Copyright (C) Gerald (Jerry) Carter 2000-2006
Copyright (C) Andrew Bartlett 2001-2002
Copyright (C) Stefan (metze) Metzmacher 2002
-
+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
+#include "passdb.h"
+#include "../libcli/auth/libcli_auth.h"
+#include "../libcli/security/security.h"
+#include "../lib/util/bitmap.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_PASSDB
#define PDB_NOT_QUITE_NULL ""
+/*********************************************************************
+ Test if a change time is a max value. Copes with old and new values
+ of max.
+ ********************************************************************/
+
+bool pdb_is_password_change_time_max(time_t test_time)
+{
+ if (test_time == get_time_t_max()) {
+ return true;
+ }
+#if (defined(SIZEOF_TIME_T) && (SIZEOF_TIME_T == 8))
+ if (test_time == 0x7FFFFFFFFFFFFFFFLL) {
+ return true;
+ }
+#endif
+ if (test_time == 0x7FFFFFFF) {
+ return true;
+ }
+ return false;
+}
+
+/*********************************************************************
+ Return an unchanging version of max password change time - 0x7FFFFFFF.
+ ********************************************************************/
+
+static time_t pdb_password_change_time_max(void)
+{
+ return 0x7FFFFFFF;
+}
+
/*********************************************************************
Collection of get...() functions for struct samu.
********************************************************************/
-uint32 pdb_get_acct_ctrl(const struct samu *sampass)
+uint32_t pdb_get_acct_ctrl(const struct samu *sampass)
{
return sampass->acct_ctrl;
}
time_t pdb_get_pass_can_change_time(const struct samu *sampass)
{
- uint32 allow;
+ uint32_t allow;
/* if the last set time is zero, it means the user cannot
change their password, and this time must be zero. jmcd
*/
if (sampass->pass_last_set_time == 0)
return (time_t) 0;
-
+
/* if the time is max, and the field has been changed,
we're trying to update this real value from the sampass
to indicate that the user cannot change their password. jmcd
*/
- if (sampass->pass_can_change_time == get_time_t_max() &&
- pdb_get_init_flags(sampass, PDB_CANCHANGETIME) == PDB_CHANGED)
+ if (pdb_is_password_change_time_max(sampass->pass_can_change_time) &&
+ IS_SAM_CHANGED(sampass, PDB_CANCHANGETIME))
return sampass->pass_can_change_time;
- if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &allow))
+ if (!pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE, &allow))
allow = 0;
/* in normal cases, just calculate it from policy */
time_t pdb_get_pass_must_change_time(const struct samu *sampass)
{
- uint32 expire;
+ uint32_t expire;
if (sampass->pass_last_set_time == 0)
return (time_t) 0;
if (sampass->acct_ctrl & ACB_PWNOEXP)
- return get_time_t_max();
+ return pdb_password_change_time_max();
- if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &expire)
- || expire == (uint32)-1 || expire == 0)
+ if (!pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE, &expire)
+ || expire == (uint32_t)-1 || expire == 0)
return get_time_t_max();
return sampass->pass_last_set_time + expire;
bool pdb_get_pass_can_change(const struct samu *sampass)
{
- if (sampass->pass_can_change_time == get_time_t_max() &&
- sampass->pass_last_set_time != 0)
+ if (pdb_is_password_change_time_max(sampass->pass_can_change_time))
return False;
return True;
}
-uint16 pdb_get_logon_divs(const struct samu *sampass)
+uint16_t pdb_get_logon_divs(const struct samu *sampass)
{
return sampass->logon_divs;
}
-uint32 pdb_get_hours_len(const struct samu *sampass)
+uint32_t pdb_get_hours_len(const struct samu *sampass)
{
return sampass->hours_len;
}
-const uint8 *pdb_get_hours(const struct samu *sampass)
+const uint8_t *pdb_get_hours(const struct samu *sampass)
{
return (sampass->hours);
}
-const uint8 *pdb_get_nt_passwd(const struct samu *sampass)
+const uint8_t *pdb_get_nt_passwd(const struct samu *sampass)
{
SMB_ASSERT((!sampass->nt_pw.data)
|| sampass->nt_pw.length == NT_HASH_LEN);
- return (uint8 *)sampass->nt_pw.data;
+ return (uint8_t *)sampass->nt_pw.data;
}
-const uint8 *pdb_get_lanman_passwd(const struct samu *sampass)
+const uint8_t *pdb_get_lanman_passwd(const struct samu *sampass)
{
SMB_ASSERT((!sampass->lm_pw.data)
|| sampass->lm_pw.length == LM_HASH_LEN);
- return (uint8 *)sampass->lm_pw.data;
+ return (uint8_t *)sampass->lm_pw.data;
}
-const uint8 *pdb_get_pw_history(const struct samu *sampass, uint32 *current_hist_len)
+const uint8_t *pdb_get_pw_history(const struct samu *sampass, uint32_t *current_hist_len)
{
SMB_ASSERT((!sampass->nt_pw_his.data)
|| ((sampass->nt_pw_his.length % PW_HISTORY_ENTRY_LEN) == 0));
*current_hist_len = sampass->nt_pw_his.length / PW_HISTORY_ENTRY_LEN;
- return (uint8 *)sampass->nt_pw_his.data;
+ return (uint8_t *)sampass->nt_pw_his.data;
}
/* Return the plaintext password if known. Most of the time
it isn't, so don't assume anything magic about this function.
-
+
Used to pass the plaintext to passdb backends that might
want to store more than just the NTLM hashes.
*/
return sampass->plaintext_pw;
}
-const DOM_SID *pdb_get_user_sid(const struct samu *sampass)
+const struct dom_sid *pdb_get_user_sid(const struct samu *sampass)
{
return &sampass->user_sid;
}
-const DOM_SID *pdb_get_group_sid(struct samu *sampass)
+const struct dom_sid *pdb_get_group_sid(struct samu *sampass)
{
- DOM_SID *gsid;
- struct passwd *pwd;
-
+ NTSTATUS status;
+
/* Return the cached group SID if we have that */
- if ( sampass->group_sid ) {
+ if (sampass->group_sid) {
return sampass->group_sid;
}
-
- /* generate the group SID from the user's primary Unix group */
-
- if ( !(gsid = TALLOC_P( sampass, DOM_SID )) ) {
- return NULL;
- }
-
+
/* No algorithmic mapping, meaning that we have to figure out the
primary group SID according to group mapping and the user SID must
be a newly allocated one. We rely on the user's Unix primary gid.
We have no choice but to fail if we can't find it. */
-
- if ( sampass->unix_pw ) {
- pwd = sampass->unix_pw;
- } else {
- pwd = Get_Pwnam_alloc( sampass, pdb_get_username(sampass) );
- }
-
- if ( !pwd ) {
- DEBUG(0,("pdb_get_group_sid: Failed to find Unix account for %s\n", pdb_get_username(sampass) ));
+ status = get_primary_group_sid(sampass,
+ pdb_get_username(sampass),
+ &sampass->unix_pw,
+ &sampass->group_sid);
+ if (!NT_STATUS_IS_OK(status)) {
return NULL;
}
-
- if ( pdb_gid_to_sid(pwd->pw_gid, gsid) ) {
- enum lsa_SidType type = SID_NAME_UNKNOWN;
- TALLOC_CTX *mem_ctx = talloc_init("pdb_get_group_sid");
- bool lookup_ret;
-
- if (!mem_ctx) {
- return NULL;
- }
-
- /* Now check that it's actually a domain group and not something else */
-
- lookup_ret = lookup_sid(mem_ctx, gsid, NULL, NULL, &type);
-
- TALLOC_FREE( mem_ctx );
-
- if ( lookup_ret && (type == SID_NAME_DOM_GRP) ) {
- sampass->group_sid = gsid;
- return sampass->group_sid;
- }
-
- DEBUG(3, ("Primary group for user %s is a %s and not a domain group\n",
- pwd->pw_name, sid_type_lookup(type)));
- }
- /* Just set it to the 'Domain Users' RID of 512 which will
- always resolve to a name */
-
- sid_copy( gsid, get_global_sam_sid() );
- sid_append_rid( gsid, DOMAIN_GROUP_RID_USERS );
-
- sampass->group_sid = gsid;
-
return sampass->group_sid;
-}
+}
/**
* Get flags showing what is initalised in the struct samu
* @param sampass the struct samu in question
* @return the flags indicating the members initialised in the struct.
**/
-
+
enum pdb_value_state pdb_get_init_flags(const struct samu *sampass, enum pdb_elements element)
{
enum pdb_value_state ret = PDB_DEFAULT;
-
+
if (!sampass->change_flags || !sampass->set_flags)
return ret;
-
+
if (bitmap_query(sampass->set_flags, element)) {
DEBUG(11, ("element %d: SET\n", element));
ret = PDB_SET;
}
-
+
if (bitmap_query(sampass->change_flags, element)) {
DEBUG(11, ("element %d: CHANGED\n", element));
ret = PDB_CHANGED;
return sampass->home_dir;
}
-const char *pdb_get_unix_homedir(const struct samu *sampass)
-{
- if (sampass->unix_pw ) {
- return sampass->unix_pw->pw_dir;
- }
- return NULL;
-}
-
const char *pdb_get_dir_drive(const struct samu *sampass)
{
return sampass->dir_drive;
return sampass->munged_dial;
}
-uint16 pdb_get_bad_password_count(const struct samu *sampass)
+uint16_t pdb_get_bad_password_count(const struct samu *sampass)
{
return sampass->bad_password_count;
}
-uint16 pdb_get_logon_count(const struct samu *sampass)
+uint16_t pdb_get_logon_count(const struct samu *sampass)
{
return sampass->logon_count;
}
-uint32 pdb_get_unknown_6(const struct samu *sampass)
+uint16_t pdb_get_country_code(const struct samu *sampass)
+{
+ return sampass->country_code;
+}
+
+uint16_t pdb_get_code_page(const struct samu *sampass)
+{
+ return sampass->code_page;
+}
+
+uint32_t pdb_get_unknown_6(const struct samu *sampass)
{
return sampass->unknown_6;
}
Collection of set...() functions for struct samu.
********************************************************************/
-bool pdb_set_acct_ctrl(struct samu *sampass, uint32 acct_ctrl, enum pdb_value_state flag)
+bool pdb_set_acct_ctrl(struct samu *sampass, uint32_t acct_ctrl, enum pdb_value_state flag)
{
sampass->acct_ctrl = acct_ctrl;
return pdb_set_init_flags(sampass, PDB_ACCTCTRL, flag);
return pdb_set_init_flags(sampass, PDB_CANCHANGETIME, flag);
}
-bool pdb_set_pass_must_change_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
-{
- sampass->pass_must_change_time = mytime;
- return pdb_set_init_flags(sampass, PDB_MUSTCHANGETIME, flag);
-}
-
bool pdb_set_pass_last_set_time(struct samu *sampass, time_t mytime, enum pdb_value_state flag)
{
sampass->pass_last_set_time = mytime;
return pdb_set_init_flags(sampass, PDB_PASSLASTSET, flag);
}
-bool pdb_set_hours_len(struct samu *sampass, uint32 len, enum pdb_value_state flag)
+bool pdb_set_hours_len(struct samu *sampass, uint32_t len, enum pdb_value_state flag)
{
sampass->hours_len = len;
return pdb_set_init_flags(sampass, PDB_HOURSLEN, flag);
}
-bool pdb_set_logon_divs(struct samu *sampass, uint16 hours, enum pdb_value_state flag)
+bool pdb_set_logon_divs(struct samu *sampass, uint16_t hours, enum pdb_value_state flag)
{
sampass->logon_divs = hours;
return pdb_set_init_flags(sampass, PDB_LOGONDIVS, flag);
* @param flag The *new* flag to be set. Old flags preserved
* this flag is only added.
**/
-
+
bool pdb_set_init_flags(struct samu *sampass, enum pdb_elements element, enum pdb_value_state value_flag)
{
if (!sampass->set_flags) {
return False;
}
}
-
+
switch(value_flag) {
case PDB_CHANGED:
if (!bitmap_set(sampass->change_flags, element)) {
return True;
}
-bool pdb_set_user_sid(struct samu *sampass, const DOM_SID *u_sid, enum pdb_value_state flag)
+bool pdb_set_user_sid(struct samu *sampass, const struct dom_sid *u_sid, enum pdb_value_state flag)
{
if (!u_sid)
return False;
-
+
sid_copy(&sampass->user_sid, u_sid);
DEBUG(10, ("pdb_set_user_sid: setting user sid %s\n",
- sid_string_static(&sampass->user_sid)));
+ sid_string_dbg(&sampass->user_sid)));
return pdb_set_init_flags(sampass, PDB_USERSID, flag);
}
-bool pdb_set_user_sid_from_string(struct samu *sampass, fstring u_sid, enum pdb_value_state flag)
+bool pdb_set_user_sid_from_string(struct samu *sampass, const char *u_sid, enum pdb_value_state flag)
{
- DOM_SID new_sid;
-
+ struct dom_sid new_sid;
+
if (!u_sid)
return False;
DEBUG(1, ("pdb_set_user_sid_from_string: %s isn't a valid SID!\n", u_sid));
return False;
}
-
+
if (!pdb_set_user_sid(sampass, &new_sid, flag)) {
DEBUG(1, ("pdb_set_user_sid_from_string: could not set sid %s on struct samu!\n", u_sid));
return False;
We never fill this in from a passdb backend but rather set is
based on the user's primary group membership. However, the
struct samu* is overloaded and reused in domain memship code
- as well and built from the NET_USER_INFO_3 or PAC so we
+ as well and built from the netr_SamInfo3 or PAC so we
have to allow the explicitly setting of a group SID here.
********************************************************************/
-bool pdb_set_group_sid(struct samu *sampass, const DOM_SID *g_sid, enum pdb_value_state flag)
+bool pdb_set_group_sid(struct samu *sampass, const struct dom_sid *g_sid, enum pdb_value_state flag)
{
gid_t gid;
+ struct dom_sid dug_sid;
if (!g_sid)
return False;
- if ( !(sampass->group_sid = TALLOC_P( sampass, DOM_SID )) ) {
+ if ( !(sampass->group_sid = talloc( sampass, struct dom_sid )) ) {
return False;
}
/* if we cannot resolve the SID to gid, then just ignore it and
store DOMAIN_USERS as the primary groupSID */
- if ( sid_to_gid( g_sid, &gid ) ) {
+ sid_compose(&dug_sid, get_global_sam_sid(), DOMAIN_RID_USERS);
+
+ if (dom_sid_equal(&dug_sid, g_sid)) {
+ sid_copy(sampass->group_sid, &dug_sid);
+ } else if (sid_to_gid( g_sid, &gid ) ) {
sid_copy(sampass->group_sid, g_sid);
} else {
- sid_copy( sampass->group_sid, get_global_sam_sid() );
- sid_append_rid( sampass->group_sid, DOMAIN_GROUP_RID_USERS );
+ sid_copy(sampass->group_sid, &dug_sid);
}
DEBUG(10, ("pdb_set_group_sid: setting group sid %s\n",
- sid_string_static(sampass->group_sid)));
+ sid_string_dbg(sampass->group_sid)));
return pdb_set_init_flags(sampass, PDB_GROUPSID, flag);
}
} else {
sampass->username = PDB_NOT_QUITE_NULL;
}
-
+
return pdb_set_init_flags(sampass, PDB_USERNAME, flag);
}
(sampass->nt_username)?(sampass->nt_username):"NULL"));
sampass->nt_username = talloc_strdup(sampass, nt_username);
-
+
if (!sampass->nt_username) {
DEBUG(0, ("pdb_set_nt_username: talloc_strdup() failed!\n"));
return False;
if (full_name) {
DEBUG(10, ("pdb_set_full_name: setting full name %s, was %s\n", full_name,
(sampass->full_name)?(sampass->full_name):"NULL"));
-
+
sampass->full_name = talloc_strdup(sampass, full_name);
if (!sampass->full_name) {
if (logon_script) {
DEBUG(10, ("pdb_set_logon_script: setting logon script %s, was %s\n", logon_script,
(sampass->logon_script)?(sampass->logon_script):"NULL"));
-
+
sampass->logon_script = talloc_strdup(sampass, logon_script);
if (!sampass->logon_script) {
} else {
sampass->logon_script = PDB_NOT_QUITE_NULL;
}
-
+
return pdb_set_init_flags(sampass, PDB_LOGONSCRIPT, flag);
}
if (profile_path) {
DEBUG(10, ("pdb_set_profile_path: setting profile path %s, was %s\n", profile_path,
(sampass->profile_path)?(sampass->profile_path):"NULL"));
-
+
sampass->profile_path = talloc_strdup(sampass, profile_path);
-
+
if (!sampass->profile_path) {
DEBUG(0, ("pdb_set_profile_path: talloc_strdup() failed!\n"));
return False;
if (dir_drive) {
DEBUG(10, ("pdb_set_dir_drive: setting dir drive %s, was %s\n", dir_drive,
(sampass->dir_drive)?(sampass->dir_drive):"NULL"));
-
+
sampass->dir_drive = talloc_strdup(sampass, dir_drive);
-
+
if (!sampass->dir_drive) {
DEBUG(0, ("pdb_set_dir_drive: talloc_strdup() failed!\n"));
return False;
} else {
sampass->dir_drive = PDB_NOT_QUITE_NULL;
}
-
+
return pdb_set_init_flags(sampass, PDB_DRIVE, flag);
}
if (home_dir) {
DEBUG(10, ("pdb_set_homedir: setting home dir %s, was %s\n", home_dir,
(sampass->home_dir)?(sampass->home_dir):"NULL"));
-
+
sampass->home_dir = talloc_strdup(sampass, home_dir);
-
+
if (!sampass->home_dir) {
DEBUG(0, ("pdb_set_home_dir: talloc_strdup() failed!\n"));
return False;
if (workstations) {
DEBUG(10, ("pdb_set_workstations: setting workstations %s, was %s\n", workstations,
(sampass->workstations)?(sampass->workstations):"NULL"));
-
+
sampass->workstations = talloc_strdup(sampass, workstations);
if (!sampass->workstations) {
{
if (comment) {
sampass->comment = talloc_strdup(sampass, comment);
-
+
if (!sampass->comment) {
DEBUG(0, ("pdb_set_comment: talloc_strdup() failed!\n"));
return False;
{
if (munged_dial) {
sampass->munged_dial = talloc_strdup(sampass, munged_dial);
-
+
if (!sampass->munged_dial) {
DEBUG(0, ("pdb_set_munged_dial: talloc_strdup() failed!\n"));
return False;
Set the user's NT hash.
********************************************************************/
-bool pdb_set_nt_passwd(struct samu *sampass, const uint8 pwd[NT_HASH_LEN], enum pdb_value_state flag)
+bool pdb_set_nt_passwd(struct samu *sampass, const uint8_t pwd[NT_HASH_LEN], enum pdb_value_state flag)
{
data_blob_clear_free(&sampass->nt_pw);
-
+
if (pwd) {
sampass->nt_pw =
data_blob_talloc(sampass, pwd, NT_HASH_LEN);
Set the user's LM hash.
********************************************************************/
-bool pdb_set_lanman_passwd(struct samu *sampass, const uint8 pwd[LM_HASH_LEN], enum pdb_value_state flag)
+bool pdb_set_lanman_passwd(struct samu *sampass, const uint8_t pwd[LM_HASH_LEN], enum pdb_value_state flag)
{
data_blob_clear_free(&sampass->lm_pw);
-
+
/* on keep the password if we are allowing LANMAN authentication */
if (pwd && lp_lanman_auth() ) {
/*********************************************************************
Set the user's password history hash. historyLen is the number of
PW_HISTORY_SALT_LEN+SALTED_MD5_HASH_LEN length
- entries to store in the history - this must match the size of the uint8 array
+ entries to store in the history - this must match the size of the uint8_t array
in pwd.
********************************************************************/
-bool pdb_set_pw_history(struct samu *sampass, const uint8 *pwd, uint32 historyLen, enum pdb_value_state flag)
+bool pdb_set_pw_history(struct samu *sampass, const uint8_t *pwd, uint32_t historyLen, enum pdb_value_state flag)
{
+ DATA_BLOB new_nt_pw_his = {};
+
if (historyLen && pwd){
- sampass->nt_pw_his = data_blob_talloc(sampass,
- pwd, historyLen*PW_HISTORY_ENTRY_LEN);
- if (!sampass->nt_pw_his.length) {
+ new_nt_pw_his = data_blob_talloc(sampass,
+ pwd, historyLen*PW_HISTORY_ENTRY_LEN);
+ if (new_nt_pw_his.length == 0) {
DEBUG(0, ("pdb_set_pw_history: data_blob_talloc() failed!\n"));
return False;
}
- } else {
- sampass->nt_pw_his = data_blob_talloc(sampass, NULL, 0);
}
+ data_blob_free(&sampass->nt_pw_his);
+ sampass->nt_pw_his = new_nt_pw_his;
+
return pdb_set_init_flags(sampass, PDB_PWHISTORY, flag);
}
memset(sampass->plaintext_pw,'\0',strlen(sampass->plaintext_pw)+1);
sampass->plaintext_pw = talloc_strdup(sampass, password);
-
+
if (!sampass->plaintext_pw) {
DEBUG(0, ("pdb_set_unknown_str: talloc_strdup() failed!\n"));
return False;
return pdb_set_init_flags(sampass, PDB_PLAINTEXT_PW, flag);
}
-bool pdb_set_bad_password_count(struct samu *sampass, uint16 bad_password_count, enum pdb_value_state flag)
+bool pdb_set_bad_password_count(struct samu *sampass, uint16_t bad_password_count, enum pdb_value_state flag)
{
sampass->bad_password_count = bad_password_count;
return pdb_set_init_flags(sampass, PDB_BAD_PASSWORD_COUNT, flag);
}
-bool pdb_set_logon_count(struct samu *sampass, uint16 logon_count, enum pdb_value_state flag)
+bool pdb_set_logon_count(struct samu *sampass, uint16_t logon_count, enum pdb_value_state flag)
{
sampass->logon_count = logon_count;
return pdb_set_init_flags(sampass, PDB_LOGON_COUNT, flag);
}
-bool pdb_set_unknown_6(struct samu *sampass, uint32 unkn, enum pdb_value_state flag)
+bool pdb_set_country_code(struct samu *sampass, uint16_t country_code,
+ enum pdb_value_state flag)
+{
+ sampass->country_code = country_code;
+ return pdb_set_init_flags(sampass, PDB_COUNTRY_CODE, flag);
+}
+
+bool pdb_set_code_page(struct samu *sampass, uint16_t code_page,
+ enum pdb_value_state flag)
+{
+ sampass->code_page = code_page;
+ return pdb_set_init_flags(sampass, PDB_CODE_PAGE, flag);
+}
+
+bool pdb_set_unknown_6(struct samu *sampass, uint32_t unkn, enum pdb_value_state flag)
{
sampass->unknown_6 = unkn;
return pdb_set_init_flags(sampass, PDB_UNKNOWN6, flag);
}
-bool pdb_set_hours(struct samu *sampass, const uint8 *hours, enum pdb_value_state flag)
+bool pdb_set_hours(struct samu *sampass, const uint8_t *hours, int hours_len,
+ enum pdb_value_state flag)
{
+ if (hours_len > sizeof(sampass->hours)) {
+ return false;
+ }
+
if (!hours) {
- memset ((char *)sampass->hours, 0, MAX_HOURS_LEN);
+ memset ((char *)sampass->hours, 0, hours_len);
} else {
- memcpy (sampass->hours, hours, MAX_HOURS_LEN);
+ memcpy (sampass->hours, hours, hours_len);
}
return pdb_set_init_flags(sampass, PDB_HOURS, flag);
bool pdb_set_pass_can_change(struct samu *sampass, bool canchange)
{
return pdb_set_pass_can_change_time(sampass,
- canchange ? 0 : get_time_t_max(),
+ canchange ? 0 : pdb_password_change_time_max(),
PDB_CHANGED);
}
if (!pdb_set_pass_last_set_time (sampass, time(NULL), PDB_CHANGED))
return False;
- /* Store the password history. */
- if (pdb_get_acct_ctrl(sampass) & ACB_NORMAL) {
- uchar *pwhistory;
- uint32 pwHistLen;
- pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
- if (pwHistLen != 0){
- uint32 current_history_len;
- /* We need to make sure we don't have a race condition here - the
- account policy history length can change between when the pw_history
- was first loaded into the struct samu struct and now.... JRA. */
- pwhistory = (uchar *)pdb_get_pw_history(sampass, ¤t_history_len);
-
- if (current_history_len != pwHistLen) {
- /* After closing and reopening struct samu the history
- values will sync up. We can't do this here. */
-
- /* current_history_len > pwHistLen is not a problem - we
- have more history than we need. */
-
- if (current_history_len < pwHistLen) {
- /* Ensure we have space for the needed history. */
- uchar *new_history = (uchar *)TALLOC(sampass,
- pwHistLen*PW_HISTORY_ENTRY_LEN);
- if (!new_history) {
- return False;
- }
-
- /* And copy it into the new buffer. */
- if (current_history_len) {
- memcpy(new_history, pwhistory,
- current_history_len*PW_HISTORY_ENTRY_LEN);
- }
- /* Clearing out any extra space. */
- memset(&new_history[current_history_len*PW_HISTORY_ENTRY_LEN],
- '\0', (pwHistLen-current_history_len)*PW_HISTORY_ENTRY_LEN);
- /* Finally replace it. */
- pwhistory = new_history;
- }
- }
- if (pwhistory && pwHistLen){
- /* Make room for the new password in the history list. */
- if (pwHistLen > 1) {
- memmove(&pwhistory[PW_HISTORY_ENTRY_LEN],
- pwhistory, (pwHistLen -1)*PW_HISTORY_ENTRY_LEN );
- }
- /* Create the new salt as the first part of the history entry. */
- generate_random_buffer(pwhistory, PW_HISTORY_SALT_LEN);
-
- /* Generate the md5 hash of the salt+new password as the second
- part of the history entry. */
-
- E_md5hash(pwhistory, new_nt_p16, &pwhistory[PW_HISTORY_SALT_LEN]);
- pdb_set_pw_history(sampass, pwhistory, pwHistLen, PDB_CHANGED);
- } else {
- DEBUG (10,("pdb_get_set.c: pdb_set_plaintext_passwd: pwhistory was NULL!\n"));
- }
- } else {
- /* Set the history length to zero. */
- pdb_set_pw_history(sampass, NULL, 0, PDB_CHANGED);
- }
+
+ return pdb_update_history(sampass, new_nt_p16);
+}
+
+/*********************************************************************
+ Update password history after change
+ ********************************************************************/
+
+bool pdb_update_history(struct samu *sampass, const uint8_t new_nt[NT_HASH_LEN])
+{
+ uchar *pwhistory;
+ uint32_t pwHistLen;
+ uint32_t current_history_len;
+ const uint8_t *current_history;
+
+ if ((pdb_get_acct_ctrl(sampass) & ACB_NORMAL) == 0) {
+ /*
+ * No password history for non-user accounts
+ */
+ return true;
+ }
+
+ pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY, &pwHistLen);
+
+ if (pwHistLen == 0) {
+ /* Set the history length to zero. */
+ pdb_set_pw_history(sampass, NULL, 0, PDB_CHANGED);
+ return true;
+ }
+
+ /*
+ * We need to make sure we don't have a race condition here -
+ * the account policy history length can change between when
+ * the pw_history was first loaded into the struct samu struct
+ * and now.... JRA.
+ */
+ current_history = pdb_get_pw_history(sampass, ¤t_history_len);
+ if ((current_history_len != 0) && (current_history == NULL)) {
+ DEBUG(1, ("pdb_update_history: pwhistory == NULL!\n"));
+ return false;
+ }
+
+ /*
+ * Ensure we have space for the needed history. This
+ * also takes care of an account which did not have
+ * any history at all so far, i.e. pwhistory==NULL
+ */
+ pwhistory = talloc_zero_array(
+ sampass, uchar,
+ pwHistLen*PW_HISTORY_ENTRY_LEN);
+ if (!pwhistory) {
+ return false;
}
+ memcpy(pwhistory, current_history,
+ current_history_len*PW_HISTORY_ENTRY_LEN);
+
+ /*
+ * Make room for the new password in the history list.
+ */
+ if (pwHistLen > 1) {
+ memmove(&pwhistory[PW_HISTORY_ENTRY_LEN], pwhistory,
+ (pwHistLen-1)*PW_HISTORY_ENTRY_LEN );
+ }
+
+ /*
+ * Fill the salt area with 0-s: this indicates that
+ * a plain nt hash is stored in the has area.
+ * The old format was to store a 16 byte salt and
+ * then an md5hash of the nt_hash concatenated with
+ * the salt.
+ */
+ memset(pwhistory, 0, PW_HISTORY_SALT_LEN);
+
+ /*
+ * Store the plain nt hash in the second 16 bytes.
+ * The old format was to store the md5 hash of
+ * the salt+newpw.
+ */
+ memcpy(&pwhistory[PW_HISTORY_SALT_LEN], new_nt, SALTED_MD5_HASH_LEN);
+
+ pdb_set_pw_history(sampass, pwhistory, pwHistLen, PDB_CHANGED);
+
return True;
+
}
/* check for any PDB_SET/CHANGED field and fill the appropriate mask bit */
-uint32 pdb_build_fields_present(struct samu *sampass)
+uint32_t pdb_build_fields_present(struct samu *sampass)
{
/* value set to all for testing */
return 0x00ffffff;
}
+
+/**********************************************************************
+ Helper function to determine for update_sam_account whether
+ we need LDAP modification.
+*********************************************************************/
+
+bool pdb_element_is_changed(const struct samu *sampass,
+ enum pdb_elements element)
+{
+ return IS_SAM_CHANGED(sampass, element);
+}
+
+/**********************************************************************
+ Helper function to determine for update_sam_account whether
+ we need LDAP modification.
+ *********************************************************************/
+
+bool pdb_element_is_set_or_changed(const struct samu *sampass,
+ enum pdb_elements element)
+{
+ return (IS_SAM_SET(sampass, element) ||
+ IS_SAM_CHANGED(sampass, element));
+}