*/
#include "includes.h"
+#include "librpc/gen_ndr/ndr_samr.h"
+#include "librpc/gen_ndr/ndr_netlogon.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "auth/auth.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
-extern DOM_SID global_sid_World;
-extern DOM_SID global_sid_Network;
-extern DOM_SID global_sid_Builtin_Guests;
-extern DOM_SID global_sid_Authenticated_Users;
-
-
-/****************************************************************************
- Create a UNIX user on demand.
-****************************************************************************/
-static int smb_create_user(const char *unix_user, const char *homedir)
-{
- pstring add_script;
- int ret;
-
- pstrcpy(add_script, lp_adduser_script());
- if (! *add_script)
- return -1;
- all_string_sub(add_script, "%u", unix_user, sizeof(pstring));
- if (homedir)
- all_string_sub(add_script, "%H", homedir, sizeof(pstring));
- ret = smbrun(add_script,NULL);
- DEBUG(3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
- return ret;
-}
-
-/****************************************************************************
- Add and Delete UNIX users on demand, based on NTSTATUS codes.
-****************************************************************************/
-
-void smb_user_control(const auth_usersupplied_info *user_info, auth_serversupplied_info *server_info, NTSTATUS nt_status)
-{
- struct passwd *pwd=NULL;
-
- if (NT_STATUS_IS_OK(nt_status)) {
-
- if (!(server_info->sam_fill_level & SAM_FILL_UNIX)) {
-
- /*
- * User validated ok against Domain controller.
- * If the admin wants us to try and create a UNIX
- * user on the fly, do so.
- */
-
- if(lp_adduser_script() && !(pwd = Get_Pwnam(user_info->internal_username.str))) {
- smb_create_user(user_info->internal_username.str, NULL);
- }
- }
- }
-}
-
-/****************************************************************************
- Create a SAM_ACCOUNT - either by looking in the pdb, or by faking it up from
- unix info.
-****************************************************************************/
-
-NTSTATUS auth_get_sam_account(const char *user, SAM_ACCOUNT **account)
-{
- BOOL pdb_ret;
- NTSTATUS nt_status;
- if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(account))) {
- return nt_status;
- }
-
- become_root();
- pdb_ret = pdb_getsampwnam(*account, user);
- unbecome_root();
-
- if (!pdb_ret) {
-
- struct passwd *pass = Get_Pwnam(user);
- if (!pass)
- return NT_STATUS_NO_SUCH_USER;
-
- if (!NT_STATUS_IS_OK(nt_status = pdb_fill_sam_pw(*account, pass))) {
- return nt_status;
- }
- }
- return NT_STATUS_OK;
-}
-
/****************************************************************************
Create an auth_usersupplied_data structure
****************************************************************************/
-
-static NTSTATUS make_user_info(auth_usersupplied_info **user_info,
+static NTSTATUS make_user_info(TALLOC_CTX *mem_ctx,
+ struct auth_usersupplied_info **user_info,
const char *smb_name,
const char *internal_username,
const char *client_domain,
const char *domain,
const char *wksta_name,
- DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
- DATA_BLOB plaintext,
- uint32 auth_flags, BOOL encrypted)
+ DATA_BLOB *lm_password, DATA_BLOB *nt_password,
+ DATA_BLOB *lm_interactive_password, DATA_BLOB *nt_interactive_password,
+ DATA_BLOB *plaintext,
+ BOOL encrypted)
{
DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
- *user_info = malloc(sizeof(**user_info));
+ *user_info = talloc_p(mem_ctx, struct auth_usersupplied_info);
if (!user_info) {
- DEBUG(0,("malloc failed for user_info (size %d)\n", sizeof(*user_info)));
return NT_STATUS_NO_MEMORY;
}
DEBUG(5,("making strings for %s's user_info struct\n", internal_username));
- (*user_info)->smb_name.str = strdup(smb_name);
+ (*user_info)->smb_name.str = talloc_strdup(*user_info, smb_name);
if ((*user_info)->smb_name.str) {
(*user_info)->smb_name.len = strlen(smb_name);
} else {
return NT_STATUS_NO_MEMORY;
}
- (*user_info)->internal_username.str = strdup(internal_username);
+ (*user_info)->internal_username.str = talloc_strdup(*user_info, internal_username);
if ((*user_info)->internal_username.str) {
(*user_info)->internal_username.len = strlen(internal_username);
} else {
return NT_STATUS_NO_MEMORY;
}
- (*user_info)->domain.str = strdup(domain);
+ (*user_info)->domain.str = talloc_strdup(*user_info, domain);
if ((*user_info)->domain.str) {
(*user_info)->domain.len = strlen(domain);
} else {
return NT_STATUS_NO_MEMORY;
}
- (*user_info)->client_domain.str = strdup(client_domain);
+ (*user_info)->client_domain.str = talloc_strdup(*user_info, client_domain);
if ((*user_info)->client_domain.str) {
(*user_info)->client_domain.len = strlen(client_domain);
} else {
return NT_STATUS_NO_MEMORY;
}
- (*user_info)->wksta_name.str = strdup(wksta_name);
+ (*user_info)->wksta_name.str = talloc_strdup(*user_info, wksta_name);
if ((*user_info)->wksta_name.str) {
(*user_info)->wksta_name.len = strlen(wksta_name);
} else {
DEBUG(5,("making blobs for %s's user_info struct\n", internal_username));
- (*user_info)->lm_resp = data_blob(lm_pwd.data, lm_pwd.length);
- (*user_info)->nt_resp = data_blob(nt_pwd.data, nt_pwd.length);
- (*user_info)->plaintext_password = data_blob(plaintext.data, plaintext.length);
+ if (lm_password)
+ (*user_info)->lm_resp = data_blob_talloc(*user_info,
+ lm_password->data,
+ lm_password->length);
+ if (nt_password)
+ (*user_info)->nt_resp = data_blob_talloc(*user_info,
+ nt_password->data,
+ nt_password->length);
+ if (lm_interactive_password)
+ (*user_info)->lm_interactive_password =
+ data_blob_talloc(*user_info,
+ lm_interactive_password->data,
+ lm_interactive_password->length);
+ if (nt_interactive_password)
+ (*user_info)->nt_interactive_password =
+ data_blob_talloc(*user_info,
+ nt_interactive_password->data,
+ nt_interactive_password->length);
+
+ if (plaintext)
+ (*user_info)->plaintext_password =
+ data_blob_talloc(*user_info,
+ plaintext->data,
+ plaintext->length);
(*user_info)->encrypted = encrypted;
- (*user_info)->auth_flags = auth_flags;
DEBUG(10,("made an %sencrypted user_info for %s (%s)\n", encrypted ? "":"un" , internal_username, smb_name));
Create an auth_usersupplied_data structure after appropriate mapping.
****************************************************************************/
-NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
+NTSTATUS make_user_info_map(TALLOC_CTX *mem_ctx,
+ struct auth_usersupplied_info **user_info,
const char *smb_name,
const char *client_domain,
const char *wksta_name,
- DATA_BLOB lm_pwd, DATA_BLOB nt_pwd,
- DATA_BLOB plaintext,
- uint32 ntlmssp_flags, BOOL encrypted)
+ DATA_BLOB *lm_password, DATA_BLOB *nt_password,
+ DATA_BLOB *lm_interactive_password, DATA_BLOB *nt_interactive_password,
+ DATA_BLOB *plaintext,
+ BOOL encrypted)
{
const char *domain;
- fstring internal_username;
- fstrcpy(internal_username, smb_name);
DEBUG(5, ("make_user_info_map: Mapping user [%s]\\[%s] from workstation [%s]\n",
client_domain, smb_name, wksta_name));
- if (lp_allow_trusted_domains() && *client_domain) {
-
- /* the client could have given us a workstation name
- or other crap for the workgroup - we really need a
- way of telling if this domain name is one of our
- trusted domain names
-
- Also don't allow "" as a domain, fixes a Win9X bug
- where it doens't supply a domain for logon script
- 'net use' commands.
-
- The way I do it here is by checking if the fully
- qualified username exists. This is rather reliant
- on winbind, but until we have a better method this
- will have to do
- */
+ /* don't allow "" as a domain, fixes a Win9X bug
+ where it doens't supply a domain for logon script
+ 'net use' commands. */
+ if ( *client_domain )
domain = client_domain;
-
- if ((smb_name) && (*smb_name)) { /* Don't do this for guests */
- char *user = NULL;
- if (asprintf(&user, "%s%s%s",
- client_domain, lp_winbind_separator(),
- smb_name) < 0) {
- DEBUG(0, ("make_user_info_map: asprintf() failed!\n"));
- return NT_STATUS_NO_MEMORY;
- }
-
- DEBUG(5, ("make_user_info_map: testing for user %s\n", user));
-
- if (Get_Pwnam(user) == NULL) {
- DEBUG(5, ("make_user_info_map: test for user %s failed\n", user));
- domain = lp_workgroup();
- DEBUG(5, ("make_user_info_map: trusted domain %s doesn't appear to exist, using %s\n",
- client_domain, domain));
- } else {
- DEBUG(5, ("make_user_info_map: using trusted domain %s\n", domain));
- }
- SAFE_FREE(user);
- }
- } else {
+ else
domain = lp_workgroup();
- }
-
- return make_user_info(user_info,
- smb_name, internal_username,
- client_domain, domain,
- wksta_name,
- lm_pwd, nt_pwd,
- plaintext,
- ntlmssp_flags, encrypted);
+
+ /* we know that it is a trusted domain (and we are allowing
+ them) or it is our domain */
+ return make_user_info(mem_ctx,
+ user_info, smb_name, smb_name,
+ client_domain, domain, wksta_name,
+ lm_password, nt_password,
+ lm_interactive_password, nt_interactive_password,
+ plaintext, encrypted);
}
/****************************************************************************
Decrypt and encrypt the passwords.
****************************************************************************/
-BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
- const char *smb_name,
- const char *client_domain,
- const char *wksta_name,
- const uchar *lm_network_pwd, int lm_pwd_len,
- const uchar *nt_network_pwd, int nt_pwd_len)
+NTSTATUS make_user_info_netlogon_network(TALLOC_CTX *mem_ctx,
+ struct auth_usersupplied_info **user_info,
+ const char *smb_name,
+ const char *client_domain,
+ const char *wksta_name,
+ const uint8_t *lm_network_password, int lm_password_len,
+ const uint8_t *nt_network_password, int nt_password_len)
{
- BOOL ret;
NTSTATUS nt_status;
- DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
- DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
- DATA_BLOB plaintext_blob = data_blob(NULL, 0);
- uint32 auth_flags = AUTH_FLAG_NONE;
-
- if (lm_pwd_len)
- auth_flags |= AUTH_FLAG_LM_RESP;
- if (nt_pwd_len == 24) {
- auth_flags |= AUTH_FLAG_NTLM_RESP;
- } else if (nt_pwd_len != 0) {
- auth_flags |= AUTH_FLAG_NTLMv2_RESP;
- }
-
- nt_status = make_user_info_map(user_info,
- smb_name, client_domain,
- wksta_name,
- lm_blob, nt_blob,
- plaintext_blob,
- auth_flags, True);
+ DATA_BLOB lm_blob = data_blob(lm_network_password, lm_password_len);
+ DATA_BLOB nt_blob = data_blob(nt_network_password, nt_password_len);
+
+ nt_status = make_user_info_map(mem_ctx,
+ user_info,
+ smb_name, client_domain,
+ wksta_name,
+ lm_password_len ? &lm_blob : NULL,
+ nt_password_len ? &nt_blob : NULL,
+ NULL, NULL, NULL,
+ True);
- ret = NT_STATUS_IS_OK(nt_status) ? True : False;
-
data_blob_free(&lm_blob);
data_blob_free(&nt_blob);
- return ret;
+ return nt_status;
}
/****************************************************************************
Decrypt and encrypt the passwords.
****************************************************************************/
-BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
- const char *smb_name,
- const char *client_domain,
- const char *wksta_name,
- const uchar chal[8],
- const uchar lm_interactive_pwd[16],
- const uchar nt_interactive_pwd[16],
- const uchar *dc_sess_key)
-{
- char lm_pwd[16];
- char nt_pwd[16];
- unsigned char local_lm_response[24];
- unsigned char local_nt_response[24];
- unsigned char key[16];
- uint32 auth_flags = AUTH_FLAG_NONE;
-
- ZERO_STRUCT(key);
- memcpy(key, dc_sess_key, 8);
-
- if (lm_interactive_pwd) memcpy(lm_pwd, lm_interactive_pwd, sizeof(lm_pwd));
- if (nt_interactive_pwd) memcpy(nt_pwd, nt_interactive_pwd, sizeof(nt_pwd));
-
-#ifdef DEBUG_PASSWORD
- DEBUG(100,("key:"));
- dump_data(100, (char *)key, sizeof(key));
-
- DEBUG(100,("lm owf password:"));
- dump_data(100, lm_pwd, sizeof(lm_pwd));
-
- DEBUG(100,("nt owf password:"));
- dump_data(100, nt_pwd, sizeof(nt_pwd));
-#endif
-
- SamOEMhash((uchar *)lm_pwd, key, sizeof(lm_pwd));
- SamOEMhash((uchar *)nt_pwd, key, sizeof(nt_pwd));
-
-#ifdef DEBUG_PASSWORD
- DEBUG(100,("decrypt of lm owf password:"));
- dump_data(100, lm_pwd, sizeof(lm_pwd));
-
- DEBUG(100,("decrypt of nt owf password:"));
- dump_data(100, nt_pwd, sizeof(nt_pwd));
-#endif
-
- SMBOWFencrypt((const unsigned char *)lm_pwd, chal, local_lm_response);
- SMBOWFencrypt((const unsigned char *)nt_pwd, chal, local_nt_response);
-
- /* Password info paranoia */
- ZERO_STRUCT(lm_pwd);
- ZERO_STRUCT(nt_pwd);
- ZERO_STRUCT(key);
-
- {
- BOOL ret;
- NTSTATUS nt_status;
- DATA_BLOB local_lm_blob = data_blob(local_lm_response, sizeof(local_lm_response));
- DATA_BLOB local_nt_blob = data_blob(local_nt_response, sizeof(local_nt_response));
- DATA_BLOB plaintext_blob = data_blob(NULL, 0);
-
- if (lm_interactive_pwd)
- auth_flags |= AUTH_FLAG_LM_RESP;
- if (nt_interactive_pwd)
- auth_flags |= AUTH_FLAG_NTLM_RESP;
-
- nt_status = make_user_info_map(user_info,
- smb_name, client_domain,
- wksta_name,
- local_lm_blob,
- local_nt_blob,
- plaintext_blob,
- auth_flags, True);
-
- ret = NT_STATUS_IS_OK(nt_status) ? True : False;
- data_blob_free(&local_lm_blob);
- data_blob_free(&local_nt_blob);
- return ret;
- }
-}
-
-
-/****************************************************************************
- Create an auth_usersupplied_data structure
-****************************************************************************/
-
-BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
- const char *smb_name,
- const char *client_domain,
- const uint8 chal[8],
- DATA_BLOB plaintext_password)
+NTSTATUS make_user_info_netlogon_interactive(TALLOC_CTX *mem_ctx,
+ struct auth_usersupplied_info **user_info,
+ const char *smb_name,
+ const char *client_domain,
+ const char *wksta_name,
+ const uint8_t chal[8],
+ const struct samr_Password *lm_interactive_password,
+ const struct samr_Password *nt_interactive_password)
{
-
+ NTSTATUS nt_status;
DATA_BLOB local_lm_blob;
DATA_BLOB local_nt_blob;
- NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
- uint32 auth_flags = AUTH_FLAG_NONE;
-
- /*
- * Not encrypted - do so.
- */
- DEBUG(5,("make_user_info_for_reply: User passwords not in encrypted format.\n"));
-
- if (plaintext_password.data) {
- unsigned char local_lm_response[24];
-
-#ifdef DEBUG_PASSWORD
- DEBUG(10,("Unencrypted password (len %d):\n",plaintext_password.length));
- dump_data(100, plaintext_password.data, plaintext_password.length);
-#endif
-
- SMBencrypt( (const uchar *)plaintext_password.data, (const uchar*)chal, local_lm_response);
- local_lm_blob = data_blob(local_lm_response, 24);
-
- /* We can't do an NT hash here, as the password needs to be
- case insensitive */
- local_nt_blob = data_blob(NULL, 0);
-
- auth_flags = (AUTH_FLAG_PLAINTEXT | AUTH_FLAG_LM_RESP);
- } else {
- local_lm_blob = data_blob(NULL, 0);
- local_nt_blob = data_blob(NULL, 0);
- }
-
- ret = make_user_info_map(user_info, smb_name,
- client_domain,
- sub_get_remote_machine(),
- local_lm_blob,
- local_nt_blob,
- plaintext_password,
- auth_flags, False);
+ DATA_BLOB lm_interactive_blob;
+ DATA_BLOB nt_interactive_blob;
+ uint8_t local_lm_response[24];
+ uint8_t local_nt_response[24];
+
+ SMBOWFencrypt(lm_interactive_password->hash, chal, local_lm_response);
+ SMBOWFencrypt(nt_interactive_password->hash, chal, local_nt_response);
+
+ local_lm_blob = data_blob(local_lm_response,
+ sizeof(local_lm_response));
+ lm_interactive_blob = data_blob(lm_interactive_password->hash,
+ sizeof(lm_interactive_password->hash));
+
+ local_nt_blob = data_blob(local_nt_response,
+ sizeof(local_nt_response));
+ nt_interactive_blob = data_blob(nt_interactive_password->hash,
+ sizeof(nt_interactive_password->hash));
+
+ nt_status = make_user_info_map(mem_ctx,
+ user_info,
+ smb_name, client_domain,
+ wksta_name,
+ &local_lm_blob,
+ &local_nt_blob,
+ &lm_interactive_blob,
+ &nt_interactive_blob,
+ NULL,
+ True);
data_blob_free(&local_lm_blob);
- return NT_STATUS_IS_OK(ret) ? True : False;
+ data_blob_free(&local_nt_blob);
+ data_blob_free(&lm_interactive_blob);
+ data_blob_free(&nt_interactive_blob);
+ return nt_status;
}
-
/****************************************************************************
Create an auth_usersupplied_data structure
****************************************************************************/
-NTSTATUS make_user_info_for_reply_enc(auth_usersupplied_info **user_info,
+NTSTATUS make_user_info_for_reply_enc(TALLOC_CTX *mem_ctx,
+ struct auth_usersupplied_info **user_info,
const char *smb_name,
const char *client_domain,
+ const char *remote_machine,
DATA_BLOB lm_resp, DATA_BLOB nt_resp)
{
- uint32 auth_flags = AUTH_FLAG_NONE;
-
- DATA_BLOB no_plaintext_blob = data_blob(NULL, 0);
-
- if (lm_resp.length == 24) {
- auth_flags |= AUTH_FLAG_LM_RESP;
- }
- if (nt_resp.length == 0) {
- } else if (nt_resp.length == 24) {
- auth_flags |= AUTH_FLAG_NTLM_RESP;
- } else {
- auth_flags |= AUTH_FLAG_NTLMv2_RESP;
- }
-
- return make_user_info_map(user_info, smb_name,
+ return make_user_info_map(mem_ctx,
+ user_info, smb_name,
client_domain,
- sub_get_remote_machine(),
- lm_resp,
- nt_resp,
- no_plaintext_blob,
- auth_flags, True);
+ remote_machine,
+ lm_resp.data ? &lm_resp : NULL,
+ nt_resp.data ? &nt_resp : NULL,
+ NULL, NULL, NULL,
+ True);
}
/****************************************************************************
Create a guest user_info blob, for anonymous authenticaion.
****************************************************************************/
-BOOL make_user_info_guest(auth_usersupplied_info **user_info)
+BOOL make_user_info_guest(TALLOC_CTX *mem_ctx,
+ struct auth_usersupplied_info **user_info)
{
- DATA_BLOB lm_blob = data_blob(NULL, 0);
- DATA_BLOB nt_blob = data_blob(NULL, 0);
- DATA_BLOB plaintext_blob = data_blob(NULL, 0);
- uint32 auth_flags = AUTH_FLAG_NONE;
NTSTATUS nt_status;
- nt_status = make_user_info(user_info,
- "","",
- "","",
- "",
- nt_blob, lm_blob,
- plaintext_blob,
- auth_flags, True);
+ nt_status = make_user_info(mem_ctx,
+ user_info,
+ "","",
+ "","",
+ "",
+ NULL, NULL,
+ NULL, NULL,
+ NULL,
+ True);
return NT_STATUS_IS_OK(nt_status) ? True : False;
}
/****************************************************************************
- prints a NT_USER_TOKEN to debug output.
+ prints a struct security_token to debug output.
****************************************************************************/
-
-void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
+void debug_security_token(int dbg_class, int dbg_lev, const struct security_token *token)
{
- fstring sid_str;
+ TALLOC_CTX *mem_ctx;
+
size_t i;
if (!token) {
- DEBUGC(dbg_class, dbg_lev, ("NT user token: (NULL)\n"));
+ DEBUGC(dbg_class, dbg_lev, ("Security token: (NULL)\n"));
return;
}
- DEBUGC(dbg_class, dbg_lev, ("NT user token of user %s\n",
- sid_to_string(sid_str, &token->user_sids[0]) ));
- DEBUGADDC(dbg_class, dbg_lev, ("contains %i SIDs\n", token->num_sids));
- for (i = 0; i < token->num_sids; i++)
- DEBUGADDC(dbg_class, dbg_lev, ("SID[%3i]: %s\n", i,
- sid_to_string(sid_str, &token->user_sids[i])));
+ mem_ctx = talloc_init("debug_security_token()");
+ if (!mem_ctx) {
+ return;
+ }
+
+ DEBUGC(dbg_class, dbg_lev, ("Security token of user %s\n",
+ dom_sid_string(mem_ctx, token->user_sid) ));
+ DEBUGADDC(dbg_class, dbg_lev, ("contains %lu SIDs\n",
+ (unsigned long)token->num_sids));
+ for (i = 0; i < token->num_sids; i++) {
+ DEBUGADDC(dbg_class, dbg_lev,
+ ("SID[%3lu]: %s\n", (unsigned long)i,
+ dom_sid_string(mem_ctx, token->sids[i])));
+ }
+
+ talloc_destroy(mem_ctx);
}
/****************************************************************************
- prints a UNIX 'token' to debug output.
+ prints a struct auth_session_info security token to debug output.
****************************************************************************/
-
-void debug_unix_user_token(int dbg_class, int dbg_lev, uid_t uid, gid_t gid, int n_groups, gid_t *groups)
+void debug_session_info(int dbg_class, int dbg_lev,
+ const struct auth_session_info *session_info)
{
- int i;
- DEBUGC(dbg_class, dbg_lev, ("UNIX token of user %ld\n", (long int)uid));
+ if (!session_info) {
+ DEBUGC(dbg_class, dbg_lev, ("Session Info: (NULL)\n"));
+ return;
+ }
- DEBUGADDC(dbg_class, dbg_lev, ("Primary group is %ld and contains %i supplementary groups\n", (long int)gid, n_groups));
- for (i = 0; i < n_groups; i++)
- DEBUGADDC(dbg_class, dbg_lev, ("Group[%3i]: %ld\n", i,
- (long int)groups[i]));
+ debug_security_token(dbg_class, dbg_lev, session_info->security_token);
}
/****************************************************************************
Create the SID list for this user.
****************************************************************************/
-
-static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *group_sid,
- int n_groupSIDs, DOM_SID *groupSIDs,
- BOOL is_guest, NT_USER_TOKEN **token)
+NTSTATUS create_security_token(TALLOC_CTX *mem_ctx,
+ struct dom_sid *user_sid, struct dom_sid *group_sid,
+ int n_groupSIDs, struct dom_sid **groupSIDs,
+ BOOL is_guest, struct security_token **token)
{
- NTSTATUS nt_status = NT_STATUS_OK;
- NT_USER_TOKEN *ptoken;
+ struct security_token *ptoken;
int i;
- int sid_ndx;
-
- if ((ptoken = malloc( sizeof(NT_USER_TOKEN) ) ) == NULL) {
- DEBUG(0, ("create_nt_token: Out of memory allocating token\n"));
- nt_status = NT_STATUS_NO_MEMORY;
- return nt_status;
- }
-
- ZERO_STRUCTP(ptoken);
+ NTSTATUS status;
- ptoken->num_sids = n_groupSIDs + 5;
+ ptoken = security_token_initialise(mem_ctx);
+ if (ptoken == NULL) {
+ return NT_STATUS_NO_MEMORY;
+ }
- if ((ptoken->user_sids = (DOM_SID *)malloc( sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
- DEBUG(0, ("create_nt_token: Out of memory allocating SIDs\n"));
- nt_status = NT_STATUS_NO_MEMORY;
- return nt_status;
+ ptoken->sids = talloc_array_p(ptoken, struct dom_sid *, n_groupSIDs + 5);
+ if (!ptoken->sids) {
+ return NT_STATUS_NO_MEMORY;
}
-
- memset((char*)ptoken->user_sids,0,sizeof(DOM_SID) * ptoken->num_sids);
-
- /*
- * Note - user SID *MUST* be first in token !
- * se_access_check depends on this.
- *
- * Primary group SID is second in token. Convention.
- */
- sid_copy(&ptoken->user_sids[PRIMARY_USER_SID_INDEX], user_sid);
- if (group_sid)
- sid_copy(&ptoken->user_sids[PRIMARY_GROUP_SID_INDEX], group_sid);
+ ptoken->user_sid = user_sid;
+ ptoken->group_sid = group_sid;
+ ptoken->privilege_mask = 0;
+
+ ptoken->sids[0] = user_sid;
+ ptoken->sids[1] = group_sid;
/*
* Finally add the "standard" SIDs.
* The only difference between guest and "anonymous" (which we
* don't really support) is the addition of Authenticated_Users.
*/
-
- sid_copy(&ptoken->user_sids[2], &global_sid_World);
- sid_copy(&ptoken->user_sids[3], &global_sid_Network);
-
- if (is_guest)
- sid_copy(&ptoken->user_sids[4], &global_sid_Builtin_Guests);
- else
- sid_copy(&ptoken->user_sids[4], &global_sid_Authenticated_Users);
-
- sid_ndx = 5; /* next available spot */
+ ptoken->sids[2] = dom_sid_parse_talloc(mem_ctx, SID_WORLD);
+ ptoken->sids[3] = dom_sid_parse_talloc(mem_ctx, SID_NT_NETWORK);
+ ptoken->sids[4] = dom_sid_parse_talloc(mem_ctx,
+ is_guest?SID_BUILTIN_GUESTS:
+ SID_NT_AUTHENTICATED_USERS);
+ ptoken->num_sids = 5;
for (i = 0; i < n_groupSIDs; i++) {
size_t check_sid_idx;
- for (check_sid_idx = 1; check_sid_idx < ptoken->num_sids; check_sid_idx++) {
- if (sid_equal(&ptoken->user_sids[check_sid_idx],
- &groupSIDs[i])) {
+ for (check_sid_idx = 1;
+ check_sid_idx < ptoken->num_sids;
+ check_sid_idx++) {
+ if (dom_sid_equal(ptoken->sids[check_sid_idx], groupSIDs[i])) {
break;
}
}
- if (check_sid_idx >= ptoken->num_sids) /* Not found already */ {
- sid_copy(&ptoken->user_sids[sid_ndx++], &groupSIDs[i]);
- } else {
- ptoken->num_sids--;
+ if (check_sid_idx == ptoken->num_sids) {
+ ptoken->sids[ptoken->num_sids++] = groupSIDs[i];
}
}
-
- debug_nt_user_token(DBGC_AUTH, 10, ptoken);
-
- *token = ptoken;
-
- return nt_status;
-}
-
-/****************************************************************************
- Create the SID list for this user.
-****************************************************************************/
-
-struct nt_user_token *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups, BOOL is_guest)
-{
- DOM_SID user_sid;
- DOM_SID group_sid;
- DOM_SID *group_sids;
- NT_USER_TOKEN *token;
- int i;
-
- if (!uid_to_sid(&user_sid, uid)) {
- return NULL;
- }
- if (!gid_to_sid(&group_sid, gid)) {
- return NULL;
- }
- group_sids = malloc(sizeof(DOM_SID) * ngroups);
- if (!group_sids) {
- DEBUG(0, ("create_nt_token: malloc() failed for DOM_SID list!\n"));
- return NULL;
+ /* setup the privilege mask for this token */
+ status = samdb_privilege_setup(ptoken);
+ if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(ptoken);
+ return status;
}
-
- for (i = 0; i < ngroups; i++) {
- if (!gid_to_sid(&(group_sids)[i], (groups)[i])) {
- DEBUG(1, ("create_nt_token: failed to convert gid %ld to a sid!\n", (long int)groups[i]));
- SAFE_FREE(group_sids);
- return NULL;
- }
- }
-
- if (!NT_STATUS_IS_OK(create_nt_user_token(&user_sid, &group_sid,
- ngroups, group_sids, is_guest, &token))) {
- SAFE_FREE(group_sids);
- return NULL;
- }
-
- SAFE_FREE(group_sids);
-
- return token;
-}
-
-/******************************************************************************
- * this function returns the groups (SIDs) of the local SAM the user is in.
- * If this samba server is a DC of the domain the user belongs to, it returns
- * both domain groups and local / builtin groups. If the user is in a trusted
- * domain, or samba is a member server of a domain, then this function returns
- * local and builtin groups the user is a member of.
- *
- * currently this is a hack, as there is no sam implementation that is capable
- * of groups.
- ******************************************************************************/
-
-static NTSTATUS get_user_groups_from_local_sam(SAM_ACCOUNT *sampass,
- int *n_groups, DOM_SID **groups, gid_t **unix_groups)
-{
- uid_t uid;
- gid_t gid;
- int n_unix_groups;
- int i;
- struct passwd *usr;
-
- *n_groups = 0;
- *groups = NULL;
-
- if (!IS_SAM_UNIX_USER(sampass)) {
- DEBUG(1, ("user %s does not have a unix identity!\n", pdb_get_username(sampass)));
- return NT_STATUS_NO_SUCH_USER;
- }
-
- uid = pdb_get_uid(sampass);
- gid = pdb_get_gid(sampass);
- n_unix_groups = groups_max();
- if ((*unix_groups = malloc( sizeof(gid_t) * n_unix_groups ) ) == NULL) {
- DEBUG(0, ("get_user_groups_from_local_sam: Out of memory allocating unix group list\n"));
- passwd_free(&usr);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (sys_getgrouplist(pdb_get_username(sampass), gid, *unix_groups, &n_unix_groups) == -1) {
- gid_t *groups_tmp;
- groups_tmp = Realloc(*unix_groups, sizeof(gid_t) * n_unix_groups);
- if (!groups_tmp) {
- SAFE_FREE(*unix_groups);
- passwd_free(&usr);
- return NT_STATUS_NO_MEMORY;
- }
- *unix_groups = groups_tmp;
-
- if (sys_getgrouplist(pdb_get_username(sampass), gid, *unix_groups, &n_unix_groups) == -1) {
- DEBUG(0, ("get_user_groups_from_local_sam: failed to get the unix group list\n"));
- SAFE_FREE(*unix_groups);
- passwd_free(&usr);
- return NT_STATUS_NO_SUCH_USER; /* what should this return value be? */
- }
- }
-
- debug_unix_user_token(DBGC_CLASS, 5, uid, gid, n_unix_groups, *unix_groups);
+ debug_security_token(DBGC_AUTH, 10, ptoken);
- if (n_unix_groups > 0) {
- *groups = malloc(sizeof(DOM_SID) * n_unix_groups);
- if (!*groups) {
- DEBUG(0, ("get_user_group_from_local_sam: malloc() failed for DOM_SID list!\n"));
- SAFE_FREE(*unix_groups);
- return NT_STATUS_NO_MEMORY;
- }
- }
-
- *n_groups = n_unix_groups;
+ *token = ptoken;
- for (i = 0; i < *n_groups; i++) {
- if (!gid_to_sid(&(*groups)[i], (*unix_groups)[i])) {
- DEBUG(1, ("get_user_groups_from_local_sam: failed to convert gid %ld to a sid!\n", (long int)(*unix_groups)[i+1]));
- SAFE_FREE(*groups);
- SAFE_FREE(*unix_groups);
- return NT_STATUS_NO_SUCH_USER;
- }
- }
-
return NT_STATUS_OK;
}
Make a user_info struct
***************************************************************************/
-static NTSTATUS make_server_info(auth_serversupplied_info **server_info, SAM_ACCOUNT *sampass)
+NTSTATUS make_server_info(const TALLOC_CTX *mem_ctx,
+ struct auth_serversupplied_info **server_info,
+ const char *username)
{
- *server_info = malloc(sizeof(**server_info));
+ *server_info = talloc_p(mem_ctx, struct auth_serversupplied_info);
if (!*server_info) {
- DEBUG(0,("make_server_info: malloc failed!\n"));
return NT_STATUS_NO_MEMORY;
}
ZERO_STRUCTP(*server_info);
-
- (*server_info)->sam_fill_level = SAM_FILL_ALL;
- (*server_info)->sam_account = sampass;
-
- return NT_STATUS_OK;
-}
-
-/***************************************************************************
- Make (and fill) a user_info struct from a SAM_ACCOUNT
-***************************************************************************/
-
-NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
- SAM_ACCOUNT *sampass)
-{
- NTSTATUS nt_status = NT_STATUS_OK;
- const DOM_SID *user_sid = pdb_get_user_sid(sampass);
- const DOM_SID *group_sid = pdb_get_group_sid(sampass);
- int n_groupSIDs = 0;
- DOM_SID *groupSIDs = NULL;
- gid_t *unix_groups = NULL;
- NT_USER_TOKEN *token;
- BOOL is_guest;
- uint32 rid;
-
- if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, sampass))) {
- return nt_status;
- }
-
- if (!NT_STATUS_IS_OK(nt_status
- = get_user_groups_from_local_sam(sampass,
- &n_groupSIDs, &groupSIDs, &unix_groups)))
- {
- DEBUG(4,("get_user_groups_from_local_sam failed\n"));
- free_server_info(server_info);
- return nt_status;
- }
-
- is_guest = (sid_peek_rid(user_sid, &rid) && rid == DOMAIN_USER_RID_GUEST);
-
- if (!NT_STATUS_IS_OK(nt_status = create_nt_user_token(user_sid, group_sid,
- n_groupSIDs, groupSIDs, is_guest,
- &token)))
- {
- DEBUG(4,("create_nt_user_token failed\n"));
- SAFE_FREE(groupSIDs);
- SAFE_FREE(unix_groups);
- free_server_info(server_info);
- return nt_status;
- }
-
- SAFE_FREE(groupSIDs);
-
- (*server_info)->n_groups = n_groupSIDs;
- (*server_info)->groups = unix_groups;
-
- (*server_info)->ptok = token;
- DEBUG(5,("make_server_info_sam: made server info for user %s\n",
- pdb_get_username((*server_info)->sam_account)));
-
- return nt_status;
+ return NT_STATUS_OK;
}
/***************************************************************************
- Make (and fill) a user_info struct from a 'struct passwd' by conversion
- to a SAM_ACCOUNT
+ Make a server_info struct from the info3 returned by a domain logon
***************************************************************************/
-NTSTATUS make_server_info_pw(auth_serversupplied_info **server_info, const struct passwd *pwd)
+NTSTATUS make_server_info_netlogon_validation(TALLOC_CTX *mem_ctx,
+ const char *internal_username,
+ struct auth_serversupplied_info **server_info,
+ uint16 validation_level,
+ union netr_Validation *validation)
{
NTSTATUS nt_status;
- SAM_ACCOUNT *sampass = NULL;
- if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam_pw(&sampass, pwd))) {
- return nt_status;
+ struct netr_SamBaseInfo *base = NULL;
+ switch (validation_level) {
+ case 2:
+ if (!validation || !validation->sam2) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ base = &validation->sam2->base;
+ break;
+ case 3:
+ if (!validation || !validation->sam3) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ base = &validation->sam3->base;
+ break;
+ case 6:
+ if (!validation || !validation->sam6) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ base = &validation->sam6->base;
+ break;
+ default:
+ return NT_STATUS_INVALID_LEVEL;
}
- return make_server_info_sam(server_info, sampass);
-}
-
-/***************************************************************************
- Make (and fill) a user_info struct for a guest login.
-***************************************************************************/
-NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
-{
- NTSTATUS nt_status;
- SAM_ACCOUNT *sampass = NULL;
- DOM_SID guest_sid;
+ nt_status = make_server_info(mem_ctx, server_info, internal_username);
- if (!NT_STATUS_IS_OK(nt_status = pdb_init_sam(&sampass))) {
+ if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
}
-
- sid_copy(&guest_sid, get_global_sam_sid());
- sid_append_rid(&guest_sid, DOMAIN_USER_RID_GUEST);
-
- become_root();
- if (!pdb_getsampwsid(sampass, &guest_sid)) {
- unbecome_root();
- return NT_STATUS_NO_SUCH_USER;
- }
- unbecome_root();
-
- nt_status = make_server_info_sam(server_info, sampass);
-
- if (NT_STATUS_IS_OK(nt_status)) {
- (*server_info)->guest = True;
- }
-
- return nt_status;
-}
-
-/***************************************************************************
- Make a server_info struct from the info3 returned by a domain logon
-***************************************************************************/
-
-NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
- const char *internal_username,
- const char *sent_nt_username,
- const char *domain,
- auth_serversupplied_info **server_info,
- NET_USER_INFO_3 *info3)
-{
- NTSTATUS nt_status = NT_STATUS_OK;
-
- const char *nt_domain;
- const char *nt_username;
-
- SAM_ACCOUNT *sam_account = NULL;
- DOM_SID user_sid;
- DOM_SID group_sid;
-
- struct passwd *passwd;
-
- uid_t uid;
- gid_t gid;
-
- int n_lgroupSIDs;
- DOM_SID *lgroupSIDs = NULL;
-
- gid_t *unix_groups = NULL;
- NT_USER_TOKEN *token;
-
- DOM_SID *all_group_SIDs;
- size_t i;
+
+ (*server_info)->guest = False;
/*
Here is where we should check the list of
matches.
*/
- sid_copy(&user_sid, &info3->dom_sid.sid);
- if (!sid_append_rid(&user_sid, info3->user_rid)) {
- return NT_STATUS_INVALID_PARAMETER;
+ (*server_info)->user_sid = dom_sid_add_rid(*server_info, dom_sid_dup(*server_info, base->domain_sid), base->rid);
+ (*server_info)->primary_group_sid = dom_sid_add_rid(*server_info, dom_sid_dup(*server_info, base->domain_sid), base->primary_gid);
+
+ (*server_info)->domain_groups = talloc_array_p((*server_info), struct dom_sid*, base->group_count);
+ if (!(*server_info)->domain_groups) {
+ return NT_STATUS_NO_MEMORY;
}
- sid_copy(&group_sid, &info3->dom_sid.sid);
- if (!sid_append_rid(&group_sid, info3->group_rid)) {
- return NT_STATUS_INVALID_PARAMETER;
+ for ((*server_info)->n_domain_groups = 0;
+ (*server_info)->n_domain_groups < base->group_count;
+ (*server_info)->n_domain_groups++) {
+ struct dom_sid *sid;
+ sid = dom_sid_dup((*server_info)->domain_groups, base->domain_sid);
+ if (!sid) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ (*server_info)->domain_groups[(*server_info)->n_domain_groups]
+ = dom_sid_add_rid(*server_info, sid,
+ base->groupids[(*server_info)->n_domain_groups].rid);
+ if (!(*server_info)->domain_groups[(*server_info)->n_domain_groups]) {
+ return NT_STATUS_NO_MEMORY;
+ }
}
- if (!(nt_username = unistr2_tdup(mem_ctx, &(info3->uni_user_name)))) {
- /* If the server didn't give us one, just use the one we sent them */
- nt_username = sent_nt_username;
- }
+ /* Copy 'other' sids. We need to do sid filtering here to
+ prevent possible elevation of privileges. See:
- if (!(nt_domain = unistr2_tdup(mem_ctx, &(info3->uni_logon_dom)))) {
- /* If the server didn't give us one, just use the one we sent them */
- domain = domain;
- }
+ http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
+ */
- if (winbind_sid_to_uid(&uid, &user_sid)
- && winbind_sid_to_gid(&gid, &group_sid)
- && ((passwd = getpwuid_alloc(uid)))) {
- nt_status = pdb_init_sam_pw(&sam_account, passwd);
- passwd_free(&passwd);
- } else {
- char *dom_user;
- dom_user = talloc_asprintf(mem_ctx, "%s%s%s",
- nt_domain,
- lp_winbind_separator(),
- internal_username);
+ if (validation_level == 3) {
+ int i;
+ (*server_info)->domain_groups
+ = talloc_realloc_p((*server_info),
+ (*server_info)->domain_groups,
+ struct dom_sid*,
+ base->group_count + validation->sam3->sidcount);
- if (!dom_user) {
- DEBUG(0, ("talloc_asprintf failed!\n"));
+ if (!(*server_info)->domain_groups) {
return NT_STATUS_NO_MEMORY;
- } else {
-
- if (!(passwd = Get_Pwnam(dom_user))
- /* Only lookup local for the local
- domain, we don't want this for
- trusted domains */
- && strequal(nt_domain, lp_workgroup())) {
- passwd = Get_Pwnam(internal_username);
- }
-
- if (!passwd) {
- return NT_STATUS_NO_SUCH_USER;
- } else {
- nt_status = pdb_init_sam_pw(&sam_account, passwd);
- }
}
- }
- if (!NT_STATUS_IS_OK(nt_status)) {
- DEBUG(0, ("make_server_info_info3: pdb_init_sam failed!\n"));
- return nt_status;
- }
-
- if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_fullname(sam_account, unistr2_static(mem_ctx, &(info3->uni_full_name)), PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_logon_script(sam_account, unistr2_static(mem_ctx, &(info3->uni_logon_script)), PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_profile_path(sam_account, unistr2_static(mem_ctx, &(info3->uni_profile_path)), PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_NO_MEMORY;
- }
-
- if (!pdb_set_homedir(sam_account, unistr2_static(mem_ctx, &(info3->uni_home_dir)), PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_NO_MEMORY;
- }
+ for (i = 0; i < validation->sam3->sidcount; i++) {
+ (*server_info)->domain_groups[(*server_info)->n_domain_groups + i] =
+ dom_sid_dup((*server_info)->domain_groups,
+ validation->sam3->sids[i].sid);
+ }
- if (!pdb_set_dir_drive(sam_account, unistr2_static(mem_ctx, &(info3->uni_dir_drive)), PDB_CHANGED)) {
- pdb_free_sam(&sam_account);
- return NT_STATUS_NO_MEMORY;
+ /* Where are the 'global' sids?... */
}
- if (!NT_STATUS_IS_OK(nt_status = make_server_info(server_info, sam_account))) {
- DEBUG(4, ("make_server_info failed!\n"));
- pdb_free_sam(&sam_account);
- return nt_status;
+ if (base->account_name.string) {
+ (*server_info)->account_name = talloc_reference(*server_info, base->account_name.string);
+ } else {
+ (*server_info)->account_name = talloc_strdup(*server_info, internal_username);
}
-
- /* Store the user group information in the server_info
- returned to the caller. */
- if (!NT_STATUS_IS_OK(nt_status
- = get_user_groups_from_local_sam(sam_account,
- &n_lgroupSIDs,
- &lgroupSIDs,
- &unix_groups)))
- {
- DEBUG(4,("get_user_groups_from_local_sam failed\n"));
- return nt_status;
- }
+ (*server_info)->domain = talloc_reference(*server_info, base->domain.string);
+ (*server_info)->full_name = talloc_reference(*server_info, base->full_name.string);
+ (*server_info)->logon_script = talloc_reference(*server_info, base->logon_script.string);
+ (*server_info)->profile_path = talloc_reference(*server_info, base->profile_path.string);
+ (*server_info)->home_directory = talloc_reference(*server_info, base->home_directory.string);
+ (*server_info)->home_drive = talloc_reference(*server_info, base->home_drive.string);
+ (*server_info)->last_logon = base->last_logon;
+ (*server_info)->last_logoff = base->last_logoff;
+ (*server_info)->acct_expiry = base->acct_expiry;
+ (*server_info)->last_password_change = base->last_password_change;
+ (*server_info)->allow_password_change = base->allow_password_change;
+ (*server_info)->force_password_change = base->force_password_change;
- (*server_info)->groups = unix_groups;
- (*server_info)->n_groups = n_lgroupSIDs;
-
- /* Create a 'combined' list of all SIDs we might want in the SD */
- all_group_SIDs = malloc(sizeof(DOM_SID) *
- (n_lgroupSIDs + info3->num_groups2 +
- info3->num_other_sids));
- if (!all_group_SIDs) {
- DEBUG(0, ("create_nt_token_info3: malloc() failed for DOM_SID list!\n"));
- SAFE_FREE(lgroupSIDs);
- return NT_STATUS_NO_MEMORY;
- }
+ (*server_info)->logon_count = base->logon_count;
+ (*server_info)->bad_password_count = base->bad_password_count;
- /* Copy the 'local' sids */
- memcpy(all_group_SIDs, lgroupSIDs, sizeof(DOM_SID) * n_lgroupSIDs);
- SAFE_FREE(lgroupSIDs);
-
- /* and create (by appending rids) the 'domain' sids */
- for (i = 0; i < info3->num_groups2; i++) {
- sid_copy(&all_group_SIDs[i+n_lgroupSIDs], &(info3->dom_sid.sid));
- if (!sid_append_rid(&all_group_SIDs[i+n_lgroupSIDs], info3->gids[i].g_rid)) {
- nt_status = NT_STATUS_INVALID_PARAMETER;
- DEBUG(3,("create_nt_token_info3: could not append additional group rid 0x%x\n",
- info3->gids[i].g_rid));
- SAFE_FREE(lgroupSIDs);
- return nt_status;
- }
- }
-
- /* Copy 'other' sids. We need to do sid filtering here to
- prevent possible elevation of privileges. See:
+ (*server_info)->acct_flags = base->acct_flags;
- http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
- */
-
- for (i = 0; i < info3->num_other_sids; i++)
- sid_copy(&all_group_SIDs[
- n_lgroupSIDs + info3->num_groups2 + i],
- &info3->other_sids[i].sid);
+ /* ensure we are never given NULL session keys */
- /* Where are the 'global' sids... */
-
- /* can the user be guest? if yes, where is it stored? */
- if (!NT_STATUS_IS_OK(
- nt_status = create_nt_user_token(
- &user_sid, &group_sid,
- n_lgroupSIDs + info3->num_groups2 + info3->num_other_sids,
- all_group_SIDs, False, &token))) {
- DEBUG(4,("create_nt_user_token failed\n"));
- SAFE_FREE(all_group_SIDs);
- return nt_status;
+ if (all_zero(base->key.key, sizeof(base->key.key))) {
+ (*server_info)->user_session_key = data_blob(NULL, 0);
+ } else {
+ (*server_info)->user_session_key = data_blob_talloc((*server_info), base->key.key, sizeof(base->key.key));
}
- (*server_info)->ptok = token;
-
- SAFE_FREE(all_group_SIDs);
-
+ if (all_zero(base->LMSessKey.key, sizeof(base->LMSessKey.key))) {
+ (*server_info)->lm_session_key = data_blob(NULL, 0);
+ } else {
+ (*server_info)->lm_session_key = data_blob_talloc((*server_info), base->LMSessKey.key, sizeof(base->LMSessKey.key));
+ }
return NT_STATUS_OK;
}
Free a user_info struct
***************************************************************************/
-void free_user_info(auth_usersupplied_info **user_info)
+void free_user_info(struct auth_usersupplied_info **user_info)
{
DEBUG(5,("attempting to free (and zero) a user_info structure\n"));
- if (*user_info != NULL) {
- if ((*user_info)->smb_name.str) {
- DEBUG(10,("structure was created for %s\n", (*user_info)->smb_name.str));
- }
- SAFE_FREE((*user_info)->smb_name.str);
- SAFE_FREE((*user_info)->internal_username.str);
- SAFE_FREE((*user_info)->client_domain.str);
- SAFE_FREE((*user_info)->domain.str);
- SAFE_FREE((*user_info)->wksta_name.str);
- data_blob_free(&(*user_info)->lm_resp);
- data_blob_free(&(*user_info)->nt_resp);
- SAFE_FREE((*user_info)->interactive_password);
- data_blob_clear_free(&(*user_info)->plaintext_password);
- ZERO_STRUCT(**user_info);
+ if (*user_info) {
+ data_blob_clear(&(*user_info)->plaintext_password);
}
- SAFE_FREE(*user_info);
+
+ talloc_free(*user_info);
+ *user_info = NULL;
}
/***************************************************************************
Clear out a server_info struct that has been allocated
***************************************************************************/
-void free_server_info(auth_serversupplied_info **server_info)
+void free_server_info(struct auth_serversupplied_info **server_info)
{
- DEBUG(5,("attempting to free (and zero) a server_info structure\n"));
- if (*server_info != NULL) {
- pdb_free_sam(&(*server_info)->sam_account);
-
- /* call pam_end here, unless we know we are keeping it */
- delete_nt_token( &(*server_info)->ptok );
- SAFE_FREE((*server_info)->groups);
- ZERO_STRUCT(**server_info);
- }
- SAFE_FREE(*server_info);
+ DEBUG(5,("attempting to free a server_info structure\n"));
+ talloc_free(*server_info);
+ *server_info = NULL;
}
/***************************************************************************
Make an auth_methods struct
***************************************************************************/
-BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method)
+BOOL make_auth_methods(struct auth_context *auth_context, struct auth_methods **auth_method)
{
if (!auth_context) {
smb_panic("no auth_context supplied to make_auth_methods()!\n");
smb_panic("make_auth_methods: pointer to auth_method pointer is NULL!\n");
}
- *auth_method = talloc(auth_context->mem_ctx, sizeof(**auth_method));
+ *auth_method = talloc_p(auth_context, struct auth_methods);
if (!*auth_method) {
- DEBUG(0,("make_auth_method: malloc failed!\n"));
return False;
}
ZERO_STRUCTP(*auth_method);
return True;
}
-/****************************************************************************
- Delete a SID token.
-****************************************************************************/
-
-void delete_nt_token(NT_USER_TOKEN **pptoken)
+NTSTATUS make_session_info(TALLOC_CTX *mem_ctx,
+ struct auth_serversupplied_info *server_info,
+ struct auth_session_info **session_info)
{
- if (*pptoken) {
- NT_USER_TOKEN *ptoken = *pptoken;
- SAFE_FREE( ptoken->user_sids );
- ZERO_STRUCTP(ptoken);
- }
- SAFE_FREE(*pptoken);
-}
-
-/****************************************************************************
- Duplicate a SID token.
-****************************************************************************/
-
-struct nt_user_token *dup_nt_token(NT_USER_TOKEN *ptoken)
-{
- NT_USER_TOKEN *token;
-
- if (!ptoken)
- return NULL;
+ NTSTATUS nt_status;
- if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
- return NULL;
+ *session_info = talloc_p(mem_ctx, struct auth_session_info);
+ if (!*session_info) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ (*session_info)->server_info = server_info;
+ talloc_reference(*session_info, (*session_info)->server_info);
- ZERO_STRUCTP(token);
+ /* unless set otherwise, the session key is the user session
+ * key from the auth subsystem */
+
+ (*session_info)->session_key = server_info->user_session_key;
- if ((token->user_sids = (DOM_SID *)memdup( ptoken->user_sids, sizeof(DOM_SID) * ptoken->num_sids )) == NULL) {
- SAFE_FREE(token);
- return NULL;
- }
+ /* we should search for local groups here */
+
+ nt_status = create_security_token((*session_info),
+ server_info->user_sid,
+ server_info->primary_group_sid,
+ server_info->n_domain_groups,
+ server_info->domain_groups,
+ False,
+ &(*session_info)->security_token);
+
+ return nt_status;
+}
- token->num_sids = ptoken->num_sids;
+/***************************************************************************
+ Clear out a server_info struct that has been allocated
+***************************************************************************/
- return token;
+void free_session_info(struct auth_session_info **session_info)
+{
+ DEBUG(5,("attempting to free a session_info structure\n"));
+ talloc_free((*session_info));
+ *session_info = NULL;
}
/**
git.samba.org / samba.git / blobdiff