extern int DEBUGLEVEL;
extern int Protocol;
-BOOL global_machine_pasword_needs_changing;
-
/* users from session setup */
static pstring session_users="";
+extern pstring scope;
extern pstring global_myname;
extern fstring global_myworkgroup;
/*******************************************************************
set the last challenge sent, usually from a password server
********************************************************************/
-BOOL set_challenge(char *challenge)
+BOOL set_challenge(unsigned char *challenge)
{
memcpy(saved_challenge,challenge,8);
challenge_sent = True;
return NULL;
vuid -= VUID_OFFSET;
if ((vuid >= (uint16)num_validated_users) ||
- (validated_users[vuid].uid == -1) || (validated_users[vuid].gid == -1))
+ (validated_users[vuid].uid == (uid_t)-1) || (validated_users[vuid].gid == (gid_t)-1))
return NULL;
return &validated_users[vuid];
}
if (vuser == NULL) return;
- vuser->uid = -1;
- vuser->gid = -1;
+ vuser->uid = (uid_t)-1;
+ vuser->gid = (gid_t)-1;
vuser->n_sids = 0;
/* same number of igroups as groups */
vuser->n_groups = 0;
- if (vuser->groups) free(vuser->groups);
+ if (vuser->groups)
+ free((char *)vuser->groups);
- if (vuser->sids) free(vuser->sids);
+ if (vuser->sids)
+ free((char *)vuser->sids);
vuser->sids = NULL;
vuser->groups = NULL;
/****************************************************************************
Setup the groups a user belongs to.
****************************************************************************/
-int setup_groups(char *user, int uid, int gid, int *p_ngroups, GID_T **p_groups)
+int setup_groups(char *user, uid_t uid, gid_t gid, int *p_ngroups, gid_t **p_groups)
{
int i,ngroups;
- GID_T *groups;
- GID_T grp = 0;
+ gid_t grp = 0;
+ gid_t *groups = NULL;
- if (-1 == initgroups(user,gid)) {
- if (getuid() == 0) {
+ if (-1 == initgroups(user,gid))
+ {
+ if (getuid() == 0)
+ {
DEBUG(0,("Unable to initgroups!\n"));
- if (gid < 0 || gid > 16000 || uid < 0 || uid > 16000) {
- DEBUG(0,("This is probably a problem with the account %s\n",
- user));
+ if (gid < 0 || gid > 16000 || uid < 0 || uid > 16000)
+ {
+ DEBUG(0,("This is probably a problem with the account %s\n", user));
}
}
return -1;
}
- ngroups = getgroups(0,&grp);
- if (ngroups <= 0) ngroups = 32;
+ ngroups = sys_getgroups(0,&grp);
+ if (ngroups <= 0)
+ {
+ ngroups = 32;
+ }
- groups = (GID_T *)malloc(sizeof(groups[0])*ngroups);
+ if((groups = (gid_t *)malloc(sizeof(gid_t)*ngroups)) == NULL)
+ {
+ DEBUG(0,("setup_groups malloc fail !\n"));
+ return -1;
+ }
- ngroups = getgroups(ngroups,(gid_t *)groups);
+ ngroups = sys_getgroups(ngroups,groups);
(*p_ngroups) = ngroups;
-
(*p_groups) = groups;
DEBUG( 3, ( "%s is in %d groups: ", user, ngroups ) );
- for (i = 0; i < ngroups; i++ ) {
+ for (i = 0; i < ngroups; i++ )
+ {
DEBUG( 3, ( "%s%d", (i ? ", " : ""), (int)groups[i] ) );
}
DEBUG( 3, ( "\n" ) );
has been given. vuid is biased by an offset. This allows us to
tell random client vuid's (normally zero) from valid vuids.
****************************************************************************/
-uint16 register_vuid(int uid,int gid, char *unix_name, char *requested_name, BOOL guest)
+uint16 register_vuid(uid_t uid,gid_t gid, char *unix_name, char *requested_name, BOOL guest)
{
user_struct *vuser;
struct passwd *pwfile; /* for getting real name from passwd file */
&vuser->n_groups,
&vuser->groups);
- DEBUG(3,("uid %d registered to name %s\n",uid,unix_name));
+ DEBUG(3,("uid %d registered to name %s\n",(int)uid,unix_name));
DEBUG(3, ("Clearing default real name\n"));
fstrcpy(vuser->real_name, "<Full Name>\0");
Do a specific test for an smb password being correct, given a smb_password and
the lanman and NT responses.
****************************************************************************/
+
BOOL smb_password_ok(struct smb_passwd *smb_pass,
uchar lm_pass[24], uchar nt_pass[24])
{
if (!lm_pass || !smb_pass) return(False);
+ DEBUG(4,("Checking SMB password for user %s\n",
+ smb_pass->smb_name));
+
if(smb_pass->acct_ctrl & ACB_DISABLED) {
DEBUG(3,("account for user %s was disabled.\n",
smb_pass->smb_name));
return False;
}
- DEBUG(4,("Checking SMB password for user %s\n",
- smb_pass->smb_name));
-
if ((Protocol >= PROTOCOL_NT1) && (smb_pass->smb_nt_passwd != NULL)) {
/* We have the NT MD4 hash challenge available - see if we can
use it (ie. does it exist in the smbpasswd file).
SMB hash
return True if the password is correct, False otherwise
****************************************************************************/
-static BOOL pass_check_smb(char *user,char *password, struct passwd *pwd)
+BOOL pass_check_smb(char *user, char *domain,
+ char *challenge, char *lm_pwd, char *nt_pwd,
+ struct passwd *pwd)
{
struct passwd *pass;
- uchar challenge[8];
struct smb_passwd *smb_pass;
- BOOL challenge_done;
- if (!password) {
+ if (!lm_pwd || !nt_pwd)
+ {
return(False);
}
- challenge_done = last_challenge(challenge);
-
- if (!challenge_done) {
- DEBUG(0,("Error: challenge not done for user=%s\n", user));
- return False;
- }
-
- if (pwd && !user) {
+ if (pwd != NULL && user == NULL)
+ {
pass = (struct passwd *) pwd;
user = pass->pw_name;
- } else {
+ }
+ else
+ {
pass = Get_Pwnam(user,True);
}
- if (!pass) {
+ if (pass == NULL)
+ {
DEBUG(3,("Couldn't find user %s\n",user));
return(False);
}
smb_pass = getsmbpwnam(user);
- if (!smb_pass) {
+ if (smb_pass == NULL)
+ {
DEBUG(3,("Couldn't find user %s in smb_passwd file.\n", user));
return(False);
}
}
/* Ensure the uid's match */
- if (smb_pass->smb_userid != pass->pw_uid) {
+ if (smb_pass->smb_userid != pass->pw_uid)
+ {
DEBUG(3,("Error : UNIX and SMB uids in password files do not match !\n"));
return(False);
}
- if (smb_password_ok(smb_pass,
- (unsigned char *)password,
- (uchar *)password)) {
+ if (lm_pwd[0] == '\0' && IS_BITS_SET_ALL(smb_pass->acct_ctrl, ACB_PWNOTREQ) && lp_null_passwords())
+ {
+ DEBUG(3,("account for user %s has no password and null passwords are allowed.\n", smb_pass->smb_name));
+ return(True);
+ }
+
+ if (smb_password_ok(smb_pass, (uchar *)lm_pwd, (uchar *)nt_pwd))
+ {
return(True);
}
database or the encrypted SMB password database
return True if the password is correct, False otherwise
****************************************************************************/
-BOOL password_ok(char *user,char *password, int pwlen, struct passwd *pwd)
+BOOL password_ok(char *user, char *password, int pwlen, struct passwd *pwd)
{
- if (pwlen == 24) {
- /* if it is 24 bytes long then assume it is an encrypted
- password */
- return pass_check_smb(user, password, pwd);
+ if (pwlen == 24 || (lp_encrypted_passwords() && (pwlen == 0) && lp_null_passwords()))
+ {
+ /* if 24 bytes long assume it is an encrypted password */
+ uchar challenge[8];
+
+ if (!last_challenge(challenge))
+ {
+ DEBUG(0,("Error: challenge not done for user=%s\n", user));
+ return False;
+ }
+
+ return pass_check_smb(user, global_myworkgroup,
+ challenge, password, password, pwd);
}
return pass_check(user, password, pwlen, pwd,
}
-static struct cli_state pw_cli;
-
/****************************************************************************
return the client state structure
****************************************************************************/
struct cli_state *server_client(void)
{
+ static struct cli_state pw_cli;
return &pw_cli;
}
****************************************************************************/
struct cli_state *server_cryptkey(void)
{
+ struct cli_state *cli;
fstring desthost;
struct in_addr dest_ip;
extern fstring local_machine;
char *p;
BOOL connected_ok = False;
+ struct nmb_name calling, called;
- if (!cli_initialise(&pw_cli))
+ cli = server_client();
+
+ if (!cli_initialise(cli))
return NULL;
p = lp_passwordserver();
standard_sub_basic(desthost);
strupper(desthost);
- if(!resolve_name( desthost, &dest_ip)) {
+ if(!resolve_name( desthost, &dest_ip, 0x20)) {
DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
continue;
}
continue;
}
- if (cli_connect(&pw_cli, desthost, &dest_ip)) {
+ if (cli_connect(cli, desthost, &dest_ip)) {
DEBUG(3,("connected to password server %s\n",desthost));
connected_ok = True;
break;
if (!connected_ok) {
DEBUG(0,("password server not available\n"));
- cli_shutdown(&pw_cli);
+ cli_shutdown(cli);
return NULL;
}
- if (!cli_session_request(&pw_cli, desthost, 0x20, local_machine)) {
+ make_nmb_name(&calling, local_machine, 0x0 , scope);
+ make_nmb_name(&called , desthost , 0x20, scope);
+
+ if (!cli_session_request(cli, &calling, &called))
+ {
DEBUG(1,("%s rejected the session\n",desthost));
- cli_shutdown(&pw_cli);
+ cli_shutdown(cli);
return NULL;
}
DEBUG(3,("got session\n"));
- if (!cli_negprot(&pw_cli)) {
+ if (!cli_negprot(cli)) {
DEBUG(1,("%s rejected the negprot\n",desthost));
- cli_shutdown(&pw_cli);
+ cli_shutdown(cli);
return NULL;
}
- if (pw_cli.protocol < PROTOCOL_LANMAN2 ||
- !(pw_cli.sec_mode & 1)) {
+ if (cli->protocol < PROTOCOL_LANMAN2 ||
+ !(cli->sec_mode & 1)) {
DEBUG(1,("%s isn't in user level security mode\n",desthost));
- cli_shutdown(&pw_cli);
+ cli_shutdown(cli);
return NULL;
}
DEBUG(3,("password server OK\n"));
- return &pw_cli;
+ return cli;
}
/****************************************************************************
char *pass, int passlen,
char *ntpass, int ntpasslen)
{
+ struct cli_state *cli;
extern fstring local_machine;
static unsigned char badpass[24];
+ cli = server_client();
- if (!pw_cli.initialised) {
- DEBUG(1,("password server %s is not connected\n", pw_cli.desthost));
+ if (!cli->initialised) {
+ DEBUG(1,("password server %s is not connected\n", cli->desthost));
return(False);
}
* need to detect this as some versions of NT4.x are broken. JRA.
*/
- if (cli_session_setup(&pw_cli, user, (char *)badpass, sizeof(badpass),
+ if (cli_session_setup(cli, user, (char *)badpass, sizeof(badpass),
(char *)badpass, sizeof(badpass), domain)) {
- if ((SVAL(pw_cli.inbuf,smb_vwv2) & 1) == 0) {
+ if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
DEBUG(0,("server_validate: password server %s allows users as non-guest \
-with a bad password.\n", pw_cli.desthost));
+with a bad password.\n", cli->desthost));
DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
use this machine as the password server.\n"));
- cli_ulogoff(&pw_cli);
+ cli_ulogoff(cli);
return False;
}
- cli_ulogoff(&pw_cli);
+ cli_ulogoff(cli);
}
/*
* not guest enabled, we can try with the real password.
*/
- if (!cli_session_setup(&pw_cli, user, pass, passlen, ntpass, ntpasslen, domain)) {
- DEBUG(1,("password server %s rejected the password\n", pw_cli.desthost));
+ if (!cli_session_setup(cli, user, pass, passlen, ntpass, ntpasslen, domain)) {
+ DEBUG(1,("password server %s rejected the password\n", cli->desthost));
return False;
}
/* if logged in as guest then reject */
- if ((SVAL(pw_cli.inbuf,smb_vwv2) & 1) != 0) {
- DEBUG(1,("password server %s gave us guest only\n", pw_cli.desthost));
- cli_ulogoff(&pw_cli);
+ if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
+ DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
+ cli_ulogoff(cli);
return(False);
}
*/
if (lp_net_wksta_user_logon()) {
- DEBUG(3,("trying NetWkstaUserLogon with password server %s\n", pw_cli.desthost));
+ DEBUG(3,("trying NetWkstaUserLogon with password server %s\n", cli->desthost));
- if (!cli_send_tconX(&pw_cli, "IPC$", "IPC", "", 1)) {
- DEBUG(0,("password server %s refused IPC$ connect\n", pw_cli.desthost));
- cli_ulogoff(&pw_cli);
+ if (!cli_send_tconX(cli, "IPC$", "IPC", "", 1)) {
+ DEBUG(0,("password server %s refused IPC$ connect\n", cli->desthost));
+ cli_ulogoff(cli);
return False;
}
- if (!cli_NetWkstaUserLogon(&pw_cli,user,local_machine)) {
- DEBUG(0,("password server %s failed NetWkstaUserLogon\n", pw_cli.desthost));
- cli_tdis(&pw_cli);
- cli_ulogoff(&pw_cli);
+ if (!cli_NetWkstaUserLogon(cli,user,local_machine)) {
+ DEBUG(0,("password server %s failed NetWkstaUserLogon\n", cli->desthost));
+ cli_tdis(cli);
+ cli_ulogoff(cli);
return False;
}
- if (pw_cli.privilages == 0) {
- DEBUG(0,("password server %s gave guest privilages\n", pw_cli.desthost));
- cli_tdis(&pw_cli);
- cli_ulogoff(&pw_cli);
+ if (cli->privilages == 0) {
+ DEBUG(0,("password server %s gave guest privilages\n", cli->desthost));
+ cli_tdis(cli);
+ cli_ulogoff(cli);
return False;
}
- if (!strequal(pw_cli.eff_name, user)) {
+ if (!strequal(cli->eff_name, user)) {
DEBUG(0,("password server %s gave different username %s\n",
- pw_cli.desthost,
- pw_cli.eff_name));
- cli_tdis(&pw_cli);
- cli_ulogoff(&pw_cli);
+ cli->desthost,
+ cli->eff_name));
+ cli_tdis(cli);
+ cli_ulogoff(cli);
return False;
}
- cli_tdis(&pw_cli);
+ cli_tdis(cli);
}
else {
- DEBUG(3,("skipping NetWkstaUserLogon with password server %s\n", pw_cli.desthost));
+ DEBUG(3,("skipping NetWkstaUserLogon with password server %s\n", cli->desthost));
}
- DEBUG(3,("password server %s accepted the password\n", pw_cli.desthost));
+ DEBUG(3,("password server %s accepted the password\n", cli->desthost));
- cli_ulogoff(&pw_cli);
+ cli_ulogoff(cli);
return(True);
}
unsigned char local_lm_response[24];
unsigned char local_nt_reponse[24];
unsigned char trust_passwd[16];
- time_t lct;
fstring remote_machine;
char *p;
struct in_addr dest_ip;
struct cli_state cli;
uint32 smb_uid_low;
BOOL connected_ok = False;
+ struct nmb_name calling, called;
/*
* Check that the requested domain is not our own machine name.
/*
* Get the machine account password.
*/
- if(!trust_password_lock( global_myworkgroup, global_myname, False)) {
- DEBUG(0,("domain_client_validate: unable to open the machine account password file for \
-machine %s in domain %s.\n", global_myname, global_myworkgroup ));
- return False;
- }
-
- if(get_trust_account_password( trust_passwd, &lct) == False) {
- DEBUG(0,("domain_client_validate: unable to read the machine account password for \
-machine %s in domain %s.\n", global_myname, global_myworkgroup ));
- trust_password_unlock();
+ if (!trust_get_passwd( trust_passwd, global_myworkgroup, global_myname))
+ {
return False;
}
- trust_password_unlock();
-
- /*
- * Here we check the last change time to see if the machine
- * password needs changing. JRA.
- */
-
- if(time(NULL) > lct + lp_machine_password_timeout())
- global_machine_pasword_needs_changing = True;
-
/*
* At this point, smb_apasswd points to the lanman response to
* the challenge in local_challenge, and smb_ntpasswd points to
* see if they were valid.
*/
- memset(&cli, '\0', sizeof(struct cli_state));
+ ZERO_STRUCT(cli);
+
if(cli_initialise(&cli) == False) {
DEBUG(0,("domain_client_validate: unable to initialize client connection.\n"));
return False;
standard_sub_basic(remote_machine);
strupper(remote_machine);
- if(!resolve_name( remote_machine, &dest_ip)) {
+ if(!resolve_name( remote_machine, &dest_ip, 0x20)) {
DEBUG(1,("domain_client_validate: Can't resolve address for %s\n", remote_machine));
continue;
}
continue;
}
- if (!cli_session_request(&cli, remote_machine, 0x20, global_myname)) {
+ make_nmb_name(&calling, global_myname , 0x0 , scope);
+ make_nmb_name(&called , remote_machine, 0x20, scope);
+
+ if (!cli_session_request(&cli, &calling, &called))
+ {
DEBUG(0,("domain_client_validate: machine %s rejected the session setup. \
Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
cli_shutdown(&cli);
* Now start the NT Domain stuff :-).
*/
- if(cli_nt_session_open(&cli, PIPE_NETLOGON, False) == False) {
+ if(cli_nt_session_open(&cli, PIPE_NETLOGON) == False) {
DEBUG(0,("domain_client_validate: unable to open the domain client session to \
machine %s. Error was : %s.\n", remote_machine, cli_errstr(&cli)));
cli_nt_session_close(&cli);
git.samba.org / samba.git / blobdiff