source3/libnet/libnet_dssync_passdb.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Guenther Deschner <gd@samba.org> 2008
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/passwd.h"
  22 #include "libnet/libnet_dssync.h"
  23 #include "../libcli/security/security.h"
  24 #include "../libds/common/flags.h"
  25 #include "../librpc/gen_ndr/ndr_drsuapi.h"
  26 #include "util_tdb.h"
  27 #include "dbwrap/dbwrap.h"
  28 #include "dbwrap/dbwrap_rbt.h"
  29 #include "../libds/common/flag_mapping.h"
  30 #include "passdb.h"
  31 #include "lib/util/base64.h"
  32
  33 /****************************************************************
  34 ****************************************************************/
  35
  36 struct dssync_passdb {
  37         struct pdb_methods *methods;
  38         struct db_context *all;
  39         struct db_context *aliases;
  40         struct db_context *groups;
  41 };
  42
  43 struct dssync_passdb_obj {
  44         struct dssync_passdb_obj *self;
  45         uint32_t type;
  46         struct drsuapi_DsReplicaObjectListItemEx *cur;
  47         TDB_DATA key;
  48         TDB_DATA data;
  49         struct db_context *members;
  50 };
  51
  52 struct dssync_passdb_mem {
  53         struct dssync_passdb_mem *self;
  54         bool active;
  55         struct drsuapi_DsReplicaObjectIdentifier3 *cur;
  56         struct dssync_passdb_obj *obj;
  57         TDB_DATA key;
  58         TDB_DATA data;
  59 };
  60
  61 static NTSTATUS dssync_insert_obj(struct dssync_passdb *pctx,
  62                                   struct db_context *db,
  63                                   struct dssync_passdb_obj *obj)
  64 {
  65         NTSTATUS status;
  66         struct db_record *rec;
  67         TDB_DATA value;
  68
  69         rec = dbwrap_fetch_locked(db, talloc_tos(), obj->key);
  70         if (rec == NULL) {
  71                 return NT_STATUS_NO_MEMORY;
  72         }
  73
  74         value = dbwrap_record_get_value(rec);
  75         if (value.dsize != 0) {
  76                 abort();
  77         }
  78
  79         status = dbwrap_record_store(rec, obj->data, TDB_INSERT);
  80         if (!NT_STATUS_IS_OK(status)) {
  81                 TALLOC_FREE(rec);
  82                 return status;
  83         }
  84         TALLOC_FREE(rec);
  85         return NT_STATUS_OK;
  86 }
  87
  88 static struct dssync_passdb_obj *dssync_parse_obj(const TDB_DATA data)
  89 {
  90         struct dssync_passdb_obj *obj;
  91
  92         if (data.dsize != sizeof(obj)) {
  93                 return NULL;
  94         }
  95
  96         /*
  97          * we need to copy the pointer to avoid alignment problems
  98          * on some systems.
  99          */
 100         memcpy(&obj, data.dptr, sizeof(obj));
 101
 102         return talloc_get_type_abort(obj, struct dssync_passdb_obj);
 103 }
 104
 105 static struct dssync_passdb_obj *dssync_search_obj_by_guid(struct dssync_passdb *pctx,
 106                                                            struct db_context *db,
 107                                                            const struct GUID *guid)
 108 {
 109         struct dssync_passdb_obj *obj;
 110         TDB_DATA key;
 111         TDB_DATA data;
 112         NTSTATUS status;
 113
 114         key = make_tdb_data((const uint8_t *)(const void *)guid,
 115                              sizeof(*guid));
 116
 117         status = dbwrap_fetch(db, talloc_tos(), key, &data);
 118         if (!NT_STATUS_IS_OK(status)) {
 119                 return NULL;
 120         }
 121
 122         obj = dssync_parse_obj(data);
 123         return obj;
 124 }
 125
 126 static NTSTATUS dssync_create_obj(struct dssync_passdb *pctx,
 127                                   struct db_context *db,
 128                                   uint32_t type,
 129                                   struct drsuapi_DsReplicaObjectListItemEx *cur,
 130                                   struct dssync_passdb_obj **_obj)
 131 {
 132         NTSTATUS status;
 133         struct dssync_passdb_obj *obj;
 134
 135         obj = talloc_zero(pctx, struct dssync_passdb_obj);
 136         if (obj == NULL) {
 137                 return NT_STATUS_NO_MEMORY;
 138         }
 139         obj->self = obj;
 140         obj->cur = cur;
 141         obj->type = type;
 142         obj->key = make_tdb_data((const uint8_t *)(void *)&cur->object.identifier->guid,
 143                                    sizeof(cur->object.identifier->guid));
 144         obj->data = make_tdb_data((const uint8_t *)(void *)&obj->self,
 145                                   sizeof(obj->self));
 146
 147         obj->members = db_open_rbt(obj);
 148         if (obj->members == NULL) {
 149                 return NT_STATUS_NO_MEMORY;
 150         }
 151
 152         status = dssync_insert_obj(pctx, db, obj);
 153         if (!NT_STATUS_IS_OK(status)) {
 154                 TALLOC_FREE(obj);
 155                 return status;
 156         }
 157         *_obj = obj;
 158         return NT_STATUS_OK;
 159 }
 160
 161 static NTSTATUS dssync_insert_mem(struct dssync_passdb *pctx,
 162                                   struct dssync_passdb_obj *obj,
 163                                   struct dssync_passdb_mem *mem)
 164 {
 165         NTSTATUS status;
 166         struct db_record *rec;
 167         TDB_DATA value;
 168
 169         rec = dbwrap_fetch_locked(obj->members, talloc_tos(), mem->key);
 170         if (rec == NULL) {
 171                 return NT_STATUS_NO_MEMORY;
 172         }
 173
 174         value = dbwrap_record_get_value(rec);
 175         if (value.dsize != 0) {
 176                 abort();
 177         }
 178
 179         status = dbwrap_record_store(rec, mem->data, TDB_INSERT);
 180         if (!NT_STATUS_IS_OK(status)) {
 181                 TALLOC_FREE(rec);
 182                 return status;
 183         }
 184         TALLOC_FREE(rec);
 185         return NT_STATUS_OK;
 186 }
 187
 188 static NTSTATUS dssync_create_mem(struct dssync_passdb *pctx,
 189                                   struct dssync_passdb_obj *obj,
 190                                   bool active,
 191                                   struct drsuapi_DsReplicaObjectIdentifier3 *cur,
 192                                   struct dssync_passdb_mem **_mem)
 193 {
 194         NTSTATUS status;
 195         struct dssync_passdb_mem *mem;
 196
 197         mem = talloc_zero(pctx, struct dssync_passdb_mem);
 198         if (mem == NULL) {
 199                 return NT_STATUS_NO_MEMORY;
 200         }
 201         mem->self = mem;
 202         mem->cur = cur;
 203         mem->active = active;
 204         mem->obj = NULL;
 205         mem->key = make_tdb_data((const uint8_t *)(void *)&cur->guid,
 206                                    sizeof(cur->guid));
 207         mem->data = make_tdb_data((const uint8_t *)(void *)&mem->self,
 208                                   sizeof(mem->self));
 209
 210         status = dssync_insert_mem(pctx, obj, mem);
 211         if (!NT_STATUS_IS_OK(status)) {
 212                 TALLOC_FREE(obj);
 213                 return status;
 214         }
 215         *_mem = mem;
 216         return NT_STATUS_OK;
 217 }
 218
 219 static struct dssync_passdb_mem *dssync_parse_mem(const TDB_DATA data)
 220 {
 221         struct dssync_passdb_mem *mem;
 222
 223         if (data.dsize != sizeof(mem)) {
 224                 return NULL;
 225         }
 226
 227         /*
 228          * we need to copy the pointer to avoid alignment problems
 229          * on some systems.
 230          */
 231         memcpy(&mem, data.dptr, sizeof(mem));
 232
 233         return talloc_get_type_abort(mem, struct dssync_passdb_mem);
 234 }
 235
 236 static NTSTATUS passdb_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 237                                struct replUpToDateVectorBlob **pold_utdv)
 238 {
 239         NTSTATUS status;
 240         struct dssync_passdb *pctx;
 241
 242         pctx = talloc_zero(mem_ctx, struct dssync_passdb);
 243         if (pctx == NULL) {
 244                 return NT_STATUS_NO_MEMORY;
 245         }
 246
 247         if (ctx->output_filename) {
 248                 status = make_pdb_method_name(&pctx->methods, ctx->output_filename);
 249         } else {
 250                 status = make_pdb_method_name(&pctx->methods, lp_passdb_backend());
 251         }
 252
 253         if (!NT_STATUS_IS_OK(status)) {
 254                 return status;
 255         }
 256
 257         pctx->all = db_open_rbt(pctx);
 258         if (pctx->all == NULL) {
 259                 return NT_STATUS_NO_MEMORY;
 260         }
 261         pctx->aliases = db_open_rbt(pctx);
 262         if (pctx->aliases == NULL) {
 263                 return NT_STATUS_NO_MEMORY;
 264         }
 265         pctx->groups = db_open_rbt(pctx);
 266         if (pctx->groups == NULL) {
 267                 return NT_STATUS_NO_MEMORY;
 268         }
 269
 270         ctx->private_data = pctx;
 271
 272         return status;
 273 }
 274
 275 /****************************************************************
 276 ****************************************************************/
 277
 278 struct dssync_passdb_traverse_amembers {
 279         struct dssync_context *ctx;
 280         struct dssync_passdb_obj *obj;
 281         const char *name;
 282         uint32_t idx;
 283 };
 284
 285 struct dssync_passdb_traverse_aliases {
 286         struct dssync_context *ctx;
 287         const char *name;
 288         uint32_t idx;
 289 };
 290
 291 static int dssync_passdb_traverse_amembers(struct db_record *rec,
 292                                            void *private_data)
 293 {
 294         struct dssync_passdb_traverse_amembers *state =
 295                 (struct dssync_passdb_traverse_amembers *)private_data;
 296         struct dssync_passdb *pctx =
 297                 talloc_get_type_abort(state->ctx->private_data,
 298                 struct dssync_passdb);
 299         struct dssync_passdb_mem *mem;
 300         NTSTATUS status;
 301         struct dom_sid alias_sid;
 302         struct dom_sid member_sid;
 303         const char *member_dn;
 304         size_t num_members;
 305         size_t i;
 306         struct dom_sid *members;
 307         bool is_member = false;
 308         const char *action;
 309         TDB_DATA value;
 310
 311         state->idx++;
 312
 313         alias_sid = state->obj->cur->object.identifier->sid;
 314
 315         value = dbwrap_record_get_value(rec);
 316         mem = dssync_parse_mem(value);
 317         if (mem == NULL) {
 318                 return -1;
 319         }
 320
 321         member_sid = mem->cur->sid;
 322         member_dn = mem->cur->dn;
 323
 324         mem->obj = dssync_search_obj_by_guid(pctx, pctx->all, &mem->cur->guid);
 325         if (mem->obj == NULL) {
 326                 DEBUG(0,("alias[%s] member[%s] can't resolve member - ignoring\n",
 327                          sid_string_dbg(&alias_sid),
 328                          is_null_sid(&member_sid)?
 329                          sid_string_dbg(&member_sid):
 330                          member_dn));
 331                 return 0;
 332         }
 333
 334         switch (mem->obj->type) {
 335         case ATYPE_DISTRIBUTION_LOCAL_GROUP:
 336         case ATYPE_DISTRIBUTION_GLOBAL_GROUP:
 337                 DEBUG(0, ("alias[%s] ignore distribution group [%s]\n",
 338                           sid_string_dbg(&alias_sid),
 339                           member_dn));
 340                 return 0;
 341         default:
 342                 break;
 343         }
 344
 345         DEBUG(0,("alias[%s] member[%s]\n",
 346                  sid_string_dbg(&alias_sid),
 347                  sid_string_dbg(&member_sid)));
 348
 349         status = pdb_enum_aliasmem(&alias_sid, talloc_tos(),
 350                                    &members, &num_members);
 351         if (!NT_STATUS_IS_OK(status)) {
 352                 DEBUG(0, ("Could not find current alias members %s - %s\n",
 353                           sid_string_dbg(&alias_sid),
 354                           nt_errstr(status)));
 355                 return -1;
 356         }
 357
 358         for (i=0; i < num_members; i++) {
 359                 bool match;
 360
 361                 match = dom_sid_equal(&members[i], &member_sid);
 362                 if (match) {
 363                         is_member = true;
 364                         break;
 365                 }
 366         }
 367
 368         status = NT_STATUS_OK;
 369         action = "none";
 370         if (!is_member && mem->active) {
 371                 action = "add";
 372                 pdb_add_aliasmem(&alias_sid, &member_sid);
 373         } else if (is_member && !mem->active) {
 374                 action = "delete";
 375                 pdb_del_aliasmem(&alias_sid, &member_sid);
 376         }
 377         if (!NT_STATUS_IS_OK(status)) {
 378                 DEBUG(0, ("Could not %s %s as alias members of %s - %s\n",
 379                           action,
 380                           sid_string_dbg(&member_sid),
 381                           sid_string_dbg(&alias_sid),
 382                           nt_errstr(status)));
 383                 return -1;
 384         }
 385
 386         return 0;
 387 }
 388
 389 static int dssync_passdb_traverse_aliases(struct db_record *rec,
 390                                           void *private_data)
 391 {
 392         struct dssync_passdb_traverse_aliases *state =
 393                 (struct dssync_passdb_traverse_aliases *)private_data;
 394         struct dssync_passdb *pctx =
 395                 talloc_get_type_abort(state->ctx->private_data,
 396                 struct dssync_passdb);
 397         struct dssync_passdb_traverse_amembers mstate;
 398         struct dssync_passdb_obj *obj;
 399         TDB_DATA value;
 400         NTSTATUS status;
 401
 402         state->idx++;
 403         if (pctx->methods == NULL) {
 404                 return -1;
 405         }
 406
 407         value = dbwrap_record_get_value(rec);
 408         obj = dssync_parse_obj(value);
 409         if (obj == NULL) {
 410                 return -1;
 411         }
 412
 413         ZERO_STRUCT(mstate);
 414         mstate.ctx = state->ctx;
 415         mstate.name = "members";
 416         mstate.obj = obj;
 417         status = dbwrap_traverse_read(obj->members,
 418                                       dssync_passdb_traverse_amembers,
 419                                       &mstate, NULL);
 420         if (!NT_STATUS_IS_OK(status)) {
 421                 return -1;
 422         }
 423
 424         return 0;
 425 }
 426
 427 struct dssync_passdb_traverse_gmembers {
 428         struct dssync_context *ctx;
 429         struct dssync_passdb_obj *obj;
 430         const char *name;
 431         uint32_t idx;
 432 };
 433
 434 struct dssync_passdb_traverse_groups {
 435         struct dssync_context *ctx;
 436         const char *name;
 437         uint32_t idx;
 438 };
 439
 440 static int dssync_passdb_traverse_gmembers(struct db_record *rec,
 441                                            void *private_data)
 442 {
 443         struct dssync_passdb_traverse_gmembers *state =
 444                 (struct dssync_passdb_traverse_gmembers *)private_data;
 445         struct dssync_passdb *pctx =
 446                 talloc_get_type_abort(state->ctx->private_data,
 447                 struct dssync_passdb);
 448         struct dssync_passdb_mem *mem;
 449         NTSTATUS status;
 450         char *nt_member = NULL;
 451         char **unix_members;
 452         struct dom_sid group_sid;
 453         struct dom_sid member_sid;
 454         struct samu *member = NULL;
 455         const char *member_dn = NULL;
 456         GROUP_MAP *map;
 457         struct group *grp;
 458         uint32_t rid;
 459         bool is_unix_member = false;
 460         TDB_DATA value;
 461
 462         state->idx++;
 463
 464         group_sid = state->obj->cur->object.identifier->sid;
 465
 466         status = dom_sid_split_rid(talloc_tos(), &group_sid, NULL, &rid);
 467         if (!NT_STATUS_IS_OK(status)) {
 468                 return -1;
 469         }
 470
 471         value = dbwrap_record_get_value(rec);
 472
 473         mem = dssync_parse_mem(value);
 474         if (mem == NULL) {
 475                 return -1;
 476         }
 477
 478         member_sid = mem->cur->sid;
 479         member_dn = mem->cur->dn;
 480
 481         mem->obj = dssync_search_obj_by_guid(pctx, pctx->all, &mem->cur->guid);
 482         if (mem->obj == NULL) {
 483                 DEBUG(0,("group[%s] member[%s] can't resolve member - ignoring\n",
 484                          sid_string_dbg(&group_sid),
 485                          is_null_sid(&member_sid)?
 486                          sid_string_dbg(&member_sid):
 487                          member_dn));
 488                 return 0;
 489         }
 490
 491         member_sid = mem->obj->cur->object.identifier->sid;
 492         member_dn = mem->obj->cur->object.identifier->dn;
 493
 494         switch (mem->obj->type) {
 495         case ATYPE_SECURITY_LOCAL_GROUP:
 496         case ATYPE_SECURITY_GLOBAL_GROUP:
 497                 DEBUG(0, ("Group[%s] ignore member group [%s]\n",
 498                           sid_string_dbg(&group_sid),
 499                           sid_string_dbg(&member_sid)));
 500                 return 0;
 501
 502         case ATYPE_DISTRIBUTION_LOCAL_GROUP:
 503         case ATYPE_DISTRIBUTION_GLOBAL_GROUP:
 504                 DEBUG(0, ("Group[%s] ignore distribution group [%s]\n",
 505                           sid_string_dbg(&group_sid),
 506                           member_dn));
 507                 return 0;
 508         default:
 509                 break;
 510         }
 511
 512         map = talloc_zero(NULL, GROUP_MAP);
 513         if (!map) {
 514                 return -1;
 515         }
 516
 517         if (!get_domain_group_from_sid(group_sid, map)) {
 518                 DEBUG(0, ("Could not find global group %s\n",
 519                           sid_string_dbg(&group_sid)));
 520                 //return NT_STATUS_NO_SUCH_GROUP;
 521                 TALLOC_FREE(map);
 522                 return -1;
 523         }
 524
 525         if (!(grp = getgrgid(map->gid))) {
 526                 DEBUG(0, ("Could not find unix group %lu\n",
 527                                                 (unsigned long)map->gid));
 528                 //return NT_STATUS_NO_SUCH_GROUP;
 529                 TALLOC_FREE(map);
 530                 return -1;
 531         }
 532
 533         TALLOC_FREE(map);
 534
 535         DEBUG(0,("Group members of %s: ", grp->gr_name));
 536
 537         if ( !(member = samu_new(talloc_tos())) ) {
 538                 //return NT_STATUS_NO_MEMORY;
 539                 return -1;
 540         }
 541
 542         if (!pdb_getsampwsid(member, &member_sid)) {
 543                 DEBUG(1, ("Found bogus group member: (member_sid=%s group=%s)\n",
 544                           sid_string_tos(&member_sid), grp->gr_name));
 545                 TALLOC_FREE(member);
 546                 return -1;
 547         }
 548
 549         if (pdb_get_group_rid(member) == rid) {
 550                 DEBUGADD(0,("%s(primary),", pdb_get_username(member)));
 551                 TALLOC_FREE(member);
 552                 return -1;
 553         }
 554
 555         DEBUGADD(0,("%s,", pdb_get_username(member)));
 556         nt_member = talloc_strdup(talloc_tos(), pdb_get_username(member));
 557         TALLOC_FREE(member);
 558
 559         DEBUGADD(0,("\n"));
 560
 561         unix_members = grp->gr_mem;
 562
 563         while (*unix_members) {
 564                 if (strcmp(*unix_members, nt_member) == 0) {
 565                         is_unix_member = true;
 566                         break;
 567                 }
 568                 unix_members += 1;
 569         }
 570
 571         if (!is_unix_member && mem->active) {
 572                 smb_add_user_group(grp->gr_name, nt_member);
 573         } else if (is_unix_member && !mem->active) {
 574                 smb_delete_user_group(grp->gr_name, nt_member);
 575         }
 576
 577         return 0;
 578 }
 579
 580 static int dssync_passdb_traverse_groups(struct db_record *rec,
 581                                          void *private_data)
 582 {
 583         struct dssync_passdb_traverse_groups *state =
 584                 (struct dssync_passdb_traverse_groups *)private_data;
 585         struct dssync_passdb *pctx =
 586                 talloc_get_type_abort(state->ctx->private_data,
 587                 struct dssync_passdb);
 588         struct dssync_passdb_traverse_gmembers mstate;
 589         struct dssync_passdb_obj *obj;
 590         TDB_DATA value;
 591         NTSTATUS status;
 592
 593         state->idx++;
 594         if (pctx->methods == NULL) {
 595                 return -1;
 596         }
 597
 598         value = dbwrap_record_get_value(rec);
 599
 600         obj = dssync_parse_obj(value);
 601         if (obj == NULL) {
 602                 return -1;
 603         }
 604
 605         ZERO_STRUCT(mstate);
 606         mstate.ctx = state->ctx;
 607         mstate.name = "members";
 608         mstate.obj = obj;
 609         status = dbwrap_traverse_read(obj->members,
 610                                       dssync_passdb_traverse_gmembers,
 611                                       &mstate, NULL);
 612         if (!NT_STATUS_IS_OK(status)) {
 613                 return -1;
 614         }
 615
 616         return 0;
 617 }
 618
 619 static NTSTATUS passdb_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 620                               struct replUpToDateVectorBlob *new_utdv)
 621 {
 622         struct dssync_passdb *pctx =
 623                 talloc_get_type_abort(ctx->private_data,
 624                 struct dssync_passdb);
 625         struct dssync_passdb_traverse_aliases astate;
 626         struct dssync_passdb_traverse_groups gstate;
 627         NTSTATUS status;
 628
 629         ZERO_STRUCT(astate);
 630         astate.ctx = ctx;
 631         astate.name = "aliases";
 632         status = dbwrap_traverse_read(pctx->aliases,
 633                                       dssync_passdb_traverse_aliases,
 634                                       &astate, NULL);
 635         if (!NT_STATUS_IS_OK(status)) {
 636                 return NT_STATUS_INTERNAL_ERROR;
 637         }
 638
 639         ZERO_STRUCT(gstate);
 640         gstate.ctx = ctx;
 641         gstate.name = "groups";
 642         status = dbwrap_traverse_read(pctx->groups,
 643                                       dssync_passdb_traverse_groups,
 644                                       &gstate, NULL);
 645         if (!NT_STATUS_IS_OK(status)) {
 646                 return NT_STATUS_INTERNAL_ERROR;
 647         }
 648
 649         TALLOC_FREE(pctx->methods);
 650         TALLOC_FREE(pctx);
 651
 652         return NT_STATUS_OK;
 653 }
 654
 655 /****************************************************************
 656 ****************************************************************/
 657
 658 static NTSTATUS smb_create_user(TALLOC_CTX *mem_ctx,
 659                                 uint32_t acct_flags,
 660                                 const char *account,
 661                                 struct passwd **passwd_p)
 662 {
 663         struct passwd *passwd;
 664         char *add_script = NULL;
 665
 666         passwd = Get_Pwnam_alloc(mem_ctx, account);
 667         if (passwd) {
 668                 *passwd_p = passwd;
 669                 return NT_STATUS_OK;
 670         }
 671
 672         /* Create appropriate user */
 673         if (acct_flags & ACB_NORMAL) {
 674                 add_script = lp_add_user_script(mem_ctx);
 675         } else if ( (acct_flags & ACB_WSTRUST) ||
 676                     (acct_flags & ACB_SVRTRUST) ||
 677                     (acct_flags & ACB_DOMTRUST) ) {
 678                 add_script = lp_add_machine_script(mem_ctx);
 679         } else {
 680                 DEBUG(1, ("Unknown user type: %s\n",
 681                           pdb_encode_acct_ctrl(acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
 682                 return NT_STATUS_UNSUCCESSFUL;
 683         }
 684
 685         if (!add_script) {
 686                 return NT_STATUS_NO_MEMORY;
 687         }
 688
 689         if (*add_script) {
 690                 int add_ret;
 691                 add_script = talloc_all_string_sub(mem_ctx, add_script,
 692                                                    "%u", account);
 693                 if (!add_script) {
 694                         return NT_STATUS_NO_MEMORY;
 695                 }
 696                 add_ret = smbrun(add_script, NULL, NULL);
 697                 DEBUG(add_ret ? 0 : 1,("fetch_account: Running the command `%s' "
 698                          "gave %d\n", add_script, add_ret));
 699                 if (add_ret == 0) {
 700                         smb_nscd_flush_user_cache();
 701                 }
 702         }
 703
 704         /* try and find the possible unix account again */
 705         passwd = Get_Pwnam_alloc(mem_ctx, account);
 706         if (!passwd) {
 707                 return NT_STATUS_NO_SUCH_USER;
 708         }
 709
 710         *passwd_p = passwd;
 711
 712         return NT_STATUS_OK;
 713 }
 714
 715 static struct drsuapi_DsReplicaAttribute *find_drsuapi_attr(
 716                         const struct drsuapi_DsReplicaObjectListItemEx *cur,
 717                         uint32_t attid)
 718 {
 719         int i = 0;
 720
 721         for (i = 0; i < cur->object.attribute_ctr.num_attributes; i++) {
 722                 struct drsuapi_DsReplicaAttribute *attr;
 723
 724                 attr = &cur->object.attribute_ctr.attributes[i];
 725
 726                 if (attr->attid == attid) {
 727                         return attr;
 728                 }
 729         }
 730
 731         return NULL;
 732 }
 733
 734 static NTSTATUS find_drsuapi_attr_string(TALLOC_CTX *mem_ctx,
 735                                          const struct drsuapi_DsReplicaObjectListItemEx *cur,
 736                                          uint32_t attid,
 737                                          uint32_t *_count,
 738                                          char ***_array)
 739 {
 740         struct drsuapi_DsReplicaAttribute *attr;
 741         char **array;
 742         uint32_t a;
 743
 744         attr = find_drsuapi_attr(cur, attid);
 745         if (attr == NULL) {
 746                 return NT_STATUS_PROPSET_NOT_FOUND;
 747         }
 748
 749         array = talloc_array(mem_ctx, char *, attr->value_ctr.num_values);
 750         if (array == NULL) {
 751                 return NT_STATUS_NO_MEMORY;
 752         }
 753
 754         for (a = 0; a < attr->value_ctr.num_values; a++) {
 755                 const DATA_BLOB *blob;
 756                 ssize_t ret;
 757
 758                 blob = attr->value_ctr.values[a].blob;
 759
 760                 if (blob == NULL) {
 761                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 762                 }
 763
 764                 ret = pull_string_talloc(array, NULL, 0, &array[a],
 765                                          blob->data, blob->length,
 766                                          STR_UNICODE);
 767                 if (ret == -1) {
 768                         //TODO
 769                         return NT_STATUS_INTERNAL_ERROR;
 770                 }
 771         }
 772
 773         *_count = attr->value_ctr.num_values;
 774         *_array = array;
 775         return NT_STATUS_OK;
 776 }
 777
 778 static NTSTATUS find_drsuapi_attr_int32(TALLOC_CTX *mem_ctx,
 779                                         const struct drsuapi_DsReplicaObjectListItemEx *cur,
 780                                         uint32_t attid,
 781                                         uint32_t *_count,
 782                                         int32_t **_array)
 783 {
 784         struct drsuapi_DsReplicaAttribute *attr;
 785         int32_t *array;
 786         uint32_t a;
 787
 788         attr = find_drsuapi_attr(cur, attid);
 789         if (attr == NULL) {
 790                 return NT_STATUS_PROPSET_NOT_FOUND;
 791         }
 792
 793         array = talloc_array(mem_ctx, int32_t, attr->value_ctr.num_values);
 794         if (array == NULL) {
 795                 return NT_STATUS_NO_MEMORY;
 796         }
 797
 798         for (a = 0; a < attr->value_ctr.num_values; a++) {
 799                 const DATA_BLOB *blob;
 800
 801                 blob = attr->value_ctr.values[a].blob;
 802
 803                 if (blob == NULL) {
 804                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 805                 }
 806
 807                 if (blob->length != 4) {
 808                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 809                 }
 810
 811                 array[a] = IVAL(blob->data, 0);
 812         }
 813
 814         *_count = attr->value_ctr.num_values;
 815         *_array = array;
 816         return NT_STATUS_OK;
 817 }
 818
 819 static NTSTATUS find_drsuapi_attr_blob(TALLOC_CTX *mem_ctx,
 820                                        const struct drsuapi_DsReplicaObjectListItemEx *cur,
 821                                        uint32_t attid,
 822                                        uint32_t *_count,
 823                                        DATA_BLOB **_array)
 824 {
 825         struct drsuapi_DsReplicaAttribute *attr;
 826         DATA_BLOB *array;
 827         uint32_t a;
 828
 829         attr = find_drsuapi_attr(cur, attid);
 830         if (attr == NULL) {
 831                 return NT_STATUS_PROPSET_NOT_FOUND;
 832         }
 833
 834         array = talloc_array(mem_ctx, DATA_BLOB, attr->value_ctr.num_values);
 835         if (array == NULL) {
 836                 return NT_STATUS_NO_MEMORY;
 837         }
 838
 839         for (a = 0; a < attr->value_ctr.num_values; a++) {
 840                 const DATA_BLOB *blob;
 841
 842                 blob = attr->value_ctr.values[a].blob;
 843
 844                 if (blob == NULL) {
 845                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 846                 }
 847
 848                 array[a] = data_blob_talloc(array, blob->data, blob->length);
 849                 if (array[a].length != blob->length) {
 850                         return NT_STATUS_NO_MEMORY;
 851                 }
 852         }
 853         *_count = attr->value_ctr.num_values;
 854         *_array = array;
 855         return NT_STATUS_OK;
 856 }
 857
 858 static NTSTATUS find_drsuapi_attr_int64(TALLOC_CTX *mem_ctx,
 859                                         const struct drsuapi_DsReplicaObjectListItemEx *cur,
 860                                         uint32_t attid,
 861                                         uint32_t *_count,
 862                                         int64_t **_array)
 863 {
 864         struct drsuapi_DsReplicaAttribute *attr;
 865         int64_t *array;
 866         uint32_t a;
 867
 868         attr = find_drsuapi_attr(cur, attid);
 869         if (attr == NULL) {
 870                 return NT_STATUS_PROPSET_NOT_FOUND;
 871         }
 872
 873         array = talloc_array(mem_ctx, int64_t, attr->value_ctr.num_values);
 874         if (array == NULL) {
 875                 return NT_STATUS_NO_MEMORY;
 876         }
 877
 878         for (a = 0; a < attr->value_ctr.num_values; a++) {
 879                 const DATA_BLOB *blob;
 880
 881                 blob = attr->value_ctr.values[a].blob;
 882
 883                 if (blob == NULL) {
 884                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 885                 }
 886
 887                 if (blob->length != 8) {
 888                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 889                 }
 890
 891                 array[a] = BVAL(blob->data, 0);
 892         }
 893         *_count = attr->value_ctr.num_values;
 894         *_array = array;
 895         return NT_STATUS_OK;
 896 }
 897
 898 static NTSTATUS find_drsuapi_attr_dn(TALLOC_CTX *mem_ctx,
 899                                      const struct drsuapi_DsReplicaObjectListItemEx *cur,
 900                                      uint32_t attid,
 901                                      uint32_t *_count,
 902                                      struct drsuapi_DsReplicaObjectIdentifier3 **_array)
 903 {
 904         struct drsuapi_DsReplicaAttribute *attr;
 905         struct drsuapi_DsReplicaObjectIdentifier3 *array;
 906         uint32_t a;
 907
 908         attr = find_drsuapi_attr(cur, attid);
 909         if (attr == NULL) {
 910                 return NT_STATUS_PROPSET_NOT_FOUND;
 911         }
 912
 913         array = talloc_array(mem_ctx,
 914                              struct drsuapi_DsReplicaObjectIdentifier3,
 915                              attr->value_ctr.num_values);
 916         if (array == NULL) {
 917                 return NT_STATUS_NO_MEMORY;
 918         }
 919
 920         for (a = 0; a < attr->value_ctr.num_values; a++) {
 921                 const DATA_BLOB *blob;
 922                 enum ndr_err_code ndr_err;
 923                 NTSTATUS status;
 924
 925                 blob = attr->value_ctr.values[a].blob;
 926
 927                 if (blob == NULL) {
 928                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 929                 }
 930
 931                 /* windows sometimes sends an extra two pad bytes here */
 932                 ndr_err = ndr_pull_struct_blob(blob, array, &array[a],
 933                                 (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
 934                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 935                         status = ndr_map_error2ntstatus(ndr_err);
 936                         return status;
 937                 }
 938         }
 939         *_count = attr->value_ctr.num_values;
 940         *_array = array;
 941         return NT_STATUS_OK;
 942 }
 943
 944 #define GET_BLOB_EX(attr, needed) do { \
 945         NTSTATUS _status; \
 946         uint32_t _cnt; \
 947         DATA_BLOB *_vals = NULL; \
 948         attr = data_blob_null; \
 949         _status = find_drsuapi_attr_blob(mem_ctx, cur, \
 950                                          DRSUAPI_ATTID_ ## attr, \
 951                                          &_cnt, &_vals); \
 952         if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
 953                 if (!needed) { \
 954                         _status = NT_STATUS_OK; \
 955                         _cnt = 0; \
 956                 } \
 957         } \
 958         if (!NT_STATUS_IS_OK(_status)) { \
 959                 DEBUG(0,(__location__ "attr[%s] %s\n", \
 960                         #attr, nt_errstr(_status))); \
 961                 return _status; \
 962         } \
 963         if (_cnt == 0) { \
 964                 if (needed) { \
 965                         talloc_free(_vals); \
 966                         DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
 967                         return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
 968                 } \
 969         } else if (_cnt > 1) { \
 970                 talloc_free(_vals); \
 971                 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
 972                 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
 973         } else { \
 974                 attr = _vals[0]; \
 975                 (void)talloc_steal(mem_ctx, _vals[0].data); \
 976         } \
 977         talloc_free(_vals); \
 978 } while(0)
 979
 980 #define GET_STRING_EX(attr, needed) do { \
 981         NTSTATUS _status; \
 982         uint32_t _cnt; \
 983         char **_vals = NULL; \
 984         attr = NULL; \
 985         _status = find_drsuapi_attr_string(mem_ctx, cur, \
 986                                            DRSUAPI_ATTID_ ## attr, \
 987                                            &_cnt, &_vals); \
 988         if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
 989                 if (!needed) { \
 990                         _status = NT_STATUS_OK; \
 991                         _cnt = 0; \
 992                 } \
 993         } \
 994         if (!NT_STATUS_IS_OK(_status)) { \
 995                 DEBUG(0,(__location__ "attr[%s] %s\n", \
 996                         #attr, nt_errstr(_status))); \
 997                 return _status; \
 998         } \
 999         if (_cnt == 0) { \
1000                 if (needed) { \
1001                         talloc_free(_vals); \
1002                         DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1003                         return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1004                 } \
1005         } else if (_cnt > 1) { \
1006                 talloc_free(_vals); \
1007                 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1008                 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1009         } else { \
1010                 attr = talloc_move(mem_ctx, &_vals[0]); \
1011         } \
1012         talloc_free(_vals); \
1013 } while(0)
1014
1015 #define GET_UINT32_EX(attr, needed) do { \
1016         NTSTATUS _status; \
1017         uint32_t _cnt; \
1018         int32_t*_vals = NULL; \
1019         attr = 0; \
1020         _status = find_drsuapi_attr_int32(mem_ctx, cur, \
1021                                           DRSUAPI_ATTID_ ## attr, \
1022                                           &_cnt, &_vals); \
1023         if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
1024                 if (!needed) { \
1025                         _status = NT_STATUS_OK; \
1026                         _cnt = 0; \
1027                 } \
1028         } \
1029         if (!NT_STATUS_IS_OK(_status)) { \
1030                 DEBUG(0,(__location__ "attr[%s] %s\n", \
1031                         #attr, nt_errstr(_status))); \
1032                 return _status; \
1033         } \
1034         if (_cnt == 0) { \
1035                 if (needed) { \
1036                         talloc_free(_vals); \
1037                         DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1038                         return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1039                 } \
1040         } else if (_cnt > 1) { \
1041                 talloc_free(_vals); \
1042                 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1043                 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1044         } else { \
1045                 attr = (uint32_t)_vals[0]; \
1046         } \
1047         talloc_free(_vals); \
1048 } while(0)
1049
1050 #define GET_UINT64_EX(attr, needed) do { \
1051         NTSTATUS _status; \
1052         uint32_t _cnt; \
1053         int64_t *_vals = NULL; \
1054         attr = 0; \
1055         _status = find_drsuapi_attr_int64(mem_ctx, cur, \
1056                                           DRSUAPI_ATTID_ ## attr, \
1057                                           &_cnt, &_vals); \
1058         if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
1059                 if (!needed) { \
1060                         _status = NT_STATUS_OK; \
1061                         _cnt = 0; \
1062                 } \
1063         } \
1064         if (!NT_STATUS_IS_OK(_status)) { \
1065                 DEBUG(0,(__location__ "attr[%s] %s\n", \
1066                         #attr, nt_errstr(_status))); \
1067                 return _status; \
1068         } \
1069         if (_cnt == 0) { \
1070                 if (needed) { \
1071                         talloc_free(_vals); \
1072                         DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1073                         return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1074                 } \
1075         } else if (_cnt > 1) { \
1076                 talloc_free(_vals); \
1077                 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1078                 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1079         } else { \
1080                 attr = (uint64_t)_vals[0]; \
1081         } \
1082         talloc_free(_vals); \
1083 } while(0)
1084
1085 #define GET_BLOB(attr) GET_BLOB_EX(attr, false)
1086 #define GET_STRING(attr) GET_STRING_EX(attr, false)
1087 #define GET_UINT32(attr) GET_UINT32_EX(attr, false)
1088 #define GET_UINT64(attr) GET_UINT64_EX(attr, false)
1089
1090 /* Convert a struct samu_DELTA to a struct samu. */
1091 #define STRING_CHANGED (old_string && !new_string) ||\
1092                     (!old_string && new_string) ||\
1093                 (old_string && new_string && (strcmp(old_string, new_string) != 0))
1094
1095 #define STRING_CHANGED_NC(s1,s2) ((s1) && !(s2)) ||\
1096                     (!(s1) && (s2)) ||\
1097                 ((s1) && (s2) && (strcmp((s1), (s2)) != 0))
1098
1099 /****************************************************************
1100 ****************************************************************/
1101
1102 static NTSTATUS sam_account_from_object(struct samu *account,
1103                                 struct drsuapi_DsReplicaObjectListItemEx *cur)
1104 {
1105         TALLOC_CTX *mem_ctx = account;
1106         const char *old_string, *new_string;
1107         time_t unix_time, stored_time;
1108         NTSTATUS status;
1109
1110         NTTIME lastLogon;
1111         NTTIME lastLogoff;
1112         NTTIME pwdLastSet;
1113         NTTIME accountExpires;
1114         const char *sAMAccountName;
1115         const char *displayName;
1116         const char *homeDirectory;
1117         const char *homeDrive;
1118         const char *scriptPath;
1119         const char *profilePath;
1120         const char *description;
1121         const char *userWorkstations;
1122         DATA_BLOB userParameters;
1123         struct dom_sid objectSid;
1124         uint32_t primaryGroupID;
1125         uint32_t userAccountControl;
1126         DATA_BLOB logonHours;
1127         uint32_t badPwdCount;
1128         uint32_t logonCount;
1129         DATA_BLOB unicodePwd;
1130         DATA_BLOB dBCSPwd;
1131
1132         uint32_t rid = 0;
1133         uint32_t acct_flags;
1134         uint32_t units_per_week;
1135
1136         objectSid = cur->object.identifier->sid;
1137         GET_STRING_EX(sAMAccountName, true);
1138         DEBUG(0,("sam_account_from_object(%s, %s) start\n",
1139                  sAMAccountName, sid_string_dbg(&objectSid)));
1140         GET_UINT64(lastLogon);
1141         GET_UINT64(lastLogoff);
1142         GET_UINT64(pwdLastSet);
1143         GET_UINT64(accountExpires);
1144         GET_STRING(displayName);
1145         GET_STRING(homeDirectory);
1146         GET_STRING(homeDrive);
1147         GET_STRING(scriptPath);
1148         GET_STRING(profilePath);
1149         GET_STRING(description);
1150         GET_STRING(userWorkstations);
1151         GET_BLOB(userParameters);
1152         GET_UINT32(primaryGroupID);
1153         GET_UINT32(userAccountControl);
1154         GET_BLOB(logonHours);
1155         GET_UINT32(badPwdCount);
1156         GET_UINT32(logonCount);
1157         GET_BLOB(unicodePwd);
1158         GET_BLOB(dBCSPwd);
1159
1160         status = dom_sid_split_rid(mem_ctx, &objectSid, NULL, &rid);
1161         if (!NT_STATUS_IS_OK(status)) {
1162                 return status;
1163         }
1164         acct_flags = ds_uf2acb(userAccountControl);
1165
1166         /* Username, fullname, home dir, dir drive, logon script, acct
1167            desc, workstations, profile. */
1168
1169         if (sAMAccountName) {
1170                 old_string = pdb_get_nt_username(account);
1171                 new_string = sAMAccountName;
1172
1173                 if (STRING_CHANGED) {
1174                         pdb_set_nt_username(account, new_string, PDB_CHANGED);
1175                 }
1176
1177                 /* Unix username is the same - for sanity */
1178                 old_string = pdb_get_username( account );
1179                 if (STRING_CHANGED) {
1180                         pdb_set_username(account, new_string, PDB_CHANGED);
1181                 }
1182         }
1183
1184         if (displayName) {
1185                 old_string = pdb_get_fullname(account);
1186                 new_string = displayName;
1187
1188                 if (STRING_CHANGED)
1189                         pdb_set_fullname(account, new_string, PDB_CHANGED);
1190         }
1191
1192         if (homeDirectory) {
1193                 old_string = pdb_get_homedir(account);
1194                 new_string = homeDirectory;
1195
1196                 if (STRING_CHANGED)
1197                         pdb_set_homedir(account, new_string, PDB_CHANGED);
1198         }
1199
1200         if (homeDrive) {
1201                 old_string = pdb_get_dir_drive(account);
1202                 new_string = homeDrive;
1203
1204                 if (STRING_CHANGED)
1205                         pdb_set_dir_drive(account, new_string, PDB_CHANGED);
1206         }
1207
1208         if (scriptPath) {
1209                 old_string = pdb_get_logon_script(account);
1210                 new_string = scriptPath;
1211
1212                 if (STRING_CHANGED)
1213                         pdb_set_logon_script(account, new_string, PDB_CHANGED);
1214         }
1215
1216         if (description) {
1217                 old_string = pdb_get_acct_desc(account);
1218                 new_string = description;
1219
1220                 if (STRING_CHANGED)
1221                         pdb_set_acct_desc(account, new_string, PDB_CHANGED);
1222         }
1223
1224         if (userWorkstations) {
1225                 old_string = pdb_get_workstations(account);
1226                 new_string = userWorkstations;
1227
1228                 if (STRING_CHANGED)
1229                         pdb_set_workstations(account, new_string, PDB_CHANGED);
1230         }
1231
1232         if (profilePath) {
1233                 old_string = pdb_get_profile_path(account);
1234                 new_string = profilePath;
1235
1236                 if (STRING_CHANGED)
1237                         pdb_set_profile_path(account, new_string, PDB_CHANGED);
1238         }
1239
1240         if (userParameters.data) {
1241                 char *newstr = NULL;
1242                 old_string = pdb_get_munged_dial(account);
1243
1244                 if (userParameters.length != 0) {
1245                         newstr = base64_encode_data_blob(talloc_tos(),
1246                                                          userParameters);
1247                         SMB_ASSERT(newstr != NULL);
1248                 }
1249
1250                 if (STRING_CHANGED_NC(old_string, newstr))
1251                         pdb_set_munged_dial(account, newstr, PDB_CHANGED);
1252                 TALLOC_FREE(newstr);
1253         }
1254
1255         /* User and group sid */
1256         if (rid != 0 && pdb_get_user_rid(account) != rid) {
1257                 pdb_set_user_sid_from_rid(account, rid, PDB_CHANGED);
1258         }
1259         if (primaryGroupID != 0 && pdb_get_group_rid(account) != primaryGroupID) {
1260                 pdb_set_group_sid_from_rid(account, primaryGroupID, PDB_CHANGED);
1261         }
1262
1263         /* Logon and password information */
1264         if (!nt_time_is_zero(&lastLogon)) {
1265                 unix_time = nt_time_to_unix(lastLogon);
1266                 stored_time = pdb_get_logon_time(account);
1267                 if (stored_time != unix_time)
1268                         pdb_set_logon_time(account, unix_time, PDB_CHANGED);
1269         }
1270
1271         if (!nt_time_is_zero(&lastLogoff)) {
1272                 unix_time = nt_time_to_unix(lastLogoff);
1273                 stored_time = pdb_get_logoff_time(account);
1274                 if (stored_time != unix_time)
1275                         pdb_set_logoff_time(account, unix_time,PDB_CHANGED);
1276         }
1277
1278         /* Logon Divs */
1279         units_per_week = logonHours.length * 8;
1280
1281         if (pdb_get_logon_divs(account) != units_per_week) {
1282                 pdb_set_logon_divs(account, units_per_week, PDB_CHANGED);
1283         }
1284
1285         /* Logon Hours Len */
1286         if (units_per_week/8 != pdb_get_hours_len(account)) {
1287                 pdb_set_hours_len(account, units_per_week/8, PDB_CHANGED);
1288         }
1289
1290         /* Logon Hours */
1291         if (logonHours.data) {
1292                 char oldstr[44], newstr[44];
1293                 pdb_sethexhours(oldstr, pdb_get_hours(account));
1294                 pdb_sethexhours(newstr, logonHours.data);
1295                 if (!strequal(oldstr, newstr)) {
1296                         pdb_set_hours(account, logonHours.data,
1297                                       logonHours.length, PDB_CHANGED);
1298                 }
1299         }
1300
1301         if (pdb_get_bad_password_count(account) != badPwdCount)
1302                 pdb_set_bad_password_count(account, badPwdCount, PDB_CHANGED);
1303
1304         if (pdb_get_logon_count(account) != logonCount)
1305                 pdb_set_logon_count(account, logonCount, PDB_CHANGED);
1306
1307         if (!nt_time_is_zero(&pwdLastSet)) {
1308                 unix_time = nt_time_to_unix(pwdLastSet);
1309                 stored_time = pdb_get_pass_last_set_time(account);
1310                 if (stored_time != unix_time)
1311                         pdb_set_pass_last_set_time(account, unix_time, PDB_CHANGED);
1312         } else {
1313                 /* no last set time, make it now */
1314                 pdb_set_pass_last_set_time(account, time(NULL), PDB_CHANGED);
1315         }
1316
1317         if (!nt_time_is_zero(&accountExpires)) {
1318                 unix_time = nt_time_to_unix(accountExpires);
1319                 stored_time = pdb_get_kickoff_time(account);
1320                 if (stored_time != unix_time)
1321                         pdb_set_kickoff_time(account, unix_time, PDB_CHANGED);
1322         }
1323
1324         /* Decode hashes from password hash
1325            Note that win2000 may send us all zeros for the hashes if it doesn't
1326            think this channel is secure enough - don't set the passwords at all
1327            in that case
1328         */
1329         if (dBCSPwd.length == 16 && !all_zero(dBCSPwd.data, 16)) {
1330                 pdb_set_lanman_passwd(account, dBCSPwd.data, PDB_CHANGED);
1331         }
1332
1333         if (unicodePwd.length == 16 && !all_zero(unicodePwd.data, 16)) {
1334                 pdb_set_nt_passwd(account, unicodePwd.data, PDB_CHANGED);
1335         }
1336
1337         /* TODO: history */
1338
1339         /* TODO: account expiry time */
1340
1341         pdb_set_acct_ctrl(account, acct_flags, PDB_CHANGED);
1342
1343         pdb_set_domain(account, lp_workgroup(), PDB_CHANGED);
1344
1345         DEBUG(0,("sam_account_from_object(%s, %s) done\n",
1346                  sAMAccountName, sid_string_dbg(&objectSid)));
1347         return NT_STATUS_OK;
1348 }
1349
1350 /****************************************************************
1351 ****************************************************************/
1352
1353 static NTSTATUS handle_account_object(struct dssync_passdb *pctx,
1354                                       TALLOC_CTX *mem_ctx,
1355                                       struct dssync_passdb_obj *obj)
1356 {
1357         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1358         NTSTATUS status;
1359         fstring account;
1360         struct samu *sam_account=NULL;
1361         GROUP_MAP *map;
1362         struct group *grp;
1363         struct dom_sid user_sid;
1364         struct dom_sid group_sid;
1365         struct passwd *passwd = NULL;
1366         uint32_t acct_flags;
1367         uint32_t rid;
1368
1369         const char *sAMAccountName;
1370         uint32_t userAccountControl;
1371
1372         user_sid = cur->object.identifier->sid;
1373         GET_STRING_EX(sAMAccountName, true);
1374         GET_UINT32_EX(userAccountControl, true);
1375
1376         status = dom_sid_split_rid(mem_ctx, &user_sid, NULL, &rid);
1377         if (!NT_STATUS_IS_OK(status)) {
1378                 return status;
1379         }
1380
1381         fstrcpy(account, sAMAccountName);
1382         if (rid == DOMAIN_RID_GUEST) {
1383                 /*
1384                  * pdb_getsampwsid() has special handling for DOMAIN_RID_GUEST
1385                  * that's why we need to ignore it here.
1386                  *
1387                  * pdb_smbpasswd.c also has some DOMAIN_RID_GUEST related
1388                  * code...
1389                  */
1390                 DEBUG(0,("Ignore %s - %s\n", account, sid_string_dbg(&user_sid)));
1391                 return NT_STATUS_OK;
1392         }
1393         DEBUG(0,("Creating account: %s\n", account));
1394
1395         if ( !(sam_account = samu_new(mem_ctx)) ) {
1396                 return NT_STATUS_NO_MEMORY;
1397         }
1398
1399         acct_flags = ds_uf2acb(userAccountControl);
1400         status = smb_create_user(sam_account, acct_flags, account, &passwd);
1401         if (!NT_STATUS_IS_OK(status)) {
1402                 DEBUG(0,("Could not create posix account info for '%s'- %s\n",
1403                         account, nt_errstr(status)));
1404                 TALLOC_FREE(sam_account);
1405                 return status;
1406         }
1407
1408         DEBUG(3, ("Attempting to find SID %s for user %s in the passdb\n",
1409                   sid_string_dbg(&user_sid), account));
1410         if (!pdb_getsampwsid(sam_account, &user_sid)) {
1411                 sam_account_from_object(sam_account, cur);
1412                 DEBUG(3, ("Attempting to add user SID %s for user %s in the passdb\n",
1413                           sid_string_dbg(&user_sid),
1414                           pdb_get_username(sam_account)));
1415                 if (!NT_STATUS_IS_OK(pdb_add_sam_account(sam_account))) {
1416                         DEBUG(1, ("SAM Account for %s failed to be added to the passdb!\n",
1417                                   account));
1418                         TALLOC_FREE(sam_account);
1419                         return NT_STATUS_ACCESS_DENIED;
1420                 }
1421         } else {
1422                 sam_account_from_object(sam_account, cur);
1423                 DEBUG(3, ("Attempting to update user SID %s for user %s in the passdb\n",
1424                           sid_string_dbg(&user_sid),
1425                           pdb_get_username(sam_account)));
1426                 if (!NT_STATUS_IS_OK(pdb_update_sam_account(sam_account))) {
1427                         DEBUG(1, ("SAM Account for %s failed to be updated in the passdb!\n",
1428                                   account));
1429                         TALLOC_FREE(sam_account);
1430                         return NT_STATUS_ACCESS_DENIED;
1431                 }
1432         }
1433
1434         if (pdb_get_group_sid(sam_account) == NULL) {
1435                 TALLOC_FREE(sam_account);
1436                 return NT_STATUS_UNSUCCESSFUL;
1437         }
1438
1439         group_sid = *pdb_get_group_sid(sam_account);
1440
1441         map = talloc_zero(NULL, GROUP_MAP);
1442         if (!map) {
1443                 return NT_STATUS_NO_MEMORY;
1444         }
1445
1446         if (!pdb_getgrsid(map, group_sid)) {
1447                 DEBUG(0, ("Primary group of %s has no mapping!\n",
1448                           pdb_get_username(sam_account)));
1449         } else {
1450                 if (map->gid != passwd->pw_gid) {
1451                         if (!(grp = getgrgid(map->gid))) {
1452                                 DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n",
1453                                           (unsigned long)map->gid, pdb_get_username(sam_account),
1454                                           sid_string_dbg(&group_sid)));
1455                         } else {
1456                                 smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account));
1457                         }
1458                 }
1459         }
1460
1461         TALLOC_FREE(map);
1462
1463         if ( !passwd ) {
1464                 DEBUG(1, ("No unix user for this account (%s), cannot adjust mappings\n",
1465                         pdb_get_username(sam_account)));
1466         }
1467
1468         TALLOC_FREE(sam_account);
1469         return NT_STATUS_OK;
1470 }
1471
1472 /****************************************************************
1473 ****************************************************************/
1474
1475 static NTSTATUS handle_alias_object(struct dssync_passdb *pctx,
1476                                     TALLOC_CTX *mem_ctx,
1477                                     struct dssync_passdb_obj *obj)
1478 {
1479         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1480         NTSTATUS status;
1481         struct group *grp = NULL;
1482         struct dom_sid group_sid;
1483         uint32_t rid = 0;
1484         struct dom_sid *dom_sid = NULL;
1485         struct dom_sid_buf sid_str;
1486         GROUP_MAP *map;
1487         bool insert = true;
1488
1489         const char *sAMAccountName;
1490         const char *description;
1491         uint32_t i;
1492         uint32_t num_members = 0;
1493         struct drsuapi_DsReplicaObjectIdentifier3 *members = NULL;
1494
1495         group_sid = cur->object.identifier->sid;
1496         GET_STRING_EX(sAMAccountName, true);
1497         GET_STRING(description);
1498
1499         status = find_drsuapi_attr_dn(obj, cur, DRSUAPI_ATTID_member,
1500                                       &num_members, &members);
1501         if (NT_STATUS_EQUAL(status, NT_STATUS_PROPSET_NOT_FOUND)) {
1502                 status = NT_STATUS_OK;
1503         }
1504         if (!NT_STATUS_IS_OK(status)) {
1505                 return status;
1506         }
1507
1508         dom_sid_split_rid(mem_ctx, &group_sid, &dom_sid, &rid);
1509
1510         map = talloc_zero(mem_ctx, GROUP_MAP);
1511         if (map == NULL) {
1512                 status = NT_STATUS_NO_MEMORY;
1513                 goto done;
1514         }
1515
1516         map->nt_name = talloc_strdup(map, sAMAccountName);
1517         if (map->nt_name == NULL) {
1518                 status = NT_STATUS_NO_MEMORY;
1519                 goto done;
1520         }
1521
1522         if (description) {
1523                 map->comment = talloc_strdup(map, description);
1524         } else {
1525                 map->comment = talloc_strdup(map, "");
1526         }
1527         if (map->comment == NULL) {
1528                 status = NT_STATUS_NO_MEMORY;
1529                 goto done;
1530         }
1531
1532         DEBUG(0,("Creating alias[%s] - %s members[%u]\n",
1533                  map->nt_name,
1534                  dom_sid_str_buf(&group_sid, &sid_str),
1535                  num_members));
1536
1537         status = dssync_insert_obj(pctx, pctx->aliases, obj);
1538         if (!NT_STATUS_IS_OK(status)) {
1539                 goto done;
1540         }
1541
1542         if (pdb_getgrsid(map, group_sid)) {
1543                 if (map->gid != -1) {
1544                         grp = getgrgid(map->gid);
1545                 }
1546                 insert = false;
1547         }
1548
1549         if (grp == NULL) {
1550                 gid_t gid;
1551
1552                 /* No group found from mapping, find it from its name. */
1553                 if ((grp = getgrnam(map->nt_name)) == NULL) {
1554
1555                         /* No appropriate group found, create one */
1556
1557                         DEBUG(0, ("Creating unix group: '%s'\n",
1558                                                         map->nt_name));
1559
1560                         if (smb_create_group(map->nt_name, &gid) != 0) {
1561                                 status = NT_STATUS_ACCESS_DENIED;
1562                                 goto done;
1563                         }
1564
1565                         if ((grp = getgrgid(gid)) == NULL) {
1566                                 status = NT_STATUS_ACCESS_DENIED;
1567                                 goto done;
1568                         }
1569                 }
1570         }
1571
1572         map->gid = grp->gr_gid;
1573         map->sid = group_sid;
1574
1575         if (dom_sid_equal(dom_sid, &global_sid_Builtin)) {
1576                 /*
1577                  * pdb_ldap does not like SID_NAME_WKN_GRP...
1578                  *
1579                  * map.sid_name_use = SID_NAME_WKN_GRP;
1580                  */
1581                 map->sid_name_use = SID_NAME_ALIAS;
1582         } else {
1583                 map->sid_name_use = SID_NAME_ALIAS;
1584         }
1585
1586         if (insert) {
1587                 pdb_add_group_mapping_entry(map);
1588         } else {
1589                 pdb_update_group_mapping_entry(map);
1590         }
1591
1592         for (i=0; i < num_members; i++) {
1593                 struct dssync_passdb_mem *mem;
1594
1595                 status = dssync_create_mem(pctx, obj,
1596                                            true /* active */,
1597                                            &members[i], &mem);
1598                 if (!NT_STATUS_IS_OK(status)) {
1599                         goto done;
1600                 }
1601         }
1602
1603         status = NT_STATUS_OK;
1604
1605 done:
1606         TALLOC_FREE(map);
1607         return status;
1608 }
1609
1610 /****************************************************************
1611 ****************************************************************/
1612
1613 static NTSTATUS handle_group_object(struct dssync_passdb *pctx,
1614                                     TALLOC_CTX *mem_ctx,
1615                                     struct dssync_passdb_obj *obj)
1616 {
1617         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1618         NTSTATUS status;
1619         struct group *grp = NULL;
1620         struct dom_sid group_sid;
1621         struct dom_sid_buf sid_str;
1622         GROUP_MAP *map;
1623         bool insert = true;
1624
1625         const char *sAMAccountName;
1626         const char *description;
1627         uint32_t i;
1628         uint32_t num_members = 0;
1629         struct drsuapi_DsReplicaObjectIdentifier3 *members = NULL;
1630
1631         group_sid = cur->object.identifier->sid;
1632         GET_STRING_EX(sAMAccountName, true);
1633         GET_STRING(description);
1634
1635         status = find_drsuapi_attr_dn(obj, cur, DRSUAPI_ATTID_member,
1636                                       &num_members, &members);
1637         if (NT_STATUS_EQUAL(status, NT_STATUS_PROPSET_NOT_FOUND)) {
1638                 status = NT_STATUS_OK;
1639         }
1640         if (!NT_STATUS_IS_OK(status)) {
1641                 return status;
1642         }
1643
1644         map = talloc_zero(NULL, GROUP_MAP);
1645         if (!map) {
1646                 return NT_STATUS_NO_MEMORY;
1647         }
1648
1649         map->nt_name = talloc_strdup(map, sAMAccountName);
1650         if (!map->nt_name) {
1651                 status = NT_STATUS_NO_MEMORY;
1652                 goto done;
1653         }
1654         if (description) {
1655                 map->comment = talloc_strdup(map, description);
1656         } else {
1657                 map->comment = talloc_strdup(map, "");
1658         }
1659         if (!map->comment) {
1660                 status = NT_STATUS_NO_MEMORY;
1661                 goto done;
1662         }
1663
1664         DEBUG(0,("Creating group[%s] - %s members [%u]\n",
1665                  map->nt_name,
1666                  dom_sid_str_buf(&group_sid, &sid_str),
1667                  num_members));
1668
1669         status = dssync_insert_obj(pctx, pctx->groups, obj);
1670         if (!NT_STATUS_IS_OK(status)) {
1671                 goto done;
1672         }
1673
1674         if (pdb_getgrsid(map, group_sid)) {
1675                 if (map->gid != -1) {
1676                         grp = getgrgid(map->gid);
1677                 }
1678                 insert = false;
1679         }
1680
1681         if (grp == NULL) {
1682                 gid_t gid;
1683
1684                 /* No group found from mapping, find it from its name. */
1685                 if ((grp = getgrnam(map->nt_name)) == NULL) {
1686
1687                         /* No appropriate group found, create one */
1688
1689                         DEBUG(0, ("Creating unix group: '%s'\n",
1690                                                         map->nt_name));
1691
1692                         if (smb_create_group(map->nt_name, &gid) != 0) {
1693                                 status = NT_STATUS_ACCESS_DENIED;
1694                                 goto done;
1695                         }
1696
1697                         if ((grp = getgrnam(map->nt_name)) == NULL) {
1698                                 status = NT_STATUS_ACCESS_DENIED;
1699                                 goto done;
1700                         }
1701                 }
1702         }
1703
1704         map->gid = grp->gr_gid;
1705         map->sid = group_sid;
1706         map->sid_name_use = SID_NAME_DOM_GRP;
1707
1708         if (insert) {
1709                 pdb_add_group_mapping_entry(map);
1710         } else {
1711                 pdb_update_group_mapping_entry(map);
1712         }
1713
1714         for (i=0; i < num_members; i++) {
1715                 struct dssync_passdb_mem *mem;
1716
1717                 status = dssync_create_mem(pctx, obj,
1718                                            true /* active */,
1719                                            &members[i], &mem);
1720                 if (!NT_STATUS_IS_OK(status)) {
1721                         goto done;
1722                 }
1723         }
1724
1725         status = NT_STATUS_OK;
1726
1727 done:
1728         TALLOC_FREE(map);
1729         return status;
1730 }
1731
1732 /****************************************************************
1733 ****************************************************************/
1734
1735 static NTSTATUS handle_interdomain_trust_object(struct dssync_passdb *pctx,
1736                                                 TALLOC_CTX *mem_ctx,
1737                                                 struct dssync_passdb_obj *obj)
1738 {
1739         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1740         DEBUG(0,("trust: %s\n", cur->object.identifier->dn));
1741         return NT_STATUS_NOT_IMPLEMENTED;
1742 }
1743
1744 /****************************************************************
1745 ****************************************************************/
1746
1747 struct dssync_object_table_t {
1748         uint32_t type;
1749         NTSTATUS (*fn) (struct dssync_passdb *pctx,
1750                         TALLOC_CTX *mem_ctx,
1751                         struct dssync_passdb_obj *obj);
1752 };
1753
1754 static const struct dssync_object_table_t dssync_object_table[] = {
1755         { ATYPE_NORMAL_ACCOUNT,         handle_account_object },
1756         { ATYPE_WORKSTATION_TRUST,      handle_account_object },
1757         { ATYPE_SECURITY_LOCAL_GROUP,   handle_alias_object },
1758         { ATYPE_SECURITY_GLOBAL_GROUP,  handle_group_object },
1759         { ATYPE_INTERDOMAIN_TRUST,      handle_interdomain_trust_object },
1760 };
1761
1762 /****************************************************************
1763 ****************************************************************/
1764
1765 static NTSTATUS parse_object(struct dssync_passdb *pctx,
1766                              TALLOC_CTX *mem_ctx,
1767                              struct drsuapi_DsReplicaObjectListItemEx *cur)
1768 {
1769         NTSTATUS status = NT_STATUS_OK;
1770         DATA_BLOB *blob;
1771         int i = 0;
1772         int a = 0;
1773         struct drsuapi_DsReplicaAttribute *attr;
1774
1775         char *name = NULL;
1776         uint32_t sam_type = 0;
1777
1778         DEBUG(3, ("parsing object '%s'\n", cur->object.identifier->dn));
1779
1780         for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
1781
1782                 attr = &cur->object.attribute_ctr.attributes[i];
1783
1784                 if (attr->value_ctr.num_values != 1) {
1785                         continue;
1786                 }
1787
1788                 if (!attr->value_ctr.values[0].blob) {
1789                         continue;
1790                 }
1791
1792                 blob = attr->value_ctr.values[0].blob;
1793
1794                 switch (attr->attid) {
1795                         case DRSUAPI_ATTID_sAMAccountName:
1796                                 pull_string_talloc(mem_ctx, NULL, 0, &name,
1797                                                    blob->data, blob->length,
1798                                                    STR_UNICODE);
1799                                 break;
1800                         case DRSUAPI_ATTID_sAMAccountType:
1801                                 sam_type = IVAL(blob->data, 0);
1802                                 break;
1803                         default:
1804                                 break;
1805                 }
1806         }
1807
1808         for (a=0; a < ARRAY_SIZE(dssync_object_table); a++) {
1809                 if (sam_type == dssync_object_table[a].type) {
1810                         if (dssync_object_table[a].fn) {
1811                                 struct dssync_passdb_obj *obj = NULL;
1812                                 status = dssync_create_obj(pctx, pctx->all,
1813                                                            sam_type, cur, &obj);
1814                                 if (!NT_STATUS_IS_OK(status)) {
1815                                         break;
1816                                 }
1817                                 status = dssync_object_table[a].fn(pctx,
1818                                                                    mem_ctx,
1819                                                                    obj);
1820                                 break;
1821                         }
1822                 }
1823         }
1824
1825         return status;
1826 }
1827
1828 static NTSTATUS parse_link(struct dssync_passdb *pctx,
1829                            TALLOC_CTX *mem_ctx,
1830                            struct drsuapi_DsReplicaLinkedAttribute *cur)
1831 {
1832         struct drsuapi_DsReplicaObjectIdentifier3 *id3;
1833         const DATA_BLOB *blob;
1834         enum ndr_err_code ndr_err;
1835         NTSTATUS status;
1836         bool active = false;
1837         struct dssync_passdb_mem *mem;
1838         struct dssync_passdb_obj *obj;
1839
1840         if (cur->attid != DRSUAPI_ATTID_member) {
1841                 return NT_STATUS_OK;
1842         }
1843
1844         if (cur->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) {
1845                 active = true;
1846         }
1847
1848         DEBUG(3, ("parsing link '%s' - %s\n",
1849                   cur->identifier->dn, active?"adding":"deleting"));
1850
1851         blob = cur->value.blob;
1852
1853         if (blob == NULL) {
1854                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1855         }
1856
1857         obj = dssync_search_obj_by_guid(pctx, pctx->all, &cur->identifier->guid);
1858         if (obj == NULL) {
1859                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1860         }
1861
1862         id3 = talloc_zero(obj, struct drsuapi_DsReplicaObjectIdentifier3);
1863         if (id3 == NULL) {
1864                 return NT_STATUS_NO_MEMORY;
1865         }
1866
1867         /* windows sometimes sends an extra two pad bytes here */
1868         ndr_err = ndr_pull_struct_blob(blob, id3, id3,
1869                         (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
1870         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1871                 status = ndr_map_error2ntstatus(ndr_err);
1872                 return status;
1873         }
1874
1875         status = dssync_create_mem(pctx, obj,
1876                                    active,
1877                                    id3, &mem);
1878         if (!NT_STATUS_IS_OK(status)) {
1879                 return status;
1880         }
1881
1882         return NT_STATUS_OK;
1883 }
1884
1885 /****************************************************************
1886 ****************************************************************/
1887
1888 static NTSTATUS passdb_process_objects(struct dssync_context *ctx,
1889                                        TALLOC_CTX *mem_ctx,
1890                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
1891                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
1892 {
1893         NTSTATUS status = NT_STATUS_OK;
1894         struct dssync_passdb *pctx =
1895                 talloc_get_type_abort(ctx->private_data,
1896                 struct dssync_passdb);
1897
1898         for (; cur; cur = cur->next_object) {
1899                 status = parse_object(pctx, mem_ctx, cur);
1900                 if (!NT_STATUS_IS_OK(status)) {
1901                         goto out;
1902                 }
1903         }
1904
1905  out:
1906         return status;
1907 }
1908
1909 /****************************************************************
1910 ****************************************************************/
1911
1912 static NTSTATUS passdb_process_links(struct dssync_context *ctx,
1913                                      TALLOC_CTX *mem_ctx,
1914                                      uint32_t count,
1915                                      struct drsuapi_DsReplicaLinkedAttribute *links,
1916                                      struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
1917 {
1918         NTSTATUS status = NT_STATUS_OK;
1919         struct dssync_passdb *pctx =
1920                 talloc_get_type_abort(ctx->private_data,
1921                 struct dssync_passdb);
1922         uint32_t i;
1923
1924         for (i = 0; i < count; i++) {
1925                 status = parse_link(pctx, mem_ctx, &links[i]);
1926                 if (!NT_STATUS_IS_OK(status)) {
1927                         goto out;
1928                 }
1929         }
1930
1931  out:
1932         return status;
1933 }
1934
1935 /****************************************************************
1936 ****************************************************************/
1937
1938 const struct dssync_ops libnet_dssync_passdb_ops = {
1939         .startup                = passdb_startup,
1940         .process_objects        = passdb_process_objects,
1941         .process_links          = passdb_process_links,
1942         .finish                 = passdb_finish,
1943 };