+#define OLD_NTDOMAIN 1
+
/*
Unix SMB/Netbios implementation.
Version 1.9.
extern int DEBUGLEVEL;
extern int Protocol;
+extern struct in_addr ipzero;
/* users from session setup */
static pstring session_users="";
-extern pstring scope;
extern pstring global_myname;
extern fstring global_myworkgroup;
/* get a sort-of random number */
GetTimeOfDay(&tval);
- v1 = (counter++) + getpid() + tval.tv_sec;
- v2 = (counter++) * getpid() + tval.tv_usec;
+ v1 = (counter++) + sys_getpid() + tval.tv_sec;
+ v2 = (counter++) * sys_getpid() + tval.tv_usec;
SIVAL(challenge,0,v1);
SIVAL(challenge,4,v2);
}
/* this holds info on user ids that are already validated for this VC */
-static user_struct *validated_users = NULL;
-static int num_validated_users = 0;
+static user_struct *validated_users;
+static int next_vuid = VUID_OFFSET;
+static int num_validated_vuids;
/****************************************************************************
check if a uid has been validated, and return an pointer to the user_struct
****************************************************************************/
user_struct *get_valid_user_struct(uint16 vuid)
{
- if (vuid == UID_FIELD_INVALID)
- return NULL;
- vuid -= VUID_OFFSET;
- if ((vuid >= (uint16)num_validated_users) ||
- (validated_users[vuid].uid == (uid_t)-1) || (validated_users[vuid].gid == (gid_t)-1))
- return NULL;
- return &validated_users[vuid];
+ user_struct *usp;
+ int count=0;
+
+ if (vuid == UID_FIELD_INVALID)
+ return NULL;
+
+ for (usp=validated_users;usp;usp=usp->next,count++) {
+ if (vuid == usp->vuid) {
+ if (count > 10)
+ DLIST_PROMOTE(validated_users, usp);
+ return usp;
+ }
+ }
+
+ return NULL;
}
/****************************************************************************
****************************************************************************/
void invalidate_vuid(uint16 vuid)
{
- user_struct *vuser = get_valid_user_struct(vuid);
-
- if (vuser == NULL) return;
-
- vuser->uid = (uid_t)-1;
- vuser->gid = (gid_t)-1;
-
- vuser->n_sids = 0;
+ user_struct *vuser = get_valid_user_struct(vuid);
- /* same number of igroups as groups */
- vuser->n_groups = 0;
+ if (vuser == NULL)
+ return;
- if (vuser->groups)
- free((char *)vuser->groups);
+ DLIST_REMOVE(validated_users, vuser);
- if (vuser->sids)
- free((char *)vuser->sids);
-
- vuser->sids = NULL;
- vuser->groups = NULL;
+ safe_free(vuser->groups);
+ delete_nt_token(&vuser->nt_user_token);
+ safe_free(vuser);
+ num_validated_vuids--;
}
-
/****************************************************************************
return a validated username
****************************************************************************/
char *validated_username(uint16 vuid)
{
- user_struct *vuser = get_valid_user_struct(vuid);
- if (vuser == NULL)
- return 0;
- return(vuser->name);
+ user_struct *vuser = get_valid_user_struct(vuid);
+ if (vuser == NULL)
+ return 0;
+ return(vuser->user.unix_name);
+}
+
+/****************************************************************************
+return a validated domain
+****************************************************************************/
+char *validated_domain(uint16 vuid)
+{
+ user_struct *vuser = get_valid_user_struct(vuid);
+ if (vuser == NULL)
+ return 0;
+ return(vuser->user.domain);
}
/****************************************************************************
-Setup the groups a user belongs to.
+ Create the SID list for this user.
****************************************************************************/
-int setup_groups(char *user, uid_t uid, gid_t gid, int *p_ngroups, gid_t **p_groups)
+
+NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups, BOOL is_guest)
{
- int i,ngroups;
- gid_t grp = 0;
- gid_t *groups = NULL;
+ extern DOM_SID global_sid_World;
+ extern DOM_SID global_sid_Network;
+ extern DOM_SID global_sid_Builtin_Guests;
+ extern DOM_SID global_sid_Authenticated_Users;
+ NT_USER_TOKEN *token;
+ DOM_SID *psids;
+ int i, psid_ndx = 0;
+ size_t num_sids = 0;
+ fstring sid_str;
+
+ if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
+ return NULL;
- if (-1 == initgroups(user,gid))
- {
- if (getuid() == 0)
- {
- DEBUG(0,("Unable to initgroups!\n"));
- if (gid < 0 || gid > 16000 || uid < 0 || uid > 16000)
- {
- DEBUG(0,("This is probably a problem with the account %s\n", user));
- }
- }
- return -1;
- }
+ ZERO_STRUCTP(token);
- ngroups = sys_getgroups(0,&grp);
- if (ngroups <= 0)
- {
- ngroups = 32;
+ /* We always have uid/gid plus World and Network and Authenticated Users or Guest SIDs. */
+ num_sids = 5 + ngroups;
+
+ if ((token->user_sids = (DOM_SID *)malloc( num_sids*sizeof(DOM_SID))) == NULL) {
+ free(token);
+ return NULL;
}
- if((groups = (gid_t *)malloc(sizeof(gid_t)*ngroups)) == NULL)
- {
- DEBUG(0,("setup_groups malloc fail !\n"));
- return -1;
+ psids = token->user_sids;
+
+ /*
+ * Note - user SID *MUST* be first in token !
+ * se_access_check depends on this.
+ */
+
+ uid_to_sid( &psids[psid_ndx++], uid);
+
+ /*
+ * Primary group SID is second in token. Convention.
+ */
+
+ gid_to_sid( &psids[psid_ndx++], gid);
+
+ /* Now add the group SIDs. */
+
+ for (i = 0; i < ngroups; i++) {
+ if (groups[i] != gid) {
+ gid_to_sid( &psids[psid_ndx++], groups[i]);
+ }
}
- ngroups = sys_getgroups(ngroups,groups);
+ /*
+ * Finally add the "standard" SIDs.
+ * The only difference between guest and "anonymous" (which we
+ * don't really support) is the addition of Authenticated_Users.
+ */
- (*p_ngroups) = ngroups;
- (*p_groups) = groups;
+ sid_copy( &psids[psid_ndx++], &global_sid_World);
+ sid_copy( &psids[psid_ndx++], &global_sid_Network);
- DEBUG( 3, ( "%s is in %d groups: ", user, ngroups ) );
- for (i = 0; i < ngroups; i++ )
- {
- DEBUG( 3, ( "%s%d", (i ? ", " : ""), (int)groups[i] ) );
+ if (is_guest)
+ sid_copy( &psids[psid_ndx++], &global_sid_Builtin_Guests);
+ else
+ sid_copy( &psids[psid_ndx++], &global_sid_Authenticated_Users);
+
+ token->num_sids = psid_ndx;
+
+ /* Dump list of sids in token */
+
+ for (i = 0; i < token->num_sids; i++) {
+ DEBUG(5, ("user token sid %s\n",
+ sid_to_string(sid_str, &token->user_sids[i])));
}
- DEBUG( 3, ( "\n" ) );
- return 0;
+ return token;
}
-
/****************************************************************************
register a uid/name pair as being valid and that a valid password
has been given. vuid is biased by an offset. This allows us to
tell random client vuid's (normally zero) from valid vuids.
****************************************************************************/
-uint16 register_vuid(uid_t uid,gid_t gid, char *unix_name, char *requested_name, BOOL guest)
+
+uint16 register_vuid(uid_t uid,gid_t gid, char *unix_name, char *requested_name,
+ char *domain,BOOL guest)
{
- user_struct *vuser;
- struct passwd *pwfile; /* for getting real name from passwd file */
+ user_struct *vuser = NULL;
+ struct passwd *pwfile; /* for getting real name from passwd file */
- /* Ensure no vuid gets registered in share level security. */
- if(lp_security() == SEC_SHARE)
- return UID_FIELD_INVALID;
+ /* Ensure no vuid gets registered in share level security. */
+ if(lp_security() == SEC_SHARE)
+ return UID_FIELD_INVALID;
-#if 0
- /*
- * After observing MS-Exchange services writing to a Samba share
- * I belive this code is incorrect. Each service does its own
- * sessionsetup_and_X for the same user, and as each service shuts
- * down, it does a user_logoff_and_X. As we are consolidating multiple
- * sessionsetup_and_X's onto the same vuid here, when the first service
- * shuts down, it invalidates all the open files for the other services.
- * Hence I am removing this code and forcing each sessionsetup_and_X
- * to get a new vuid.
- * Jeremy Allison. (jallison@whistle.com).
- */
+ /* Limit allowed vuids to 16bits - VUID_OFFSET. */
+ if (num_validated_vuids >= 0xFFFF-VUID_OFFSET)
+ return UID_FIELD_INVALID;
- int i;
- for(i = 0; i < num_validated_users; i++) {
- vuser = &validated_users[i];
- if ( vuser->uid == uid )
- return (uint16)(i + VUID_OFFSET); /* User already validated */
- }
-#endif
+ if((vuser = (user_struct *)malloc( sizeof(user_struct) )) == NULL) {
+ DEBUG(0,("Failed to malloc users struct!\n"));
+ return UID_FIELD_INVALID;
+ }
- validated_users = (user_struct *)Realloc(validated_users,
- sizeof(user_struct)*
- (num_validated_users+1));
-
- if (!validated_users)
- {
- DEBUG(0,("Failed to realloc users struct!\n"));
- num_validated_users = 0;
- return UID_FIELD_INVALID;
- }
+ ZERO_STRUCTP(vuser);
- vuser = &validated_users[num_validated_users];
- num_validated_users++;
+ DEBUG(10,("register_vuid: (%u,%u) %s %s %s guest=%d\n", (unsigned int)uid, (unsigned int)gid,
+ unix_name, requested_name, domain, guest ));
- vuser->uid = uid;
- vuser->gid = gid;
- vuser->guest = guest;
- fstrcpy(vuser->name,unix_name);
- fstrcpy(vuser->requested_name,requested_name);
+ /* Allocate a free vuid. Yes this is a linear search... :-) */
+ while( get_valid_user_struct(next_vuid) != NULL ) {
+ next_vuid++;
+ /* Check for vuid wrap. */
+ if (next_vuid == UID_FIELD_INVALID)
+ next_vuid = VUID_OFFSET;
+ }
- vuser->n_sids = 0;
- vuser->sids = NULL;
+ DEBUG(10,("register_vuid: allocated vuid = %u\n", (unsigned int)next_vuid ));
- vuser->n_groups = 0;
- vuser->groups = NULL;
+ vuser->vuid = next_vuid;
+ vuser->uid = uid;
+ vuser->gid = gid;
+ vuser->guest = guest;
+ fstrcpy(vuser->user.unix_name,unix_name);
+ fstrcpy(vuser->user.smb_name,requested_name);
+ fstrcpy(vuser->user.domain,domain);
- /* Find all the groups this uid is in and store them.
- Used by become_user() */
- setup_groups(unix_name,uid,gid,
- &vuser->n_groups,
- &vuser->groups);
+ vuser->n_groups = 0;
+ vuser->groups = NULL;
- DEBUG(3,("uid %d registered to name %s\n",(int)uid,unix_name));
+ /* Find all the groups this uid is in and store them.
+ Used by become_user() */
+ initialise_groups(unix_name, uid, gid);
+ get_current_groups( &vuser->n_groups, &vuser->groups);
- DEBUG(3, ("Clearing default real name\n"));
- fstrcpy(vuser->real_name, "<Full Name>\0");
- if (lp_unix_realname()) {
- if ((pwfile=getpwnam(vuser->name))!= NULL)
- {
- DEBUG(3, ("User name: %s\tReal name: %s\n",vuser->name,pwfile->pw_gecos));
- fstrcpy(vuser->real_name, pwfile->pw_gecos);
- }
- }
+ /* Create an NT_USER_TOKEN struct for this user. */
+ vuser->nt_user_token = create_nt_token(uid,gid, vuser->n_groups, vuser->groups, guest);
+
+ next_vuid++;
+ num_validated_vuids++;
+
+ DLIST_ADD(validated_users, vuser);
+
+ DEBUG(3,("uid %d registered to name %s\n",(int)uid,unix_name));
+
+ DEBUG(3, ("Clearing default real name\n"));
+ fstrcpy(vuser->user.full_name, "<Full Name>");
+ if (lp_unix_realname()) {
+ if ((pwfile=sys_getpwnam(vuser->user.unix_name))!= NULL) {
+ DEBUG(3, ("User name: %s\tReal name: %s\n",vuser->user.unix_name,pwfile->pw_gecos));
+ fstrcpy(vuser->user.full_name, pwfile->pw_gecos);
+ }
+ }
+
+ memset(&vuser->dc, '\0', sizeof(vuser->dc));
- return (uint16)((num_validated_users - 1) + VUID_OFFSET);
+ return vuser->vuid;
}
*****************************************************************************/
static BOOL update_smbpassword_file(char *user, char *password)
{
- struct smb_passwd *smbpw;
- BOOL ret;
-
- become_root(0);
- smbpw = getsmbpwnam(user);
- unbecome_root(0);
+ SAM_ACCOUNT *sampass = NULL;
+ BOOL ret;
- if(smbpw == NULL) {
- DEBUG(0,("getsmbpwnam returned NULL\n"));
+ become_root();
+ sampass = pdb_getsampwnam(user);
+ unbecome_root();
+
+ if(sampass == NULL) {
+ DEBUG(0,("pdb_getsampwnam returned NULL\n"));
return False;
}
-
+
+ /*
+ * Remove the account disabled flag - we are updating the
+ * users password from a login.
+ */
+ pdb_set_acct_ctrl(sampass, pdb_get_acct_ctrl(sampass) & ~ACB_DISABLED);
+
/* Here, the flag is one, because we want to ignore the
XXXXXXX'd out password */
- ret = change_oem_password( smbpw, password, True);
+ ret = change_oem_password( sampass, password, True);
if (ret == False) {
DEBUG(3,("change_oem_password returned False\n"));
}
return ret;
}
-
-
-
-
/****************************************************************************
core of smb password checking routine.
****************************************************************************/
unsigned char p21[21];
unsigned char p24[24];
- if (part_passwd == NULL)
+ if (part_passwd == NULL)
+ {
DEBUG(10,("No password set - allowing access\n"));
- /* No password set - always true ! */
- if (part_passwd == NULL)
+
+ /* No password set - always true ! */
return 1;
+ }
memset(p21,'\0',21);
memcpy(p21,part_passwd,16);
Do a specific test for an smb password being correct, given a smb_password and
the lanman and NT responses.
****************************************************************************/
-
-BOOL smb_password_ok(struct smb_passwd *smb_pass,
+BOOL smb_password_ok(SAM_ACCOUNT *sampass, uchar chal[8],
uchar lm_pass[24], uchar nt_pass[24])
{
uchar challenge[8];
+ char* user_name;
+ BYTE *nt_pw, *lm_pw;
- if (!lm_pass || !smb_pass) return(False);
+ if (!lm_pass || !sampass)
+ return(False);
- DEBUG(4,("Checking SMB password for user %s\n",
- smb_pass->smb_name));
+ user_name = pdb_get_username(sampass);
+
+ DEBUG(4,("Checking SMB password for user %s\n",user_name));
- if(smb_pass->acct_ctrl & ACB_DISABLED) {
- DEBUG(3,("account for user %s was disabled.\n",
- smb_pass->smb_name));
+ if(pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
+ DEBUG(1,("account for user %s was disabled.\n", user_name));
return(False);
}
- if (!last_challenge(challenge)) {
- DEBUG(1,("no challenge done - password failed\n"));
- return False;
+ if (chal == NULL)
+ {
+ DEBUG(5,("use last SMBnegprot challenge\n"));
+ if (!last_challenge(challenge))
+ {
+ DEBUG(1,("no challenge done - password failed\n"));
+ return False;
+ }
+ }
+ else
+ {
+ DEBUG(5,("challenge received\n"));
+ memcpy(challenge, chal, 8);
}
- if ((Protocol >= PROTOCOL_NT1) && (smb_pass->smb_nt_passwd != NULL)) {
+ nt_pw = pdb_get_nt_passwd(sampass);
+
+ if ((Protocol >= PROTOCOL_NT1) && (nt_pw != NULL)) {
/* We have the NT MD4 hash challenge available - see if we can
use it (ie. does it exist in the smbpasswd file).
*/
DEBUG(4,("smb_password_ok: Checking NT MD4 password\n"));
- if (smb_password_check((char *)nt_pass,
- (uchar *)smb_pass->smb_nt_passwd,
- challenge)) {
+ if (smb_password_check((char *)nt_pass, (uchar *)nt_pw, challenge))
+ {
DEBUG(4,("NT MD4 password check succeeded\n"));
return(True);
}
DEBUG(4,("NT MD4 password check failed\n"));
}
- /* Try against the lanman password. smb_pass->smb_passwd == NULL means
- no password, allow access. */
+ /* Try against the lanman password. pdb_get_lanman_passwd(sampass) == NULL
+ means no password, allow access. */
DEBUG(4,("Checking LM MD4 password\n"));
- if((smb_pass->smb_passwd == NULL) &&
- (smb_pass->acct_ctrl & ACB_PWNOTREQ)) {
- DEBUG(4,("no password required for user %s\n",
- smb_pass->smb_name));
+ lm_pw = pdb_get_lanman_passwd(sampass);
+
+ if((lm_pw == NULL) && (pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ))
+ {
+ DEBUG(4,("no password required for user %s\n",user_name));
return True;
}
- if((smb_pass->smb_passwd != NULL) &&
- smb_password_check((char *)lm_pass,
- (uchar *)smb_pass->smb_passwd, challenge)) {
+ if((lm_pw != NULL) && smb_password_check((char *)lm_pass,(uchar *)lm_pw, challenge))
+ {
DEBUG(4,("LM MD4 password check succeeded\n"));
return(True);
}
SMB hash
return True if the password is correct, False otherwise
****************************************************************************/
-BOOL pass_check_smb(char *user, char *domain,
- char *challenge, char *lm_pwd, char *nt_pwd,
- struct passwd *pwd)
+
+BOOL pass_check_smb(char *user, char *domain, uchar *chal,
+ uchar *lm_pwd, uchar *nt_pwd, struct passwd *pwd)
{
struct passwd *pass;
- struct smb_passwd *smb_pass;
+ SAM_ACCOUNT *sampass;
if (!lm_pwd || !nt_pwd)
{
return(False);
}
+ /* FIXME! this code looks to be unnecessary now that the passdb
+ validates that the username exists and has a valid uid */
if (pwd != NULL && user == NULL)
{
pass = (struct passwd *) pwd;
}
else
{
- pass = Get_Pwnam(user,True);
+ /* I don't get this call here. I think it should be moved.
+ Need to check on it. --jerry */
+ pass = smb_getpwnam(user,True);
}
- if (pass != NULL)
+ if (pass == NULL)
{
- DEBUG(3,("Couldn't find user %s\n",user));
+ DEBUG(1,("Couldn't find user '%s' in UNIX password database.\n",user));
return(False);
}
- smb_pass = getsmbpwnam(user);
-
- if (smb_pass != NULL)
+ /* get the account information */
+ sampass = pdb_getsampwnam(user);
+ if (sampass == NULL)
{
- DEBUG(3,("Couldn't find user %s in smb_passwd file.\n", user));
+ DEBUG(1,("Couldn't find user '%s' in passdb file.\n", user));
return(False);
}
/* Quit if the account was disabled. */
- if(smb_pass->acct_ctrl & ACB_DISABLED) {
- DEBUG(3,("account for user %s was disabled.\n", user));
+ if(pdb_get_acct_ctrl(sampass) & ACB_DISABLED) {
+ DEBUG(1,("Account for user '%s' was disabled.\n", user));
return(False);
- }
+ }
- /* Ensure the uid's match */
+ /* Ensure the uid's match
+ FIXME! This also seems unnecessary --jerry */
+#if 0 /* GWC */
if (smb_pass->smb_userid != pass->pw_uid)
{
- DEBUG(3,("Error : UNIX and SMB uids in password files do not match !\n"));
+ DEBUG(0,("Error : UNIX and SMB uids in password files do not match for user '%s'!\n", user));
return(False);
}
+#endif
- if (lm_pwd[0] == '\0' && IS_BITS_SET_ALL(smb_pass->acct_ctrl, ACB_PWNOTREQ) && lp_null_passwords())
+ if (pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ)
{
- DEBUG(3,("account for user %s has no password and null passwords are allowed.\n", smb_pass->smb_name));
- return(True);
+ if (lp_null_passwords())
+ {
+ DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", user));
+ return(True);
+ }
+ else
+ {
+ DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", user));
+ return(False);
+ }
}
- if (smb_password_ok(smb_pass, (uchar *)lm_pwd, (uchar *)nt_pwd))
+ if (smb_password_ok(sampass, chal, lm_pwd, nt_pwd))
{
return(True);
}
- DEBUG(3,("Error smb_password_check failed\n"));
+ DEBUG(2,("pass_check_smb failed - invalid password for user [%s]\n", user));
return False;
}
}
return pass_check_smb(user, global_myworkgroup,
- challenge, password, password, pwd);
+ challenge, (uchar *)password, (uchar *)password, pwd);
}
return pass_check(user, password, pwlen, pwd,
pstring valid, invalid;
BOOL ret;
- StrnCpy(valid, lp_valid_users(snum), sizeof(pstring));
- StrnCpy(invalid, lp_invalid_users(snum), sizeof(pstring));
+ StrnCpy(valid, lp_valid_users(snum), sizeof(pstring)-1);
+ StrnCpy(invalid, lp_invalid_users(snum), sizeof(pstring)-1);
- string_sub(valid,"%S",lp_servicename(snum));
- string_sub(invalid,"%S",lp_servicename(snum));
+ pstring_sub(valid,"%S",lp_servicename(snum));
+ pstring_sub(invalid,"%S",lp_servicename(snum));
ret = !user_in_list(user,invalid);
if (ret && lp_onlyuser(snum)) {
char *user_list = lp_username(snum);
- string_sub(user_list,"%S",lp_servicename(snum));
+ pstring_sub(user_list,"%S",lp_servicename(snum));
ret = user_in_list(user,user_list);
}
static char *validate_group(char *group,char *password,int pwlen,int snum)
{
#ifdef HAVE_NETGROUP
- {
- char *host, *user, *domain;
- setnetgrent(group);
- while (getnetgrent(&host, &user, &domain)) {
- if (user) {
- if (user_ok(user, snum) &&
- password_ok(user,password,pwlen,NULL)) {
- endnetgrent();
- return(user);
+ {
+ char *host, *user, *domain;
+ setnetgrent(group);
+ while (getnetgrent(&host, &user, &domain)) {
+ if (user) {
+ if (user_ok(user, snum) &&
+ password_ok(user,password,pwlen,NULL)) {
+ endnetgrent();
+ return(user);
+ }
+ }
+ }
+ endnetgrent();
}
- }
- }
- endnetgrent();
- }
#endif
-#ifdef HAVE_GETGRNAM
- {
- struct group *gptr = (struct group *)getgrnam(group);
- char **member;
- if (gptr)
- {
- member = gptr->gr_mem;
- while (member && *member)
- {
- static fstring name;
- fstrcpy(name,*member);
- if (user_ok(name,snum) &&
- password_ok(name,password,pwlen,NULL))
- return(&name[0]);
- member++;
- }
-#ifdef GROUP_CHECK_PWENT
+#ifdef HAVE_GETGRENT
{
- struct passwd *pwd;
- static fstring tm;
-
- setpwent ();
- while (pwd = getpwent ()) {
- if (*(pwd->pw_passwd) && pwd->pw_gid == gptr->gr_gid) {
- /* This Entry have PASSWORD and same GID then check pwd */
- if (password_ok(NULL, password, pwlen, pwd)) {
- fstrcpy(tm, pwd->pw_name);
- endpwent ();
- return tm;
- }
- }
- }
- endpwent ();
+ struct group *gptr;
+ setgrent();
+ while ((gptr = (struct group *)getgrent())) {
+ if (strequal(gptr->gr_name,group))
+ break;
+ }
+
+ /*
+ * As user_ok can recurse doing a getgrent(), we must
+ * copy the member list into a pstring on the stack before
+ * use. Bug pointed out by leon@eatworms.swmed.edu.
+ */
+
+ if (gptr) {
+ pstring member_list;
+ char *member;
+ size_t copied_len = 0;
+ int i;
+
+ *member_list = '\0';
+ member = member_list;
+
+ for(i = 0; gptr->gr_mem && gptr->gr_mem[i]; i++) {
+ size_t member_len = strlen(gptr->gr_mem[i]) + 1;
+ if( copied_len + member_len < sizeof(pstring)) {
+
+ DEBUG(10,("validate_group: = gr_mem = %s\n", gptr->gr_mem[i]));
+
+ safe_strcpy(member, gptr->gr_mem[i], sizeof(pstring) - copied_len - 1);
+ copied_len += member_len;
+ member += copied_len;
+ } else {
+ *member = '\0';
+ }
+ }
+
+ endgrent();
+
+ member = member_list;
+ while (*member) {
+ static fstring name;
+ fstrcpy(name,member);
+ if (user_ok(name,snum) &&
+ password_ok(name,password,pwlen,NULL)) {
+ endgrent();
+ return(&name[0]);
+ }
+
+ DEBUG(10,("validate_group = member = %s\n", member));
+
+ member += strlen(member) + 1;
+ }
+ } else {
+ endgrent();
+ return NULL;
+ }
}
-#endif /* GROUP_CHECK_PWENT */
- }
- }
#endif
- return(NULL);
+ return(NULL);
}
/* check for a previously registered guest username */
if (!ok && (vuser != 0) && vuser->guest) {
- if (user_ok(vuser->name,snum) &&
- password_ok(vuser->name, password, pwlen, NULL)) {
- fstrcpy(user, vuser->name);
+ if (user_ok(vuser->user.unix_name,snum) &&
+ password_ok(vuser->user.unix_name, password, pwlen, NULL)) {
+ fstrcpy(user, vuser->user.unix_name);
vuser->guest = False;
DEBUG(3,("ACCEPTED: given password with registered user %s\n", user));
ok = True;
}
/* check for a previously validated username/password pair */
- if (!ok && (!lp_revalidate(snum) || lp_security() > SEC_SHARE) &&
+ if (!ok && (lp_security() > SEC_SHARE) &&
(vuser != 0) && !vuser->guest &&
- user_ok(vuser->name,snum)) {
- fstrcpy(user,vuser->name);
+ user_ok(vuser->user.unix_name,snum)) {
+ fstrcpy(user,vuser->user.unix_name);
*guest = False;
DEBUG(3,("ACCEPTED: validated uid ok as non-guest\n"));
ok = True;
pstring user_list;
StrnCpy(user_list,lp_username(snum),sizeof(pstring));
- string_sub(user_list,"%S",lp_servicename(snum));
+ pstring_sub(user_list,"%S",lp_servicename(snum));
for (auser=strtok(user_list,LIST_SEP);
auser && !ok;
else
DEBUG(0,("Invalid guest account %s??\n",guestname));
*guest = True;
- *force = True;
}
if (ok && !user_ok(user,snum))
****************************************************************************/
static BOOL check_user_equiv(char *user, char *remote, char *equiv_file)
{
- pstring buf;
int plus_allowed = 1;
char *file_host;
char *file_user;
- FILE *fp = fopen(equiv_file, "r");
+ char **lines = file_lines_load(equiv_file, NULL, False);
+ int i;
+
DEBUG(5, ("check_user_equiv %s %s %s\n", user, remote, equiv_file));
- if (! fp) return False;
- while(fgets(buf, sizeof(buf), fp))
- {
+ if (! lines) return False;
+ for (i=0; lines[i]; i++) {
+ char *buf = lines[i];
trim_string(buf," "," ");
if (buf[0] != '#' && buf[0] != '\n')
{
/* a bare plus means everbody allowed */
DEBUG(6, ("check_user_equiv everybody allowed\n"));
- fclose(fp);
+ file_lines_free(lines);
return True;
}
}
/* is it this user */
if (file_user == 0 || strequal(user, file_user))
{
- fclose(fp);
DEBUG(5, ("check_user_equiv matched %s%s %s\n",
(plus ? "+" : "-"), file_host,
(file_user ? file_user : "")));
+ file_lines_free(lines);
return (plus ? True : False);
}
}
}
}
}
- fclose(fp);
+ file_lines_free(lines);
return False;
}
/* note: don't allow hosts.equiv on root */
if (fname && *fname && (pass->pw_uid != 0)) {
- extern int Client;
- if (check_user_equiv(user,client_name(Client),fname))
+ if (check_user_equiv(user,client_name(),fname))
return(True);
}
if (lp_use_rhosts())
{
- char *home = get_home_dir(user);
+ char *home = get_user_home_dir(user);
if (home) {
- extern int Client;
slprintf(rhostsfile, sizeof(rhostsfile)-1, "%s/.rhosts", home);
- if (check_user_equiv(user,client_name(Client),rhostsfile))
+ if (check_user_equiv(user,client_name(),rhostsfile))
return(True);
}
}
/****************************************************************************
-return the client state structure
+ Return the client state structure.
****************************************************************************/
+
struct cli_state *server_client(void)
{
static struct cli_state pw_cli;
}
/****************************************************************************
-support for server level security
+ Support for server level security.
****************************************************************************/
+
struct cli_state *server_cryptkey(void)
{
struct cli_state *cli;
fstring desthost;
struct in_addr dest_ip;
- extern fstring local_machine;
- char *p;
- BOOL connected_ok = False;
- struct nmb_name calling, called;
+ char *p, *pserver;
+ BOOL connected_ok = False;
cli = server_client();
if (!cli_initialise(cli))
return NULL;
- p = lp_passwordserver();
- while(p && next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
+ pserver = strdup(lp_passwordserver());
+ p = pserver;
+
+ while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
standard_sub_basic(desthost);
strupper(desthost);
- if(!resolve_name( desthost, &dest_ip, 0x20)) {
- DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
- continue;
- }
+ if(!resolve_name( desthost, &dest_ip, 0x20)) {
+ DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
+ continue;
+ }
if (ismyip(dest_ip)) {
DEBUG(1,("Password server loop - disabling password server %s\n",desthost));
}
}
+ free(pserver);
+
if (!connected_ok) {
DEBUG(0,("password server not available\n"));
cli_shutdown(cli);
return NULL;
}
- make_nmb_name(&calling, local_machine, 0x0 , scope);
- make_nmb_name(&called , desthost , 0x20, scope);
-
- if (!cli_session_request(cli, &calling, &called))
- {
- DEBUG(1,("%s rejected the session\n",desthost));
- cli_shutdown(cli);
+ if (!attempt_netbios_session_request(cli, global_myname, desthost, &dest_ip))
return NULL;
- }
DEBUG(3,("got session\n"));
}
/****************************************************************************
-validate a password with the password server
+ Validate a password with the password server.
****************************************************************************/
+
BOOL server_validate(char *user, char *domain,
char *pass, int passlen,
char *ntpass, int ntpasslen)
{
- struct cli_state *cli;
- extern fstring local_machine;
- static unsigned char badpass[24];
- cli = server_client();
+ struct cli_state *cli;
+ static unsigned char badpass[24];
+ static BOOL tested_password_server = False;
+ static BOOL bad_password_server = False;
- if (!cli->initialised) {
- DEBUG(1,("password server %s is not connected\n", cli->desthost));
- return(False);
- }
+ cli = server_client();
- if(badpass[0] == 0) {
- memset(badpass, 0x1f, sizeof(badpass));
- }
+ if (!cli->initialised) {
+ DEBUG(1,("password server %s is not connected\n", cli->desthost));
+ return(False);
+ }
- if((passlen == sizeof(badpass)) && !memcmp(badpass, pass, passlen)) {
- /* Very unlikely, our random bad password is the same as the users
- password. */
- memset(badpass, badpass[0]+1, sizeof(badpass));
- }
+ if(badpass[0] == 0)
+ memset(badpass, 0x1f, sizeof(badpass));
- /*
- * Attempt a session setup with a totally incorrect password.
- * If this succeeds with the guest bit *NOT* set then the password
- * server is broken and is not correctly setting the guest bit. We
- * need to detect this as some versions of NT4.x are broken. JRA.
- */
+ if((passlen == sizeof(badpass)) && !memcmp(badpass, pass, passlen)) {
+ /*
+ * Very unlikely, our random bad password is the same as the users
+ * password. */
+ memset(badpass, badpass[0]+1, sizeof(badpass));
+ }
- if (cli_session_setup(cli, user, (char *)badpass, sizeof(badpass),
+ /*
+ * Attempt a session setup with a totally incorrect password.
+ * If this succeeds with the guest bit *NOT* set then the password
+ * server is broken and is not correctly setting the guest bit. We
+ * need to detect this as some versions of NT4.x are broken. JRA.
+ */
+
+ if(!tested_password_server) {
+ if (cli_session_setup(cli, user, (char *)badpass, sizeof(badpass),
(char *)badpass, sizeof(badpass), domain)) {
- if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
- DEBUG(0,("server_validate: password server %s allows users as non-guest \
+
+ /*
+ * We connected to the password server so we
+ * can say we've tested it.
+ */
+ tested_password_server = True;
+
+ if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
+ DEBUG(0,("server_validate: password server %s allows users as non-guest \
with a bad password.\n", cli->desthost));
- DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
+ DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
use this machine as the password server.\n"));
- cli_ulogoff(cli);
- return False;
- }
- cli_ulogoff(cli);
- }
+ cli_ulogoff(cli);
/*
- * Now we know the password server will correctly set the guest bit, or is
- * not guest enabled, we can try with the real password.
+ * Password server has the bug.
*/
+ bad_password_server = True;
+ return False;
+ }
+ cli_ulogoff(cli);
+ }
+ } else {
- if (!cli_session_setup(cli, user, pass, passlen, ntpass, ntpasslen, domain)) {
- DEBUG(1,("password server %s rejected the password\n", cli->desthost));
- return False;
- }
+ /*
+ * We have already tested the password server.
+ * Fail immediately if it has the bug.
+ */
- /* if logged in as guest then reject */
- if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
- DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
- cli_ulogoff(cli);
- return(False);
- }
+ if(bad_password_server) {
+ DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
+with a bad password.\n", cli->desthost));
+ DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
+use this machine as the password server.\n"));
+ return False;
+ }
+ }
- /*
- * This patch from Rob Nielsen <ran@adc.com> makes doing
- * the NetWksaUserLogon a dynamic, rather than compile-time
- * parameter, defaulting to on. This is somewhat dangerous
- * as it allows people to turn off this neccessary check,
- * but so many people have had problems with this that I
- * think it is a neccessary change. JRA.
- */
+ /*
+ * Now we know the password server will correctly set the guest bit, or is
+ * not guest enabled, we can try with the real password.
+ */
+
+ if (!cli_session_setup(cli, user, pass, passlen, ntpass, ntpasslen, domain)) {
+ DEBUG(1,("password server %s rejected the password\n", cli->desthost));
+ return False;
+ }
+
+ /* if logged in as guest then reject */
+ if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
+ DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
+ cli_ulogoff(cli);
+ return(False);
+ }
- if (lp_net_wksta_user_logon()) {
- DEBUG(3,("trying NetWkstaUserLogon with password server %s\n", cli->desthost));
+ cli_ulogoff(cli);
- if (!cli_send_tconX(cli, "IPC$", "IPC", "", 1)) {
- DEBUG(0,("password server %s refused IPC$ connect\n", cli->desthost));
- cli_ulogoff(cli);
- return False;
- }
+ return(True);
+}
- if (!cli_NetWkstaUserLogon(cli,user,local_machine)) {
- DEBUG(0,("password server %s failed NetWkstaUserLogon\n", cli->desthost));
- cli_tdis(cli);
- cli_ulogoff(cli);
- return False;
- }
+/***********************************************************************
+ Connect to a remote machine for domain security authentication
+ given a name or IP address.
+************************************************************************/
- if (cli->privilages == 0) {
- DEBUG(0,("password server %s gave guest privilages\n", cli->desthost));
- cli_tdis(cli);
- cli_ulogoff(cli);
- return False;
- }
+static BOOL connect_to_domain_password_server(struct cli_state *pcli, char *remote_machine,
+ unsigned char *trust_passwd)
+{
+ struct in_addr dest_ip;
- if (!strequal(cli->eff_name, user)) {
- DEBUG(0,("password server %s gave different username %s\n",
- cli->desthost,
- cli->eff_name));
- cli_tdis(cli);
- cli_ulogoff(cli);
- return False;
+ if(cli_initialise(pcli) == False) {
+ DEBUG(0,("connect_to_domain_password_server: unable to initialize client connection.\n"));
+ return False;
+ }
+
+ standard_sub_basic(remote_machine);
+ strupper(remote_machine);
+
+ if(!resolve_name( remote_machine, &dest_ip, 0x20)) {
+ DEBUG(1,("connect_to_domain_password_server: Can't resolve address for %s\n", remote_machine));
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ if (ismyip(dest_ip)) {
+ DEBUG(1,("connect_to_domain_password_server: Password server loop - not using password server %s\n",
+ remote_machine));
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ if (!cli_connect(pcli, remote_machine, &dest_ip)) {
+ DEBUG(0,("connect_to_domain_password_server: unable to connect to SMB server on \
+machine %s. Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ if (!attempt_netbios_session_request(pcli, global_myname, remote_machine, &dest_ip)) {
+ DEBUG(0,("connect_to_password_server: machine %s rejected the NetBIOS \
+session request. Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
+ return False;
+ }
+
+ pcli->protocol = PROTOCOL_NT1;
+
+ if (!cli_negprot(pcli)) {
+ DEBUG(0,("connect_to_domain_password_server: machine %s rejected the negotiate protocol. \
+Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ if (pcli->protocol != PROTOCOL_NT1) {
+ DEBUG(0,("connect_to_domain_password_server: machine %s didn't negotiate NT protocol.\n",
+ remote_machine));
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ /*
+ * Do an anonymous session setup.
+ */
+
+ if (!cli_session_setup(pcli, "", "", 0, "", 0, "")) {
+ DEBUG(0,("connect_to_domain_password_server: machine %s rejected the session setup. \
+Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ if (!(pcli->sec_mode & 1)) {
+ DEBUG(1,("connect_to_domain_password_server: machine %s isn't in user level security mode\n",
+ remote_machine));
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ if (!cli_send_tconX(pcli, "IPC$", "IPC", "", 1)) {
+ DEBUG(0,("connect_to_domain_password_server: machine %s rejected the tconX on the IPC$ share. \
+Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ /*
+ * We now have an anonymous connection to IPC$ on the domain password server.
+ */
+
+ /*
+ * Even if the connect succeeds we need to setup the netlogon
+ * pipe here. We do this as we may just have changed the domain
+ * account password on the PDC and yet we may be talking to
+ * a BDC that doesn't have this replicated yet. In this case
+ * a successful connect to a DC needs to take the netlogon connect
+ * into account also. This patch from "Bjart Kvarme" <bjart.kvarme@usit.uio.no>.
+ */
+
+ if(cli_nt_session_open(pcli, PIPE_NETLOGON) == False) {
+ DEBUG(0,("connect_to_domain_password_server: unable to open the domain client session to \
+machine %s. Error was : %s.\n", remote_machine, cli_errstr(pcli)));
+ cli_nt_session_close(pcli);
+ cli_ulogoff(pcli);
+ cli_shutdown(pcli);
+ return False;
+ }
+
+ if (cli_nt_setup_creds(pcli, trust_passwd) == False) {
+ DEBUG(0,("connect_to_domain_password_server: unable to setup the PDC credentials to machine \
+%s. Error was : %s.\n", remote_machine, cli_errstr(pcli)));
+ cli_nt_session_close(pcli);
+ cli_ulogoff(pcli);
+ cli_shutdown(pcli);
+ return(False);
+ }
+
+ return True;
+}
+
+/***********************************************************************
+ Utility function to attempt a connection to an IP address of a DC.
+************************************************************************/
+
+static BOOL attempt_connect_to_dc(struct cli_state *pcli, struct in_addr *ip, unsigned char *trust_passwd)
+{
+ fstring dc_name;
+
+ /*
+ * Ignore addresses we have already tried.
+ */
+
+ if (ip_equal(ipzero, *ip))
+ return False;
+
+ if (!lookup_pdc_name(global_myname, lp_workgroup(), ip, dc_name))
+ return False;
+
+ return connect_to_domain_password_server(pcli, dc_name, trust_passwd);
+}
+
+
+
+/***********************************************************************
+ We have been asked to dynamcially determine the IP addresses of
+ the PDC and BDC's for this DOMAIN, and query them in turn.
+************************************************************************/
+static BOOL find_connect_pdc(struct cli_state *pcli, unsigned char *trust_passwd, time_t last_change_time)
+{
+ struct in_addr *ip_list = NULL;
+ int count = 0;
+ int i;
+ BOOL connected_ok = False;
+ time_t time_now = time(NULL);
+ BOOL use_pdc_only = False;
+
+ /*
+ * If the time the machine password has changed
+ * was less than an hour ago then we need to contact
+ * the PDC only, as we cannot be sure domain replication
+ * has yet taken place. Bug found by Gerald (way to go
+ * Gerald !). JRA.
+ */
+
+ if (time_now - last_change_time < 3600)
+ use_pdc_only = True;
+
+ if (!get_dc_list(use_pdc_only, lp_workgroup(), &ip_list, &count))
+ return False;
+
+ /*
+ * Firstly try and contact a PDC/BDC who has the same
+ * network address as any of our interfaces.
+ */
+ for(i = 0; i < count; i++) {
+ if(!is_local_net(ip_list[i]))
+ continue;
+
+ if((connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
+ break;
+
+ ip_list[i] = ipzero; /* Tried and failed. */
+ }
+
+ /*
+ * Secondly try and contact a random PDC/BDC.
+ */
+ if(!connected_ok) {
+ i = (sys_random() % count);
+
+ if (!(connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
+ ip_list[i] = ipzero; /* Tried and failed. */
+ }
+
+ /*
+ * Finally go through the IP list in turn, ignoring any addresses
+ * we have already tried.
+ */
+ if(!connected_ok) {
+ /*
+ * Try and connect to any of the other IP addresses in the PDC/BDC list.
+ * Note that from a WINS server the #1 IP address is the PDC.
+ */
+ for(i = 0; i < count; i++) {
+ if((connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
+ break;
}
- cli_tdis(cli);
}
- else {
- DEBUG(3,("skipping NetWkstaUserLogon with password server %s\n", cli->desthost));
- }
- DEBUG(3,("password server %s accepted the password\n", cli->desthost));
+ if(ip_list != NULL)
+ free((char *)ip_list);
- cli_ulogoff(cli);
- return(True);
+ return connected_ok;
}
+
+
/***********************************************************************
Do the same as security=server, but using NT Domain calls and a session
key from the machine password.
BOOL domain_client_validate( char *user, char *domain,
char *smb_apasswd, int smb_apasslen,
- char *smb_ntpasswd, int smb_ntpasslen)
+ char *smb_ntpasswd, int smb_ntpasslen,
+ BOOL *user_exists)
{
unsigned char local_challenge[8];
unsigned char local_lm_response[24];
- unsigned char local_nt_reponse[24];
+ unsigned char local_nt_response[24];
unsigned char trust_passwd[16];
fstring remote_machine;
- char *p;
- struct in_addr dest_ip;
+ char *p, *pserver;
NET_ID_INFO_CTR ctr;
NET_USER_INFO_3 info3;
struct cli_state cli;
uint32 smb_uid_low;
BOOL connected_ok = False;
- struct nmb_name calling, called;
+ time_t last_change_time;
+ if(user_exists != NULL)
+ *user_exists = True; /* Only set false on a very specific error. */
+
/*
* Check that the requested domain is not our own machine name.
* If it is, we should never check the PDC here, we use our own local
DEBUG(3,("domain_client_validate: User passwords not in encrypted format.\n"));
generate_random_buffer( local_challenge, 8, False);
SMBencrypt( (uchar *)smb_apasswd, local_challenge, local_lm_response);
- SMBNTencrypt((uchar *)smb_ntpasswd, local_challenge, local_nt_reponse);
+ SMBNTencrypt((uchar *)smb_ntpasswd, local_challenge, local_nt_response);
smb_apasslen = 24;
smb_ntpasslen = 24;
smb_apasswd = (char *)local_lm_response;
- smb_ntpasswd = (char *)local_nt_reponse;
+ smb_ntpasswd = (char *)local_nt_response;
} else {
/*
}
/*
- * Get the machine account password.
+ * Get the machine account password for our primary domain
*/
- if (!trust_get_passwd( trust_passwd, global_myworkgroup, global_myname))
+ if (!secrets_fetch_trust_account_password(lp_workgroup(), trust_passwd, &last_change_time))
{
- return False;
+ DEBUG(0, ("domain_client_validate: could not fetch trust account password for domain %s\n", lp_workgroup()));
+ return False;
}
/*
ZERO_STRUCT(cli);
- if(cli_initialise(&cli) == False) {
- DEBUG(0,("domain_client_validate: unable to initialize client connection.\n"));
- return False;
- }
-
/*
* Treat each name in the 'password server =' line as a potential
* PDC/BDC. Contact each in turn and try and authenticate.
*/
- p = lp_passwordserver();
- while(p && next_token(&p,remote_machine,LIST_SEP,sizeof(remote_machine))) {
+ pserver = lp_passwordserver();
+ if (! *pserver) pserver = "*";
+ p = pserver;
- standard_sub_basic(remote_machine);
- strupper(remote_machine);
-
- if(!resolve_name( remote_machine, &dest_ip, 0x20)) {
- DEBUG(1,("domain_client_validate: Can't resolve address for %s\n", remote_machine));
- continue;
- }
-
- if (ismyip(dest_ip)) {
- DEBUG(1,("domain_client_validate: Password server loop - not using password server %s\n",remote_machine));
- continue;
- }
-
- if (!cli_connect(&cli, remote_machine, &dest_ip)) {
- DEBUG(0,("domain_client_validate: unable to connect to SMB server on \
-machine %s. Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- continue;
- }
-
- make_nmb_name(&calling, global_myname , 0x0 , scope);
- make_nmb_name(&called , remote_machine, 0x20, scope);
-
- if (!cli_session_request(&cli, &calling, &called))
- {
- DEBUG(0,("domain_client_validate: machine %s rejected the session setup. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- cli.protocol = PROTOCOL_NT1;
-
- if (!cli_negprot(&cli)) {
- DEBUG(0,("domain_client_validate: machine %s rejected the negotiate protocol. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- if (cli.protocol != PROTOCOL_NT1) {
- DEBUG(0,("domain_client_validate: machine %s didn't negotiate NT protocol.\n",
- remote_machine));
- cli_shutdown(&cli);
- continue;
- }
-
- /*
- * Do an anonymous session setup.
- */
-
- if (!cli_session_setup(&cli, "", "", 0, "", 0, "")) {
- DEBUG(0,("domain_client_validate: machine %s rejected the session setup. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- if (!(cli.sec_mode & 1)) {
- DEBUG(1,("domain_client_validate: machine %s isn't in user level security mode\n",
- remote_machine));
- cli_shutdown(&cli);
- continue;
- }
-
- if (!cli_send_tconX(&cli, "IPC$", "IPC", "", 1)) {
- DEBUG(0,("domain_client_validate: machine %s rejected the tconX on the IPC$ share. \
-Error was : %s.\n", remote_machine, cli_errstr(&cli) ));
- cli_shutdown(&cli);
- continue;
- }
-
- /*
- * We have an anonymous connection to IPC$.
- */
- connected_ok = True;
- break;
+ while (!connected_ok &&
+ next_token(&p,remote_machine,LIST_SEP,sizeof(remote_machine))) {
+ if(strequal(remote_machine, "*")) {
+ connected_ok = find_connect_pdc(&cli, trust_passwd, last_change_time);
+ } else {
+ connected_ok = connect_to_domain_password_server(&cli, remote_machine, trust_passwd);
+ }
}
if (!connected_ok) {
return False;
}
- /*
- * Ok - we have an anonymous connection to the IPC$ share.
- * Now start the NT Domain stuff :-).
- */
-
- if(cli_nt_session_open(&cli, PIPE_NETLOGON) == False) {
- DEBUG(0,("domain_client_validate: unable to open the domain client session to \
-machine %s. Error was : %s.\n", remote_machine, cli_errstr(&cli)));
- cli_nt_session_close(&cli);
- cli_ulogoff(&cli);
- cli_shutdown(&cli);
- return False;
- }
-
- if(cli_nt_setup_creds(&cli, trust_passwd) == False) {
- DEBUG(0,("domain_client_validate: unable to setup the PDC credentials to machine \
-%s. Error was : %s.\n", remote_machine, cli_errstr(&cli)));
- cli_nt_session_close(&cli);
- cli_ulogoff(&cli);
- cli_shutdown(&cli);
- return False;
- }
-
/* We really don't care what LUID we give the user. */
generate_random_buffer( (unsigned char *)&smb_uid_low, 4, False);
+ ZERO_STRUCT(info3);
+
if(cli_nt_login_network(&cli, domain, user, smb_uid_low, (char *)local_challenge,
((smb_apasslen != 0) ? smb_apasswd : NULL),
((smb_ntpasslen != 0) ? smb_ntpasswd : NULL),
&ctr, &info3) == False) {
+ uint32 nt_rpc_err;
+
+ cli_error(&cli, NULL, NULL, &nt_rpc_err);
DEBUG(0,("domain_client_validate: unable to validate password for user %s in domain \
%s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli)));
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
+
+ if((nt_rpc_err == NT_STATUS_NO_SUCH_USER) && (user_exists != NULL))
+ *user_exists = False;
+
return False;
}
}
#endif /* 0 */
+ /* Note - once the cli stream is shutdown the mem_ctx used
+ to allocate the other_sids and gids structures has been deleted - so
+ these pointers are no longer valid..... */
+
cli_nt_session_close(&cli);
cli_ulogoff(&cli);
cli_shutdown(&cli);
return True;
}
+
+#undef OLD_NTDOMAIN
git.samba.org / ira / wip.git / blobdiff