source3/passdb/pdb_get_set.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    struct samu access routines
   4    Copyright (C) Jeremy Allison                 1996-2001
   5    Copyright (C) Luke Kenneth Casson Leighton   1996-1998
   6    Copyright (C) Gerald (Jerry) Carter          2000-2006
   7    Copyright (C) Andrew Bartlett                2001-2002
   8    Copyright (C) Stefan (metze) Metzmacher      2002
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_PASSDB
  29
  30 /**
  31  * @todo Redefine this to NULL, but this changes the API because
  32  *       much of samba assumes that the pdb_get...() funtions
  33  *       return pstrings.  (ie not null-pointers).
  34  *       See also pdb_fill_default_sam().
  35  */
  36
  37 #define PDB_NOT_QUITE_NULL ""
  38
  39 /*********************************************************************
  40  Collection of get...() functions for struct samu.
  41  ********************************************************************/
  42
  43 uint32 pdb_get_acct_ctrl(const struct samu *sampass)
  44 {
  45         return sampass->acct_ctrl;
  46 }
  47
  48 time_t pdb_get_logon_time(const struct samu *sampass)
  49 {
  50         return sampass->logon_time;
  51 }
  52
  53 time_t pdb_get_logoff_time(const struct samu *sampass)
  54 {
  55         return sampass->logoff_time;
  56 }
  57
  58 time_t pdb_get_kickoff_time(const struct samu *sampass)
  59 {
  60         return sampass->kickoff_time;
  61 }
  62
  63 time_t pdb_get_bad_password_time(const struct samu *sampass)
  64 {
  65         return sampass->bad_password_time;
  66 }
  67
  68 time_t pdb_get_pass_last_set_time(const struct samu *sampass)
  69 {
  70         return sampass->pass_last_set_time;
  71 }
  72
  73 time_t pdb_get_pass_can_change_time(const struct samu *sampass)
  74 {
  75         return sampass->pass_can_change_time;
  76 }
  77
  78 time_t pdb_get_pass_must_change_time(const struct samu *sampass)
  79 {
  80         return sampass->pass_must_change_time;
  81 }
  82
  83 uint16 pdb_get_logon_divs(const struct samu *sampass)
  84 {
  85         return sampass->logon_divs;
  86 }
  87
  88 uint32 pdb_get_hours_len(const struct samu *sampass)
  89 {
  90         return sampass->hours_len;
  91 }
  92
  93 const uint8 *pdb_get_hours(const struct samu *sampass)
  94 {
  95         return (sampass->hours);
  96 }
  97
  98 const uint8 *pdb_get_nt_passwd(const struct samu *sampass)
  99 {
 100         SMB_ASSERT((!sampass->nt_pw.data)
 101                    || sampass->nt_pw.length == NT_HASH_LEN);
 102         return (uint8 *)sampass->nt_pw.data;
 103 }
 104
 105 const uint8 *pdb_get_lanman_passwd(const struct samu *sampass)
 106 {
 107         SMB_ASSERT((!sampass->lm_pw.data)
 108                    || sampass->lm_pw.length == LM_HASH_LEN);
 109         return (uint8 *)sampass->lm_pw.data;
 110 }
 111
 112 const uint8 *pdb_get_pw_history(const struct samu *sampass, uint32 *current_hist_len)
 113 {
 114         SMB_ASSERT((!sampass->nt_pw_his.data)
 115            || ((sampass->nt_pw_his.length % PW_HISTORY_ENTRY_LEN) == 0));
 116         *current_hist_len = sampass->nt_pw_his.length / PW_HISTORY_ENTRY_LEN;
 117         return (uint8 *)sampass->nt_pw_his.data;
 118 }
 119
 120 /* Return the plaintext password if known.  Most of the time
 121    it isn't, so don't assume anything magic about this function.
 122
 123    Used to pass the plaintext to passdb backends that might
 124    want to store more than just the NTLM hashes.
 125 */
 126 const char *pdb_get_plaintext_passwd(const struct samu *sampass)
 127 {
 128         return sampass->plaintext_pw;
 129 }
 130
 131 const DOM_SID *pdb_get_user_sid(const struct samu *sampass)
 132 {
 133         return &sampass->user_sid;
 134 }
 135
 136 const DOM_SID *pdb_get_group_sid(struct samu *sampass)
 137 {
 138         DOM_SID *gsid;
 139         struct passwd *pwd;
 140
 141         /* Return the cached group SID if we have that */
 142         if ( sampass->group_sid ) {
 143                 return sampass->group_sid;
 144         }
 145
 146         /* generate the group SID from the user's primary Unix group */
 147
 148         if ( !(gsid  = TALLOC_P( sampass, DOM_SID )) ) {
 149                 return NULL;
 150         }
 151
 152         /* No algorithmic mapping, meaning that we have to figure out the
 153            primary group SID according to group mapping and the user SID must
 154            be a newly allocated one.  We rely on the user's Unix primary gid.
 155            We have no choice but to fail if we can't find it. */
 156
 157         if ( sampass->unix_pw ) {
 158                 pwd = sampass->unix_pw;
 159         } else {
 160                 pwd = Get_Pwnam_alloc( sampass, pdb_get_username(sampass) );
 161         }
 162
 163         if ( !pwd ) {
 164                 DEBUG(0,("pdb_get_group_sid: Failed to find Unix account for %s\n", pdb_get_username(sampass) ));
 165                 return NULL;
 166         }
 167
 168         if ( pdb_gid_to_sid(pwd->pw_gid, gsid) ) {
 169                 enum lsa_SidType type = SID_NAME_UNKNOWN;
 170                 TALLOC_CTX *mem_ctx = talloc_init("pdb_get_group_sid");
 171                 BOOL lookup_ret;
 172
 173                 if (!mem_ctx) {
 174                         return NULL;
 175                 }
 176
 177                 /* Now check that it's actually a domain group and not something else */
 178
 179                 lookup_ret = lookup_sid(mem_ctx, gsid, NULL, NULL, &type);
 180
 181                 TALLOC_FREE( mem_ctx );
 182
 183                 if ( lookup_ret && (type == SID_NAME_DOM_GRP) ) {
 184                         sampass->group_sid = gsid;
 185                         return sampass->group_sid;
 186                 }
 187
 188                 DEBUG(3, ("Primary group for user %s is a %s and not a domain group\n",
 189                         pwd->pw_name, sid_type_lookup(type)));
 190         }
 191
 192         /* Just set it to the 'Domain Users' RID of 512 which will
 193            always resolve to a name */
 194
 195         sid_copy( gsid, get_global_sam_sid() );
 196         sid_append_rid( gsid, DOMAIN_GROUP_RID_USERS );
 197
 198         sampass->group_sid = gsid;
 199
 200         return sampass->group_sid;
 201 }
 202
 203 /**
 204  * Get flags showing what is initalised in the struct samu
 205  * @param sampass the struct samu in question
 206  * @return the flags indicating the members initialised in the struct.
 207  **/
 208
 209 enum pdb_value_state pdb_get_init_flags(const struct samu *sampass, enum pdb_elements element)
 210 {
 211         enum pdb_value_state ret = PDB_DEFAULT;
 212
 213         if (!sampass->change_flags || !sampass->set_flags)
 214                 return ret;
 215
 216         if (bitmap_query(sampass->set_flags, element)) {
 217                 DEBUG(11, ("element %d: SET\n", element));
 218                 ret = PDB_SET;
 219         }
 220
 221         if (bitmap_query(sampass->change_flags, element)) {
 222                 DEBUG(11, ("element %d: CHANGED\n", element));
 223                 ret = PDB_CHANGED;
 224         }
 225
 226         if (ret == PDB_DEFAULT) {
 227                 DEBUG(11, ("element %d: DEFAULT\n", element));
 228         }
 229
 230         return ret;
 231 }
 232
 233 const char *pdb_get_username(const struct samu *sampass)
 234 {
 235         return sampass->username;
 236 }
 237
 238 const char *pdb_get_domain(const struct samu *sampass)
 239 {
 240         return sampass->domain;
 241 }
 242
 243 const char *pdb_get_nt_username(const struct samu *sampass)
 244 {
 245         return sampass->nt_username;
 246 }
 247
 248 const char *pdb_get_fullname(const struct samu *sampass)
 249 {
 250         return sampass->full_name;
 251 }
 252
 253 const char *pdb_get_homedir(const struct samu *sampass)
 254 {
 255         return sampass->home_dir;
 256 }
 257
 258 const char *pdb_get_unix_homedir(const struct samu *sampass)
 259 {
 260         if (sampass->unix_pw ) {
 261                 return sampass->unix_pw->pw_dir;
 262         }
 263         return NULL;
 264 }
 265
 266 const char *pdb_get_dir_drive(const struct samu *sampass)
 267 {
 268         return sampass->dir_drive;
 269 }
 270
 271 const char *pdb_get_logon_script(const struct samu *sampass)
 272 {
 273         return sampass->logon_script;
 274 }
 275
 276 const char *pdb_get_profile_path(const struct samu *sampass)
 277 {
 278         return sampass->profile_path;
 279 }
 280
 281 const char *pdb_get_acct_desc(const struct samu *sampass)
 282 {
 283         return sampass->acct_desc;
 284 }
 285
 286 const char *pdb_get_workstations(const struct samu *sampass)
 287 {
 288         return sampass->workstations;
 289 }
 290
 291 const char *pdb_get_comment(const struct samu *sampass)
 292 {
 293         return sampass->comment;
 294 }
 295
 296 const char *pdb_get_munged_dial(const struct samu *sampass)
 297 {
 298         return sampass->munged_dial;
 299 }
 300
 301 uint16 pdb_get_bad_password_count(const struct samu *sampass)
 302 {
 303         return sampass->bad_password_count;
 304 }
 305
 306 uint16 pdb_get_logon_count(const struct samu *sampass)
 307 {
 308         return sampass->logon_count;
 309 }
 310
 311 uint32 pdb_get_unknown_6(const struct samu *sampass)
 312 {
 313         return sampass->unknown_6;
 314 }
 315
 316 void *pdb_get_backend_private_data(const struct samu *sampass, const struct pdb_methods *my_methods)
 317 {
 318         if (my_methods == sampass->backend_private_methods) {
 319                 return sampass->backend_private_data;
 320         } else {
 321                 return NULL;
 322         }
 323 }
 324
 325 /*********************************************************************
 326  Collection of set...() functions for struct samu.
 327  ********************************************************************/
 328
 329 BOOL pdb_set_acct_ctrl(struct samu *sampass, uint32 acct_ctrl, enum pdb_value_state flag)
 330 {
 331         sampass->acct_ctrl = acct_ctrl;
 332         return pdb_set_init_flags(sampass, PDB_ACCTCTRL, flag);
 333 }
 334
 335 BOOL pdb_set_logon_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 336 {
 337         sampass->logon_time = mytime;
 338         return pdb_set_init_flags(sampass, PDB_LOGONTIME, flag);
 339 }
 340
 341 BOOL pdb_set_logoff_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 342 {
 343         sampass->logoff_time = mytime;
 344         return pdb_set_init_flags(sampass, PDB_LOGOFFTIME, flag);
 345 }
 346
 347 BOOL pdb_set_kickoff_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 348 {
 349         sampass->kickoff_time = mytime;
 350         return pdb_set_init_flags(sampass, PDB_KICKOFFTIME, flag);
 351 }
 352
 353 BOOL pdb_set_bad_password_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 354 {
 355         sampass->bad_password_time = mytime;
 356         return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_TIME, flag);
 357 }
 358
 359 BOOL pdb_set_pass_can_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 360 {
 361         sampass->pass_can_change_time = mytime;
 362         return pdb_set_init_flags(sampass, PDB_CANCHANGETIME, flag);
 363 }
 364
 365 BOOL pdb_set_pass_must_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 366 {
 367         sampass->pass_must_change_time = mytime;
 368         return pdb_set_init_flags(sampass, PDB_MUSTCHANGETIME, flag);
 369 }
 370
 371 BOOL pdb_set_pass_last_set_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 372 {
 373         sampass->pass_last_set_time = mytime;
 374         return pdb_set_init_flags(sampass, PDB_PASSLASTSET, flag);
 375 }
 376
 377 BOOL pdb_set_hours_len(struct samu *sampass, uint32 len, enum pdb_value_state flag)
 378 {
 379         sampass->hours_len = len;
 380         return pdb_set_init_flags(sampass, PDB_HOURSLEN, flag);
 381 }
 382
 383 BOOL pdb_set_logon_divs(struct samu *sampass, uint16 hours, enum pdb_value_state flag)
 384 {
 385         sampass->logon_divs = hours;
 386         return pdb_set_init_flags(sampass, PDB_LOGONDIVS, flag);
 387 }
 388
 389 /**
 390  * Set flags showing what is initalised in the struct samu
 391  * @param sampass the struct samu in question
 392  * @param flag The *new* flag to be set.  Old flags preserved
 393  *             this flag is only added.
 394  **/
 395
 396 BOOL pdb_set_init_flags(struct samu *sampass, enum pdb_elements element, enum pdb_value_state value_flag)
 397 {
 398         if (!sampass->set_flags) {
 399                 if ((sampass->set_flags =
 400                         bitmap_talloc(sampass,
 401                                         PDB_COUNT))==NULL) {
 402                         DEBUG(0,("bitmap_talloc failed\n"));
 403                         return False;
 404                 }
 405         }
 406         if (!sampass->change_flags) {
 407                 if ((sampass->change_flags =
 408                         bitmap_talloc(sampass,
 409                                         PDB_COUNT))==NULL) {
 410                         DEBUG(0,("bitmap_talloc failed\n"));
 411                         return False;
 412                 }
 413         }
 414
 415         switch(value_flag) {
 416                 case PDB_CHANGED:
 417                         if (!bitmap_set(sampass->change_flags, element)) {
 418                                 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
 419                                 return False;
 420                         }
 421                         if (!bitmap_set(sampass->set_flags, element)) {
 422                                 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
 423                                 return False;
 424                         }
 425                         DEBUG(11, ("element %d -> now CHANGED\n", element));
 426                         break;
 427                 case PDB_SET:
 428                         if (!bitmap_clear(sampass->change_flags, element)) {
 429                                 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
 430                                 return False;
 431                         }
 432                         if (!bitmap_set(sampass->set_flags, element)) {
 433                                 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
 434                                 return False;
 435                         }
 436                         DEBUG(11, ("element %d -> now SET\n", element));
 437                         break;
 438                 case PDB_DEFAULT:
 439                 default:
 440                         if (!bitmap_clear(sampass->change_flags, element)) {
 441                                 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
 442                                 return False;
 443                         }
 444                         if (!bitmap_clear(sampass->set_flags, element)) {
 445                                 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
 446                                 return False;
 447                         }
 448                         DEBUG(11, ("element %d -> now DEFAULT\n", element));
 449                         break;
 450         }
 451
 452         return True;
 453 }
 454
 455 BOOL pdb_set_user_sid(struct samu *sampass, const DOM_SID *u_sid, enum pdb_value_state flag)
 456 {
 457         if (!u_sid)
 458                 return False;
 459
 460         sid_copy(&sampass->user_sid, u_sid);
 461
 462         DEBUG(10, ("pdb_set_user_sid: setting user sid %s\n",
 463                     sid_string_static(&sampass->user_sid)));
 464
 465         return pdb_set_init_flags(sampass, PDB_USERSID, flag);
 466 }
 467
 468 BOOL pdb_set_user_sid_from_string(struct samu *sampass, fstring u_sid, enum pdb_value_state flag)
 469 {
 470         DOM_SID new_sid;
 471
 472         if (!u_sid)
 473                 return False;
 474
 475         DEBUG(10, ("pdb_set_user_sid_from_string: setting user sid %s\n",
 476                    u_sid));
 477
 478         if (!string_to_sid(&new_sid, u_sid)) {
 479                 DEBUG(1, ("pdb_set_user_sid_from_string: %s isn't a valid SID!\n", u_sid));
 480                 return False;
 481         }
 482
 483         if (!pdb_set_user_sid(sampass, &new_sid, flag)) {
 484                 DEBUG(1, ("pdb_set_user_sid_from_string: could not set sid %s on struct samu!\n", u_sid));
 485                 return False;
 486         }
 487
 488         return True;
 489 }
 490
 491 /********************************************************************
 492  We never fill this in from a passdb backend but rather set is
 493  based on the user's primary group membership.  However, the
 494  struct samu* is overloaded and reused in domain memship code
 495  as well and built from the NET_USER_INFO_3 or PAC so we
 496  have to allow the explicitly setting of a group SID here.
 497 ********************************************************************/
 498
 499 BOOL pdb_set_group_sid(struct samu *sampass, const DOM_SID *g_sid, enum pdb_value_state flag)
 500 {
 501         gid_t gid;
 502
 503         if (!g_sid)
 504                 return False;
 505
 506         if ( !(sampass->group_sid = TALLOC_P( sampass, DOM_SID )) ) {
 507                 return False;
 508         }
 509
 510         /* if we cannot resolve the SID to gid, then just ignore it and
 511            store DOMAIN_USERS as the primary groupSID */
 512
 513         if ( sid_to_gid( g_sid, &gid ) ) {
 514                 sid_copy(sampass->group_sid, g_sid);
 515         } else {
 516                 sid_copy( sampass->group_sid, get_global_sam_sid() );
 517                 sid_append_rid( sampass->group_sid, DOMAIN_GROUP_RID_USERS );
 518         }
 519
 520         DEBUG(10, ("pdb_set_group_sid: setting group sid %s\n",
 521                 sid_string_static(sampass->group_sid)));
 522
 523         return pdb_set_init_flags(sampass, PDB_GROUPSID, flag);
 524 }
 525
 526 /*********************************************************************
 527  Set the user's UNIX name.
 528  ********************************************************************/
 529
 530 BOOL pdb_set_username(struct samu *sampass, const char *username, enum pdb_value_state flag)
 531 {
 532         if (username) {
 533                 DEBUG(10, ("pdb_set_username: setting username %s, was %s\n", username,
 534                         (sampass->username)?(sampass->username):"NULL"));
 535
 536                 sampass->username = talloc_strdup(sampass, username);
 537
 538                 if (!sampass->username) {
 539                         DEBUG(0, ("pdb_set_username: talloc_strdup() failed!\n"));
 540                         return False;
 541                 }
 542         } else {
 543                 sampass->username = PDB_NOT_QUITE_NULL;
 544         }
 545
 546         return pdb_set_init_flags(sampass, PDB_USERNAME, flag);
 547 }
 548
 549 /*********************************************************************
 550  Set the domain name.
 551  ********************************************************************/
 552
 553 BOOL pdb_set_domain(struct samu *sampass, const char *domain, enum pdb_value_state flag)
 554 {
 555         if (domain) {
 556                 DEBUG(10, ("pdb_set_domain: setting domain %s, was %s\n", domain,
 557                         (sampass->domain)?(sampass->domain):"NULL"));
 558
 559                 sampass->domain = talloc_strdup(sampass, domain);
 560
 561                 if (!sampass->domain) {
 562                         DEBUG(0, ("pdb_set_domain: talloc_strdup() failed!\n"));
 563                         return False;
 564                 }
 565         } else {
 566                 sampass->domain = PDB_NOT_QUITE_NULL;
 567         }
 568
 569         return pdb_set_init_flags(sampass, PDB_DOMAIN, flag);
 570 }
 571
 572 /*********************************************************************
 573  Set the user's NT name.
 574  ********************************************************************/
 575
 576 BOOL pdb_set_nt_username(struct samu *sampass, const char *nt_username, enum pdb_value_state flag)
 577 {
 578         if (nt_username) {
 579                 DEBUG(10, ("pdb_set_nt_username: setting nt username %s, was %s\n", nt_username,
 580                         (sampass->nt_username)?(sampass->nt_username):"NULL"));
 581
 582                 sampass->nt_username = talloc_strdup(sampass, nt_username);
 583
 584                 if (!sampass->nt_username) {
 585                         DEBUG(0, ("pdb_set_nt_username: talloc_strdup() failed!\n"));
 586                         return False;
 587                 }
 588         } else {
 589                 sampass->nt_username = PDB_NOT_QUITE_NULL;
 590         }
 591
 592         return pdb_set_init_flags(sampass, PDB_NTUSERNAME, flag);
 593 }
 594
 595 /*********************************************************************
 596  Set the user's full name.
 597  ********************************************************************/
 598
 599 BOOL pdb_set_fullname(struct samu *sampass, const char *full_name, enum pdb_value_state flag)
 600 {
 601         if (full_name) {
 602                 DEBUG(10, ("pdb_set_full_name: setting full name %s, was %s\n", full_name,
 603                         (sampass->full_name)?(sampass->full_name):"NULL"));
 604
 605                 sampass->full_name = talloc_strdup(sampass, full_name);
 606
 607                 if (!sampass->full_name) {
 608                         DEBUG(0, ("pdb_set_fullname: talloc_strdup() failed!\n"));
 609                         return False;
 610                 }
 611         } else {
 612                 sampass->full_name = PDB_NOT_QUITE_NULL;
 613         }
 614
 615         return pdb_set_init_flags(sampass, PDB_FULLNAME, flag);
 616 }
 617
 618 /*********************************************************************
 619  Set the user's logon script.
 620  ********************************************************************/
 621
 622 BOOL pdb_set_logon_script(struct samu *sampass, const char *logon_script, enum pdb_value_state flag)
 623 {
 624         if (logon_script) {
 625                 DEBUG(10, ("pdb_set_logon_script: setting logon script %s, was %s\n", logon_script,
 626                         (sampass->logon_script)?(sampass->logon_script):"NULL"));
 627
 628                 sampass->logon_script = talloc_strdup(sampass, logon_script);
 629
 630                 if (!sampass->logon_script) {
 631                         DEBUG(0, ("pdb_set_logon_script: talloc_strdup() failed!\n"));
 632                         return False;
 633                 }
 634         } else {
 635                 sampass->logon_script = PDB_NOT_QUITE_NULL;
 636         }
 637
 638         return pdb_set_init_flags(sampass, PDB_LOGONSCRIPT, flag);
 639 }
 640
 641 /*********************************************************************
 642  Set the user's profile path.
 643  ********************************************************************/
 644
 645 BOOL pdb_set_profile_path(struct samu *sampass, const char *profile_path, enum pdb_value_state flag)
 646 {
 647         if (profile_path) {
 648                 DEBUG(10, ("pdb_set_profile_path: setting profile path %s, was %s\n", profile_path,
 649                         (sampass->profile_path)?(sampass->profile_path):"NULL"));
 650
 651                 sampass->profile_path = talloc_strdup(sampass, profile_path);
 652
 653                 if (!sampass->profile_path) {
 654                         DEBUG(0, ("pdb_set_profile_path: talloc_strdup() failed!\n"));
 655                         return False;
 656                 }
 657         } else {
 658                 sampass->profile_path = PDB_NOT_QUITE_NULL;
 659         }
 660
 661         return pdb_set_init_flags(sampass, PDB_PROFILE, flag);
 662 }
 663
 664 /*********************************************************************
 665  Set the user's directory drive.
 666  ********************************************************************/
 667
 668 BOOL pdb_set_dir_drive(struct samu *sampass, const char *dir_drive, enum pdb_value_state flag)
 669 {
 670         if (dir_drive) {
 671                 DEBUG(10, ("pdb_set_dir_drive: setting dir drive %s, was %s\n", dir_drive,
 672                         (sampass->dir_drive)?(sampass->dir_drive):"NULL"));
 673
 674                 sampass->dir_drive = talloc_strdup(sampass, dir_drive);
 675
 676                 if (!sampass->dir_drive) {
 677                         DEBUG(0, ("pdb_set_dir_drive: talloc_strdup() failed!\n"));
 678                         return False;
 679                 }
 680
 681         } else {
 682                 sampass->dir_drive = PDB_NOT_QUITE_NULL;
 683         }
 684
 685         return pdb_set_init_flags(sampass, PDB_DRIVE, flag);
 686 }
 687
 688 /*********************************************************************
 689  Set the user's home directory.
 690  ********************************************************************/
 691
 692 BOOL pdb_set_homedir(struct samu *sampass, const char *home_dir, enum pdb_value_state flag)
 693 {
 694         if (home_dir) {
 695                 DEBUG(10, ("pdb_set_homedir: setting home dir %s, was %s\n", home_dir,
 696                         (sampass->home_dir)?(sampass->home_dir):"NULL"));
 697
 698                 sampass->home_dir = talloc_strdup(sampass, home_dir);
 699
 700                 if (!sampass->home_dir) {
 701                         DEBUG(0, ("pdb_set_home_dir: talloc_strdup() failed!\n"));
 702                         return False;
 703                 }
 704         } else {
 705                 sampass->home_dir = PDB_NOT_QUITE_NULL;
 706         }
 707
 708         return pdb_set_init_flags(sampass, PDB_SMBHOME, flag);
 709 }
 710
 711 /*********************************************************************
 712  Set the user's account description.
 713  ********************************************************************/
 714
 715 BOOL pdb_set_acct_desc(struct samu *sampass, const char *acct_desc, enum pdb_value_state flag)
 716 {
 717         if (acct_desc) {
 718                 sampass->acct_desc = talloc_strdup(sampass, acct_desc);
 719
 720                 if (!sampass->acct_desc) {
 721                         DEBUG(0, ("pdb_set_acct_desc: talloc_strdup() failed!\n"));
 722                         return False;
 723                 }
 724         } else {
 725                 sampass->acct_desc = PDB_NOT_QUITE_NULL;
 726         }
 727
 728         return pdb_set_init_flags(sampass, PDB_ACCTDESC, flag);
 729 }
 730
 731 /*********************************************************************
 732  Set the user's workstation allowed list.
 733  ********************************************************************/
 734
 735 BOOL pdb_set_workstations(struct samu *sampass, const char *workstations, enum pdb_value_state flag)
 736 {
 737         if (workstations) {
 738                 DEBUG(10, ("pdb_set_workstations: setting workstations %s, was %s\n", workstations,
 739                         (sampass->workstations)?(sampass->workstations):"NULL"));
 740
 741                 sampass->workstations = talloc_strdup(sampass, workstations);
 742
 743                 if (!sampass->workstations) {
 744                         DEBUG(0, ("pdb_set_workstations: talloc_strdup() failed!\n"));
 745                         return False;
 746                 }
 747         } else {
 748                 sampass->workstations = PDB_NOT_QUITE_NULL;
 749         }
 750
 751         return pdb_set_init_flags(sampass, PDB_WORKSTATIONS, flag);
 752 }
 753
 754 /*********************************************************************
 755  ********************************************************************/
 756
 757 BOOL pdb_set_comment(struct samu *sampass, const char *comment, enum pdb_value_state flag)
 758 {
 759         if (comment) {
 760                 sampass->comment = talloc_strdup(sampass, comment);
 761
 762                 if (!sampass->comment) {
 763                         DEBUG(0, ("pdb_set_comment: talloc_strdup() failed!\n"));
 764                         return False;
 765                 }
 766         } else {
 767                 sampass->comment = PDB_NOT_QUITE_NULL;
 768         }
 769
 770         return pdb_set_init_flags(sampass, PDB_COMMENT, flag);
 771 }
 772
 773 /*********************************************************************
 774  Set the user's dial string.
 775  ********************************************************************/
 776
 777 BOOL pdb_set_munged_dial(struct samu *sampass, const char *munged_dial, enum pdb_value_state flag)
 778 {
 779         if (munged_dial) {
 780                 sampass->munged_dial = talloc_strdup(sampass, munged_dial);
 781
 782                 if (!sampass->munged_dial) {
 783                         DEBUG(0, ("pdb_set_munged_dial: talloc_strdup() failed!\n"));
 784                         return False;
 785                 }
 786         } else {
 787                 sampass->munged_dial = PDB_NOT_QUITE_NULL;
 788         }
 789
 790         return pdb_set_init_flags(sampass, PDB_MUNGEDDIAL, flag);
 791 }
 792
 793 /*********************************************************************
 794  Set the user's NT hash.
 795  ********************************************************************/
 796
 797 BOOL pdb_set_nt_passwd(struct samu *sampass, const uint8 pwd[NT_HASH_LEN], enum pdb_value_state flag)
 798 {
 799         data_blob_clear_free(&sampass->nt_pw);
 800
 801        if (pwd) {
 802                sampass->nt_pw =
 803                        data_blob_talloc(sampass, pwd, NT_HASH_LEN);
 804        } else {
 805                sampass->nt_pw = data_blob(NULL, 0);
 806        }
 807
 808         return pdb_set_init_flags(sampass, PDB_NTPASSWD, flag);
 809 }
 810
 811 /*********************************************************************
 812  Set the user's LM hash.
 813  ********************************************************************/
 814
 815 BOOL pdb_set_lanman_passwd(struct samu *sampass, const uint8 pwd[LM_HASH_LEN], enum pdb_value_state flag)
 816 {
 817         data_blob_clear_free(&sampass->lm_pw);
 818
 819         /* on keep the password if we are allowing LANMAN authentication */
 820
 821         if (pwd && lp_lanman_auth() ) {
 822                 sampass->lm_pw = data_blob_talloc(sampass, pwd, LM_HASH_LEN);
 823         } else {
 824                 sampass->lm_pw = data_blob(NULL, 0);
 825         }
 826
 827         return pdb_set_init_flags(sampass, PDB_LMPASSWD, flag);
 828 }
 829
 830 /*********************************************************************
 831  Set the user's password history hash. historyLen is the number of
 832  PW_HISTORY_SALT_LEN+SALTED_MD5_HASH_LEN length
 833  entries to store in the history - this must match the size of the uint8 array
 834  in pwd.
 835 ********************************************************************/
 836
 837 BOOL pdb_set_pw_history(struct samu *sampass, const uint8 *pwd, uint32 historyLen, enum pdb_value_state flag)
 838 {
 839         if (historyLen && pwd){
 840                 sampass->nt_pw_his = data_blob_talloc(sampass,
 841                                                 pwd, historyLen*PW_HISTORY_ENTRY_LEN);
 842                 if (!sampass->nt_pw_his.length) {
 843                         DEBUG(0, ("pdb_set_pw_history: data_blob_talloc() failed!\n"));
 844                         return False;
 845                 }
 846         } else {
 847                 sampass->nt_pw_his = data_blob_talloc(sampass, NULL, 0);
 848         }
 849
 850         return pdb_set_init_flags(sampass, PDB_PWHISTORY, flag);
 851 }
 852
 853 /*********************************************************************
 854  Set the user's plaintext password only (base procedure, see helper
 855  below)
 856  ********************************************************************/
 857
 858 BOOL pdb_set_plaintext_pw_only(struct samu *sampass, const char *password, enum pdb_value_state flag)
 859 {
 860         if (password) {
 861                 if (sampass->plaintext_pw!=NULL)
 862                         memset(sampass->plaintext_pw,'\0',strlen(sampass->plaintext_pw)+1);
 863
 864                 sampass->plaintext_pw = talloc_strdup(sampass, password);
 865
 866                 if (!sampass->plaintext_pw) {
 867                         DEBUG(0, ("pdb_set_unknown_str: talloc_strdup() failed!\n"));
 868                         return False;
 869                 }
 870         } else {
 871                 sampass->plaintext_pw = NULL;
 872         }
 873
 874         return pdb_set_init_flags(sampass, PDB_PLAINTEXT_PW, flag);
 875 }
 876
 877 BOOL pdb_set_bad_password_count(struct samu *sampass, uint16 bad_password_count, enum pdb_value_state flag)
 878 {
 879         sampass->bad_password_count = bad_password_count;
 880         return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_COUNT, flag);
 881 }
 882
 883 BOOL pdb_set_logon_count(struct samu *sampass, uint16 logon_count, enum pdb_value_state flag)
 884 {
 885         sampass->logon_count = logon_count;
 886         return pdb_set_init_flags(sampass, PDB_LOGON_COUNT, flag);
 887 }
 888
 889 BOOL pdb_set_unknown_6(struct samu *sampass, uint32 unkn, enum pdb_value_state flag)
 890 {
 891         sampass->unknown_6 = unkn;
 892         return pdb_set_init_flags(sampass, PDB_UNKNOWN6, flag);
 893 }
 894
 895 BOOL pdb_set_hours(struct samu *sampass, const uint8 *hours, enum pdb_value_state flag)
 896 {
 897         if (!hours) {
 898                 memset ((char *)sampass->hours, 0, MAX_HOURS_LEN);
 899         } else {
 900                 memcpy (sampass->hours, hours, MAX_HOURS_LEN);
 901         }
 902
 903         return pdb_set_init_flags(sampass, PDB_HOURS, flag);
 904 }
 905
 906 BOOL pdb_set_backend_private_data(struct samu *sampass, void *private_data,
 907                                    void (*free_fn)(void **),
 908                                    const struct pdb_methods *my_methods,
 909                                    enum pdb_value_state flag)
 910 {
 911         if (sampass->backend_private_data &&
 912             sampass->backend_private_data_free_fn) {
 913                 sampass->backend_private_data_free_fn(
 914                         &sampass->backend_private_data);
 915         }
 916
 917         sampass->backend_private_data = private_data;
 918         sampass->backend_private_data_free_fn = free_fn;
 919         sampass->backend_private_methods = my_methods;
 920
 921         return pdb_set_init_flags(sampass, PDB_BACKEND_PRIVATE_DATA, flag);
 922 }
 923
 924
 925 /* Helpful interfaces to the above */
 926
 927 /*********************************************************************
 928  Sets the last changed times and must change times for a normal
 929  password change.
 930  ********************************************************************/
 931
 932 BOOL pdb_set_pass_changed_now(struct samu *sampass)
 933 {
 934         uint32 expire;
 935         uint32 min_age;
 936
 937         if (!pdb_set_pass_last_set_time (sampass, time(NULL), PDB_CHANGED))
 938                 return False;
 939
 940         if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &expire)
 941             || (expire==(uint32)-1) || (expire == 0)) {
 942                 if (!pdb_set_pass_must_change_time (sampass, get_time_t_max(), PDB_CHANGED))
 943                         return False;
 944         } else {
 945                 if (!pdb_set_pass_must_change_time (sampass,
 946                                                     pdb_get_pass_last_set_time(sampass)
 947                                                     + expire, PDB_CHANGED))
 948                         return False;
 949         }
 950
 951         if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &min_age)
 952             || (min_age==(uint32)-1)) {
 953                 if (!pdb_set_pass_can_change_time (sampass, 0, PDB_CHANGED))
 954                         return False;
 955         } else {
 956                 if (!pdb_set_pass_can_change_time (sampass,
 957                                                     pdb_get_pass_last_set_time(sampass)
 958                                                     + min_age, PDB_CHANGED))
 959                         return False;
 960         }
 961         return True;
 962 }
 963
 964 /*********************************************************************
 965  Set the user's PLAINTEXT password.  Used as an interface to the above.
 966  Also sets the last change time to NOW.
 967  ********************************************************************/
 968
 969 BOOL pdb_set_plaintext_passwd(struct samu *sampass, const char *plaintext)
 970 {
 971         uchar new_lanman_p16[LM_HASH_LEN];
 972         uchar new_nt_p16[NT_HASH_LEN];
 973
 974         if (!plaintext)
 975                 return False;
 976
 977         /* Calculate the MD4 hash (NT compatible) of the password */
 978         E_md4hash(plaintext, new_nt_p16);
 979
 980         if (!pdb_set_nt_passwd (sampass, new_nt_p16, PDB_CHANGED))
 981                 return False;
 982
 983         if (!E_deshash(plaintext, new_lanman_p16)) {
 984                 /* E_deshash returns false for 'long' passwords (> 14
 985                    DOS chars).  This allows us to match Win2k, which
 986                    does not store a LM hash for these passwords (which
 987                    would reduce the effective password length to 14 */
 988
 989                 if (!pdb_set_lanman_passwd (sampass, NULL, PDB_CHANGED))
 990                         return False;
 991         } else {
 992                 if (!pdb_set_lanman_passwd (sampass, new_lanman_p16, PDB_CHANGED))
 993                         return False;
 994         }
 995
 996         if (!pdb_set_plaintext_pw_only (sampass, plaintext, PDB_CHANGED))
 997                 return False;
 998
 999         if (!pdb_set_pass_changed_now (sampass))
1000                 return False;
1001
1002         /* Store the password history. */
1003         if (pdb_get_acct_ctrl(sampass) & ACB_NORMAL) {
1004                 uchar *pwhistory;
1005                 uint32 pwHistLen;
1006                 pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
1007                 if (pwHistLen != 0){
1008                         uint32 current_history_len;
1009                         /* We need to make sure we don't have a race condition here - the
1010                            account policy history length can change between when the pw_history
1011                            was first loaded into the struct samu struct and now.... JRA. */
1012                         pwhistory = (uchar *)pdb_get_pw_history(sampass, &current_history_len);
1013
1014                         if (current_history_len != pwHistLen) {
1015                                 /* After closing and reopening struct samu the history
1016                                         values will sync up. We can't do this here. */
1017
1018                                 /* current_history_len > pwHistLen is not a problem - we
1019                                         have more history than we need. */
1020
1021                                 if (current_history_len < pwHistLen) {
1022                                         /* Ensure we have space for the needed history. */
1023                                         uchar *new_history = (uchar *)TALLOC(sampass,
1024                                                                 pwHistLen*PW_HISTORY_ENTRY_LEN);
1025                                         if (!new_history) {
1026                                                 return False;
1027                                         }
1028
1029                                         /* And copy it into the new buffer. */
1030                                         if (current_history_len) {
1031                                                 memcpy(new_history, pwhistory,
1032                                                         current_history_len*PW_HISTORY_ENTRY_LEN);
1033                                         }
1034                                         /* Clearing out any extra space. */
1035                                         memset(&new_history[current_history_len*PW_HISTORY_ENTRY_LEN],
1036                                                 '\0', (pwHistLen-current_history_len)*PW_HISTORY_ENTRY_LEN);
1037                                         /* Finally replace it. */
1038                                         pwhistory = new_history;
1039                                 }
1040                         }
1041                         if (pwhistory && pwHistLen){
1042                                 /* Make room for the new password in the history list. */
1043                                 if (pwHistLen > 1) {
1044                                         memmove(&pwhistory[PW_HISTORY_ENTRY_LEN],
1045                                                 pwhistory, (pwHistLen -1)*PW_HISTORY_ENTRY_LEN );
1046                                 }
1047                                 /* Create the new salt as the first part of the history entry. */
1048                                 generate_random_buffer(pwhistory, PW_HISTORY_SALT_LEN);
1049
1050                                 /* Generate the md5 hash of the salt+new password as the second
1051                                         part of the history entry. */
1052
1053                                 E_md5hash(pwhistory, new_nt_p16, &pwhistory[PW_HISTORY_SALT_LEN]);
1054                                 pdb_set_pw_history(sampass, pwhistory, pwHistLen, PDB_CHANGED);
1055                         } else {
1056                                 DEBUG (10,("pdb_get_set.c: pdb_set_plaintext_passwd: pwhistory was NULL!\n"));
1057                         }
1058                 } else {
1059                         /* Set the history length to zero. */
1060                         pdb_set_pw_history(sampass, NULL, 0, PDB_CHANGED);
1061                 }
1062         }
1063
1064         return True;
1065 }
1066
1067 /* check for any PDB_SET/CHANGED field and fill the appropriate mask bit */
1068 uint32 pdb_build_fields_present(struct samu *sampass)
1069 {
1070         /* value set to all for testing */
1071         return 0x00ffffff;
1072 }