if (delta->unknown1 != pdb_get_unknown_6(account)) {
174                 pdb_set_unknown_6(account, delta->unknown1, PDB_CHANGED);
175         }
176 #endif
177         /* Logon Hours Len */
178         if (r->logon_hours.units_per_week/8 != pdb_get_hours_len(account)) {
179                 pdb_set_hours_len(account, r->logon_hours.units_per_week/8, PDB_CHANGED);
180         }
181
182         /* Logon Hours */
183         if (r->logon_hours.bits) {
184                 char oldstr[44], newstr[44];
185                 pdb_sethexhours(oldstr, pdb_get_hours(account));
186                 pdb_sethexhours(newstr, r->logon_hours.bits);
187                 if (!strequal(oldstr, newstr))
188                         pdb_set_hours(account, r->logon_hours.bits,
189                                       pdb_get_hours_len(account), PDB_CHANGED);
190         }
191
192         if (pdb_get_bad_password_count(account) != r->bad_password_count)
193                 pdb_set_bad_password_count(account, r->bad_password_count, PDB_CHANGED);
194
195         if (pdb_get_logon_count(account) != r->logon_count)
196                 pdb_set_logon_count(account, r->logon_count, PDB_CHANGED);
197
198         if (!nt_time_is_zero(&r->last_password_change)) {
199                 unix_time = nt_time_to_unix(r->last_password_change);
200                 stored_time = pdb_get_pass_last_set_time(account);
201                 if (stored_time != unix_time)
202                         pdb_set_pass_last_set_time(account, unix_time, PDB_CHANGED);
203         } else {
204                 /* no last set time, make it now */
205                 pdb_set_pass_last_set_time(account, time(NULL), PDB_CHANGED);
206         }
207
208         if (!nt_time_is_zero(&r->acct_expiry)) {
209                 unix_time = nt_time_to_unix(r->acct_expiry);
210                 stored_time = pdb_get_kickoff_time(account);
211                 if (stored_time != unix_time)
212                         pdb_set_kickoff_time(account, unix_time, PDB_CHANGED);
213         }
214
215         /* Decode hashes from password hash
216            Note that win2000 may send us all zeros for the hashes if it doesn't
217            think this channel is secure enough - don't set the passwords at all
218            in that case
219         */
220         if (memcmp(r->lmpassword.hash, zero_buf, 16) != 0) {
221                 pdb_set_lanman_passwd(account, r->lmpassword.hash, PDB_CHANGED);
222         }
223
224         if (memcmp(r->ntpassword.hash, zero_buf, 16) != 0) {
225                 pdb_set_nt_passwd(account, r->ntpassword.hash, PDB_CHANGED);
226         }
227
228         /* TODO: account expiry time */
229
230         pdb_set_acct_ctrl(account, r->acct_flags, PDB_CHANGED);
231
232         pdb_set_domain(account, lp_workgroup(), PDB_CHANGED);
233
234         return NT_STATUS_OK;
235 }
236
237
238 /****************************************************************
239 ****************************************************************/
240
241 static NTSTATUS smb_create_user(TALLOC_CTX *mem_ctx,
242                                 uint32_t acct_flags,
243                                 const char *account,
244                                 struct passwd **passwd_p)
245 {
246         struct passwd *passwd;
247         char *add_script = NULL;
248
249         passwd = Get_Pwnam_alloc(mem_ctx, account);
250         if (passwd) {
251                 *passwd_p = passwd;
252                 return NT_STATUS_OK;
253         }
254
255         /* Create appropriate user */
256         if (acct_flags & ACB_NORMAL) {
257                 add_script = lp_add_user_script(mem_ctx);
258         } else if ( (acct_flags & ACB_WSTRUST) ||
259                     (acct_flags & ACB_SVRTRUST) ||
260                     (acct_flags & ACB_DOMTRUST) ) {
261                 add_script = lp_add_machine_script(mem_ctx);
262         } else {
263                 DEBUG(1, ("Unknown user type: %s\n",
264                           pdb_encode_acct_ctrl(acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
265                 return NT_STATUS_UNSUCCESSFUL;
266         }
267
268         if (!add_script) {
269                 return NT_STATUS_NO_MEMORY;
270         }
271
272         if (*add_script) {
273                 int add_ret;
274                 add_script = talloc_all_string_sub(mem_ctx, add_script,
275                                                    "%u", account);
276                 if (!add_script) {
277                         return NT_STATUS_NO_MEMORY;
278                 }
279                 add_ret = smbrun(add_script, NULL);
280                 DEBUG(add_ret ? 0 : 1,("fetch_account: Running the command `%s' "
281                          "gave %d\n", add_script, add_ret));
282                 if (add_ret == 0) {
283                         smb_nscd_flush_user_cache();
284                 }
285         }
286
287         /* try and find the possible unix account again */
288         passwd = Get_Pwnam_alloc(mem_ctx, account);
289         if (!passwd) {
290                 return NT_STATUS_NO_SUCH_USER;
291         }
292
293         *passwd_p = passwd;
294
295         return NT_STATUS_OK;
296 }
297 /****************************************************************
298 ****************************************************************/
299
300 static NTSTATUS fetch_account_info(TALLOC_CTX *mem_ctx,
301                                    uint32_t rid,
302                                    struct netr_DELTA_USER *r)
303 {
304
305         NTSTATUS nt_ret = NT_STATUS_UNSUCCESSFUL;
306         fstring account;
307         struct samu *sam_account=NULL;
308         GROUP_MAP *map = NULL;
309         struct group *grp;
310         struct dom_sid user_sid;
311         struct dom_sid group_sid;
312         struct passwd *passwd = NULL;
313         fstring sid_string;
314
315         fstrcpy(account, r->account_name.string);
316         d_printf("Creating account: %s\n", account);
317
318         if ( !(sam_account = samu_new(mem_ctx)) ) {
319                 return NT_STATUS_NO_MEMORY;
320         }
321
322         nt_ret = smb_create_user(sam_account, r->acct_flags, account, &passwd);
323         if (!NT_STATUS_IS_OK(nt_ret)) {
324                 d_fprintf(stderr, "Could not create posix account info for '%s'\n",
325                         account);
326                 goto done;
327         }
328
329         sid_compose(&user_sid, get_global_sam_sid(), r->rid);
330
331         DEBUG(3, ("Attempting to find SID %s for user %s in the passdb\n",
332                   sid_to_fstring(sid_string, &user_sid), account));
333         if (!pdb_getsampwsid(sam_account, &user_sid)) {
334                 sam_account_from_delta(sam_account, r);
335                 DEBUG(3, ("Attempting to add user SID %s for user %s in the passdb\n",
336                           sid_to_fstring(sid_string, &user_sid),
337                           pdb_get_username(sam_account)));
338                 if (!NT_STATUS_IS_OK(pdb_add_sam_account(sam_account))) {
339                         DEBUG(1, ("SAM Account for %s failed to be added to the passdb!\n",
340                                   account));
341                         return NT_STATUS_ACCESS_DENIED;
342                 }
343         } else {
344                 sam_account_from_delta(sam_account, r);
345                 DEBUG(3, ("Attempting to update user SID %s for user %s in the passdb\n",
346                           sid_to_fstring(sid_string, &user_sid),
347                           pdb_get_username(sam_account)));
348                 if (!NT_STATUS_IS_OK(pdb_update_sam_account(sam_account))) {
349                         DEBUG(1, ("SAM Account for %s failed to be updated in the passdb!\n",
350                                   account));
351                         TALLOC_FREE(sam_account);
352                         return NT_STATUS_ACCESS_DENIED;
353                 }
354         }
355
356         if (pdb_get_group_sid(sam_account) == NULL) {
357                 return NT_STATUS_UNSUCCESSFUL;
358         }
359
360         group_sid = *pdb_get_group_sid(sam_account);
361
362         map = talloc_zero(mem_ctx, GROUP_MAP);
363         if (!map) {
364                 return NT_STATUS_NO_MEMORY;
365         }
366
367         if (!pdb_getgrsid(map, group_sid)) {
368                 DEBUG(0, ("Primary group of %s has no mapping!\n",
369                           pdb_get_username(sam_account)));
370         } else {
371                 if (map->gid != passwd->pw_gid) {
372                         if (!(grp = getgrgid(map->gid))) {
373                                 DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n",
374                                           (unsigned long)map->gid, pdb_get_username(sam_account), sid_string_tos(&group_sid)));
375                         } else {
376                                 smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account));
377                         }
378                 }
379         }
380
381         if ( !passwd ) {
382                 DEBUG(1, ("No unix user for this account (%s), cannot adjust mappings\n",
383                         pdb_get_username(sam_account)));
384         }
385
386  done:
387         TALLOC_FREE(sam_account);
388         TALLOC_FREE(map);
389         return nt_ret;
390 }
391
392 /****************************************************************
393 ****************************************************************/
394
395 static NTSTATUS fetch_group_info(TALLOC_CTX *mem_ctx,
396                                  uint32_t rid,
397                                  struct netr_DELTA_GROUP *r)
398 {
399         struct group *grp = NULL;
400         struct dom_sid group_sid;
401         fstring sid_string;
402         GROUP_MAP *map;
403         bool insert = true;
404
405         map = talloc_zero(mem_ctx, GROUP_MAP);
406         if (!map) {
407                 return NT_STATUS_NO_MEMORY;
408         }
409         /* add the group to the mapping table */
410         sid_compose(&group_sid, get_global_sam_sid(), rid);
411         sid_to_fstring(sid_string, &group_sid);
412
413         if (pdb_getgrsid(map, group_sid)) {
414                 if (map->gid != -1) {
415                         grp = getgrgid(map->gid);
416                 }
417                 insert = false;
418         }
419
420         map->nt_name = talloc_strdup(map, r->group_name.string);
421         if (!map->nt_name) {
422                 return NT_STATUS_NO_MEMORY;
423         }
424         map->comment = talloc_strdup(map, r->description.string);
425         if (!map->comment) {
426                 return NT_STATUS_NO_MEMORY;
427         }
428
429         if (grp == NULL) {
430                 gid_t gid;
431
432                 /* No group found from mapping, find it from its name. */
433                 if ((grp = getgrnam(map->nt_name)) == NULL) {
434
435                         /* No appropriate group found, create one */
436
437                         d_printf("Creating unix group: '%s'\n", map->nt_name);
438
439                         if (smb_create_group(map->nt_name, &gid) != 0)
440                                 return NT_STATUS_ACCESS_DENIED;
441
442                         if ((grp = getgrnam(map->nt_name)) == NULL)
443                                 return NT_STATUS_ACCESS_DENIED;
444                 }
445         }
446
447         map->gid = grp->gr_gid;
448         map->sid = group_sid;
449         map->sid_name_use = SID_NAME_DOM_GRP;
450
451         if (insert) {
452                 pdb_add_group_mapping_entry(map);
453         } else {
454                 pdb_update_group_mapping_entry(map);
455         }
456
457         TALLOC_FREE(map);
458         return NT_STATUS_OK;
459 }
460
461 /****************************************************************
462 ****************************************************************/
463
464 static NTSTATUS fetch_group_mem_info(TALLOC_CTX *mem_ctx,
465                                      uint32_t rid,
466                                      struct netr_DELTA_GROUP_MEMBER *r)
467 {
468         int i;
469         char **nt_members = NULL;
470         char **unix_members;
471         struct dom_sid group_sid;
472         GROUP_MAP *map;
473         struct group *grp;
474
475         if (r->num_rids == 0) {
476                 return NT_STATUS_OK;
477         }
478
479         sid_compose(&group_sid, get_global_sam_sid(), rid);
480
481         map = talloc_zero(mem_ctx, GROUP_MAP);
482         if (!map) {
483                 return NT_STATUS_NO_MEMORY;
484         }
485
486         if (!get_domain_group_from_sid(group_sid, map)) {
487                 DEBUG(0, ("Could not find global group %d\n", rid));
488                 TALLOC_FREE(map);
489                 return NT_STATUS_NO_SUCH_GROUP;
490         }
491
492         if (!(grp = getgrgid(map->gid))) {
493                 DEBUG(0, ("Could not find unix group %lu\n",
494                                                 (unsigned long)map->gid));
495                 TALLOC_FREE(map);
496                 return NT_STATUS_NO_SUCH_GROUP;
497         }
498
499         TALLOC_FREE(map);
500
501         d_printf("Group members of %s: ", grp->gr_name);
502
503         if (r->num_rids) {
504                 if ((nt_members = talloc_zero_array(mem_ctx, char *, r->num_rids)) == NULL) {
505                         DEBUG(0, ("talloc failed\n"));
506                         return NT_STATUS_NO_MEMORY;
507                 }
508         } else {
509                 nt_members = NULL;
510         }
511
512         for (i=0; i < r->num_rids; i++) {
513                 struct samu *member = NULL;
514                 struct dom_sid member_sid;
515
516                 if ( !(member = samu_new(mem_ctx)) ) {
517                         return NT_STATUS_NO_MEMORY;
518                 }
519
520                 sid_compose(&member_sid, get_global_sam_sid(), r->rids[i]);
521
522                 if (!pdb_getsampwsid(member, &member_sid)) {
523                         DEBUG(1, ("Found bogus group member: %d (member_sid=%s group=%s)\n",
524                                   r->rids[i], sid_string_tos(&member_sid), grp->gr_name));
525                         TALLOC_FREE(member);
526                         continue;
527                 }
528
529                 if (pdb_get_group_rid(member) == rid) {
530                         d_printf("%s(primary),", pdb_get_username(member));
531                         TALLOC_FREE(member);
532                         continue;
533                 }
534
535                 d_printf("%s,", pdb_get_username(member));
536                 nt_members[i] = talloc_strdup(mem_ctx, pdb_get_username(member));
537                 TALLOC_FREE(member);
538         }
539
540         d_printf("\n");
541
542         unix_members = grp->gr_mem;
543
544         while (*unix_members) {
545                 bool is_nt_member = false;
546                 for (i=0; i < r->num_rids; i++) {
547                         if (nt_members[i] == NULL) {
548                                 /* This was a primary group */
549                                 continue;
550                         }
551
552                         if (strcmp(*unix_members, nt_members[i]) == 0) {
553                                 is_nt_member = true;
554                                 break;
555                         }
556                 }
557                 if (!is_nt_member) {
558                         /* We look at a unix group member that is not
559                            an nt group member. So, remove it. NT is
560                            boss here. */
561                         smb_delete_user_group(grp->gr_name, *unix_members);
562                 }
563                 unix_members += 1;
564         }
565
566         for (i=0; i < r->num_rids; i++) {
567                 bool is_unix_member = false;
568
569                 if (nt_members[i] == NULL) {
570                         /* This was the primary group */
571                         continue;
572                 }
573
574                 unix_members = grp->gr_mem;
575
576                 while (*unix_members) {
577                         if (strcmp(*unix_members, nt_members[i]) == 0) {
578                                 is_unix_member = true;
579                                 break;
580                         }
581                         unix_members += 1;
582                 }
583
584                 if (!is_unix_member) {
585                         /* We look at a nt group member that is not a
586                            unix group member currently. So, add the nt
587                            group member. */
588                         smb_add_user_group(grp->gr_name, nt_members[i]);
589                 }
590         }
591
592         return NT_STATUS_OK;
593 }
594
595 /****************************************************************
596 ****************************************************************/
597
598 static NTSTATUS fetch_alias_info(TALLOC_CTX *mem_ctx,
599                                  uint32_t rid,
600                                  struct netr_DELTA_ALIAS *r,
601                                  const struct dom_sid *dom_sid)
602 {
603         struct group *grp = NULL;
604         struct dom_sid alias_sid;
605         fstring sid_string;
606         GROUP_MAP *map;
607         bool insert = true;
608
609         map = talloc_zero(mem_ctx, GROUP_MAP);
610         if (!map) {
611                 return NT_STATUS_NO_MEMORY;
612         }
613
614         /* Find out whether the group is already mapped */
615         sid_compose(&alias_sid, dom_sid, rid);
616         sid_to_fstring(sid_string, &alias_sid);
617
618         if (pdb_getgrsid(map, alias_sid)) {
619                 grp = getgrgid(map->gid);
620                 insert = false;
621         }
622
623         map->nt_name = talloc_strdup(map, r->alias_name.string);
624         if (!map->nt_name) {
625                 return NT_STATUS_NO_MEMORY;
626         }
627         map->comment = talloc_strdup(map, r->description.string);
628         if (!map->comment) {
629                 return NT_STATUS_NO_MEMORY;
630         }
631
632         if (grp == NULL) {
633                 gid_t gid;
634
635                 /* No group found from mapping, find it from its name. */
636                 if ((grp = getgrnam(map->nt_name)) == NULL) {
637                         /* No appropriate group found, create one */
638                         d_printf("Creating unix group: '%s'\n", map->nt_name);
639                         if (smb_create_group(map->nt_name, &gid) != 0)
640                                 return NT_STATUS_ACCESS_DENIED;
641                         if ((grp = getgrgid(gid)) == NULL)
642                                 return NT_STATUS_ACCESS_DENIED;
643                 }
644         }
645
646         map->gid = grp->gr_gid;
647         map->sid = alias_sid;
648
649         if (dom_sid_equal(dom_sid, &global_sid_Builtin)) {
650                 map->sid_name_use = SID_NAME_WKN_GRP;
651         } else {
652                 map->sid_name_use = SID_NAME_ALIAS;
653         }
654
655         if (insert) {
656                 pdb_add_group_mapping_entry(map);
657         } else {
658                 pdb_update_group_mapping_entry(map);
659         }
660
661         TALLOC_FREE(map);
662         return NT_STATUS_OK;
663 }
664
665 /****************************************************************
666 ****************************************************************/
667
668 static NTSTATUS fetch_alias_mem(TALLOC_CTX *mem_ctx,
669                                 uint32_t rid,
670                                 struct netr_DELTA_ALIAS_MEMBER *r,
671                                 const struct dom_sid *dom_sid)
672 {
673         return NT_STATUS_OK;
674 }
675
676 /****************************************************************
677 ****************************************************************/
678
679 static NTSTATUS fetch_domain_info(TALLOC_CTX *mem_ctx,
680                                   uint32_t rid,
681                                   struct netr_DELTA_DOMAIN *r)
682 {
683         time_t u_max_age, u_min_age, u_logout;
684         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
685         const char *domname;
686         struct netr_AcctLockStr *lockstr = NULL;
687         NTSTATUS status;
688
689         status = pull_netr_AcctLockStr(mem_ctx, &r->account_lockout,
690                                        &lockstr);
691         if (!NT_STATUS_IS_OK(status)) {
692                 d_printf("failed to pull account lockout string: %s\n",
693                         nt_errstr(status));
694         }
695
696         u_max_age = uint64s_nt_time_to_unix_abs((uint64_t *)&r->max_password_age);
697         u_min_age = uint64s_nt_time_to_unix_abs((uint64_t *)&r->min_password_age);
698         u_logout = uint64s_nt_time_to_unix_abs((uint64_t *)&r->force_logoff_time);
699
700         domname = r->domain_name.string;
701         if (!domname) {
702                 return NT_STATUS_NO_MEMORY;
703         }
704
705         /* we don't handle BUILTIN account policies */
706         if (!strequal(domname, get_global_sam_name())) {
707                 printf("skipping SAM_DOMAIN_INFO delta for '%s' (is not my domain)\n", domname);
708                 return NT_STATUS_OK;
709         }
710
711
712         if (!pdb_set_account_policy(PDB_POLICY_PASSWORD_HISTORY,
713                                     r->password_history_length))
714                 return nt_status;
715
716         if (!pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
717                                     r->min_password_length))
718                 return nt_status;
719
720         if (!pdb_set_account_policy(PDB_POLICY_MAX_PASSWORD_AGE,
721                                     (uint32_t)u_max_age))
722                 return nt_status;
723
724         if (!pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_AGE,
725                                     (uint32_t)u_min_age))
726                 return nt_status;
727
728         if (!pdb_set_account_policy(PDB_POLICY_TIME_TO_LOGOUT,
729                                     (uint32_t)u_logout))
730                 return nt_status;
731
732         if (lockstr) {
733                 time_t u_lockoutreset, u_lockouttime;
734
735                 u_lockoutreset = uint64s_nt_time_to_unix_abs(&lockstr->reset_count);
736                 u_lockouttime = uint64s_nt_time_to_unix_abs((uint64_t *)&lockstr->lockout_duration);
737
738                 if (!pdb_set_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT,
739                                             lockstr->bad_attempt_lockout))
740                         return nt_status;
741
742                 if (!pdb_set_account_policy(PDB_POLICY_RESET_COUNT_TIME,
743                                             (uint32_t)u_lockoutreset/60))
744                         return nt_status;
745
746                 if (u_lockouttime != -1)
747                         u_lockouttime /= 60;
748
749                 if (!pdb_set_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION,
750                                             (uint32_t)u_lockouttime))
751                         return nt_status;
752         }
753
754         if (!pdb_set_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
755                                     r->logon_to_chgpass))
756                 return nt_status;
757
758         return NT_STATUS_OK;
759 }
760
761 /****************************************************************
762 ****************************************************************/
763
764 static NTSTATUS fetch_sam_entry(TALLOC_CTX *mem_ctx,
765                                 enum netr_SamDatabaseID database_id,
766                                 struct netr_DELTA_ENUM *r,
767                                 struct samsync_context *ctx)
768 {
769         NTSTATUS status = NT_STATUS_NOT_IMPLEMENTED;
770
771         switch (r->delta_type) {
772         case NETR_DELTA_USER:
773                 status = fetch_account_info(mem_ctx,
774                                             r->delta_id_union.rid,
775                                             r->delta_union.user);
776                 break;
777         case NETR_DELTA_GROUP:
778                 status = fetch_group_info(mem_ctx,
779                                           r->delta_id_union.rid,
780                                           r->delta_union.group);
781                 break;
782         case NETR_DELTA_GROUP_MEMBER:
783                 status = fetch_group_mem_info(mem_ctx,
784                                               r->delta_id_union.rid,
785                                               r->delta_union.group_member);
786                 break;
787         case NETR_DELTA_ALIAS:
788                 status = fetch_alias_info(mem_ctx,
789                                           r->delta_id_union.rid,
790                                           r->delta_union.alias,
791                                           ctx->domain_sid);
792                 break;
793         case NETR_DELTA_ALIAS_MEMBER:
794                 status = fetch_alias_mem(mem_ctx,
795                                          r->delta_id_union.rid,
796                                          r->delta_union.alias_member,
797                                          ctx->domain_sid);
798                 break;
799         case NETR_DELTA_DOMAIN:
800                 status = fetch_domain_info(mem_ctx,
801                                            r->delta_id_union.rid,
802                                            r->delta_union.domain);
803                 break;
804         /* The following types are recognised but not handled */
805         case NETR_DELTA_RENAME_GROUP:
806                 d_printf("NETR_DELTA_RENAME_GROUP not handled\n");
807                 break;
808         case NETR_DELTA_RENAME_USER:
809                 d_printf("NETR_DELTA_RENAME_USER not handled\n");
810                 break;
811         case NETR_DELTA_RENAME_ALIAS:
812                 d_printf("NETR_DELTA_RENAME_ALIAS not handled\n");
813                 break;
814         case NETR_DELTA_POLICY:
815                 d_printf("NETR_DELTA_POLICY not handled\n");
816                 break;
817         case NETR_DELTA_TRUSTED_DOMAIN:
818                 d_printf("NETR_DELTA_TRUSTED_DOMAIN not handled\n");
819                 break;
820         case NETR_DELTA_ACCOUNT:
821                 d_printf("NETR_DELTA_ACCOUNT not handled\n");
822                 break;
823         case NETR_DELTA_SECRET:
824                 d_printf("NETR_DELTA_SECRET not handled\n");
825                 break;
826         case NETR_DELTA_DELETE_GROUP:
827                 d_printf("NETR_DELTA_DELETE_GROUP not handled\n");
828                 break;
829         case NETR_DELTA_DELETE_USER:
830                 d_printf("NETR_DELTA_DELETE_USER not handled\n");
831                 break;
832         case NETR_DELTA_MODIFY_COUNT:
833                 d_printf("NETR_DELTA_MODIFY_COUNT not handled\n");
834                 break;
835         case NETR_DELTA_DELETE_ALIAS:
836                 d_printf("NETR_DELTA_DELETE_ALIAS not handled\n");
837                 break;
838         case NETR_DELTA_DELETE_TRUST:
839                 d_printf("NETR_DELTA_DELETE_TRUST not handled\n");
840                 break;
841         case NETR_DELTA_DELETE_ACCOUNT:
842                 d_printf("NETR_DELTA_DELETE_ACCOUNT not handled\n");
843                 break;
844         case NETR_DELTA_DELETE_SECRET:
845                 d_printf("NETR_DELTA_DELETE_SECRET not handled\n");
846                 break;
847         case NETR_DELTA_DELETE_GROUP2:
848                 d_printf("NETR_DELTA_DELETE_GROUP2 not handled\n");
849                 break;
850         case NETR_DELTA_DELETE_USER2:
851                 d_printf("NETR_DELTA_DELETE_USER2 not handled\n");
852                 break;
853         default:
854                 d_printf("Unknown delta record type %d\n", r->delta_type);
855                 status = NT_STATUS_INVALID_PARAMETER;
856                 break;
857         }
858
859         return status;
860 }
861
862 /****************************************************************
863 ****************************************************************/
864
865 static NTSTATUS fetch_sam_entries(TALLOC_CTX *mem_ctx,
866                                   enum netr_SamDatabaseID database_id,
867                                   struct netr_DELTA_ENUM_ARRAY *r,
868                                   uint64_t *sequence_num,
869                                   struct samsync_context *ctx)
870 {
871         int i;
872
873         for (i = 0; i < r->num_deltas; i++) {
874                 fetch_sam_entry(mem_ctx, database_id, &r->delta_enum[i], ctx);
875         }
876
877         return NT_STATUS_OK;
878 }
879
880 /****************************************************************
881 ****************************************************************/
882
883 const struct samsync_ops libnet_samsync_passdb_ops = {
884         .process_objects        = fetch_sam_entries,
885 };