source3/passdb/pdb_get_set.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    struct samu access routines
   4    Copyright (C) Jeremy Allison                 1996-2001
   5    Copyright (C) Luke Kenneth Casson Leighton   1996-1998
   6    Copyright (C) Gerald (Jerry) Carter          2000-2006
   7    Copyright (C) Andrew Bartlett                2001-2002
   8    Copyright (C) Stefan (metze) Metzmacher      2002
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "../libcli/auth/libcli_auth.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_PASSDB
  29
  30 /**
  31  * @todo Redefine this to NULL, but this changes the API because
  32  *       much of samba assumes that the pdb_get...() funtions
  33  *       return strings.  (ie not null-pointers).
  34  *       See also pdb_fill_default_sam().
  35  */
  36
  37 #define PDB_NOT_QUITE_NULL ""
  38
  39 /*********************************************************************
  40  Collection of get...() functions for struct samu.
  41  ********************************************************************/
  42
  43 uint32_t pdb_get_acct_ctrl(const struct samu *sampass)
  44 {
  45         return sampass->acct_ctrl;
  46 }
  47
  48 time_t pdb_get_logon_time(const struct samu *sampass)
  49 {
  50         return sampass->logon_time;
  51 }
  52
  53 time_t pdb_get_logoff_time(const struct samu *sampass)
  54 {
  55         return sampass->logoff_time;
  56 }
  57
  58 time_t pdb_get_kickoff_time(const struct samu *sampass)
  59 {
  60         return sampass->kickoff_time;
  61 }
  62
  63 time_t pdb_get_bad_password_time(const struct samu *sampass)
  64 {
  65         return sampass->bad_password_time;
  66 }
  67
  68 time_t pdb_get_pass_last_set_time(const struct samu *sampass)
  69 {
  70         return sampass->pass_last_set_time;
  71 }
  72
  73 time_t pdb_get_pass_can_change_time(const struct samu *sampass)
  74 {
  75         uint32_t allow;
  76
  77         /* if the last set time is zero, it means the user cannot
  78            change their password, and this time must be zero.   jmcd
  79         */
  80         if (sampass->pass_last_set_time == 0)
  81                 return (time_t) 0;
  82
  83         /* if the time is max, and the field has been changed,
  84            we're trying to update this real value from the sampass
  85            to indicate that the user cannot change their password.  jmcd
  86         */
  87         if (sampass->pass_can_change_time == get_time_t_max() &&
  88             IS_SAM_CHANGED(sampass, PDB_CANCHANGETIME))
  89                 return sampass->pass_can_change_time;
  90
  91         if (!pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &allow))
  92                 allow = 0;
  93
  94         /* in normal cases, just calculate it from policy */
  95         return sampass->pass_last_set_time + allow;
  96 }
  97
  98 /* we need this for loading from the backend, so that we don't overwrite
  99    non-changed max times, otherwise the pass_can_change checking won't work */
 100 time_t pdb_get_pass_can_change_time_noncalc(const struct samu *sampass)
 101 {
 102         return sampass->pass_can_change_time;
 103 }
 104
 105 time_t pdb_get_pass_must_change_time(const struct samu *sampass)
 106 {
 107         uint32_t expire;
 108
 109         if (sampass->pass_last_set_time == 0)
 110                 return (time_t) 0;
 111
 112         if (sampass->acct_ctrl & ACB_PWNOEXP)
 113                 return get_time_t_max();
 114
 115         if (!pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &expire)
 116             || expire == (uint32_t)-1 || expire == 0)
 117                 return get_time_t_max();
 118
 119         return sampass->pass_last_set_time + expire;
 120 }
 121
 122 bool pdb_get_pass_can_change(const struct samu *sampass)
 123 {
 124         if (sampass->pass_can_change_time == get_time_t_max() &&
 125             sampass->pass_last_set_time != 0)
 126                 return False;
 127         return True;
 128 }
 129
 130 uint16_t pdb_get_logon_divs(const struct samu *sampass)
 131 {
 132         return sampass->logon_divs;
 133 }
 134
 135 uint32_t pdb_get_hours_len(const struct samu *sampass)
 136 {
 137         return sampass->hours_len;
 138 }
 139
 140 const uint8 *pdb_get_hours(const struct samu *sampass)
 141 {
 142         return (sampass->hours);
 143 }
 144
 145 const uint8 *pdb_get_nt_passwd(const struct samu *sampass)
 146 {
 147         SMB_ASSERT((!sampass->nt_pw.data)
 148                    || sampass->nt_pw.length == NT_HASH_LEN);
 149         return (uint8 *)sampass->nt_pw.data;
 150 }
 151
 152 const uint8 *pdb_get_lanman_passwd(const struct samu *sampass)
 153 {
 154         SMB_ASSERT((!sampass->lm_pw.data)
 155                    || sampass->lm_pw.length == LM_HASH_LEN);
 156         return (uint8 *)sampass->lm_pw.data;
 157 }
 158
 159 const uint8 *pdb_get_pw_history(const struct samu *sampass, uint32_t *current_hist_len)
 160 {
 161         SMB_ASSERT((!sampass->nt_pw_his.data)
 162            || ((sampass->nt_pw_his.length % PW_HISTORY_ENTRY_LEN) == 0));
 163         *current_hist_len = sampass->nt_pw_his.length / PW_HISTORY_ENTRY_LEN;
 164         return (uint8 *)sampass->nt_pw_his.data;
 165 }
 166
 167 /* Return the plaintext password if known.  Most of the time
 168    it isn't, so don't assume anything magic about this function.
 169
 170    Used to pass the plaintext to passdb backends that might
 171    want to store more than just the NTLM hashes.
 172 */
 173 const char *pdb_get_plaintext_passwd(const struct samu *sampass)
 174 {
 175         return sampass->plaintext_pw;
 176 }
 177
 178 const DOM_SID *pdb_get_user_sid(const struct samu *sampass)
 179 {
 180         return &sampass->user_sid;
 181 }
 182
 183 const DOM_SID *pdb_get_group_sid(struct samu *sampass)
 184 {
 185         DOM_SID *gsid;
 186         struct passwd *pwd;
 187         bool need_lookup_sid = false;
 188
 189         /* Return the cached group SID if we have that */
 190         if ( sampass->group_sid ) {
 191                 return sampass->group_sid;
 192         }
 193
 194         /* generate the group SID from the user's primary Unix group */
 195
 196         if ( !(gsid  = TALLOC_ZERO_P( sampass, DOM_SID )) ) {
 197                 return NULL;
 198         }
 199
 200         /* No algorithmic mapping, meaning that we have to figure out the
 201            primary group SID according to group mapping and the user SID must
 202            be a newly allocated one.  We rely on the user's Unix primary gid.
 203            We have no choice but to fail if we can't find it. */
 204
 205         if ( sampass->unix_pw ) {
 206                 pwd = sampass->unix_pw;
 207         } else {
 208                 pwd = Get_Pwnam_alloc( sampass, pdb_get_username(sampass) );
 209         }
 210
 211         if ( !pwd ) {
 212                 DEBUG(0,("pdb_get_group_sid: Failed to find Unix account for %s\n", pdb_get_username(sampass) ));
 213                 return NULL;
 214         }
 215
 216         gid_to_sid(gsid, pwd->pw_gid);
 217         if (!is_null_sid(gsid)) {
 218                 DOM_SID dgsid;
 219                 uint32_t rid;
 220
 221                 sid_copy(&dgsid, gsid);
 222                 sid_split_rid(&dgsid, &rid);
 223                 if (sid_equal(&dgsid, get_global_sam_sid())) {
 224                         /*
 225                          * As shortcut for the expensive lookup_sid call
 226                          * compare the domain sid part
 227                          */
 228                         switch (rid) {
 229                         case DOMAIN_RID_ADMINS:
 230                         case DOMAIN_RID_USERS:
 231                                 sampass->group_sid = gsid;
 232                                 return sampass->group_sid;
 233                         default:
 234                                 need_lookup_sid = true;
 235                                 break;
 236                         }
 237                 } else {
 238                         ZERO_STRUCTP(gsid);
 239                         if (pdb_gid_to_sid(pwd->pw_gid, gsid)) {
 240                                 need_lookup_sid = true;
 241                         }
 242                 }
 243         }
 244
 245         if (need_lookup_sid) {
 246                 enum lsa_SidType type = SID_NAME_UNKNOWN;
 247                 TALLOC_CTX *mem_ctx;
 248                 bool lookup_ret;
 249                 const DOM_SID *usid = pdb_get_user_sid(sampass);
 250
 251                 mem_ctx = talloc_init("pdb_get_group_sid");
 252                 if (!mem_ctx) {
 253                         return NULL;
 254                 }
 255
 256                 DEBUG(10,("do lookup_sid(%s) for group of user %s\n",
 257                           sid_string_dbg(gsid), sid_string_dbg(usid)));
 258
 259                 /* Now check that it's actually a domain group and not something else */
 260
 261                 lookup_ret = lookup_sid(mem_ctx, gsid, NULL, NULL, &type);
 262
 263                 TALLOC_FREE( mem_ctx );
 264
 265                 if ( lookup_ret && (type == SID_NAME_DOM_GRP) ) {
 266                         sampass->group_sid = gsid;
 267                         return sampass->group_sid;
 268                 }
 269
 270                 DEBUG(3, ("Primary group %s for user %s is a %s and not a domain group\n",
 271                         sid_string_dbg(gsid), pwd->pw_name, sid_type_lookup(type)));
 272         }
 273
 274         /* Just set it to the 'Domain Users' RID of 513 which will
 275            always resolve to a name */
 276
 277         sid_compose(gsid, get_global_sam_sid(), DOMAIN_RID_USERS);
 278
 279         sampass->group_sid = gsid;
 280
 281         return sampass->group_sid;
 282 }
 283
 284 /**
 285  * Get flags showing what is initalised in the struct samu
 286  * @param sampass the struct samu in question
 287  * @return the flags indicating the members initialised in the struct.
 288  **/
 289
 290 enum pdb_value_state pdb_get_init_flags(const struct samu *sampass, enum pdb_elements element)
 291 {
 292         enum pdb_value_state ret = PDB_DEFAULT;
 293
 294         if (!sampass->change_flags || !sampass->set_flags)
 295                 return ret;
 296
 297         if (bitmap_query(sampass->set_flags, element)) {
 298                 DEBUG(11, ("element %d: SET\n", element));
 299                 ret = PDB_SET;
 300         }
 301
 302         if (bitmap_query(sampass->change_flags, element)) {
 303                 DEBUG(11, ("element %d: CHANGED\n", element));
 304                 ret = PDB_CHANGED;
 305         }
 306
 307         if (ret == PDB_DEFAULT) {
 308                 DEBUG(11, ("element %d: DEFAULT\n", element));
 309         }
 310
 311         return ret;
 312 }
 313
 314 const char *pdb_get_username(const struct samu *sampass)
 315 {
 316         return sampass->username;
 317 }
 318
 319 const char *pdb_get_domain(const struct samu *sampass)
 320 {
 321         return sampass->domain;
 322 }
 323
 324 const char *pdb_get_nt_username(const struct samu *sampass)
 325 {
 326         return sampass->nt_username;
 327 }
 328
 329 const char *pdb_get_fullname(const struct samu *sampass)
 330 {
 331         return sampass->full_name;
 332 }
 333
 334 const char *pdb_get_homedir(const struct samu *sampass)
 335 {
 336         return sampass->home_dir;
 337 }
 338
 339 const char *pdb_get_dir_drive(const struct samu *sampass)
 340 {
 341         return sampass->dir_drive;
 342 }
 343
 344 const char *pdb_get_logon_script(const struct samu *sampass)
 345 {
 346         return sampass->logon_script;
 347 }
 348
 349 const char *pdb_get_profile_path(const struct samu *sampass)
 350 {
 351         return sampass->profile_path;
 352 }
 353
 354 const char *pdb_get_acct_desc(const struct samu *sampass)
 355 {
 356         return sampass->acct_desc;
 357 }
 358
 359 const char *pdb_get_workstations(const struct samu *sampass)
 360 {
 361         return sampass->workstations;
 362 }
 363
 364 const char *pdb_get_comment(const struct samu *sampass)
 365 {
 366         return sampass->comment;
 367 }
 368
 369 const char *pdb_get_munged_dial(const struct samu *sampass)
 370 {
 371         return sampass->munged_dial;
 372 }
 373
 374 uint16_t pdb_get_bad_password_count(const struct samu *sampass)
 375 {
 376         return sampass->bad_password_count;
 377 }
 378
 379 uint16_t pdb_get_logon_count(const struct samu *sampass)
 380 {
 381         return sampass->logon_count;
 382 }
 383
 384 uint32_t pdb_get_unknown_6(const struct samu *sampass)
 385 {
 386         return sampass->unknown_6;
 387 }
 388
 389 void *pdb_get_backend_private_data(const struct samu *sampass, const struct pdb_methods *my_methods)
 390 {
 391         if (my_methods == sampass->backend_private_methods) {
 392                 return sampass->backend_private_data;
 393         } else {
 394                 return NULL;
 395         }
 396 }
 397
 398 /*********************************************************************
 399  Collection of set...() functions for struct samu.
 400  ********************************************************************/
 401
 402 bool pdb_set_acct_ctrl(struct samu *sampass, uint32_t acct_ctrl, enum pdb_value_state flag)
 403 {
 404         sampass->acct_ctrl = acct_ctrl;
 405         return pdb_set_init_flags(sampass, PDB_ACCTCTRL, flag);
 406 }
 407
 408 bool pdb_set_logon_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 409 {
 410         sampass->logon_time = mytime;
 411         return pdb_set_init_flags(sampass, PDB_LOGONTIME, flag);
 412 }
 413
 414 bool pdb_set_logoff_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 415 {
 416         sampass->logoff_time = mytime;
 417         return pdb_set_init_flags(sampass, PDB_LOGOFFTIME, flag);
 418 }
 419
 420 bool pdb_set_kickoff_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 421 {
 422         sampass->kickoff_time = mytime;
 423         return pdb_set_init_flags(sampass, PDB_KICKOFFTIME, flag);
 424 }
 425
 426 bool pdb_set_bad_password_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 427 {
 428         sampass->bad_password_time = mytime;
 429         return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_TIME, flag);
 430 }
 431
 432 bool pdb_set_pass_can_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 433 {
 434         sampass->pass_can_change_time = mytime;
 435         return pdb_set_init_flags(sampass, PDB_CANCHANGETIME, flag);
 436 }
 437
 438 bool pdb_set_pass_must_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 439 {
 440         sampass->pass_must_change_time = mytime;
 441         return pdb_set_init_flags(sampass, PDB_MUSTCHANGETIME, flag);
 442 }
 443
 444 bool pdb_set_pass_last_set_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
 445 {
 446         sampass->pass_last_set_time = mytime;
 447         return pdb_set_init_flags(sampass, PDB_PASSLASTSET, flag);
 448 }
 449
 450 bool pdb_set_hours_len(struct samu *sampass, uint32_t len, enum pdb_value_state flag)
 451 {
 452         sampass->hours_len = len;
 453         return pdb_set_init_flags(sampass, PDB_HOURSLEN, flag);
 454 }
 455
 456 bool pdb_set_logon_divs(struct samu *sampass, uint16_t hours, enum pdb_value_state flag)
 457 {
 458         sampass->logon_divs = hours;
 459         return pdb_set_init_flags(sampass, PDB_LOGONDIVS, flag);
 460 }
 461
 462 /**
 463  * Set flags showing what is initalised in the struct samu
 464  * @param sampass the struct samu in question
 465  * @param flag The *new* flag to be set.  Old flags preserved
 466  *             this flag is only added.
 467  **/
 468
 469 bool pdb_set_init_flags(struct samu *sampass, enum pdb_elements element, enum pdb_value_state value_flag)
 470 {
 471         if (!sampass->set_flags) {
 472                 if ((sampass->set_flags =
 473                         bitmap_talloc(sampass,
 474                                         PDB_COUNT))==NULL) {
 475                         DEBUG(0,("bitmap_talloc failed\n"));
 476                         return False;
 477                 }
 478         }
 479         if (!sampass->change_flags) {
 480                 if ((sampass->change_flags =
 481                         bitmap_talloc(sampass,
 482                                         PDB_COUNT))==NULL) {
 483                         DEBUG(0,("bitmap_talloc failed\n"));
 484                         return False;
 485                 }
 486         }
 487
 488         switch(value_flag) {
 489                 case PDB_CHANGED:
 490                         if (!bitmap_set(sampass->change_flags, element)) {
 491                                 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
 492                                 return False;
 493                         }
 494                         if (!bitmap_set(sampass->set_flags, element)) {
 495                                 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
 496                                 return False;
 497                         }
 498                         DEBUG(11, ("element %d -> now CHANGED\n", element));
 499                         break;
 500                 case PDB_SET:
 501                         if (!bitmap_clear(sampass->change_flags, element)) {
 502                                 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
 503                                 return False;
 504                         }
 505                         if (!bitmap_set(sampass->set_flags, element)) {
 506                                 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
 507                                 return False;
 508                         }
 509                         DEBUG(11, ("element %d -> now SET\n", element));
 510                         break;
 511                 case PDB_DEFAULT:
 512                 default:
 513                         if (!bitmap_clear(sampass->change_flags, element)) {
 514                                 DEBUG(0,("Can't set flag: %d in change_flags.\n",element));
 515                                 return False;
 516                         }
 517                         if (!bitmap_clear(sampass->set_flags, element)) {
 518                                 DEBUG(0,("Can't set flag: %d in set_flags.\n",element));
 519                                 return False;
 520                         }
 521                         DEBUG(11, ("element %d -> now DEFAULT\n", element));
 522                         break;
 523         }
 524
 525         return True;
 526 }
 527
 528 bool pdb_set_user_sid(struct samu *sampass, const DOM_SID *u_sid, enum pdb_value_state flag)
 529 {
 530         if (!u_sid)
 531                 return False;
 532
 533         sid_copy(&sampass->user_sid, u_sid);
 534
 535         DEBUG(10, ("pdb_set_user_sid: setting user sid %s\n",
 536                     sid_string_dbg(&sampass->user_sid)));
 537
 538         return pdb_set_init_flags(sampass, PDB_USERSID, flag);
 539 }
 540
 541 bool pdb_set_user_sid_from_string(struct samu *sampass, fstring u_sid, enum pdb_value_state flag)
 542 {
 543         DOM_SID new_sid;
 544
 545         if (!u_sid)
 546                 return False;
 547
 548         DEBUG(10, ("pdb_set_user_sid_from_string: setting user sid %s\n",
 549                    u_sid));
 550
 551         if (!string_to_sid(&new_sid, u_sid)) {
 552                 DEBUG(1, ("pdb_set_user_sid_from_string: %s isn't a valid SID!\n", u_sid));
 553                 return False;
 554         }
 555
 556         if (!pdb_set_user_sid(sampass, &new_sid, flag)) {
 557                 DEBUG(1, ("pdb_set_user_sid_from_string: could not set sid %s on struct samu!\n", u_sid));
 558                 return False;
 559         }
 560
 561         return True;
 562 }
 563
 564 /********************************************************************
 565  We never fill this in from a passdb backend but rather set is
 566  based on the user's primary group membership.  However, the
 567  struct samu* is overloaded and reused in domain memship code
 568  as well and built from the netr_SamInfo3 or PAC so we
 569  have to allow the explicitly setting of a group SID here.
 570 ********************************************************************/
 571
 572 bool pdb_set_group_sid(struct samu *sampass, const DOM_SID *g_sid, enum pdb_value_state flag)
 573 {
 574         gid_t gid;
 575         DOM_SID dug_sid;
 576
 577         if (!g_sid)
 578                 return False;
 579
 580         if ( !(sampass->group_sid = TALLOC_P( sampass, DOM_SID )) ) {
 581                 return False;
 582         }
 583
 584         /* if we cannot resolve the SID to gid, then just ignore it and
 585            store DOMAIN_USERS as the primary groupSID */
 586
 587         sid_compose(&dug_sid, get_global_sam_sid(), DOMAIN_RID_USERS);
 588
 589         if (sid_equal(&dug_sid, g_sid)) {
 590                 sid_copy(sampass->group_sid, &dug_sid);
 591         } else if (sid_to_gid( g_sid, &gid ) ) {
 592                 sid_copy(sampass->group_sid, g_sid);
 593         } else {
 594                 sid_copy(sampass->group_sid, &dug_sid);
 595         }
 596
 597         DEBUG(10, ("pdb_set_group_sid: setting group sid %s\n",
 598                    sid_string_dbg(sampass->group_sid)));
 599
 600         return pdb_set_init_flags(sampass, PDB_GROUPSID, flag);
 601 }
 602
 603 /*********************************************************************
 604  Set the user's UNIX name.
 605  ********************************************************************/
 606
 607 bool pdb_set_username(struct samu *sampass, const char *username, enum pdb_value_state flag)
 608 {
 609         if (username) {
 610                 DEBUG(10, ("pdb_set_username: setting username %s, was %s\n", username,
 611                         (sampass->username)?(sampass->username):"NULL"));
 612
 613                 sampass->username = talloc_strdup(sampass, username);
 614
 615                 if (!sampass->username) {
 616                         DEBUG(0, ("pdb_set_username: talloc_strdup() failed!\n"));
 617                         return False;
 618                 }
 619         } else {
 620                 sampass->username = PDB_NOT_QUITE_NULL;
 621         }
 622
 623         return pdb_set_init_flags(sampass, PDB_USERNAME, flag);
 624 }
 625
 626 /*********************************************************************
 627  Set the domain name.
 628  ********************************************************************/
 629
 630 bool pdb_set_domain(struct samu *sampass, const char *domain, enum pdb_value_state flag)
 631 {
 632         if (domain) {
 633                 DEBUG(10, ("pdb_set_domain: setting domain %s, was %s\n", domain,
 634                         (sampass->domain)?(sampass->domain):"NULL"));
 635
 636                 sampass->domain = talloc_strdup(sampass, domain);
 637
 638                 if (!sampass->domain) {
 639                         DEBUG(0, ("pdb_set_domain: talloc_strdup() failed!\n"));
 640                         return False;
 641                 }
 642         } else {
 643                 sampass->domain = PDB_NOT_QUITE_NULL;
 644         }
 645
 646         return pdb_set_init_flags(sampass, PDB_DOMAIN, flag);
 647 }
 648
 649 /*********************************************************************
 650  Set the user's NT name.
 651  ********************************************************************/
 652
 653 bool pdb_set_nt_username(struct samu *sampass, const char *nt_username, enum pdb_value_state flag)
 654 {
 655         if (nt_username) {
 656                 DEBUG(10, ("pdb_set_nt_username: setting nt username %s, was %s\n", nt_username,
 657                         (sampass->nt_username)?(sampass->nt_username):"NULL"));
 658
 659                 sampass->nt_username = talloc_strdup(sampass, nt_username);
 660
 661                 if (!sampass->nt_username) {
 662                         DEBUG(0, ("pdb_set_nt_username: talloc_strdup() failed!\n"));
 663                         return False;
 664                 }
 665         } else {
 666                 sampass->nt_username = PDB_NOT_QUITE_NULL;
 667         }
 668
 669         return pdb_set_init_flags(sampass, PDB_NTUSERNAME, flag);
 670 }
 671
 672 /*********************************************************************
 673  Set the user's full name.
 674  ********************************************************************/
 675
 676 bool pdb_set_fullname(struct samu *sampass, const char *full_name, enum pdb_value_state flag)
 677 {
 678         if (full_name) {
 679                 DEBUG(10, ("pdb_set_full_name: setting full name %s, was %s\n", full_name,
 680                         (sampass->full_name)?(sampass->full_name):"NULL"));
 681
 682                 sampass->full_name = talloc_strdup(sampass, full_name);
 683
 684                 if (!sampass->full_name) {
 685                         DEBUG(0, ("pdb_set_fullname: talloc_strdup() failed!\n"));
 686                         return False;
 687                 }
 688         } else {
 689                 sampass->full_name = PDB_NOT_QUITE_NULL;
 690         }
 691
 692         return pdb_set_init_flags(sampass, PDB_FULLNAME, flag);
 693 }
 694
 695 /*********************************************************************
 696  Set the user's logon script.
 697  ********************************************************************/
 698
 699 bool pdb_set_logon_script(struct samu *sampass, const char *logon_script, enum pdb_value_state flag)
 700 {
 701         if (logon_script) {
 702                 DEBUG(10, ("pdb_set_logon_script: setting logon script %s, was %s\n", logon_script,
 703                         (sampass->logon_script)?(sampass->logon_script):"NULL"));
 704
 705                 sampass->logon_script = talloc_strdup(sampass, logon_script);
 706
 707                 if (!sampass->logon_script) {
 708                         DEBUG(0, ("pdb_set_logon_script: talloc_strdup() failed!\n"));
 709                         return False;
 710                 }
 711         } else {
 712                 sampass->logon_script = PDB_NOT_QUITE_NULL;
 713         }
 714
 715         return pdb_set_init_flags(sampass, PDB_LOGONSCRIPT, flag);
 716 }
 717
 718 /*********************************************************************
 719  Set the user's profile path.
 720  ********************************************************************/
 721
 722 bool pdb_set_profile_path(struct samu *sampass, const char *profile_path, enum pdb_value_state flag)
 723 {
 724         if (profile_path) {
 725                 DEBUG(10, ("pdb_set_profile_path: setting profile path %s, was %s\n", profile_path,
 726                         (sampass->profile_path)?(sampass->profile_path):"NULL"));
 727
 728                 sampass->profile_path = talloc_strdup(sampass, profile_path);
 729
 730                 if (!sampass->profile_path) {
 731                         DEBUG(0, ("pdb_set_profile_path: talloc_strdup() failed!\n"));
 732                         return False;
 733                 }
 734         } else {
 735                 sampass->profile_path = PDB_NOT_QUITE_NULL;
 736         }
 737
 738         return pdb_set_init_flags(sampass, PDB_PROFILE, flag);
 739 }
 740
 741 /*********************************************************************
 742  Set the user's directory drive.
 743  ********************************************************************/
 744
 745 bool pdb_set_dir_drive(struct samu *sampass, const char *dir_drive, enum pdb_value_state flag)
 746 {
 747         if (dir_drive) {
 748                 DEBUG(10, ("pdb_set_dir_drive: setting dir drive %s, was %s\n", dir_drive,
 749                         (sampass->dir_drive)?(sampass->dir_drive):"NULL"));
 750
 751                 sampass->dir_drive = talloc_strdup(sampass, dir_drive);
 752
 753                 if (!sampass->dir_drive) {
 754                         DEBUG(0, ("pdb_set_dir_drive: talloc_strdup() failed!\n"));
 755                         return False;
 756                 }
 757
 758         } else {
 759                 sampass->dir_drive = PDB_NOT_QUITE_NULL;
 760         }
 761
 762         return pdb_set_init_flags(sampass, PDB_DRIVE, flag);
 763 }
 764
 765 /*********************************************************************
 766  Set the user's home directory.
 767  ********************************************************************/
 768
 769 bool pdb_set_homedir(struct samu *sampass, const char *home_dir, enum pdb_value_state flag)
 770 {
 771         if (home_dir) {
 772                 DEBUG(10, ("pdb_set_homedir: setting home dir %s, was %s\n", home_dir,
 773                         (sampass->home_dir)?(sampass->home_dir):"NULL"));
 774
 775                 sampass->home_dir = talloc_strdup(sampass, home_dir);
 776
 777                 if (!sampass->home_dir) {
 778                         DEBUG(0, ("pdb_set_home_dir: talloc_strdup() failed!\n"));
 779                         return False;
 780                 }
 781         } else {
 782                 sampass->home_dir = PDB_NOT_QUITE_NULL;
 783         }
 784
 785         return pdb_set_init_flags(sampass, PDB_SMBHOME, flag);
 786 }
 787
 788 /*********************************************************************
 789  Set the user's account description.
 790  ********************************************************************/
 791
 792 bool pdb_set_acct_desc(struct samu *sampass, const char *acct_desc, enum pdb_value_state flag)
 793 {
 794         if (acct_desc) {
 795                 sampass->acct_desc = talloc_strdup(sampass, acct_desc);
 796
 797                 if (!sampass->acct_desc) {
 798                         DEBUG(0, ("pdb_set_acct_desc: talloc_strdup() failed!\n"));
 799                         return False;
 800                 }
 801         } else {
 802                 sampass->acct_desc = PDB_NOT_QUITE_NULL;
 803         }
 804
 805         return pdb_set_init_flags(sampass, PDB_ACCTDESC, flag);
 806 }
 807
 808 /*********************************************************************
 809  Set the user's workstation allowed list.
 810  ********************************************************************/
 811
 812 bool pdb_set_workstations(struct samu *sampass, const char *workstations, enum pdb_value_state flag)
 813 {
 814         if (workstations) {
 815                 DEBUG(10, ("pdb_set_workstations: setting workstations %s, was %s\n", workstations,
 816                         (sampass->workstations)?(sampass->workstations):"NULL"));
 817
 818                 sampass->workstations = talloc_strdup(sampass, workstations);
 819
 820                 if (!sampass->workstations) {
 821                         DEBUG(0, ("pdb_set_workstations: talloc_strdup() failed!\n"));
 822                         return False;
 823                 }
 824         } else {
 825                 sampass->workstations = PDB_NOT_QUITE_NULL;
 826         }
 827
 828         return pdb_set_init_flags(sampass, PDB_WORKSTATIONS, flag);
 829 }
 830
 831 /*********************************************************************
 832  ********************************************************************/
 833
 834 bool pdb_set_comment(struct samu *sampass, const char *comment, enum pdb_value_state flag)
 835 {
 836         if (comment) {
 837                 sampass->comment = talloc_strdup(sampass, comment);
 838
 839                 if (!sampass->comment) {
 840                         DEBUG(0, ("pdb_set_comment: talloc_strdup() failed!\n"));
 841                         return False;
 842                 }
 843         } else {
 844                 sampass->comment = PDB_NOT_QUITE_NULL;
 845         }
 846
 847         return pdb_set_init_flags(sampass, PDB_COMMENT, flag);
 848 }
 849
 850 /*********************************************************************
 851  Set the user's dial string.
 852  ********************************************************************/
 853
 854 bool pdb_set_munged_dial(struct samu *sampass, const char *munged_dial, enum pdb_value_state flag)
 855 {
 856         if (munged_dial) {
 857                 sampass->munged_dial = talloc_strdup(sampass, munged_dial);
 858
 859                 if (!sampass->munged_dial) {
 860                         DEBUG(0, ("pdb_set_munged_dial: talloc_strdup() failed!\n"));
 861                         return False;
 862                 }
 863         } else {
 864                 sampass->munged_dial = PDB_NOT_QUITE_NULL;
 865         }
 866
 867         return pdb_set_init_flags(sampass, PDB_MUNGEDDIAL, flag);
 868 }
 869
 870 /*********************************************************************
 871  Set the user's NT hash.
 872  ********************************************************************/
 873
 874 bool pdb_set_nt_passwd(struct samu *sampass, const uint8 pwd[NT_HASH_LEN], enum pdb_value_state flag)
 875 {
 876         data_blob_clear_free(&sampass->nt_pw);
 877
 878        if (pwd) {
 879                sampass->nt_pw =
 880                        data_blob_talloc(sampass, pwd, NT_HASH_LEN);
 881        } else {
 882                sampass->nt_pw = data_blob_null;
 883        }
 884
 885         return pdb_set_init_flags(sampass, PDB_NTPASSWD, flag);
 886 }
 887
 888 /*********************************************************************
 889  Set the user's LM hash.
 890  ********************************************************************/
 891
 892 bool pdb_set_lanman_passwd(struct samu *sampass, const uint8 pwd[LM_HASH_LEN], enum pdb_value_state flag)
 893 {
 894         data_blob_clear_free(&sampass->lm_pw);
 895
 896         /* on keep the password if we are allowing LANMAN authentication */
 897
 898         if (pwd && lp_lanman_auth() ) {
 899                 sampass->lm_pw = data_blob_talloc(sampass, pwd, LM_HASH_LEN);
 900         } else {
 901                 sampass->lm_pw = data_blob_null;
 902         }
 903
 904         return pdb_set_init_flags(sampass, PDB_LMPASSWD, flag);
 905 }
 906
 907 /*********************************************************************
 908  Set the user's password history hash. historyLen is the number of
 909  PW_HISTORY_SALT_LEN+SALTED_MD5_HASH_LEN length
 910  entries to store in the history - this must match the size of the uint8 array
 911  in pwd.
 912 ********************************************************************/
 913
 914 bool pdb_set_pw_history(struct samu *sampass, const uint8 *pwd, uint32_t historyLen, enum pdb_value_state flag)
 915 {
 916         if (historyLen && pwd){
 917                 data_blob_free(&(sampass->nt_pw_his));
 918                 sampass->nt_pw_his = data_blob_talloc(sampass,
 919                                                 pwd, historyLen*PW_HISTORY_ENTRY_LEN);
 920                 if (!sampass->nt_pw_his.length) {
 921                         DEBUG(0, ("pdb_set_pw_history: data_blob_talloc() failed!\n"));
 922                         return False;
 923                 }
 924         } else {
 925                 sampass->nt_pw_his = data_blob_talloc(sampass, NULL, 0);
 926         }
 927
 928         return pdb_set_init_flags(sampass, PDB_PWHISTORY, flag);
 929 }
 930
 931 /*********************************************************************
 932  Set the user's plaintext password only (base procedure, see helper
 933  below)
 934  ********************************************************************/
 935
 936 bool pdb_set_plaintext_pw_only(struct samu *sampass, const char *password, enum pdb_value_state flag)
 937 {
 938         if (password) {
 939                 if (sampass->plaintext_pw!=NULL)
 940                         memset(sampass->plaintext_pw,'\0',strlen(sampass->plaintext_pw)+1);
 941
 942                 sampass->plaintext_pw = talloc_strdup(sampass, password);
 943
 944                 if (!sampass->plaintext_pw) {
 945                         DEBUG(0, ("pdb_set_unknown_str: talloc_strdup() failed!\n"));
 946                         return False;
 947                 }
 948         } else {
 949                 sampass->plaintext_pw = NULL;
 950         }
 951
 952         return pdb_set_init_flags(sampass, PDB_PLAINTEXT_PW, flag);
 953 }
 954
 955 bool pdb_set_bad_password_count(struct samu *sampass, uint16_t bad_password_count, enum pdb_value_state flag)
 956 {
 957         sampass->bad_password_count = bad_password_count;
 958         return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_COUNT, flag);
 959 }
 960
 961 bool pdb_set_logon_count(struct samu *sampass, uint16_t logon_count, enum pdb_value_state flag)
 962 {
 963         sampass->logon_count = logon_count;
 964         return pdb_set_init_flags(sampass, PDB_LOGON_COUNT, flag);
 965 }
 966
 967 bool pdb_set_unknown_6(struct samu *sampass, uint32_t unkn, enum pdb_value_state flag)
 968 {
 969         sampass->unknown_6 = unkn;
 970         return pdb_set_init_flags(sampass, PDB_UNKNOWN6, flag);
 971 }
 972
 973 bool pdb_set_hours(struct samu *sampass, const uint8 *hours, enum pdb_value_state flag)
 974 {
 975         if (!hours) {
 976                 memset ((char *)sampass->hours, 0, MAX_HOURS_LEN);
 977         } else {
 978                 memcpy (sampass->hours, hours, MAX_HOURS_LEN);
 979         }
 980
 981         return pdb_set_init_flags(sampass, PDB_HOURS, flag);
 982 }
 983
 984 bool pdb_set_backend_private_data(struct samu *sampass, void *private_data,
 985                                    void (*free_fn)(void **),
 986                                    const struct pdb_methods *my_methods,
 987                                    enum pdb_value_state flag)
 988 {
 989         if (sampass->backend_private_data &&
 990             sampass->backend_private_data_free_fn) {
 991                 sampass->backend_private_data_free_fn(
 992                         &sampass->backend_private_data);
 993         }
 994
 995         sampass->backend_private_data = private_data;
 996         sampass->backend_private_data_free_fn = free_fn;
 997         sampass->backend_private_methods = my_methods;
 998
 999         return pdb_set_init_flags(sampass, PDB_BACKEND_PRIVATE_DATA, flag);
1000 }
1001
1002
1003 /* Helpful interfaces to the above */
1004
1005 bool pdb_set_pass_can_change(struct samu *sampass, bool canchange)
1006 {
1007         return pdb_set_pass_can_change_time(sampass,
1008                                      canchange ? 0 : get_time_t_max(),
1009                                      PDB_CHANGED);
1010 }
1011
1012
1013 /*********************************************************************
1014  Set the user's PLAINTEXT password.  Used as an interface to the above.
1015  Also sets the last change time to NOW.
1016  ********************************************************************/
1017
1018 bool pdb_set_plaintext_passwd(struct samu *sampass, const char *plaintext)
1019 {
1020         uchar new_lanman_p16[LM_HASH_LEN];
1021         uchar new_nt_p16[NT_HASH_LEN];
1022         uchar *pwhistory;
1023         uint32_t pwHistLen;
1024         uint32_t current_history_len;
1025
1026         if (!plaintext)
1027                 return False;
1028
1029         /* Calculate the MD4 hash (NT compatible) of the password */
1030         E_md4hash(plaintext, new_nt_p16);
1031
1032         if (!pdb_set_nt_passwd (sampass, new_nt_p16, PDB_CHANGED))
1033                 return False;
1034
1035         if (!E_deshash(plaintext, new_lanman_p16)) {
1036                 /* E_deshash returns false for 'long' passwords (> 14
1037                    DOS chars).  This allows us to match Win2k, which
1038                    does not store a LM hash for these passwords (which
1039                    would reduce the effective password length to 14 */
1040
1041                 if (!pdb_set_lanman_passwd (sampass, NULL, PDB_CHANGED))
1042                         return False;
1043         } else {
1044                 if (!pdb_set_lanman_passwd (sampass, new_lanman_p16, PDB_CHANGED))
1045                         return False;
1046         }
1047
1048         if (!pdb_set_plaintext_pw_only (sampass, plaintext, PDB_CHANGED))
1049                 return False;
1050
1051         if (!pdb_set_pass_last_set_time (sampass, time(NULL), PDB_CHANGED))
1052                 return False;
1053
1054         if ((pdb_get_acct_ctrl(sampass) & ACB_NORMAL) == 0) {
1055                 /*
1056                  * No password history for non-user accounts
1057                  */
1058                 return true;
1059         }
1060
1061         pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
1062
1063         if (pwHistLen == 0) {
1064                 /* Set the history length to zero. */
1065                 pdb_set_pw_history(sampass, NULL, 0, PDB_CHANGED);
1066                 return true;
1067         }
1068
1069         /*
1070          * We need to make sure we don't have a race condition here -
1071          * the account policy history length can change between when
1072          * the pw_history was first loaded into the struct samu struct
1073          * and now.... JRA.
1074          */
1075         pwhistory = (uchar *)pdb_get_pw_history(sampass, &current_history_len);
1076
1077         if ((current_history_len != 0) && (pwhistory == NULL)) {
1078                 DEBUG(1, ("pdb_set_plaintext_passwd: pwhistory == NULL!\n"));
1079                 return false;
1080         }
1081
1082         if (current_history_len < pwHistLen) {
1083                 /*
1084                  * Ensure we have space for the needed history. This
1085                  * also takes care of an account which did not have
1086                  * any history at all so far, i.e. pwhistory==NULL
1087                  */
1088                 uchar *new_history = talloc_zero_array(
1089                         sampass, uchar,
1090                         pwHistLen*PW_HISTORY_ENTRY_LEN);
1091
1092                 if (!new_history) {
1093                         return False;
1094                 }
1095
1096                 memcpy(new_history, pwhistory,
1097                        current_history_len*PW_HISTORY_ENTRY_LEN);
1098
1099                 pwhistory = new_history;
1100         }
1101
1102         /*
1103          * Make room for the new password in the history list.
1104          */
1105         if (pwHistLen > 1) {
1106                 memmove(&pwhistory[PW_HISTORY_ENTRY_LEN], pwhistory,
1107                         (pwHistLen-1)*PW_HISTORY_ENTRY_LEN );
1108         }
1109
1110         /*
1111          * Fill the salt area with 0-s: this indicates that
1112          * a plain nt hash is stored in the has area.
1113          * The old format was to store a 16 byte salt and
1114          * then an md5hash of the nt_hash concatenated with
1115          * the salt.
1116          */
1117         memset(pwhistory, 0, PW_HISTORY_SALT_LEN);
1118
1119         /*
1120          * Store the plain nt hash in the second 16 bytes.
1121          * The old format was to store the md5 hash of
1122          * the salt+newpw.
1123          */
1124         memcpy(&pwhistory[PW_HISTORY_SALT_LEN], new_nt_p16, SALTED_MD5_HASH_LEN);
1125
1126         pdb_set_pw_history(sampass, pwhistory, pwHistLen, PDB_CHANGED);
1127
1128         return True;
1129 }
1130
1131 /* check for any PDB_SET/CHANGED field and fill the appropriate mask bit */
1132 uint32_t pdb_build_fields_present(struct samu *sampass)
1133 {
1134         /* value set to all for testing */
1135         return 0x00ffffff;
1136 }