This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_AUTH
+/****************************************************************************
+ Ensure primary group SID is always at position 0 in a
+ auth_serversupplied_info struct.
+****************************************************************************/
+
+static void sort_sid_array_for_smbd(auth_serversupplied_info *result,
+ const DOM_SID *pgroup_sid)
+{
+ unsigned int i;
+
+ if (!result->sids) {
+ return;
+ }
+
+ if (sid_compare(&result->sids[0], pgroup_sid)==0) {
+ return;
+ }
+
+ for (i = 1; i < result->num_sids; i++) {
+ if (sid_compare(pgroup_sid,
+ &result->sids[i]) == 0) {
+ sid_copy(&result->sids[i], &result->sids[0]);
+ sid_copy(&result->sids[0], pgroup_sid);
+ return;
+ }
+ }
+}
+
/****************************************************************************
Create a UNIX user on demand.
****************************************************************************/
static int smb_create_user(const char *domain, const char *unix_username, const char *homedir)
{
- pstring add_script;
+ TALLOC_CTX *ctx = talloc_tos();
+ char *add_script;
int ret;
- pstrcpy(add_script, lp_adduser_script());
- if (! *add_script)
+ add_script = talloc_strdup(ctx, lp_adduser_script());
+ if (!add_script || !*add_script) {
+ return -1;
+ }
+ add_script = talloc_all_string_sub(ctx,
+ add_script,
+ "%u",
+ unix_username);
+ if (!add_script) {
return -1;
- all_string_sub(add_script, "%u", unix_username, sizeof(pstring));
- if (domain)
- all_string_sub(add_script, "%D", domain, sizeof(pstring));
- if (homedir)
- all_string_sub(add_script, "%H", homedir, sizeof(pstring));
+ }
+ if (domain) {
+ add_script = talloc_all_string_sub(ctx,
+ add_script,
+ "%D",
+ domain);
+ if (!add_script) {
+ return -1;
+ }
+ }
+ if (homedir) {
+ add_script = talloc_all_string_sub(ctx,
+ add_script,
+ "%H",
+ homedir);
+ if (!add_script) {
+ return -1;
+ }
+ }
ret = smbrun(add_script,NULL);
flush_pwnam_cache();
- DEBUG(ret ? 0 : 3,("smb_create_user: Running the command `%s' gave %d\n",add_script,ret));
+ DEBUG(ret ? 0 : 3,
+ ("smb_create_user: Running the command `%s' gave %d\n",
+ add_script,ret));
return ret;
}
Create an auth_usersupplied_data structure
****************************************************************************/
-static NTSTATUS make_user_info(auth_usersupplied_info **user_info,
- const char *smb_name,
+static NTSTATUS make_user_info(auth_usersupplied_info **user_info,
+ const char *smb_name,
const char *internal_username,
- const char *client_domain,
+ const char *client_domain,
const char *domain,
- const char *wksta_name,
+ const char *wksta_name,
DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
- DATA_BLOB *plaintext,
- BOOL encrypted)
+ DATA_BLOB *plaintext,
+ bool encrypted)
{
DEBUG(5,("attempting to make a user_info for %s (%s)\n", internal_username, smb_name));
DATA_BLOB *lm_pwd, DATA_BLOB *nt_pwd,
DATA_BLOB *lm_interactive_pwd, DATA_BLOB *nt_interactive_pwd,
DATA_BLOB *plaintext,
- BOOL encrypted)
+ bool encrypted)
{
const char *domain;
NTSTATUS result;
- BOOL was_mapped;
+ bool was_mapped;
fstring internal_username;
fstrcpy(internal_username, smb_name);
was_mapped = map_username(internal_username);
Decrypt and encrypt the passwords.
****************************************************************************/
-BOOL make_user_info_netlogon_network(auth_usersupplied_info **user_info,
+bool make_user_info_netlogon_network(auth_usersupplied_info **user_info,
const char *smb_name,
const char *client_domain,
const char *wksta_name,
const uchar *nt_network_pwd,
int nt_pwd_len)
{
- BOOL ret;
+ bool ret;
NTSTATUS status;
DATA_BLOB lm_blob = data_blob(lm_network_pwd, lm_pwd_len);
DATA_BLOB nt_blob = data_blob(nt_network_pwd, nt_pwd_len);
Decrypt and encrypt the passwords.
****************************************************************************/
-BOOL make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
+bool make_user_info_netlogon_interactive(auth_usersupplied_info **user_info,
const char *smb_name,
const char *client_domain,
const char *wksta_name,
ZERO_STRUCT(key);
{
- BOOL ret;
+ bool ret;
NTSTATUS nt_status;
DATA_BLOB local_lm_blob;
DATA_BLOB local_nt_blob;
Create an auth_usersupplied_data structure
****************************************************************************/
-BOOL make_user_info_for_reply(auth_usersupplied_info **user_info,
+bool make_user_info_for_reply(auth_usersupplied_info **user_info,
const char *smb_name,
const char *client_domain,
const uint8 chal[8],
/* We can't do an NT hash here, as the password needs to be
case insensitive */
- local_nt_blob = data_blob(NULL, 0);
+ local_nt_blob = data_blob_null;
} else {
- local_lm_blob = data_blob(NULL, 0);
- local_nt_blob = data_blob(NULL, 0);
+ local_lm_blob = data_blob_null;
+ local_nt_blob = data_blob_null;
}
ret = make_user_info_map(
Create a guest user_info blob, for anonymous authenticaion.
****************************************************************************/
-BOOL make_user_info_guest(auth_usersupplied_info **user_info)
+bool make_user_info_guest(auth_usersupplied_info **user_info)
{
NTSTATUS nt_status;
return NT_STATUS_IS_OK(nt_status) ? True : False;
}
-/****************************************************************************
- prints a NT_USER_TOKEN to debug output.
-****************************************************************************/
-
-void debug_nt_user_token(int dbg_class, int dbg_lev, NT_USER_TOKEN *token)
-{
- size_t i;
-
- if (!token) {
- DEBUGC(dbg_class, dbg_lev, ("NT user token: (NULL)\n"));
- return;
- }
-
- DEBUGC(dbg_class, dbg_lev,
- ("NT user token of user %s\n",
- sid_string_static(&token->user_sids[0]) ));
- DEBUGADDC(dbg_class, dbg_lev,
- ("contains %lu SIDs\n", (unsigned long)token->num_sids));
- for (i = 0; i < token->num_sids; i++)
- DEBUGADDC(dbg_class, dbg_lev,
- ("SID[%3lu]: %s\n", (unsigned long)i,
- sid_string_static(&token->user_sids[i])));
-
- dump_se_priv( dbg_class, dbg_lev, &token->privileges );
-}
-
-/****************************************************************************
- prints a UNIX 'token' to debug output.
-****************************************************************************/
-
-void debug_unix_user_token(int dbg_class, int dbg_lev, uid_t uid, gid_t gid,
- int n_groups, gid_t *groups)
-{
- int i;
- DEBUGC(dbg_class, dbg_lev,
- ("UNIX token of user %ld\n", (long int)uid));
-
- DEBUGADDC(dbg_class, dbg_lev,
- ("Primary group is %ld and contains %i supplementary "
- "groups\n", (long int)gid, n_groups));
- for (i = 0; i < n_groups; i++)
- DEBUGADDC(dbg_class, dbg_lev, ("Group[%3i]: %ld\n", i,
- (long int)groups[i]));
-}
-
static int server_info_dtor(auth_serversupplied_info *server_info)
{
TALLOC_FREE(server_info->sam_account);
which may save us from giving away root access if there
is a bug in allocating these fields. */
- result->uid = -1;
- result->gid = -1;
+ result->utok.uid = -1;
+ result->utok.gid = -1;
return result;
}
+static char *sanitize_username(TALLOC_CTX *mem_ctx, const char *username)
+{
+ fstring tmp;
+
+ alpha_strcpy(tmp, username, ". _-$", sizeof(tmp));
+ return talloc_strdup(mem_ctx, tmp);
+}
+
+/***************************************************************************
+ Is the incoming username our own machine account ?
+ If so, the connection is almost certainly from winbindd.
+***************************************************************************/
+
+static bool is_our_machine_account(const char *username)
+{
+ bool ret;
+ char *truncname = NULL;
+ size_t ulen = strlen(username);
+
+ if (ulen == 0 || username[ulen-1] != '$') {
+ return false;
+ }
+ truncname = SMB_STRDUP(username);
+ if (!truncname) {
+ return false;
+ }
+ truncname[ulen-1] = '\0';
+ ret = strequal(truncname, global_myname());
+ SAFE_FREE(truncname);
+ return ret;
+}
+
/***************************************************************************
Make (and fill) a user_info struct from a struct samu
***************************************************************************/
-NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
+NTSTATUS make_server_info_sam(auth_serversupplied_info **server_info,
struct samu *sampass)
{
- NTSTATUS status;
struct passwd *pwd;
gid_t *gids;
auth_serversupplied_info *result;
int i;
size_t num_gids;
DOM_SID unix_group_sid;
-
+ const char *username = pdb_get_username(sampass);
+ NTSTATUS status;
if ( !(result = make_server_info(NULL)) ) {
return NT_STATUS_NO_MEMORY;
}
- if ( !(pwd = getpwnam_alloc(result, pdb_get_username(sampass))) ) {
+ if ( !(pwd = getpwnam_alloc(result, username)) ) {
DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
pdb_get_username(sampass)));
TALLOC_FREE(result);
result->unix_name = pwd->pw_name;
/* Ensure that we keep pwd->pw_name, because we will free pwd below */
talloc_steal(result, pwd->pw_name);
- result->gid = pwd->pw_gid;
- result->uid = pwd->pw_uid;
-
+ result->utok.gid = pwd->pw_gid;
+ result->utok.uid = pwd->pw_uid;
+
TALLOC_FREE(pwd);
- status = pdb_enum_group_memberships(result, sampass,
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
+ if (result->sanitized_username == NULL) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (IS_DC && is_our_machine_account(username)) {
+ /*
+ * Ensure for a connection from our own
+ * machine account (from winbindd on a DC)
+ * there are no supplementary groups.
+ * Prevents loops in calling gid_to_sid().
+ */
+ result->sids = NULL;
+ gids = NULL;
+ result->num_sids = 0;
+
+ /*
+ * This is a hack of monstrous proportions.
+ * If we know it's winbindd talking to us,
+ * we know we must never recurse into it,
+ * so turn off contacting winbindd for this
+ * entire process. This will get fixed when
+ * winbindd doesn't need to talk to smbd on
+ * a PDC. JRA.
+ */
+
+ (void)winbind_off();
+
+ DEBUG(10, ("make_server_info_sam: our machine account %s "
+ "setting supplementary group list empty and "
+ "turning off winbindd requests.\n",
+ username));
+ } else {
+ status = pdb_enum_group_memberships(result, sampass,
&result->sids, &gids,
&result->num_sids);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
- nt_errstr(status)));
- result->sam_account = NULL; /* Don't free on error exit. */
- TALLOC_FREE(result);
- return status;
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(10, ("pdb_enum_group_memberships failed: %s\n",
+ nt_errstr(status)));
+ result->sam_account = NULL; /* Don't free on error exit. */
+ TALLOC_FREE(result);
+ return status;
+ }
}
-
+
/* Add the "Unix Group" SID for each gid to catch mapped groups
and their Unix equivalent. This is to solve the backwards
compatibility problem of 'valid users = +ntadmin' where
"for gid %d!\n", gids[i]));
continue;
}
- if (!add_sid_to_array_unique( result, &unix_group_sid,
- &result->sids, &result->num_sids )) {
+ status = add_sid_to_array_unique(result, &unix_group_sid,
+ &result->sids,
+ &result->num_sids);
+ if (!NT_STATUS_IS_OK(status)) {
result->sam_account = NULL; /* Don't free on error exit. */
TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
+ return status;
}
}
return NT_STATUS_OK;
}
-static NTSTATUS log_nt_token(TALLOC_CTX *tmp_ctx, NT_USER_TOKEN *token)
+static NTSTATUS log_nt_token(NT_USER_TOKEN *token)
{
+ TALLOC_CTX *frame = talloc_stackframe();
char *command;
char *group_sidstr;
size_t i;
if ((lp_log_nt_token_command() == NULL) ||
(strlen(lp_log_nt_token_command()) == 0)) {
+ TALLOC_FREE(frame);
return NT_STATUS_OK;
}
- group_sidstr = talloc_strdup(tmp_ctx, "");
+ group_sidstr = talloc_strdup(frame, "");
for (i=1; i<token->num_sids; i++) {
group_sidstr = talloc_asprintf(
- tmp_ctx, "%s %s", group_sidstr,
- sid_string_static(&token->user_sids[i]));
+ frame, "%s %s", group_sidstr,
+ sid_string_talloc(frame, &token->user_sids[i]));
}
command = talloc_string_sub(
- tmp_ctx, lp_log_nt_token_command(),
- "%s", sid_string_static(&token->user_sids[0]));
- command = talloc_string_sub(tmp_ctx, command, "%t", group_sidstr);
+ frame, lp_log_nt_token_command(),
+ "%s", sid_string_talloc(frame, &token->user_sids[0]));
+ command = talloc_string_sub(frame, command, "%t", group_sidstr);
if (command == NULL) {
+ TALLOC_FREE(frame);
return NT_STATUS_NO_MEMORY;
}
DEBUG(8, ("running command: [%s]\n", command));
if (smbrun(command, NULL) != 0) {
DEBUG(0, ("Could not log NT token\n"));
+ TALLOC_FREE(frame);
return NT_STATUS_ACCESS_DENIED;
}
+ TALLOC_FREE(frame);
return NT_STATUS_OK;
}
NTSTATUS create_local_token(auth_serversupplied_info *server_info)
{
- TALLOC_CTX *mem_ctx;
NTSTATUS status;
size_t i;
-
-
- mem_ctx = talloc_new(NULL);
- if (mem_ctx == NULL) {
- DEBUG(0, ("talloc_new failed\n"));
- return NT_STATUS_NO_MEMORY;
- }
/*
* If winbind is not around, we can not make much use of the SIDs the
*/
if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
- (server_info->was_mapped)) {
+ (server_info->nss_token)) {
status = create_token_from_username(server_info,
server_info->unix_name,
server_info->guest,
- &server_info->uid,
- &server_info->gid,
+ &server_info->utok.uid,
+ &server_info->utok.gid,
&server_info->unix_name,
&server_info->ptok);
-
+
} else {
server_info->ptok = create_local_nt_token(
server_info,
}
if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(mem_ctx);
return status;
}
-
+
/* Convert the SIDs to gids. */
- server_info->n_groups = 0;
- server_info->groups = NULL;
+ server_info->utok.ngroups = 0;
+ server_info->utok.groups = NULL;
/* Start at index 1, where the groups start. */
if (!sid_to_gid(sid, &gid)) {
DEBUG(10, ("Could not convert SID %s to gid, "
- "ignoring it\n", sid_string_static(sid)));
+ "ignoring it\n", sid_string_dbg(sid)));
continue;
}
- add_gid_to_array_unique(server_info, gid, &server_info->groups,
- &server_info->n_groups);
+ add_gid_to_array_unique(server_info, gid,
+ &server_info->utok.groups,
+ &server_info->utok.ngroups);
}
-
- debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
- status = log_nt_token(mem_ctx, server_info->ptok);
+ debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
- TALLOC_FREE(mem_ctx);
+ status = log_nt_token(server_info->ptok);
return status;
}
*/
NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
- BOOL is_guest,
+ bool is_guest,
uid_t *uid, gid_t *gid,
char **found_username,
struct nt_user_token **token)
if (!sid_to_uid(&user_sid, uid)) {
DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
- username, sid_string_static(&user_sid)));
+ username, sid_string_dbg(&user_sid)));
goto done;
}
if (sid_check_is_in_our_domain(&user_sid)) {
+ bool ret;
/* This is a passdb user, so ask passdb */
goto done;
}
- if (!pdb_getsampwsid(sam_acct, &user_sid)) {
+ become_root();
+ ret = pdb_getsampwsid(sam_acct, &user_sid);
+ unbecome_root();
+
+ if (!ret) {
DEBUG(1, ("pdb_getsampwsid(%s) for user %s failed\n",
- sid_string_static(&user_sid), username));
+ sid_string_dbg(&user_sid), username));
DEBUGADD(1, ("Fall back to unix user %s\n", username));
goto unix_user;
}
goto done;
}
- group_sids = talloc_array(tmp_ctx, DOM_SID, num_group_sids);
- if (group_sids == NULL) {
- DEBUG(1, ("talloc_array failed\n"));
- result = NT_STATUS_NO_MEMORY;
- goto done;
+ if (num_group_sids) {
+ group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
+ if (group_sids == NULL) {
+ DEBUG(1, ("TALLOC_ARRAY failed\n"));
+ result = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+ } else {
+ group_sids = NULL;
}
for (i=0; i<num_group_sids; i++) {
uint32 dummy;
num_group_sids = 1;
- group_sids = talloc_array(tmp_ctx, DOM_SID, num_group_sids);
+ group_sids = TALLOC_ARRAY(tmp_ctx, DOM_SID, num_group_sids);
if (group_sids == NULL) {
- DEBUG(1, ("talloc_array failed\n"));
+ DEBUG(1, ("TALLOC_ARRAY failed\n"));
result = NT_STATUS_NO_MEMORY;
goto done;
}
if (!sid_to_gid(&group_sids[0], gid)) {
DEBUG(1, ("sid_to_gid(%s) failed\n",
- sid_string_static(&group_sids[0])));
+ sid_string_dbg(&group_sids[0])));
goto done;
}
"for gid %d!\n", gids[i]));
continue;
}
- if (!add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
- &group_sids, &num_group_sids )) {
- result = NT_STATUS_NO_MEMORY;
+ result = add_sid_to_array_unique(tmp_ctx, &unix_group_sid,
+ &group_sids, &num_group_sids);
+ if (!NT_STATUS_IS_OK(result)) {
goto done;
}
}
member of a particular group.
***************************************************************************/
-BOOL user_in_group_sid(const char *username, const DOM_SID *group_sid)
+bool user_in_group_sid(const char *username, const DOM_SID *group_sid)
{
NTSTATUS status;
uid_t uid;
gid_t gid;
char *found_username;
struct nt_user_token *token;
- BOOL result;
+ bool result;
TALLOC_CTX *mem_ctx;
}
-BOOL user_in_group(const char *username, const char *groupname)
+bool user_in_group(const char *username, const char *groupname)
{
TALLOC_CTX *mem_ctx;
DOM_SID group_sid;
- BOOL ret;
+ bool ret;
mem_ctx = talloc_new(NULL);
if (mem_ctx == NULL) {
return user_in_group_sid(username, &group_sid);
}
-
/***************************************************************************
- Make (and fill) a user_info struct from a 'struct passwd' by conversion
+ Make (and fill) a server_info struct from a 'struct passwd' by conversion
to a struct samu
***************************************************************************/
NTSTATUS status;
struct samu *sampass = NULL;
gid_t *gids;
+ char *qualified_name = NULL;
+ TALLOC_CTX *mem_ctx = NULL;
+ DOM_SID u_sid;
+ enum lsa_SidType type;
auth_serversupplied_info *result;
if ( !(sampass = samu_new( NULL )) ) {
}
result->sam_account = sampass;
+
result->unix_name = talloc_strdup(result, unix_username);
- result->uid = pwd->pw_uid;
- result->gid = pwd->pw_gid;
+ result->sanitized_username = sanitize_username(result, unix_username);
+
+ if ((result->unix_name == NULL)
+ || (result->sanitized_username == NULL)) {
+ TALLOC_FREE(sampass);
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ result->utok.uid = pwd->pw_uid;
+ result->utok.gid = pwd->pw_gid;
status = pdb_enum_group_memberships(result, sampass,
&result->sids, &gids,
return status;
}
+ /*
+ * The SID returned in server_info->sam_account is based
+ * on our SAM sid even though for a pure UNIX account this should
+ * not be the case as it doesn't really exist in the SAM db.
+ * This causes lookups on "[in]valid users" to fail as they
+ * will lookup this name as a "Unix User" SID to check against
+ * the user token. Fix this by adding the "Unix User"\unix_username
+ * SID to the sid array. The correct fix should probably be
+ * changing the server_info->sam_account user SID to be a
+ * S-1-22 Unix SID, but this might break old configs where
+ * plaintext passwords were used with no SAM backend.
+ */
+
+ mem_ctx = talloc_init("make_server_info_pw_tmp");
+ if (!mem_ctx) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
+ unix_users_domain_name(),
+ unix_username );
+ if (!qualified_name) {
+ TALLOC_FREE(result);
+ TALLOC_FREE(mem_ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!lookup_name(mem_ctx, qualified_name, LOOKUP_NAME_ALL,
+ NULL, NULL,
+ &u_sid, &type)) {
+ TALLOC_FREE(result);
+ TALLOC_FREE(mem_ctx);
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ TALLOC_FREE(mem_ctx);
+
+ if (type != SID_NAME_USER) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ status = add_sid_to_array_unique(result, &u_sid,
+ &result->sids,
+ &result->num_sids);
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(result);
+ return status;
+ }
+
/* For now we throw away the gids and convert via sid_to_gid
* later. This needs fixing, but I'd like to get the code straight and
* simple first. */
NTSTATUS status;
struct samu *sampass = NULL;
DOM_SID guest_sid;
- BOOL ret;
- static const char zeros[16] = { 0, };
+ bool ret;
+ char zeros[16];
+ fstring tmp;
if ( !(sampass = samu_new( NULL )) ) {
return NT_STATUS_NO_MEMORY;
/* annoying, but the Guest really does have a session key, and it is
all zeros! */
+ ZERO_STRUCT(zeros);
(*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
(*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
+ alpha_strcpy(tmp, pdb_get_username(sampass), ". _-$", sizeof(tmp));
+ (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
+
+ return NT_STATUS_OK;
+}
+
+/****************************************************************************
+ Fake a auth_serversupplied_info just from a username
+****************************************************************************/
+
+NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
+ const char *username,
+ bool is_guest,
+ struct auth_serversupplied_info **presult)
+{
+ struct auth_serversupplied_info *result;
+ struct passwd *pwd;
+ NTSTATUS status;
+
+ pwd = getpwnam_alloc(talloc_tos(), username);
+ if (pwd == NULL) {
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ status = make_server_info_pw(&result, pwd->pw_name, pwd);
+
+ TALLOC_FREE(pwd);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ result->nss_token = true;
+ result->guest = is_guest;
+
+ status = create_local_token(result);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ TALLOC_FREE(result);
+ return status;
+ }
+
+ *presult = result;
return NT_STATUS_OK;
}
-static auth_serversupplied_info *copy_serverinfo(auth_serversupplied_info *src)
+
+struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
+ auth_serversupplied_info *src)
{
auth_serversupplied_info *dst;
- dst = make_server_info(NULL);
+ dst = make_server_info(mem_ctx);
if (dst == NULL) {
return NULL;
}
dst->guest = src->guest;
- dst->uid = src->uid;
- dst->gid = src->gid;
- dst->n_groups = src->n_groups;
- if (src->n_groups != 0) {
- dst->groups = (gid_t *)talloc_memdup(
- dst, src->groups, sizeof(gid_t)*dst->n_groups);
+ dst->utok.uid = src->utok.uid;
+ dst->utok.gid = src->utok.gid;
+ dst->utok.ngroups = src->utok.ngroups;
+ if (src->utok.ngroups != 0) {
+ dst->utok.groups = (gid_t *)TALLOC_MEMDUP(
+ dst, src->utok.groups,
+ sizeof(gid_t)*dst->utok.ngroups);
} else {
- dst->groups = NULL;
+ dst->utok.groups = NULL;
}
if (src->ptok) {
return NULL;
}
+ dst->sanitized_username = talloc_strdup(dst, src->sanitized_username);
+ if (!dst->sanitized_username) {
+ TALLOC_FREE(dst);
+ return NULL;
+ }
+
return dst;
}
+/*
+ * Set a new session key. Used in the rpc server where we have to override the
+ * SMB level session key with SystemLibraryDTC
+ */
+
+bool server_info_set_session_key(struct auth_serversupplied_info *info,
+ DATA_BLOB session_key)
+{
+ TALLOC_FREE(info->user_session_key.data);
+
+ info->user_session_key = data_blob_talloc(
+ info, session_key.data, session_key.length);
+
+ return (info->user_session_key.data != NULL);
+}
+
static auth_serversupplied_info *guest_info = NULL;
-BOOL init_guest_info(void)
+bool init_guest_info(void)
{
if (guest_info != NULL)
return True;
return NT_STATUS_IS_OK(make_new_server_info_guest(&guest_info));
}
-NTSTATUS make_server_info_guest(auth_serversupplied_info **server_info)
+NTSTATUS make_server_info_guest(TALLOC_CTX *mem_ctx,
+ auth_serversupplied_info **server_info)
{
- *server_info = copy_serverinfo(guest_info);
+ *server_info = copy_serverinfo(mem_ctx, guest_info);
return (*server_info != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
}
-BOOL copy_current_user(struct current_user *dst, struct current_user *src)
+bool copy_current_user(struct current_user *dst, struct current_user *src)
{
gid_t *groups;
NT_USER_TOKEN *nt_token;
return True;
}
-BOOL set_current_user_guest(struct current_user *dst)
-{
- gid_t *groups;
- NT_USER_TOKEN *nt_token;
-
- groups = (gid_t *)memdup(guest_info->groups,
- sizeof(gid_t) * guest_info->n_groups);
- if (groups == NULL) {
- return False;
- }
-
- nt_token = dup_nt_token(NULL, guest_info->ptok);
- if (nt_token == NULL) {
- SAFE_FREE(groups);
- return False;
- }
-
- TALLOC_FREE(dst->nt_user_token);
- SAFE_FREE(dst->ut.groups);
-
- /* dst->conn is never really dereferenced, it's only tested for
- * equality in uid.c */
- dst->conn = NULL;
-
- dst->vuid = UID_FIELD_INVALID;
- dst->ut.uid = guest_info->uid;
- dst->ut.gid = guest_info->gid;
- dst->ut.ngroups = guest_info->n_groups;
- dst->ut.groups = groups;
- dst->nt_user_token = nt_token;
- return True;
-}
-
/***************************************************************************
Purely internal function for make_server_info_info3
Fill the sam account from getpwnam
char **found_username,
uid_t *uid, gid_t *gid,
struct samu *account,
- BOOL *username_was_mapped)
+ bool *username_was_mapped)
{
NTSTATUS nt_status;
fstring dom_user, lower_username;
****************************************************************************/
struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, char *domuser,
- fstring save_username, BOOL create )
+ fstring save_username, bool create )
{
struct passwd *pw = NULL;
char *p;
const char *sent_nt_username,
const char *domain,
auth_serversupplied_info **server_info,
- NET_USER_INFO_3 *info3)
+ struct netr_SamInfo3 *info3)
{
- static const char zeros[16] = { 0, };
+ char zeros[16];
NTSTATUS nt_status = NT_STATUS_OK;
- char *found_username;
+ char *found_username = NULL;
const char *nt_domain;
const char *nt_username;
struct samu *sam_account = NULL;
DOM_SID user_sid;
DOM_SID group_sid;
- BOOL username_was_mapped;
+ bool username_was_mapped;
- uid_t uid;
- gid_t gid;
-
- size_t i;
+ uid_t uid = (uid_t)-1;
+ gid_t gid = (gid_t)-1;
auth_serversupplied_info *result;
matches.
*/
- sid_copy(&user_sid, &info3->dom_sid.sid);
- if (!sid_append_rid(&user_sid, info3->user_rid)) {
+ sid_copy(&user_sid, info3->base.domain_sid);
+ if (!sid_append_rid(&user_sid, info3->base.rid)) {
return NT_STATUS_INVALID_PARAMETER;
}
- sid_copy(&group_sid, &info3->dom_sid.sid);
- if (!sid_append_rid(&group_sid, info3->group_rid)) {
+ sid_copy(&group_sid, info3->base.domain_sid);
+ if (!sid_append_rid(&group_sid, info3->base.primary_gid)) {
return NT_STATUS_INVALID_PARAMETER;
}
- if (!(nt_username = unistr2_tdup(mem_ctx, &(info3->uni_user_name)))) {
+ nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
+ if (!nt_username) {
/* If the server didn't give us one, just use the one we sent
* them */
nt_username = sent_nt_username;
}
- if (!(nt_domain = unistr2_tdup(mem_ctx, &(info3->uni_logon_dom)))) {
+ nt_domain = talloc_strdup(mem_ctx, info3->base.domain.string);
+ if (!nt_domain) {
/* If the server didn't give us one, just use the one we sent
* them */
nt_domain = domain;
if (!NT_STATUS_IS_OK(nt_status)) {
TALLOC_FREE( sam_account );
if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
- make_server_info_guest(server_info);
+ make_server_info_guest(NULL, server_info);
return NT_STATUS_OK;
}
return nt_status;
TALLOC_FREE(sam_account);
return NT_STATUS_UNSUCCESSFUL;
}
-
+
if (!pdb_set_fullname(sam_account,
- unistr2_static(&(info3->uni_full_name)),
+ info3->base.full_name.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_logon_script(sam_account,
- unistr2_static(&(info3->uni_logon_script)),
+ info3->base.logon_script.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_profile_path(sam_account,
- unistr2_static(&(info3->uni_profile_path)),
+ info3->base.profile_path.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_homedir(sam_account,
- unistr2_static(&(info3->uni_home_dir)),
+ info3->base.home_directory.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
if (!pdb_set_dir_drive(sam_account,
- unistr2_static(&(info3->uni_dir_drive)),
+ info3->base.home_drive.string,
PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
- if (!pdb_set_acct_ctrl(sam_account, info3->acct_flags, PDB_CHANGED)) {
+ if (!pdb_set_acct_ctrl(sam_account, info3->base.acct_flags, PDB_CHANGED)) {
+ TALLOC_FREE(sam_account);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_pass_last_set_time(
+ sam_account,
+ nt_time_to_unix(info3->base.last_password_change),
+ PDB_CHANGED)) {
+ TALLOC_FREE(sam_account);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_pass_can_change_time(
+ sam_account,
+ nt_time_to_unix(info3->base.allow_password_change),
+ PDB_CHANGED)) {
+ TALLOC_FREE(sam_account);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_pass_must_change_time(
+ sam_account,
+ nt_time_to_unix(info3->base.force_password_change),
+ PDB_CHANGED)) {
TALLOC_FREE(sam_account);
return NT_STATUS_NO_MEMORY;
}
result->sam_account = sam_account;
result->unix_name = talloc_strdup(result, found_username);
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
+ if (result->sanitized_username == NULL) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
/* Fill in the unix info we found on the way */
- result->uid = uid;
- result->gid = gid;
+ result->utok.uid = uid;
+ result->utok.gid = gid;
/* Create a 'combined' list of all SIDs we might want in the SD */
result->num_sids = 0;
result->sids = NULL;
- /* and create (by appending rids) the 'domain' sids */
-
- for (i = 0; i < info3->num_groups2; i++) {
- DOM_SID sid;
- if (!sid_compose(&sid, &info3->dom_sid.sid,
- info3->gids[i].g_rid)) {
- DEBUG(3,("could not append additional group rid "
- "0x%x\n", info3->gids[i].g_rid));
- TALLOC_FREE(result);
- return NT_STATUS_INVALID_PARAMETER;
- }
- if (!add_sid_to_array(result, &sid, &result->sids,
- &result->num_sids)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
- }
+ nt_status = sid_array_from_info3(result, info3,
+ &result->sids,
+ &result->num_sids,
+ false, false);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ TALLOC_FREE(result);
+ return nt_status;
}
- /* Copy 'other' sids. We need to do sid filtering here to
- prevent possible elevation of privileges. See:
+ /* Ensure the primary group sid is at position 0. */
+ sort_sid_array_for_smbd(result, &group_sid);
- http://www.microsoft.com/windows2000/techinfo/administration/security/sidfilter.asp
- */
+ result->login_server = talloc_strdup(result,
+ info3->base.logon_server.string);
- for (i = 0; i < info3->num_other_sids; i++) {
- if (!add_sid_to_array(result, &info3->other_sids[i].sid,
- &result->sids,
- &result->num_sids)) {
- TALLOC_FREE(result);
- return NT_STATUS_NO_MEMORY;
+ /* ensure we are never given NULL session keys */
+
+ ZERO_STRUCT(zeros);
+
+ if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
+ result->user_session_key = data_blob_null;
+ } else {
+ result->user_session_key = data_blob_talloc(
+ result, info3->base.key.key,
+ sizeof(info3->base.key.key));
+ }
+
+ if (memcmp(info3->base.LMSessKey.key, zeros, 8) == 0) {
+ result->lm_session_key = data_blob_null;
+ } else {
+ result->lm_session_key = data_blob_talloc(
+ result, info3->base.LMSessKey.key,
+ sizeof(info3->base.LMSessKey.key));
+ }
+
+ result->nss_token |= username_was_mapped;
+
+ *server_info = result;
+
+ return NT_STATUS_OK;
+}
+
+/*****************************************************************************
+ Make a server_info struct from the wbcAuthUserInfo returned by a domain logon
+******************************************************************************/
+
+NTSTATUS make_server_info_wbcAuthUserInfo(TALLOC_CTX *mem_ctx,
+ const char *sent_nt_username,
+ const char *domain,
+ const struct wbcAuthUserInfo *info,
+ auth_serversupplied_info **server_info)
+{
+ char zeros[16];
+
+ NTSTATUS nt_status = NT_STATUS_OK;
+ char *found_username = NULL;
+ const char *nt_domain;
+ const char *nt_username;
+ struct samu *sam_account = NULL;
+ DOM_SID user_sid;
+ DOM_SID group_sid;
+ bool username_was_mapped;
+ uint32_t i;
+
+ uid_t uid = (uid_t)-1;
+ gid_t gid = (gid_t)-1;
+
+ auth_serversupplied_info *result;
+
+ result = make_server_info(NULL);
+ if (result == NULL) {
+ DEBUG(4, ("make_server_info failed!\n"));
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /*
+ Here is where we should check the list of
+ trusted domains, and verify that the SID
+ matches.
+ */
+
+ memcpy(&user_sid, &info->sids[0].sid, sizeof(user_sid));
+ memcpy(&group_sid, &info->sids[1].sid, sizeof(group_sid));
+
+ if (info->account_name) {
+ nt_username = talloc_strdup(result, info->account_name);
+ } else {
+ /* If the server didn't give us one, just use the one we sent
+ * them */
+ nt_username = talloc_strdup(result, sent_nt_username);
+ }
+ if (!nt_username) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (info->domain_name) {
+ nt_domain = talloc_strdup(result, info->domain_name);
+ } else {
+ /* If the server didn't give us one, just use the one we sent
+ * them */
+ nt_domain = talloc_strdup(result, domain);
+ }
+ if (!nt_domain) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* try to fill the SAM account.. If getpwnam() fails, then try the
+ add user script (2.2.x behavior).
+
+ We use the _unmapped_ username here in an attempt to provide
+ consistent username mapping behavior between kerberos and NTLM[SSP]
+ authentication in domain mode security. I.E. Username mapping
+ should be applied to the fully qualified username
+ (e.g. DOMAIN\user) and not just the login name. Yes this means we
+ called map_username() unnecessarily in make_user_info_map() but
+ that is how the current code is designed. Making the change here
+ is the least disruptive place. -- jerry */
+
+ if ( !(sam_account = samu_new( result )) ) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* this call will try to create the user if necessary */
+
+ nt_status = fill_sam_account(result, nt_domain, sent_nt_username,
+ &found_username, &uid, &gid, sam_account,
+ &username_was_mapped);
+
+ /* if we still don't have a valid unix account check for
+ 'map to guest = bad uid' */
+
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ TALLOC_FREE( result );
+ if ( lp_map_to_guest() == MAP_TO_GUEST_ON_BAD_UID ) {
+ make_server_info_guest(NULL, server_info);
+ return NT_STATUS_OK;
}
+ return nt_status;
+ }
+
+ if (!pdb_set_nt_username(sam_account, nt_username, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_username(sam_account, nt_username, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_domain(sam_account, nt_domain, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_user_sid(sam_account, &user_sid, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ if (!pdb_set_group_sid(sam_account, &group_sid, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ if (!pdb_set_fullname(sam_account, info->full_name, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_logon_script(sam_account, info->logon_script, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_profile_path(sam_account, info->profile_path, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_homedir(sam_account, info->home_directory, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_dir_drive(sam_account, info->home_drive, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_acct_ctrl(sam_account, info->acct_flags, PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
}
- result->login_server = unistr2_tdup(result,
- &(info3->uni_logon_srv));
+ if (!pdb_set_pass_last_set_time(
+ sam_account,
+ nt_time_to_unix(info->pass_last_set_time),
+ PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_pass_can_change_time(
+ sam_account,
+ nt_time_to_unix(info->pass_can_change_time),
+ PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!pdb_set_pass_must_change_time(
+ sam_account,
+ nt_time_to_unix(info->pass_must_change_time),
+ PDB_CHANGED)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* save this here to _net_sam_logon() doesn't fail (it assumes a
+ valid struct samu) */
+
+ result->sam_account = sam_account;
+ result->unix_name = talloc_strdup(result, found_username);
+
+ result->sanitized_username = sanitize_username(result,
+ result->unix_name);
+ result->login_server = talloc_strdup(result, info->logon_server);
+
+ if ((result->unix_name == NULL)
+ || (result->sanitized_username == NULL)
+ || (result->login_server == NULL)) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ /* Fill in the unix info we found on the way */
+
+ result->utok.uid = uid;
+ result->utok.gid = gid;
+
+ /* Create a 'combined' list of all SIDs we might want in the SD */
+
+ result->num_sids = info->num_sids - 2;
+ result->sids = talloc_array(result, DOM_SID, result->num_sids);
+ if (result->sids == NULL) {
+ TALLOC_FREE(result);
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ for (i=0; i < result->num_sids; i++) {
+ memcpy(&result->sids[i], &info->sids[i+2].sid, sizeof(result->sids[i]));
+ }
+
+ /* Ensure the primary group sid is at position 0. */
+ sort_sid_array_for_smbd(result, &group_sid);
/* ensure we are never given NULL session keys */
-
- if (memcmp(info3->user_sess_key, zeros, sizeof(zeros)) == 0) {
- result->user_session_key = data_blob(NULL, 0);
+
+ ZERO_STRUCT(zeros);
+
+ if (memcmp(info->user_session_key, zeros, sizeof(zeros)) == 0) {
+ result->user_session_key = data_blob_null;
} else {
result->user_session_key = data_blob_talloc(
- result, info3->user_sess_key,
- sizeof(info3->user_sess_key));
+ result, info->user_session_key,
+ sizeof(info->user_session_key));
}
- if (memcmp(info3->lm_sess_key, zeros, 8) == 0) {
- result->lm_session_key = data_blob(NULL, 0);
+ if (memcmp(info->lm_session_key, zeros, 8) == 0) {
+ result->lm_session_key = data_blob_null;
} else {
result->lm_session_key = data_blob_talloc(
- result, info3->lm_sess_key,
- sizeof(info3->lm_sess_key));
+ result, info->lm_session_key,
+ sizeof(info->lm_session_key));
}
- result->was_mapped = username_was_mapped;
+ result->nss_token |= username_was_mapped;
*server_info = result;
Make an auth_methods struct
***************************************************************************/
-BOOL make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method)
+bool make_auth_methods(struct auth_context *auth_context, auth_methods **auth_method)
{
if (!auth_context) {
smb_panic("no auth_context supplied to "
* false if otherwise
**/
-BOOL is_trusted_domain(const char* dom_name)
+bool is_trusted_domain(const char* dom_name)
{
DOM_SID trustdom_sid;
- BOOL ret;
+ bool ret;
/* no trusted domains for a standalone server */
return True;
}
else {
- NSS_STATUS result;
+ wbcErr result;
/* If winbind is around, ask it */
result = wb_is_trusted_domain(dom_name);
- if (result == NSS_STATUS_SUCCESS) {
+ if (result == WBC_ERR_SUCCESS) {
return True;
}
- if (result == NSS_STATUS_NOTFOUND) {
+ if (result == WBC_ERR_DOMAIN_NOT_FOUND) {
/* winbind could not find the domain */
return False;
}
git.samba.org / kai / samba.git / blobdiff