*/
#include "includes.h"
+#include "passdb.h"
+#include "../libcli/auth/libcli_auth.h"
+#include "../libcli/security/security.h"
+#include "../lib/util/bitmap.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_PASSDB
#define PDB_NOT_QUITE_NULL ""
+/*********************************************************************
+ Test if a change time is a max value. Copes with old and new values
+ of max.
+ ********************************************************************/
+
+bool pdb_is_password_change_time_max(time_t test_time)
+{
+ if (test_time == get_time_t_max()) {
+ return true;
+ }
+#if (defined(SIZEOF_TIME_T) && (SIZEOF_TIME_T == 8))
+ if (test_time == 0x7FFFFFFFFFFFFFFFLL) {
+ return true;
+ }
+#endif
+ if (test_time == 0x7FFFFFFF) {
+ return true;
+ }
+ return false;
+}
+
+/*********************************************************************
+ Return an unchanging version of max password change time - 0x7FFFFFFF.
+ ********************************************************************/
+
+static time_t pdb_password_change_time_max(void)
+{
+ return 0x7FFFFFFF;
+}
+
/*********************************************************************
Collection of get...() functions for struct samu.
********************************************************************/
-uint32 pdb_get_acct_ctrl(const struct samu *sampass)
+uint32_t pdb_get_acct_ctrl(const struct samu *sampass)
{
return sampass->acct_ctrl;
}
time_t pdb_get_pass_can_change_time(const struct samu *sampass)
{
- uint32 allow;
+ uint32_t allow;
/* if the last set time is zero, it means the user cannot
change their password, and this time must be zero. jmcd
we're trying to update this real value from the sampass
to indicate that the user cannot change their password. jmcd
*/
- if (sampass->pass_can_change_time == get_time_t_max() &&
- pdb_get_init_flags(sampass, PDB_CANCHANGETIME) == PDB_CHANGED)
+ if (pdb_is_password_change_time_max(sampass->pass_can_change_time) &&
+ IS_SAM_CHANGED(sampass, PDB_CANCHANGETIME))
return sampass->pass_can_change_time;
- if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &allow))
+ if (!pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &allow))
allow = 0;
/* in normal cases, just calculate it from policy */
time_t pdb_get_pass_must_change_time(const struct samu *sampass)
{
- uint32 expire;
+ uint32_t expire;
if (sampass->pass_last_set_time == 0)
return (time_t) 0;
if (sampass->acct_ctrl & ACB_PWNOEXP)
- return get_time_t_max();
+ return pdb_password_change_time_max();
- if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &expire)
- || expire == (uint32)-1 || expire == 0)
+ if (!pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &expire)
+ || expire == (uint32_t)-1 || expire == 0)
return get_time_t_max();
return sampass->pass_last_set_time + expire;
bool pdb_get_pass_can_change(const struct samu *sampass)
{
- if (sampass->pass_can_change_time == get_time_t_max() &&
- sampass->pass_last_set_time != 0)
+ if (pdb_is_password_change_time_max(sampass->pass_can_change_time))
return False;
return True;
}
-uint16 pdb_get_logon_divs(const struct samu *sampass)
+uint16_t pdb_get_logon_divs(const struct samu *sampass)
{
return sampass->logon_divs;
}
-uint32 pdb_get_hours_len(const struct samu *sampass)
+uint32_t pdb_get_hours_len(const struct samu *sampass)
{
return sampass->hours_len;
}
-const uint8 *pdb_get_hours(const struct samu *sampass)
+const uint8_t *pdb_get_hours(const struct samu *sampass)
{
return (sampass->hours);
}
-const uint8 *pdb_get_nt_passwd(const struct samu *sampass)
+const uint8_t *pdb_get_nt_passwd(const struct samu *sampass)
{
SMB_ASSERT((!sampass->nt_pw.data)
|| sampass->nt_pw.length == NT_HASH_LEN);
- return (uint8 *)sampass->nt_pw.data;
+ return (uint8_t *)sampass->nt_pw.data;
}
-const uint8 *pdb_get_lanman_passwd(const struct samu *sampass)
+const uint8_t *pdb_get_lanman_passwd(const struct samu *sampass)
{
SMB_ASSERT((!sampass->lm_pw.data)
|| sampass->lm_pw.length == LM_HASH_LEN);
- return (uint8 *)sampass->lm_pw.data;
+ return (uint8_t *)sampass->lm_pw.data;
}
-const uint8 *pdb_get_pw_history(const struct samu *sampass, uint32 *current_hist_len)
+const uint8_t *pdb_get_pw_history(const struct samu *sampass, uint32_t *current_hist_len)
{
SMB_ASSERT((!sampass->nt_pw_his.data)
|| ((sampass->nt_pw_his.length % PW_HISTORY_ENTRY_LEN) == 0));
*current_hist_len = sampass->nt_pw_his.length / PW_HISTORY_ENTRY_LEN;
- return (uint8 *)sampass->nt_pw_his.data;
+ return (uint8_t *)sampass->nt_pw_his.data;
}
/* Return the plaintext password if known. Most of the time
return sampass->plaintext_pw;
}
-const DOM_SID *pdb_get_user_sid(const struct samu *sampass)
+const struct dom_sid *pdb_get_user_sid(const struct samu *sampass)
{
return &sampass->user_sid;
}
-const DOM_SID *pdb_get_group_sid(struct samu *sampass)
+const struct dom_sid *pdb_get_group_sid(struct samu *sampass)
{
- DOM_SID *gsid;
- struct passwd *pwd;
+ NTSTATUS status;
/* Return the cached group SID if we have that */
- if ( sampass->group_sid ) {
+ if (sampass->group_sid) {
return sampass->group_sid;
}
- /* generate the group SID from the user's primary Unix group */
-
- if ( !(gsid = TALLOC_P( sampass, DOM_SID )) ) {
- return NULL;
- }
-
/* No algorithmic mapping, meaning that we have to figure out the
primary group SID according to group mapping and the user SID must
be a newly allocated one. We rely on the user's Unix primary gid.
We have no choice but to fail if we can't find it. */
-
- if ( sampass->unix_pw ) {
- pwd = sampass->unix_pw;
- } else {
- pwd = Get_Pwnam_alloc( sampass, pdb_get_username(sampass) );
- }
-
- if ( !pwd ) {
- DEBUG(0,("pdb_get_group_sid: Failed to find Unix account for %s\n", pdb_get_username(sampass) ));
+ status = get_primary_group_sid(sampass,
+ pdb_get_username(sampass),
+ &sampass->unix_pw,
+ &sampass->group_sid);
+ if (!NT_STATUS_IS_OK(status)) {
return NULL;
}
- if ( pdb_gid_to_sid(pwd->pw_gid, gsid) ) {
- enum lsa_SidType type = SID_NAME_UNKNOWN;
- TALLOC_CTX *mem_ctx = talloc_init("pdb_get_group_sid");
- bool lookup_ret;
-
- if (!mem_ctx) {
- return NULL;
- }
-
- /* Now check that it's actually a domain group and not something else */
-
- lookup_ret = lookup_sid(mem_ctx, gsid, NULL, NULL, &type);
-
- TALLOC_FREE( mem_ctx );
-
- if ( lookup_ret && (type == SID_NAME_DOM_GRP) ) {
- sampass->group_sid = gsid;
- return sampass->group_sid;
- }
-
- DEBUG(3, ("Primary group for user %s is a %s and not a domain group\n",
- pwd->pw_name, sid_type_lookup(type)));
- }
-
- /* Just set it to the 'Domain Users' RID of 512 which will
- always resolve to a name */
-
- sid_copy( gsid, get_global_sam_sid() );
- sid_append_rid( gsid, DOMAIN_GROUP_RID_USERS );
-
- sampass->group_sid = gsid;
-
return sampass->group_sid;
-}
+}
/**
* Get flags showing what is initalised in the struct samu
return sampass->munged_dial;
}
-uint16 pdb_get_bad_password_count(const struct samu *sampass)
+uint16_t pdb_get_bad_password_count(const struct samu *sampass)
{
return sampass->bad_password_count;
}
-uint16 pdb_get_logon_count(const struct samu *sampass)
+uint16_t pdb_get_logon_count(const struct samu *sampass)
{
return sampass->logon_count;
}
-uint32 pdb_get_unknown_6(const struct samu *sampass)
+uint16_t pdb_get_country_code(const struct samu *sampass)
+{
+ return sampass->country_code;
+}
+
+uint16_t pdb_get_code_page(const struct samu *sampass)
+{
+ return sampass->code_page;
+}
+
+uint32_t pdb_get_unknown_6(const struct samu *sampass)
{
return sampass->unknown_6;
}
Collection of set...() functions for struct samu.
********************************************************************/
-bool pdb_set_acct_ctrl(struct samu *sampass, uint32 acct_ctrl, enum pdb_value_state flag)
+bool pdb_set_acct_ctrl(struct samu *sampass, uint32_t acct_ctrl, enum pdb_value_state flag)
{
sampass->acct_ctrl = acct_ctrl;
return pdb_set_init_flags(sampass, PDB_ACCTCTRL, flag);
return pdb_set_init_flags(sampass, PDB_CANCHANGETIME, flag);
}
-bool pdb_set_pass_must_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
-{
- sampass->pass_must_change_time = mytime;
- return pdb_set_init_flags(sampass, PDB_MUSTCHANGETIME, flag);
-}
-
bool pdb_set_pass_last_set_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
{
sampass->pass_last_set_time = mytime;
return pdb_set_init_flags(sampass, PDB_PASSLASTSET, flag);
}
-bool pdb_set_hours_len(struct samu *sampass, uint32 len, enum pdb_value_state flag)
+bool pdb_set_hours_len(struct samu *sampass, uint32_t len, enum pdb_value_state flag)
{
sampass->hours_len = len;
return pdb_set_init_flags(sampass, PDB_HOURSLEN, flag);
}
-bool pdb_set_logon_divs(struct samu *sampass, uint16 hours, enum pdb_value_state flag)
+bool pdb_set_logon_divs(struct samu *sampass, uint16_t hours, enum pdb_value_state flag)
{
sampass->logon_divs = hours;
return pdb_set_init_flags(sampass, PDB_LOGONDIVS, flag);
return True;
}
-bool pdb_set_user_sid(struct samu *sampass, const DOM_SID *u_sid, enum pdb_value_state flag)
+bool pdb_set_user_sid(struct samu *sampass, const struct dom_sid *u_sid, enum pdb_value_state flag)
{
if (!u_sid)
return False;
return pdb_set_init_flags(sampass, PDB_USERSID, flag);
}
-bool pdb_set_user_sid_from_string(struct samu *sampass, fstring u_sid, enum pdb_value_state flag)
+bool pdb_set_user_sid_from_string(struct samu *sampass, const char *u_sid, enum pdb_value_state flag)
{
- DOM_SID new_sid;
+ struct dom_sid new_sid;
if (!u_sid)
return False;
have to allow the explicitly setting of a group SID here.
********************************************************************/
-bool pdb_set_group_sid(struct samu *sampass, const DOM_SID *g_sid, enum pdb_value_state flag)
+bool pdb_set_group_sid(struct samu *sampass, const struct dom_sid *g_sid, enum pdb_value_state flag)
{
gid_t gid;
+ struct dom_sid dug_sid;
if (!g_sid)
return False;
- if ( !(sampass->group_sid = TALLOC_P( sampass, DOM_SID )) ) {
+ if ( !(sampass->group_sid = talloc( sampass, struct dom_sid )) ) {
return False;
}
/* if we cannot resolve the SID to gid, then just ignore it and
store DOMAIN_USERS as the primary groupSID */
- if ( sid_to_gid( g_sid, &gid ) ) {
+ sid_compose(&dug_sid, get_global_sam_sid(), DOMAIN_RID_USERS);
+
+ if (dom_sid_equal(&dug_sid, g_sid)) {
+ sid_copy(sampass->group_sid, &dug_sid);
+ } else if (sid_to_gid( g_sid, &gid ) ) {
sid_copy(sampass->group_sid, g_sid);
} else {
- sid_copy( sampass->group_sid, get_global_sam_sid() );
- sid_append_rid( sampass->group_sid, DOMAIN_GROUP_RID_USERS );
+ sid_copy(sampass->group_sid, &dug_sid);
}
DEBUG(10, ("pdb_set_group_sid: setting group sid %s\n",
Set the user's NT hash.
********************************************************************/
-bool pdb_set_nt_passwd(struct samu *sampass, const uint8 pwd[NT_HASH_LEN], enum pdb_value_state flag)
+bool pdb_set_nt_passwd(struct samu *sampass, const uint8_t pwd[NT_HASH_LEN], enum pdb_value_state flag)
{
data_blob_clear_free(&sampass->nt_pw);
Set the user's LM hash.
********************************************************************/
-bool pdb_set_lanman_passwd(struct samu *sampass, const uint8 pwd[LM_HASH_LEN], enum pdb_value_state flag)
+bool pdb_set_lanman_passwd(struct samu *sampass, const uint8_t pwd[LM_HASH_LEN], enum pdb_value_state flag)
{
data_blob_clear_free(&sampass->lm_pw);
/*********************************************************************
Set the user's password history hash. historyLen is the number of
PW_HISTORY_SALT_LEN+SALTED_MD5_HASH_LEN length
- entries to store in the history - this must match the size of the uint8 array
+ entries to store in the history - this must match the size of the uint8_t array
in pwd.
********************************************************************/
-bool pdb_set_pw_history(struct samu *sampass, const uint8 *pwd, uint32 historyLen, enum pdb_value_state flag)
+bool pdb_set_pw_history(struct samu *sampass, const uint8_t *pwd, uint32_t historyLen, enum pdb_value_state flag)
{
+ DATA_BLOB new_nt_pw_his = {};
+
if (historyLen && pwd){
- sampass->nt_pw_his = data_blob_talloc(sampass,
- pwd, historyLen*PW_HISTORY_ENTRY_LEN);
- if (!sampass->nt_pw_his.length) {
+ new_nt_pw_his = data_blob_talloc(sampass,
+ pwd, historyLen*PW_HISTORY_ENTRY_LEN);
+ if (new_nt_pw_his.length == 0) {
DEBUG(0, ("pdb_set_pw_history: data_blob_talloc() failed!\n"));
return False;
}
- } else {
- sampass->nt_pw_his = data_blob_talloc(sampass, NULL, 0);
}
+ data_blob_free(&sampass->nt_pw_his);
+ sampass->nt_pw_his = new_nt_pw_his;
+
return pdb_set_init_flags(sampass, PDB_PWHISTORY, flag);
}
return pdb_set_init_flags(sampass, PDB_PLAINTEXT_PW, flag);
}
-bool pdb_set_bad_password_count(struct samu *sampass, uint16 bad_password_count, enum pdb_value_state flag)
+bool pdb_set_bad_password_count(struct samu *sampass, uint16_t bad_password_count, enum pdb_value_state flag)
{
sampass->bad_password_count = bad_password_count;
return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_COUNT, flag);
}
-bool pdb_set_logon_count(struct samu *sampass, uint16 logon_count, enum pdb_value_state flag)
+bool pdb_set_logon_count(struct samu *sampass, uint16_t logon_count, enum pdb_value_state flag)
{
sampass->logon_count = logon_count;
return pdb_set_init_flags(sampass, PDB_LOGON_COUNT, flag);
}
-bool pdb_set_unknown_6(struct samu *sampass, uint32 unkn, enum pdb_value_state flag)
+bool pdb_set_country_code(struct samu *sampass, uint16_t country_code,
+ enum pdb_value_state flag)
+{
+ sampass->country_code = country_code;
+ return pdb_set_init_flags(sampass, PDB_COUNTRY_CODE, flag);
+}
+
+bool pdb_set_code_page(struct samu *sampass, uint16_t code_page,
+ enum pdb_value_state flag)
+{
+ sampass->code_page = code_page;
+ return pdb_set_init_flags(sampass, PDB_CODE_PAGE, flag);
+}
+
+bool pdb_set_unknown_6(struct samu *sampass, uint32_t unkn, enum pdb_value_state flag)
{
sampass->unknown_6 = unkn;
return pdb_set_init_flags(sampass, PDB_UNKNOWN6, flag);
}
-bool pdb_set_hours(struct samu *sampass, const uint8 *hours, enum pdb_value_state flag)
+bool pdb_set_hours(struct samu *sampass, const uint8_t *hours, int hours_len,
+ enum pdb_value_state flag)
{
+ if (hours_len > sizeof(sampass->hours)) {
+ return false;
+ }
+
if (!hours) {
- memset ((char *)sampass->hours, 0, MAX_HOURS_LEN);
+ memset ((char *)sampass->hours, 0, hours_len);
} else {
- memcpy (sampass->hours, hours, MAX_HOURS_LEN);
+ memcpy (sampass->hours, hours, hours_len);
}
return pdb_set_init_flags(sampass, PDB_HOURS, flag);
bool pdb_set_pass_can_change(struct samu *sampass, bool canchange)
{
return pdb_set_pass_can_change_time(sampass,
- canchange ? 0 : get_time_t_max(),
+ canchange ? 0 : pdb_password_change_time_max(),
PDB_CHANGED);
}
if (!pdb_set_pass_last_set_time (sampass, time(NULL), PDB_CHANGED))
return False;
- /* Store the password history. */
- if (pdb_get_acct_ctrl(sampass) & ACB_NORMAL) {
- uchar *pwhistory;
- uint32 pwHistLen;
- pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
- if (pwHistLen != 0){
- uint32 current_history_len;
- /* We need to make sure we don't have a race condition here - the
- account policy history length can change between when the pw_history
- was first loaded into the struct samu struct and now.... JRA. */
- pwhistory = (uchar *)pdb_get_pw_history(sampass, ¤t_history_len);
-
- if (current_history_len != pwHistLen) {
- /* After closing and reopening struct samu the history
- values will sync up. We can't do this here. */
-
- /* current_history_len > pwHistLen is not a problem - we
- have more history than we need. */
-
- if (current_history_len < pwHistLen) {
- /* Ensure we have space for the needed history. */
- uchar *new_history = (uchar *)TALLOC(sampass,
- pwHistLen*PW_HISTORY_ENTRY_LEN);
- if (!new_history) {
- return False;
- }
-
- /* And copy it into the new buffer. */
- if (current_history_len) {
- memcpy(new_history, pwhistory,
- current_history_len*PW_HISTORY_ENTRY_LEN);
- }
- /* Clearing out any extra space. */
- memset(&new_history[current_history_len*PW_HISTORY_ENTRY_LEN],
- '\0', (pwHistLen-current_history_len)*PW_HISTORY_ENTRY_LEN);
- /* Finally replace it. */
- pwhistory = new_history;
- }
- }
- if (pwhistory && pwHistLen){
- /* Make room for the new password in the history list. */
- if (pwHistLen > 1) {
- memmove(&pwhistory[PW_HISTORY_ENTRY_LEN],
- pwhistory, (pwHistLen -1)*PW_HISTORY_ENTRY_LEN );
- }
- /* Create the new salt as the first part of the history entry. */
- generate_random_buffer(pwhistory, PW_HISTORY_SALT_LEN);
-
- /* Generate the md5 hash of the salt+new password as the second
- part of the history entry. */
-
- E_md5hash(pwhistory, new_nt_p16, &pwhistory[PW_HISTORY_SALT_LEN]);
- pdb_set_pw_history(sampass, pwhistory, pwHistLen, PDB_CHANGED);
- } else {
- DEBUG (10,("pdb_get_set.c: pdb_set_plaintext_passwd: pwhistory was NULL!\n"));
- }
- } else {
- /* Set the history length to zero. */
- pdb_set_pw_history(sampass, NULL, 0, PDB_CHANGED);
- }
+
+ return pdb_update_history(sampass, new_nt_p16);
+}
+
+/*********************************************************************
+ Update password history after change
+ ********************************************************************/
+
+bool pdb_update_history(struct samu *sampass, const uint8_t new_nt[NT_HASH_LEN])
+{
+ uchar *pwhistory;
+ uint32_t pwHistLen;
+ uint32_t current_history_len;
+ const uint8_t *current_history;
+
+ if ((pdb_get_acct_ctrl(sampass) & ACB_NORMAL) == 0) {
+ /*
+ * No password history for non-user accounts
+ */
+ return true;
}
+ pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
+
+ if (pwHistLen == 0) {
+ /* Set the history length to zero. */
+ pdb_set_pw_history(sampass, NULL, 0, PDB_CHANGED);
+ return true;
+ }
+
+ /*
+ * We need to make sure we don't have a race condition here -
+ * the account policy history length can change between when
+ * the pw_history was first loaded into the struct samu struct
+ * and now.... JRA.
+ */
+ current_history = pdb_get_pw_history(sampass, ¤t_history_len);
+ if ((current_history_len != 0) && (current_history == NULL)) {
+ DEBUG(1, ("pdb_update_history: pwhistory == NULL!\n"));
+ return false;
+ }
+
+ /*
+ * Ensure we have space for the needed history. This
+ * also takes care of an account which did not have
+ * any history at all so far, i.e. pwhistory==NULL
+ */
+ pwhistory = talloc_zero_array(
+ sampass, uchar,
+ pwHistLen*PW_HISTORY_ENTRY_LEN);
+ if (!pwhistory) {
+ return false;
+ }
+
+ memcpy(pwhistory, current_history,
+ current_history_len*PW_HISTORY_ENTRY_LEN);
+
+ /*
+ * Make room for the new password in the history list.
+ */
+ if (pwHistLen > 1) {
+ memmove(&pwhistory[PW_HISTORY_ENTRY_LEN], pwhistory,
+ (pwHistLen-1)*PW_HISTORY_ENTRY_LEN );
+ }
+
+ /*
+ * Fill the salt area with 0-s: this indicates that
+ * a plain nt hash is stored in the has area.
+ * The old format was to store a 16 byte salt and
+ * then an md5hash of the nt_hash concatenated with
+ * the salt.
+ */
+ memset(pwhistory, 0, PW_HISTORY_SALT_LEN);
+
+ /*
+ * Store the plain nt hash in the second 16 bytes.
+ * The old format was to store the md5 hash of
+ * the salt+newpw.
+ */
+ memcpy(&pwhistory[PW_HISTORY_SALT_LEN], new_nt, SALTED_MD5_HASH_LEN);
+
+ pdb_set_pw_history(sampass, pwhistory, pwHistLen, PDB_CHANGED);
+
return True;
+
}
/* check for any PDB_SET/CHANGED field and fill the appropriate mask bit */
-uint32 pdb_build_fields_present(struct samu *sampass)
+uint32_t pdb_build_fields_present(struct samu *sampass)
{
/* value set to all for testing */
return 0x00ffffff;
}
+
+/**********************************************************************
+ Helper function to determine for update_sam_account whether
+ we need LDAP modification.
+*********************************************************************/
+
+bool pdb_element_is_changed(const struct samu *sampass,
+ enum pdb_elements element)
+{
+ return IS_SAM_CHANGED(sampass, element);
+}
+
+/**********************************************************************
+ Helper function to determine for update_sam_account whether
+ we need LDAP modification.
+ *********************************************************************/
+
+bool pdb_element_is_set_or_changed(const struct samu *sampass,
+ enum pdb_elements element)
+{
+ return (IS_SAM_SET(sampass, element) ||
+ IS_SAM_CHANGED(sampass, element));
+}
git.samba.org / bbaumbach / samba-autobuild / .git / blobdiff