- bool smbldap_get_single_pstring (LDAP * ldap_struct, LDAPMessage * entry,
- const char *attribute, pstring value)
-{
- return smbldap_get_single_attribute(ldap_struct, entry,
- attribute, value,
- sizeof(pstring));
-}
-
char * smbldap_talloc_single_attribute(LDAP *ldap_struct, LDAPMessage *entry,
const char *attribute,
TALLOC_CTX *mem_ctx)
char * smbldap_talloc_single_attribute(LDAP *ldap_struct, LDAPMessage *entry,
const char *attribute,
TALLOC_CTX *mem_ctx)
- Similar to string_sub, but it will accept only allocated strings
+ Similar to string_sub2, but it will accept only allocated strings
and may realloc them so pay attention at what you pass on no
pointers inside strings, no pstrings or const may be passed
as string.
**/
and may realloc them so pay attention at what you pass on no
pointers inside strings, no pstrings or const may be passed
as string.
**/
-char *realloc_string_sub(char *string, const char *pattern,
- const char *insert)
+char *realloc_string_sub2(char *string,
+ const char *pattern,
+ const char *insert,
+ bool remove_unsafe_characters,
+ bool allow_trailing_dollar)
case '\'':
case ';':
case '$':
case '\'':
case ';':
case '$':
+ /* allow a trailing $
+ * (as in machine accounts) */
+ if (allow_trailing_dollar && (i == li - 1 )) {
+ break;
+ }
case '%':
case '\r':
case '\n':
case '%':
case '\r':
case '\n':
+ if ( remove_unsafe_characters ) {
+ in[i] = '_';
+ break;
+ }
+char *realloc_string_sub(char *string,
+ const char *pattern,
+ const char *insert)
+{
+ return realloc_string_sub2(string, pattern, insert, true, false);
+}
+
/*
* Internal guts of talloc_string_sub and talloc_all_string_sub.
* 'filter' differentiates between them.
/*
* Internal guts of talloc_string_sub and talloc_all_string_sub.
* 'filter' differentiates between them.
Routine to set 32 hex password characters from a 16 byte array.
**************************************************************/
Routine to set 32 hex password characters from a 16 byte array.
**************************************************************/
-void pdb_sethexpwd(char *p, const unsigned char *pwd, uint32 acct_ctrl)
+void pdb_sethexpwd(char p[33], const unsigned char *pwd, uint32 acct_ctrl)
{
if (pwd != NULL) {
int i;
{
if (pwd != NULL) {
int i;
TALLOC_CTX *mem_ctx;
char **values = NULL;
int rc, num_result, num_values, rid;
TALLOC_CTX *mem_ctx;
char **values = NULL;
int rc, num_result, num_values, rid;
fstring tok;
const char *p;
const char **attrs;
fstring tok;
const char *p;
const char **attrs;
/* csn=20050126161620Z#0000001#00#00000 */
attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
attrs[1] = NULL;
/* csn=20050126161620Z#0000001#00#00000 */
attrs[0] = talloc_strdup(mem_ctx, "syncreplCookie");
attrs[1] = NULL;
- pstr_sprintf( suffix, "cn=syncrepl%d,%s", rid, lp_ldap_suffix());
-
+ suffix = talloc_asprintf(mem_ctx,
+ "cn=syncrepl%d,%s", rid, lp_ldap_suffix());
+ if (!suffix) {
+ ntstatus = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
} else {
/* provider contextCSN */
/* 20050126161620Z#000009#00#000000 */
attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
attrs[1] = NULL;
} else {
/* provider contextCSN */
/* 20050126161620Z#000009#00#000000 */
attrs[0] = talloc_strdup(mem_ctx, "contextCSN");
attrs[1] = NULL;
- pstr_sprintf( suffix, "cn=ldapsync,%s", lp_ldap_suffix());
+ suffix = talloc_asprintf(mem_ctx,
+ "cn=ldapsync,%s", lp_ldap_suffix());
+ if (!suffix) {
+ ntstatus = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
}
rc = smbldap_search(ldap_state->smbldap_state, suffix,
}
rc = smbldap_search(ldap_state->smbldap_state, suffix,
Run the search by name.
******************************************************************/
Run the search by name.
******************************************************************/
-int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
+int ldapsam_search_suffix_by_name(struct ldapsam_privates *ldap_state,
const char *user,
LDAPMessage ** result,
const char **attr)
{
const char *user,
LDAPMessage ** result,
const char **attr)
{
char *escape_user = escape_ldap_string_alloc(user);
char *escape_user = escape_ldap_string_alloc(user);
if (!escape_user) {
return LDAP_NO_MEMORY;
if (!escape_user) {
return LDAP_NO_MEMORY;
* in the filter expression, replace %u with the real name
* so in ldap filter, %u MUST exist :-)
*/
* in the filter expression, replace %u with the real name
* so in ldap filter, %u MUST exist :-)
*/
- pstr_sprintf(filter, "(&%s%s)", "(uid=%u)",
+ filter = talloc_asprintf(talloc_tos(), "(&%s%s)", "(uid=%u)",
get_objclass_filter(ldap_state->schema_ver));
get_objclass_filter(ldap_state->schema_ver));
+ if (!filter) {
+ return LDAP_NO_MEMORY;
+ }
+ /*
* have to use this here because $ is filtered out
* have to use this here because $ is filtered out
- all_string_sub(filter, "%u", escape_user, sizeof(pstring));
+ filter = talloc_all_string_sub(talloc_tos(),
+ filter, "%u", escape_user);
+ if (!filter) {
+ return LDAP_NO_MEMORY;
+ }
- return smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
+ ret = smbldap_search_suffix(ldap_state->smbldap_state,
+ filter, attr, result);
+ TALLOC_FREE(filter);
+ return ret;
}
/*******************************************************************
Run the search by rid.
******************************************************************/
}
/*******************************************************************
Run the search by rid.
******************************************************************/
-static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
- uint32 rid, LDAPMessage ** result,
+static int ldapsam_search_suffix_by_rid (struct ldapsam_privates *ldap_state,
+ uint32 rid, LDAPMessage ** result,
- pstr_sprintf(filter, "(&(rid=%i)%s)", rid,
+ filter = talloc_asprintf(talloc_tos(), "(&(rid=%i)%s)", rid,
get_objclass_filter(ldap_state->schema_ver));
get_objclass_filter(ldap_state->schema_ver));
-
- rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
-
+ if (!filter) {
+ return LDAP_NO_MEMORY;
+ }
+
+ rc = smbldap_search_suffix(ldap_state->smbldap_state,
+ filter, attr, result);
+ TALLOC_FREE(filter);
Run the search by SID.
******************************************************************/
Run the search by SID.
******************************************************************/
-static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
- const DOM_SID *sid, LDAPMessage ** result,
- const char **attr)
+static int ldapsam_search_suffix_by_sid (struct ldapsam_privates *ldap_state,
+ const DOM_SID *sid, LDAPMessage ** result,
+ const char **attr)
int rc;
fstring sid_string;
int rc;
fstring sid_string;
- pstr_sprintf(filter, "(&(%s=%s)%s)",
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
- sid_to_string(sid_string, sid),
+ filter = talloc_asprintf(talloc_tos(), "(&(%s=%s)%s)",
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_USER_SID),
+ sid_to_string(sid_string, sid),
get_objclass_filter(ldap_state->schema_ver));
get_objclass_filter(ldap_state->schema_ver));
-
- rc = smbldap_search_suffix(ldap_state->smbldap_state, filter, attr, result);
-
+ if (!filter) {
+ return LDAP_NO_MEMORY;
+ }
+
+ rc = smbldap_search_suffix(ldap_state->smbldap_state,
+ filter, attr, result);
+
+ TALLOC_FREE(filter);
if (ptr != NULL) {
ber_free(ptr, 0);
}
if (ptr != NULL) {
ber_free(ptr, 0);
}
smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
talloc_autofree_ldapmod(mem_ctx, mods);
smbldap_set_mod(&mods, LDAP_MOD_DELETE, "objectClass", objectclass);
talloc_autofree_ldapmod(mem_ctx, mods);
return smbldap_modify(priv->smbldap_state, dn, mods);
}
return smbldap_modify(priv->smbldap_state, dn, mods);
}
static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates *ldap_state, LDAPMessage * entry)
{
static time_t ldapsam_get_entry_timestamp( struct ldapsam_privates *ldap_state, LDAPMessage * entry)
{
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
+ temp = smbldap_talloc_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
get_userattr_key2string(ldap_state->schema_ver,LDAP_ATTR_MOD_TIMESTAMP),
+ talloc_tos());
+ if (!temp) {
if ( !strptime(temp, "%Y%m%d%H%M%SZ", &tm)) {
DEBUG(2,("ldapsam_get_entry_timestamp: strptime failed on: %s\n",
(char*)temp));
if ( !strptime(temp, "%Y%m%d%H%M%SZ", &tm)) {
DEBUG(2,("ldapsam_get_entry_timestamp: strptime failed on: %s\n",
(char*)temp));
tzset();
return timegm(&tm);
}
tzset();
return timegm(&tm);
}
(Based on init_sam_from_buffer in pdb_tdb.c)
*********************************************************************/
(Based on init_sam_from_buffer in pdb_tdb.c)
*********************************************************************/
-static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
+static bool init_sam_from_ldap(struct ldapsam_privates *ldap_state,
struct samu * sampass,
LDAPMessage * entry)
{
time_t logon_time,
logoff_time,
kickoff_time,
struct samu * sampass,
LDAPMessage * entry)
{
time_t logon_time,
logoff_time,
kickoff_time,
- pass_last_set_time,
- pass_can_change_time,
+ pass_last_set_time,
+ pass_can_change_time,
pass_must_change_time,
ldap_entry_time,
bad_password_time;
pass_must_change_time,
ldap_entry_time,
bad_password_time;
- pstring username,
- domain,
- nt_username,
- fullname,
- homedir,
- dir_drive,
- logon_script,
- profile_path,
- acct_desc,
- workstations;
- char munged_dial[2048];
- uint32 user_rid;
+ char *username = NULL,
+ *domain = NULL,
+ *nt_username = NULL,
+ *fullname = NULL,
+ *homedir = NULL,
+ *dir_drive = NULL,
+ *logon_script = NULL,
+ *profile_path = NULL,
+ *acct_desc = NULL,
+ *workstations = NULL,
+ *munged_dial = NULL;
+ uint32 user_rid;
uint8 smblmpwd[LM_HASH_LEN],
smbntpwd[NT_HASH_LEN];
bool use_samba_attrs = True;
uint32 acct_ctrl = 0;
uint16 logon_divs;
uint8 smblmpwd[LM_HASH_LEN],
smbntpwd[NT_HASH_LEN];
bool use_samba_attrs = True;
uint32 acct_ctrl = 0;
uint16 logon_divs;
- uint16 bad_password_count = 0,
+ uint16 bad_password_count = 0,
logon_count = 0;
uint32 hours_len;
uint8 hours[MAX_HOURS_LEN];
logon_count = 0;
uint32 hours_len;
uint8 hours[MAX_HOURS_LEN];
LOGIN_CACHE *cache_entry = NULL;
uint32 pwHistLen;
LOGIN_CACHE *cache_entry = NULL;
uint32 pwHistLen;
bool expand_explicit = lp_passdb_expand_explicit();
bool expand_explicit = lp_passdb_expand_explicit();
+ bool ret = false;
+ TALLOC_CTX *ctx = talloc_init("init_sam_from_ldap");
- /*
- * do a little initialization
- */
- username[0] = '\0';
- domain[0] = '\0';
- nt_username[0] = '\0';
- fullname[0] = '\0';
- homedir[0] = '\0';
- dir_drive[0] = '\0';
- logon_script[0] = '\0';
- profile_path[0] = '\0';
- acct_desc[0] = '\0';
- munged_dial[0] = '\0';
- workstations[0] = '\0';
-
-
+ if (!ctx) {
+ return false;
+ }
if (sampass == NULL || ldap_state == NULL || entry == NULL) {
DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
if (sampass == NULL || ldap_state == NULL || entry == NULL) {
DEBUG(0, ("init_sam_from_ldap: NULL parameters found!\n"));
}
if (priv2ld(ldap_state) == NULL) {
DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->"
"ldap_struct is NULL!\n"));
}
if (priv2ld(ldap_state) == NULL) {
DEBUG(0, ("init_sam_from_ldap: ldap_state->smbldap_state->"
"ldap_struct is NULL!\n"));
-
- if (!smbldap_get_single_pstring(priv2ld(ldap_state), entry, "uid",
- username)) {
+
+ if (!(username = smbldap_talloc_single_attribute(priv2ld(ldap_state),
+ entry,
+ "uid",
+ ctx))) {
DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "
"this user!\n"));
DEBUG(1, ("init_sam_from_ldap: No uid attribute found for "
"this user!\n"));
}
DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
}
DEBUG(2, ("init_sam_from_ldap: Entry found for user: %s\n", username));
- pstrcpy(nt_username, username);
+ nt_username = talloc_strdup(ctx, username);
+ if (!nt_username) {
+ goto fn_exit;
+ }
+
+ domain = talloc_strdup(ctx, ldap_state->domain_name);
+ if (!domain) {
+ goto fn_exit;
+ }
- pstrcpy(domain, ldap_state->domain_name);
-
pdb_set_username(sampass, username, PDB_SET);
pdb_set_domain(sampass, domain, PDB_DEFAULT);
pdb_set_nt_username(sampass, nt_username, PDB_SET);
/* deal with different attributes between the schema first */
pdb_set_username(sampass, username, PDB_SET);
pdb_set_domain(sampass, domain, PDB_DEFAULT);
pdb_set_nt_username(sampass, nt_username, PDB_SET);
/* deal with different attributes between the schema first */
if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
if ( ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT ) {
- if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID), temp)) {
+ if ((temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_USER_SID),
+ ctx))!=NULL) {
pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
}
} else {
pdb_set_user_sid_from_string(sampass, temp, PDB_SET);
}
} else {
- if (smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID), temp)) {
+ if ((temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_USER_RID),
+ ctx))!=NULL) {
user_rid = (uint32)atol(temp);
pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
}
user_rid = (uint32)atol(temp);
pdb_set_user_sid_from_rid(sampass, user_rid, PDB_SET);
}
if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
if (pdb_get_init_flags(sampass,PDB_USERSID) == PDB_DEFAULT) {
DEBUG(1, ("init_sam_from_ldap: no %s or %s attribute found for this user %s\n",
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_USER_SID),
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_USER_RID),
username));
return False;
}
username));
return False;
}
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_PWD_LAST_SET),
+ ctx);
+ if (temp) {
pass_last_set_time = (time_t) atol(temp);
pass_last_set_time = (time_t) atol(temp);
- pdb_set_pass_last_set_time(sampass, pass_last_set_time, PDB_SET);
+ pdb_set_pass_last_set_time(sampass,
+ pass_last_set_time, PDB_SET);
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_LOGON_TIME),
+ ctx);
+ if (temp) {
logon_time = (time_t) atol(temp);
pdb_set_logon_time(sampass, logon_time, PDB_SET);
}
logon_time = (time_t) atol(temp);
pdb_set_logon_time(sampass, logon_time, PDB_SET);
}
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_LOGOFF_TIME),
+ ctx);
+ if (temp) {
logoff_time = (time_t) atol(temp);
pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
}
logoff_time = (time_t) atol(temp);
pdb_set_logoff_time(sampass, logoff_time, PDB_SET);
}
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_KICKOFF_TIME),
+ ctx);
+ if (temp) {
kickoff_time = (time_t) atol(temp);
pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
}
kickoff_time = (time_t) atol(temp);
pdb_set_kickoff_time(sampass, kickoff_time, PDB_SET);
}
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_PWD_CAN_CHANGE),
+ ctx);
+ if (temp) {
pass_can_change_time = (time_t) atol(temp);
pass_can_change_time = (time_t) atol(temp);
- pdb_set_pass_can_change_time(sampass, pass_can_change_time, PDB_SET);
+ pdb_set_pass_can_change_time(sampass,
+ pass_can_change_time, PDB_SET);
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_PWD_MUST_CHANGE),
+ ctx);
+ if (temp) {
pass_must_change_time = (time_t) atol(temp);
pass_must_change_time = (time_t) atol(temp);
- pdb_set_pass_must_change_time(sampass, pass_must_change_time, PDB_SET);
+ pdb_set_pass_must_change_time(sampass,
+ pass_must_change_time, PDB_SET);
}
/* recommend that 'gecos' and 'displayName' should refer to the same
}
/* recommend that 'gecos' and 'displayName' should refer to the same
* that fits your needs; using cn then displayName rather than 'userFullName'
*/
* that fits your needs; using cn then displayName rather than 'userFullName'
*/
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DISPLAY_NAME), fullname)) {
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_CN), fullname)) {
- /* leave as default */
- } else {
+ fullname = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_DISPLAY_NAME),
+ ctx);
+ if (fullname) {
+ pdb_set_fullname(sampass, fullname, PDB_SET);
+ } else {
+ fullname = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_CN),
+ ctx);
+ if (fullname) {
pdb_set_fullname(sampass, fullname, PDB_SET);
}
pdb_set_fullname(sampass, fullname, PDB_SET);
}
- } else {
- pdb_set_fullname(sampass, fullname, PDB_SET);
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE), dir_drive))
- {
- pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
- } else {
+ dir_drive = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_HOME_DRIVE),
+ ctx);
+ if (dir_drive) {
pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
pdb_set_dir_drive(sampass, dir_drive, PDB_SET);
+ } else {
+ pdb_set_dir_drive( sampass, lp_logon_drive(), PDB_DEFAULT );
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH), homedir))
- {
- pdb_set_homedir( sampass,
- talloc_sub_basic(sampass, username, domain,
- lp_logon_home()),
- PDB_DEFAULT );
- } else {
- pstrcpy( tmpstring, homedir );
+ homedir = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_HOME_PATH),
+ ctx);
+ if (homedir) {
- standard_sub_basic( username, domain, tmpstring,
- sizeof(tmpstring) );
+ homedir = talloc_sub_basic(ctx,
+ username,
+ domain,
+ homedir);
+ if (!homedir) {
+ goto fn_exit;
+ }
- pdb_set_homedir(sampass, tmpstring, PDB_SET);
+ pdb_set_homedir(sampass, homedir, PDB_SET);
+ } else {
+ pdb_set_homedir(sampass,
+ talloc_sub_basic(ctx, username, domain,
+ lp_logon_home()),
+ PDB_DEFAULT);
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_SCRIPT), logon_script))
- {
- pdb_set_logon_script( sampass,
- talloc_sub_basic(sampass, username, domain,
- lp_logon_script()),
- PDB_DEFAULT );
- } else {
- pstrcpy( tmpstring, logon_script );
+ logon_script = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_LOGON_SCRIPT),
+ ctx);
+ if (logon_script) {
- standard_sub_basic( username, domain, tmpstring,
- sizeof(tmpstring) );
+ logon_script = talloc_sub_basic(ctx,
+ username,
+ domain,
+ logon_script);
+ if (!logon_script) {
+ goto fn_exit;
+ }
- pdb_set_logon_script(sampass, tmpstring, PDB_SET);
+ pdb_set_logon_script(sampass, logon_script, PDB_SET);
+ } else {
+ pdb_set_logon_script(sampass,
+ talloc_sub_basic(ctx, username, domain,
+ lp_logon_script()),
+ PDB_DEFAULT );
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH), profile_path))
- {
- pdb_set_profile_path( sampass,
- talloc_sub_basic( sampass, username, domain,
- lp_logon_path()),
- PDB_DEFAULT );
- } else {
- pstrcpy( tmpstring, profile_path );
+ profile_path = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_PROFILE_PATH),
+ ctx);
+ if (profile_path) {
- standard_sub_basic( username, domain, tmpstring,
- sizeof(tmpstring) );
+ profile_path = talloc_sub_basic(ctx,
+ username,
+ domain,
+ profile_path);
+ if (!profile_path) {
+ goto fn_exit;
+ }
- pdb_set_profile_path(sampass, tmpstring, PDB_SET);
+ pdb_set_profile_path(sampass, profile_path, PDB_SET);
+ } else {
+ pdb_set_profile_path(sampass,
+ talloc_sub_basic(ctx, username, domain,
+ lp_logon_path()),
+ PDB_DEFAULT );
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_DESC), acct_desc))
- {
- /* leave as default */
- } else {
+ acct_desc = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_DESC),
+ ctx);
+ if (acct_desc) {
pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
}
pdb_set_acct_desc(sampass, acct_desc, PDB_SET);
}
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS), workstations)) {
- /* leave as default */;
- } else {
+ workstations = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_USER_WKS),
+ ctx);
+ if (workstations) {
pdb_set_workstations(sampass, workstations, PDB_SET);
}
pdb_set_workstations(sampass, workstations, PDB_SET);
}
- if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL), munged_dial, sizeof(munged_dial))) {
- /* leave as default */;
- } else {
+ munged_dial = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_MUNGED_DIAL),
+ ctx);
+ if (munged_dial) {
pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
}
pdb_set_munged_dial(sampass, munged_dial, PDB_SET);
}
/* FIXME: hours stuff should be cleaner */
/* FIXME: hours stuff should be cleaner */
logon_divs = 168;
hours_len = 21;
memset(hours, 0xff, hours_len);
logon_divs = 168;
hours_len = 21;
memset(hours, 0xff, hours_len);
char *user_dn;
size_t pwd_len;
char clear_text_pw[512];
char *user_dn;
size_t pwd_len;
char clear_text_pw[512];
/* Make call to Novell eDirectory ldap extension to get clear text password.
NOTE: This will only work if we have an SSL connection to eDirectory. */
user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
/* Make call to Novell eDirectory ldap extension to get clear text password.
NOTE: This will only work if we have an SSL connection to eDirectory. */
user_dn = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
- if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_LMPW),
+ ctx);
+ if (temp) {
pdb_gethexpwd(temp, smblmpwd);
memset((char *)temp, '\0', strlen(temp)+1);
pdb_gethexpwd(temp, smblmpwd);
memset((char *)temp, '\0', strlen(temp)+1);
- if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET))
- return False;
+ if (!pdb_set_lanman_passwd(sampass, smblmpwd, PDB_SET)) {
+ goto fn_exit;
+ }
- if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_NTPW),
+ ctx);
+ if (temp) {
pdb_gethexpwd(temp, smbntpwd);
memset((char *)temp, '\0', strlen(temp)+1);
pdb_gethexpwd(temp, smbntpwd);
memset((char *)temp, '\0', strlen(temp)+1);
- if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET))
- return False;
+ if (!pdb_set_nt_passwd(sampass, smbntpwd, PDB_SET)) {
+ goto fn_exit;
+ }
ZERO_STRUCT(smbntpwd);
}
}
ZERO_STRUCT(smbntpwd);
}
}
if (pwHistLen > 0){
uint8 *pwhist = NULL;
int i;
if (pwHistLen > 0){
uint8 *pwhist = NULL;
int i;
- char history_string[MAX_PW_HISTORY_LEN*64];
+ char *history_string = TALLOC_ARRAY(ctx, char,
+ MAX_PW_HISTORY_LEN*64);
+
+ if (!history_string) {
+ goto fn_exit;
+ }
pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
pwHistLen = MIN(pwHistLen, MAX_PW_HISTORY_LEN);
- if ((pwhist = SMB_MALLOC_ARRAY(uint8, pwHistLen * PW_HISTORY_ENTRY_LEN)) == NULL){
- DEBUG(0, ("init_sam_from_ldap: malloc failed!\n"));
- return False;
+ if ((pwhist = TALLOC_ARRAY(ctx, uint8,
+ pwHistLen * PW_HISTORY_ENTRY_LEN)) ==
+ NULL){
+ DEBUG(0, ("init_sam_from_ldap: talloc failed!\n"));
+ goto fn_exit;
}
memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
}
memset(pwhist, '\0', pwHistLen * PW_HISTORY_ENTRY_LEN);
- if (!smbldap_get_single_attribute(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
- history_string, sizeof(history_string))) {
- /* leave as default - zeros */
- } else {
- bool hex_failed = False;
+ if (smbldap_get_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_PWD_HISTORY),
+ history_string,
+ MAX_PW_HISTORY_LEN*64)) {
+ bool hex_failed = false;
for (i = 0; i < pwHistLen; i++){
/* Get the 16 byte salt. */
for (i = 0; i < pwHistLen; i++){
/* Get the 16 byte salt. */
- if (!pdb_gethexpwd(&history_string[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN])) {
- hex_failed = True;
+ if (!pdb_gethexpwd(&history_string[i*64],
+ &pwhist[i*PW_HISTORY_ENTRY_LEN])) {
+ hex_failed = true;
break;
}
/* Get the 16 byte MD5 hash of salt+passwd. */
if (!pdb_gethexpwd(&history_string[(i*64)+32],
break;
}
/* Get the 16 byte MD5 hash of salt+passwd. */
if (!pdb_gethexpwd(&history_string[(i*64)+32],
- &pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN])) {
+ &pwhist[(i*PW_HISTORY_ENTRY_LEN)+
+ PW_HISTORY_SALT_LEN])) {
hex_failed = True;
break;
}
hex_failed = True;
break;
}
}
}
if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
}
}
if (!pdb_set_pw_history(sampass, pwhist, pwHistLen, PDB_SET)){
- SAFE_FREE(pwhist);
- return False;
- if (!smbldap_get_single_pstring (ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO), temp)) {
- acct_ctrl |= ACB_NORMAL;
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_ACB_INFO),
+ ctx);
+ if (temp) {
acct_ctrl = pdb_decode_acct_ctrl(temp);
acct_ctrl = pdb_decode_acct_ctrl(temp);
pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
pdb_set_acct_ctrl(sampass, acct_ctrl, PDB_SET);
+ } else {
+ acct_ctrl |= ACB_NORMAL;
}
pdb_set_hours_len(sampass, hours_len, PDB_SET);
pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
}
pdb_set_hours_len(sampass, hours_len, PDB_SET);
pdb_set_logon_divs(sampass, logon_divs, PDB_SET);
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_COUNT), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_BAD_PASSWORD_COUNT),
+ ctx);
+ if (temp) {
bad_password_count = (uint32) atol(temp);
bad_password_count = (uint32) atol(temp);
- pdb_set_bad_password_count(sampass, bad_password_count, PDB_SET);
+ pdb_set_bad_password_count(sampass,
+ bad_password_count, PDB_SET);
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_BAD_PASSWORD_TIME), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_BAD_PASSWORD_TIME),
+ ctx);
+ if (temp) {
bad_password_time = (time_t) atol(temp);
pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
}
bad_password_time = (time_t) atol(temp);
pdb_set_bad_password_time(sampass, bad_password_time, PDB_SET);
}
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_COUNT), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_LOGON_COUNT),
+ ctx);
+ if (temp) {
logon_count = (uint32) atol(temp);
pdb_set_logon_count(sampass, logon_count, PDB_SET);
}
/* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
logon_count = (uint32) atol(temp);
pdb_set_logon_count(sampass, logon_count, PDB_SET);
}
/* pdb_set_unknown_6(sampass, unknown6, PDB_SET); */
- if(!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_HOURS), temp)) {
- /* leave as default */
- } else {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_LOGON_HOURS),
+ ctx);
+ if (temp) {
pdb_gethexhours(temp, hours);
memset((char *)temp, '\0', strlen(temp) +1);
pdb_set_hours(sampass, hours, PDB_SET);
pdb_gethexhours(temp, hours);
memset((char *)temp, '\0', strlen(temp) +1);
pdb_set_hours(sampass, hours, PDB_SET);
}
if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
}
if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
- if (smbldap_get_single_pstring(priv2ld(ldap_state), entry,
- "uidNumber", temp)) {
+ temp = smbldap_talloc_single_attribute(
+ priv2ld(ldap_state),
+ entry,
+ "uidNumber",
+ ctx);
+ if (temp) {
/* We've got a uid, feed the cache */
uid_t uid = strtoul(temp, NULL, 10);
store_uid_sid_cache(pdb_get_user_sid(sampass), uid);
/* We've got a uid, feed the cache */
uid_t uid = strtoul(temp, NULL, 10);
store_uid_sid_cache(pdb_get_user_sid(sampass), uid);
}
/* check the timestamp of the cache vs ldap entry */
}
/* check the timestamp of the cache vs ldap entry */
- if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
- entry)))
- return True;
+ if (!(ldap_entry_time = ldapsam_get_entry_timestamp(ldap_state,
+ entry))) {
+ ret = true;
+ goto fn_exit;
+ }
/* see if we have newer updates */
if (!(cache_entry = login_cache_read(sampass))) {
DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
(unsigned int)pdb_get_bad_password_count(sampass),
(unsigned int)pdb_get_bad_password_time(sampass)));
/* see if we have newer updates */
if (!(cache_entry = login_cache_read(sampass))) {
DEBUG (9, ("No cache entry, bad count = %u, bad time = %u\n",
(unsigned int)pdb_get_bad_password_count(sampass),
(unsigned int)pdb_get_bad_password_time(sampass)));
+ ret = true;
+ goto fn_exit;
- DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
- (unsigned int)ldap_entry_time, (unsigned int)cache_entry->entry_timestamp,
+ DEBUG(7, ("ldap time is %u, cache time is %u, bad time = %u\n",
+ (unsigned int)ldap_entry_time,
+ (unsigned int)cache_entry->entry_timestamp,
(unsigned int)cache_entry->bad_password_time));
if (ldap_entry_time > cache_entry->entry_timestamp) {
/* cache is older than directory , so
(unsigned int)cache_entry->bad_password_time));
if (ldap_entry_time > cache_entry->entry_timestamp) {
/* cache is older than directory , so
- we need to delete the entry but allow the
+ we need to delete the entry but allow the
fields to be written out */
login_cache_delentry(sampass);
} else {
/* read cache in */
fields to be written out */
login_cache_delentry(sampass);
} else {
/* read cache in */
- pdb_set_acct_ctrl(sampass,
- pdb_get_acct_ctrl(sampass) |
+ pdb_set_acct_ctrl(sampass,
+ pdb_get_acct_ctrl(sampass) |
(cache_entry->acct_ctrl & ACB_AUTOLOCK),
PDB_SET);
(cache_entry->acct_ctrl & ACB_AUTOLOCK),
PDB_SET);
- pdb_set_bad_password_count(sampass,
- cache_entry->bad_password_count,
+ pdb_set_bad_password_count(sampass,
+ cache_entry->bad_password_count,
- pdb_set_bad_password_time(sampass,
- cache_entry->bad_password_time,
+ pdb_set_bad_password_time(sampass,
+ cache_entry->bad_password_time,
+ ret = true;
+
+ fn_exit:
+
+ TALLOC_FREE(ctx);
}
/**********************************************************************
}
/**********************************************************************
(Based on init_buffer_from_sam in pdb_tdb.c)
*********************************************************************/
(Based on init_buffer_from_sam in pdb_tdb.c)
*********************************************************************/
-static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
+static bool init_ldap_from_sam (struct ldapsam_privates *ldap_state,
LDAPMessage *existing,
LDAPMod *** mods, struct samu * sampass,
bool (*need_update)(const struct samu *,
enum pdb_elements))
{
LDAPMessage *existing,
LDAPMod *** mods, struct samu * sampass,
bool (*need_update)(const struct samu *,
enum pdb_elements))
{
uint32 rid;
if (mods == NULL || sampass == NULL) {
uint32 rid;
if (mods == NULL || sampass == NULL) {
* took out adding "objectclass: sambaAccount"
* do this on a per-mod basis
*/
* took out adding "objectclass: sambaAccount"
* do this on a per-mod basis
*/
if (need_update(sampass, PDB_USERSID)) {
fstring sid_string;
const DOM_SID *user_sid = pdb_get_user_sid(sampass);
if (need_update(sampass, PDB_USERSID)) {
fstring sid_string;
const DOM_SID *user_sid = pdb_get_user_sid(sampass);
switch ( ldap_state->schema_ver ) {
case SCHEMAVER_SAMBAACCOUNT:
if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
switch ( ldap_state->schema_ver ) {
case SCHEMAVER_SAMBAACCOUNT:
if (!sid_peek_check_rid(&ldap_state->domain_sid, user_sid, &rid)) {
DEBUG(1, ("init_ldap_from_sam: User's SID (%s) is not for this domain (%s), cannot add to LDAP!\n",
- sid_string_static(user_sid),
+ sid_string_static(user_sid),
sid_string_static(&ldap_state->domain_sid)));
return False;
}
sid_string_static(&ldap_state->domain_sid)));
return False;
}
- slprintf(temp, sizeof(temp) - 1, "%i", rid);
+ if (asprintf(&temp, "%i", rid) < 0) {
+ return false;
+ }
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
temp);
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_RID),
temp);
case SCHEMAVER_SAMBASAMACCOUNT:
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
case SCHEMAVER_SAMBASAMACCOUNT:
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
- sid_to_string(sid_string, user_sid));
+ sid_to_string(sid_string, user_sid));
default:
DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
break;
default:
DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
break;
}
/* we don't need to store the primary group RID - so leaving it
}
/* we don't need to store the primary group RID - so leaving it
if (need_update(sampass, PDB_GROUPSID)) {
fstring sid_string;
const DOM_SID *group_sid = pdb_get_group_sid(sampass);
if (need_update(sampass, PDB_GROUPSID)) {
fstring sid_string;
const DOM_SID *group_sid = pdb_get_group_sid(sampass);
switch ( ldap_state->schema_ver ) {
case SCHEMAVER_SAMBAACCOUNT:
if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
switch ( ldap_state->schema_ver ) {
case SCHEMAVER_SAMBAACCOUNT:
if (!sid_peek_check_rid(&ldap_state->domain_sid, group_sid, &rid)) {
- slprintf(temp, sizeof(temp) - 1, "%i", rid);
+ if (asprintf(&temp, "%i", rid) < 0) {
+ return false;
+ }
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver,
LDAP_ATTR_PRIMARY_GROUP_RID), temp);
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver,
LDAP_ATTR_PRIMARY_GROUP_RID), temp);
case SCHEMAVER_SAMBASAMACCOUNT:
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver,
LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
break;
case SCHEMAVER_SAMBASAMACCOUNT:
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver,
LDAP_ATTR_PRIMARY_GROUP_SID), sid_to_string(sid_string, group_sid));
break;
default:
DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
break;
}
default:
DEBUG(0,("init_ldap_from_sam: unknown schema version specified\n"));
break;
}
/* displayName, cn, and gecos should all be the same
* most easily accomplished by giving them the same OID
/* displayName, cn, and gecos should all be the same
* most easily accomplished by giving them the same OID
- * gecos isn't set here b/c it should be handled by the
+ * gecos isn't set here b/c it should be handled by the
* add-user script
* We change displayName only and fall back to cn if
* it does not exist.
* add-user script
* We change displayName only and fall back to cn if
* it does not exist.
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
pdb_get_workstations(sampass));
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_WKS),
pdb_get_workstations(sampass));
if (need_update(sampass, PDB_MUNGEDDIAL))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
pdb_get_munged_dial(sampass));
if (need_update(sampass, PDB_MUNGEDDIAL))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_MUNGED_DIAL),
pdb_get_munged_dial(sampass));
if (need_update(sampass, PDB_SMBHOME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
pdb_get_homedir(sampass));
if (need_update(sampass, PDB_SMBHOME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_PATH),
pdb_get_homedir(sampass));
if (need_update(sampass, PDB_DRIVE))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
if (need_update(sampass, PDB_DRIVE))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_HOME_DRIVE),
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
pdb_get_profile_path(sampass));
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PROFILE_PATH),
pdb_get_profile_path(sampass));
- slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logon_time(sampass));
+ if (asprintf(&temp, "%li", pdb_get_logon_time(sampass)) < 0) {
+ return false;
+ }
if (need_update(sampass, PDB_LOGONTIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
if (need_update(sampass, PDB_LOGONTIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGON_TIME), temp);
- slprintf(temp, sizeof(temp) - 1, "%li", pdb_get_logoff_time(sampass));
+ if (asprintf(&temp, "%li", pdb_get_logoff_time(sampass)) < 0) {
+ return false;
+ }
if (need_update(sampass, PDB_LOGOFFTIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
if (need_update(sampass, PDB_LOGOFFTIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LOGOFF_TIME), temp);
- slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_kickoff_time(sampass));
+ if (asprintf(&temp, "%li", pdb_get_kickoff_time(sampass)) < 0) {
+ return false;
+ }
if (need_update(sampass, PDB_KICKOFFTIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
if (need_update(sampass, PDB_KICKOFFTIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_KICKOFF_TIME), temp);
- slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_can_change_time_noncalc(sampass));
+ if (asprintf(&temp, "%li", pdb_get_pass_can_change_time_noncalc(sampass)) < 0) {
+ return false;
+ }
if (need_update(sampass, PDB_CANCHANGETIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
if (need_update(sampass, PDB_CANCHANGETIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_CAN_CHANGE), temp);
- slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_must_change_time(sampass));
+ if (asprintf(&temp, "%li", pdb_get_pass_must_change_time(sampass)) < 0) {
+ return false;
+ }
if (need_update(sampass, PDB_MUSTCHANGETIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
if (need_update(sampass, PDB_MUSTCHANGETIME))
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_MUST_CHANGE), temp);
if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST))
|| (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
if (need_update(sampass, PDB_LMPASSWD)) {
if ((pdb_get_acct_ctrl(sampass)&(ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST))
|| (lp_ldap_passwd_sync()!=LDAP_PASSWD_SYNC_ONLY)) {
if (need_update(sampass, PDB_LMPASSWD)) {
- const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
+ const uchar *lm_pw = pdb_get_lanman_passwd(sampass);
- pdb_sethexpwd(temp, lm_pw,
+ char pwstr[34];
+ pdb_sethexpwd(pwstr, lm_pw,
pdb_get_acct_ctrl(sampass));
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
pdb_get_acct_ctrl(sampass));
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
} else {
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
} else {
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_LMPW),
}
}
if (need_update(sampass, PDB_NTPASSWD)) {
}
}
if (need_update(sampass, PDB_NTPASSWD)) {
- const uchar *nt_pw = pdb_get_nt_passwd(sampass);
+ const uchar *nt_pw = pdb_get_nt_passwd(sampass);
- pdb_sethexpwd(temp, nt_pw,
+ char pwstr[34];
+ pdb_sethexpwd(pwstr, nt_pw,
pdb_get_acct_ctrl(sampass));
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
pdb_get_acct_ctrl(sampass));
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
} else {
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
} else {
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_NTPW),
}
if (need_update(sampass, PDB_PWHISTORY)) {
}
if (need_update(sampass, PDB_PWHISTORY)) {
uint32 pwHistLen = 0;
pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
uint32 pwHistLen = 0;
pdb_get_account_policy(AP_PASSWORD_HISTORY, &pwHistLen);
+
+ pwstr = SMB_MALLOC_ARRAY(char, 1024);
+ if (!pwstr) {
+ return false;
+ }
if (pwHistLen == 0) {
/* Remove any password history from the LDAP store. */
if (pwHistLen == 0) {
/* Remove any password history from the LDAP store. */
- memset(temp, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
- temp[64] = '\0';
+ memset(pwstr, '0', 64); /* NOTE !!!! '0' *NOT '\0' */
+ pwstr[64] = '\0';
uint32 currHistLen = 0;
const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
if (pwhist != NULL) {
uint32 currHistLen = 0;
const uint8 *pwhist = pdb_get_pw_history(sampass, &currHistLen);
if (pwhist != NULL) {
- /* We can only store (sizeof(pstring)-1)/64 password history entries. */
- pwHistLen = MIN(pwHistLen, ((sizeof(temp)-1)/64));
+ /* We can only store (1024-1/64 password history entries. */
+ pwHistLen = MIN(pwHistLen, ((1024-1)/64));
for (i=0; i< pwHistLen && i < currHistLen; i++) {
/* Store the salt. */
for (i=0; i< pwHistLen && i < currHistLen; i++) {
/* Store the salt. */
- pdb_sethexpwd(&temp[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN], 0);
+ pdb_sethexpwd(&pwstr[i*64], &pwhist[i*PW_HISTORY_ENTRY_LEN], 0);
/* Followed by the md5 hash of salt + md4 hash */
/* Followed by the md5 hash of salt + md4 hash */
- pdb_sethexpwd(&temp[(i*64)+32],
+ pdb_sethexpwd(&pwstr[(i*64)+32],
&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
&pwhist[(i*PW_HISTORY_ENTRY_LEN)+PW_HISTORY_SALT_LEN], 0);
- DEBUG(100, ("temp=%s\n", temp));
+ DEBUG(100, ("pwstr=%s\n", pwstr));
}
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
}
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_HISTORY),
+ pwstr);
+ SAFE_FREE(pwstr);
}
if (need_update(sampass, PDB_PASSLASTSET)) {
}
if (need_update(sampass, PDB_PASSLASTSET)) {
- slprintf (temp, sizeof (temp) - 1, "%li", pdb_get_pass_last_set_time(sampass));
+ if (asprintf(&temp, "%li",
+ pdb_get_pass_last_set_time(sampass)) < 0) {
+ return false;
+ }
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
temp);
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct, existing, mods,
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_PWD_LAST_SET),
temp);
}
}
if (need_update(sampass, PDB_HOURS)) {
const uint8 *hours = pdb_get_hours(sampass);
if (hours) {
}
}
if (need_update(sampass, PDB_HOURS)) {
const uint8 *hours = pdb_get_hours(sampass);
if (hours) {
- pdb_sethexhours(temp, hours);
+ char hourstr[44];
+ pdb_sethexhours(hourstr, hours);
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
existing,
mods,
get_userattr_key2string(ldap_state->schema_ver,
LDAP_ATTR_LOGON_HOURS),
smbldap_make_mod(ldap_state->smbldap_state->ldap_struct,
existing,
mods,
get_userattr_key2string(ldap_state->schema_ver,
LDAP_ATTR_LOGON_HOURS),
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_ACB_INFO),
pdb_encode_acct_ctrl (pdb_get_acct_ctrl(sampass), NEW_PW_FORMAT_SPACE_PADDED_LEN));
- /* password lockout cache:
+ /* password lockout cache:
- If we are now autolocking or clearing, we write to ldap
- If we are clearing, we delete the cache entry
- If the count is > 0, we update the cache
- If we are now autolocking or clearing, we write to ldap
- If we are clearing, we delete the cache entry
- If the count is > 0, we update the cache
if ((badcount >= pol) || (badcount == 0)) {
DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
(unsigned int)badcount, (unsigned int)badtime));
if ((badcount >= pol) || (badcount == 0)) {
DEBUG(7, ("making mods to update ldap, count=%u, time=%u\n",
(unsigned int)badcount, (unsigned int)badtime));
- slprintf (temp, sizeof (temp) - 1, "%li", (long)badcount);
+ if (asprintf(&temp, "%li", (long)badcount) < 0) {
+ return false;
+ }
smbldap_make_mod(
ldap_state->smbldap_state->ldap_struct,
smbldap_make_mod(
ldap_state->smbldap_state->ldap_struct,
- ldap_state->schema_ver,
+ ldap_state->schema_ver,
LDAP_ATTR_BAD_PASSWORD_COUNT),
temp);
LDAP_ATTR_BAD_PASSWORD_COUNT),
temp);
- slprintf (temp, sizeof (temp) - 1, "%li", badtime);
+ if (asprintf(&temp, "%li", badtime) < 0) {
+ return false;
+ }
- ldap_state->smbldap_state->ldap_struct,
+ ldap_state->smbldap_state->ldap_struct,
existing, mods,
get_userattr_key2string(
existing, mods,
get_userattr_key2string(
- ldap_state->schema_ver,
- LDAP_ATTR_BAD_PASSWORD_TIME),
+ ldap_state->schema_ver,
+ LDAP_ATTR_BAD_PASSWORD_TIME),
}
if (badcount == 0) {
DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
}
if (badcount == 0) {
DEBUG(7, ("bad password count is reset, deleting login cache entry for %s\n", pdb_get_nt_username(sampass)));
{
struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
int rc;
{
struct ldapsam_privates *ldap_state = (struct ldapsam_privates *)my_methods->private_data;
int rc;
- pstring filter, suffix;
+ char *filter = NULL;
+ const char *suffix;
const char **attr_list;
bool machine_mask = False, user_mask = False;
const char **attr_list;
bool machine_mask = False, user_mask = False;
+ NTSTATUS status = NT_STATUS_OK;
+ TALLOC_CTX *ctx = talloc_init("ldapsam_setsampwent");
- pstr_sprintf( filter, "(&%s%s)", "(uid=%u)",
+ if (!ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ filter = talloc_asprintf(ctx, "(&%s%s)", "(uid=%u)",
get_objclass_filter(ldap_state->schema_ver));
get_objclass_filter(ldap_state->schema_ver));
- all_string_sub(filter, "%u", "*", sizeof(pstring));
+ if (!filter) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
+
+ filter = talloc_all_string_sub(ctx, filter, "%u", "*");
+ if (!filter) {
+ status = NT_STATUS_NO_MEMORY;
+ goto out;
+ }
machine_mask = ((acb_mask != 0) && (acb_mask & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)));
user_mask = ((acb_mask != 0) && (acb_mask & ACB_NORMAL));
if (machine_mask) {
machine_mask = ((acb_mask != 0) && (acb_mask & (ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST)));
user_mask = ((acb_mask != 0) && (acb_mask & ACB_NORMAL));
if (machine_mask) {
- pstrcpy(suffix, lp_ldap_machine_suffix());
+ suffix = lp_ldap_machine_suffix();
- pstrcpy(suffix, lp_ldap_user_suffix());
+ suffix = lp_ldap_user_suffix();
- pstrcpy(suffix, lp_ldap_suffix());
+ suffix = lp_ldap_suffix();
}
DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n",
}
DEBUG(10,("ldapsam_setsampwent: LDAP Query for acb_mask 0x%x will use suffix %s\n",
DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix, filter));
ldap_msgfree(ldap_state->result);
ldap_state->result = NULL;
DEBUG(3, ("ldapsam_setsampwent: Query was: %s, %s\n", suffix, filter));
ldap_msgfree(ldap_state->result);
ldap_state->result = NULL;
- return NT_STATUS_UNSUCCESSFUL;
+ status = NT_STATUS_UNSUCCESSFUL;
+ goto out;
}
DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
}
DEBUG(2, ("ldapsam_setsampwent: %d entries in the base %s\n",
- ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
+ ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
ldap_state->result), suffix));
ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
ldap_state->result);
ldap_state->index = 0;
ldap_state->result), suffix));
ldap_state->entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
ldap_state->result);
ldap_state->index = 0;
+ out:
+
+ TALLOC_FREE(ctx);
+ return status;
}
/**********************************************************************
}
/**********************************************************************
***************************************************************************/
static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
***************************************************************************/
static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
const char *newname)
{
const char *oldname;
int rc;
const char *newname)
{
const char *oldname;
int rc;
+ char *rename_script = NULL;
fstring oldname_lower, newname_lower;
if (!old_acct) {
fstring oldname_lower, newname_lower;
if (!old_acct) {
DEBUG(0, ("ldapsam_rename_sam_account: newname was NULL!\n"));
return NT_STATUS_INVALID_PARAMETER;
}
DEBUG(0, ("ldapsam_rename_sam_account: newname was NULL!\n"));
return NT_STATUS_INVALID_PARAMETER;
}
oldname = pdb_get_username(old_acct);
oldname = pdb_get_username(old_acct);
- /* rename the posix user */
- pstrcpy(rename_script, lp_renameuser_script());
+ /* rename the posix user */
+ rename_script = SMB_STRDUP(lp_renameuser_script());
+ if (rename_script) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ if (!(*rename_script)) {
+ SAFE_FREE(rename_script);
return NT_STATUS_ACCESS_DENIED;
return NT_STATUS_ACCESS_DENIED;
- DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
+ DEBUG (3, ("ldapsam_rename_sam_account: Renaming user %s to %s.\n",
oldname, newname));
/* We have to allow the account name to end with a '$'.
oldname, newname));
/* We have to allow the account name to end with a '$'.
strlower_m( oldname_lower );
fstrcpy( newname_lower, newname );
strlower_m( newname_lower );
strlower_m( oldname_lower );
fstrcpy( newname_lower, newname );
strlower_m( newname_lower );
- string_sub2(rename_script, "%unew", newname_lower, sizeof(pstring),
- True, False, True);
- string_sub2(rename_script, "%uold", oldname_lower, sizeof(pstring),
- True, False, True);
+ rename_script = realloc_string_sub2(rename_script,
+ "%unew",
+ newname_lower,
+ true,
+ true);
+ if (rename_script) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ rename_script = realloc_string_sub2(rename_script,
+ "%uold",
+ oldname_lower,
+ true,
+ true);
rc = smbrun(rename_script, NULL);
rc = smbrun(rename_script, NULL);
- DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n",
+ DEBUG(rc ? 0 : 3,("Running the command `%s' gave %d\n",
+ SAFE_FREE(rename_script);
+
if (rc == 0) {
smb_nscd_flush_user_cache();
}
if (rc == 0) {
smb_nscd_flush_user_cache();
}
int rc;
LDAPMessage *result = NULL;
LDAPMessage *entry = NULL;
int rc;
LDAPMessage *result = NULL;
LDAPMessage *entry = NULL;
LDAPMod **mods = NULL;
int ldap_op = LDAP_MOD_REPLACE;
uint32 num_result;
const char **attr_list;
LDAPMod **mods = NULL;
int ldap_op = LDAP_MOD_REPLACE;
uint32 num_result;
const char **attr_list;
+ char *escape_user = NULL;
const char *username = pdb_get_username(newpwd);
const DOM_SID *sid = pdb_get_user_sid(newpwd);
const char *username = pdb_get_username(newpwd);
const DOM_SID *sid = pdb_get_user_sid(newpwd);
+ char *filter = NULL;
+ char *dn = NULL;
+ NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+ TALLOC_CTX *ctx = talloc_init("ldapsam_add_sam_account");
+
+ if (!ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
if (!username || !*username) {
DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
if (!username || !*username) {
DEBUG(0, ("ldapsam_add_sam_account: Cannot add user without a username!\n"));
- return NT_STATUS_INVALID_PARAMETER;
+ status = NT_STATUS_INVALID_PARAMETER;
+ goto fn_exit;
}
/* free this list after the second search or in case we exit on failure */
}
/* free this list after the second search or in case we exit on failure */
- attr_list = get_userattr_list(NULL, ldap_state->schema_ver);
+ attr_list = get_userattr_list(ctx, ldap_state->schema_ver);
rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
if (rc != LDAP_SUCCESS) {
rc = ldapsam_search_suffix_by_name (ldap_state, username, &result, attr_list);
if (rc != LDAP_SUCCESS) {
- TALLOC_FREE( attr_list );
- return NT_STATUS_UNSUCCESSFUL;
}
if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
username));
}
if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
DEBUG(0,("ldapsam_add_sam_account: User '%s' already in the base, with samba attributes\n",
username));
- ldap_msgfree(result);
- TALLOC_FREE( attr_list );
- return NT_STATUS_UNSUCCESSFUL;
}
ldap_msgfree(result);
result = NULL;
if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
}
ldap_msgfree(result);
result = NULL;
if (element_is_set_or_changed(newpwd, PDB_USERSID)) {
- rc = ldapsam_get_ldap_user_by_sid(ldap_state,
- sid, &result);
+ rc = ldapsam_get_ldap_user_by_sid(ldap_state,
+ sid, &result);
if (rc == LDAP_SUCCESS) {
if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n",
sid_to_string(sid_string, sid)));
if (rc == LDAP_SUCCESS) {
if (ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result) != 0) {
DEBUG(0,("ldapsam_add_sam_account: SID '%s' already in the base, with samba attributes\n",
sid_to_string(sid_string, sid)));
- TALLOC_FREE( attr_list );
- ldap_msgfree(result);
- return NT_STATUS_UNSUCCESSFUL;
}
}
/* does the entry already exist but without a samba attributes?
we need to return the samba attributes here */
}
}
/* does the entry already exist but without a samba attributes?
we need to return the samba attributes here */
escape_user = escape_ldap_string_alloc( username );
escape_user = escape_ldap_string_alloc( username );
- pstrcpy( filter, "(uid=%u)" );
- all_string_sub( filter, "%u", escape_user, sizeof(filter) );
- SAFE_FREE( escape_user );
+ filter = talloc_strdup(attr_list, "(uid=%u)");
+ if (!filter) {
+ status = NT_STATUS_NO_MEMORY;
+ goto fn_exit;
+ }
+ filter = talloc_all_string_sub(attr_list, filter, "%u", escape_user);
+ if (!filter) {
+ status = NT_STATUS_NO_MEMORY;
+ goto fn_exit;
+ }
+ SAFE_FREE(escape_user);
- rc = smbldap_search_suffix(ldap_state->smbldap_state,
+ rc = smbldap_search_suffix(ldap_state->smbldap_state,
filter, attr_list, &result);
if ( rc != LDAP_SUCCESS ) {
filter, attr_list, &result);
if ( rc != LDAP_SUCCESS ) {
- TALLOC_FREE( attr_list );
- return NT_STATUS_UNSUCCESSFUL;
}
num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
}
num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
if (num_result > 1) {
DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
if (num_result > 1) {
DEBUG (0, ("ldapsam_add_sam_account: More than one user with that uid exists: bailing out!\n"));
- TALLOC_FREE( attr_list );
- ldap_msgfree(result);
- return NT_STATUS_UNSUCCESSFUL;
/* Check if we need to update an existing entry */
if (num_result == 1) {
char *tmp;
/* Check if we need to update an existing entry */
if (num_result == 1) {
char *tmp;
DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
ldap_op = LDAP_MOD_REPLACE;
entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
ldap_op = LDAP_MOD_REPLACE;
entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
- tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
+ tmp = smbldap_get_dn(ldap_state->smbldap_state->ldap_struct, entry);
- TALLOC_FREE( attr_list );
- ldap_msgfree(result);
- return NT_STATUS_UNSUCCESSFUL;
- slprintf (dn, sizeof (dn) - 1, "%s", tmp);
+ dn = talloc_asprintf(ctx, "%s", tmp);
+ if (!dn) {
+ status = NT_STATUS_NO_MEMORY;
+ goto fn_exit;
+ }
} else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
/* There might be a SID for this account already - say an idmap entry */
} else if (ldap_state->schema_ver == SCHEMAVER_SAMBASAMACCOUNT) {
/* There might be a SID for this account already - say an idmap entry */
- pstr_sprintf(filter, "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))",
- get_userattr_key2string(ldap_state->schema_ver, LDAP_ATTR_USER_SID),
- sid_to_string(sid_string, sid),
- LDAP_OBJ_IDMAP_ENTRY,
- LDAP_OBJ_SID_ENTRY);
-
+ filter = talloc_asprintf(ctx,
+ "(&(%s=%s)(|(objectClass=%s)(objectClass=%s)))",
+ get_userattr_key2string(ldap_state->schema_ver,
+ LDAP_ATTR_USER_SID),
+ sid_to_string(sid_string, sid),
+ LDAP_OBJ_IDMAP_ENTRY,
+ LDAP_OBJ_SID_ENTRY);
+ if (!filter) {
+ status = NT_STATUS_NO_MEMORY;
+ goto fn_exit;
+ }
+
/* free old result before doing a new search */
if (result != NULL) {
ldap_msgfree(result);
result = NULL;
}
/* free old result before doing a new search */
if (result != NULL) {
ldap_msgfree(result);
result = NULL;
}
- rc = smbldap_search_suffix(ldap_state->smbldap_state,
+ rc = smbldap_search_suffix(ldap_state->smbldap_state,
filter, attr_list, &result);
filter, attr_list, &result);
if ( rc != LDAP_SUCCESS ) {
if ( rc != LDAP_SUCCESS ) {
- TALLOC_FREE( attr_list );
- return NT_STATUS_UNSUCCESSFUL;
num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
num_result = ldap_count_entries(ldap_state->smbldap_state->ldap_struct, result);
if (num_result > 1) {
DEBUG (0, ("ldapsam_add_sam_account: More than one user with specified Sid exists: bailing out!\n"));
if (num_result > 1) {
DEBUG (0, ("ldapsam_add_sam_account: More than one user with specified Sid exists: bailing out!\n"));
- TALLOC_FREE( attr_list );
- ldap_msgfree(result);
- return NT_STATUS_UNSUCCESSFUL;
/* Check if we need to update an existing entry */
if (num_result == 1) {
char *tmp;
/* Check if we need to update an existing entry */
if (num_result == 1) {
char *tmp;
DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
ldap_op = LDAP_MOD_REPLACE;
entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
if (!tmp) {
DEBUG(3,("ldapsam_add_sam_account: User exists without samba attributes: adding them\n"));
ldap_op = LDAP_MOD_REPLACE;
entry = ldap_first_entry (ldap_state->smbldap_state->ldap_struct, result);
tmp = smbldap_get_dn (ldap_state->smbldap_state->ldap_struct, entry);
if (!tmp) {
- TALLOC_FREE( attr_list );
- ldap_msgfree(result);
- return NT_STATUS_UNSUCCESSFUL;
- slprintf (dn, sizeof (dn) - 1, "%s", tmp);
+ dn = talloc_asprintf(ctx, "%s", tmp);
+ if (!dn) {
+ status = NT_STATUS_NO_MEMORY;
+ goto fn_exit;
+ }
-
- TALLOC_FREE( attr_list );
if (num_result == 0) {
char *escape_username;
if (num_result == 0) {
char *escape_username;
escape_username = escape_rdn_val_string_alloc(username);
if (!escape_username) {
escape_username = escape_rdn_val_string_alloc(username);
if (!escape_username) {
- DEBUG(0, ("Out of memory!\n"));
- ldap_msgfree(result);
- return NT_STATUS_NO_MEMORY;
+ status = NT_STATUS_NO_MEMORY;
+ goto fn_exit;
}
if (username[strlen(username)-1] == '$') {
}
if (username[strlen(username)-1] == '$') {
- slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", escape_username, lp_ldap_machine_suffix ());
+ dn = talloc_asprintf(ctx,
+ "uid=%s,%s",
+ escape_username,
+ lp_ldap_machine_suffix());
- slprintf (dn, sizeof (dn) - 1, "uid=%s,%s", escape_username, lp_ldap_user_suffix ());
+ dn = talloc_asprintf(ctx,
+ "uid=%s,%s",
+ escape_username,
+ lp_ldap_user_suffix());
}
SAFE_FREE(escape_username);
}
SAFE_FREE(escape_username);
+ if (!dn) {
+ status = NT_STATUS_NO_MEMORY;
+ goto fn_exit;
+ }
}
if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
element_is_set_or_changed)) {
DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
}
if (!init_ldap_from_sam(ldap_state, entry, &mods, newpwd,
element_is_set_or_changed)) {
DEBUG(0, ("ldapsam_add_sam_account: init_ldap_from_sam failed!\n"));
- ldap_msgfree(result);
- if (mods != NULL)
- ldap_mods_free(mods,True);
- return NT_STATUS_UNSUCCESSFUL;
+ if (mods != NULL) {
+ ldap_mods_free(mods, true);
+ }
+ goto fn_exit;
-
- ldap_msgfree(result);
if (mods == NULL) {
DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
if (mods == NULL) {
DEBUG(0,("ldapsam_add_sam_account: mods is empty: nothing to add for user: %s\n",pdb_get_username(newpwd)));
- return NT_STATUS_UNSUCCESSFUL;
}
switch ( ldap_state->schema_ver ) {
case SCHEMAVER_SAMBAACCOUNT:
}
switch ( ldap_state->schema_ver ) {
case SCHEMAVER_SAMBAACCOUNT:
if (!NT_STATUS_IS_OK(ret)) {
DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
pdb_get_username(newpwd),dn));
if (!NT_STATUS_IS_OK(ret)) {
DEBUG(0,("ldapsam_add_sam_account: failed to modify/add user with uid = %s (dn = %s)\n",
pdb_get_username(newpwd),dn));
- ldap_mods_free(mods, True);
- return ret;
+ ldap_mods_free(mods, true);
+ goto fn_exit;
}
DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
}
DEBUG(2,("ldapsam_add_sam_account: added: uid == %s in the LDAP database\n", pdb_get_username(newpwd)));
- ldap_mods_free(mods, True);
-
- return NT_STATUS_OK;
+ ldap_mods_free(mods, true);
+
+ status = NT_STATUS_OK;
+
+ fn_exit:
+
+ TALLOC_FREE(ctx);
+ SAFE_FREE(escape_user);
+ if (result) {
+ ldap_msgfree(result);
+ }
+ return status;
}
/**********************************************************************
}
/**********************************************************************
const char **attr_list;
attr_list = get_attr_list(NULL, groupmap_attr_list);
const char **attr_list;
attr_list = get_attr_list(NULL, groupmap_attr_list);
- rc = smbldap_search(ldap_state->smbldap_state,
+ rc = smbldap_search(ldap_state->smbldap_state,
lp_ldap_group_suffix (), scope,
filter, attr_list, 0, result);
TALLOC_FREE(attr_list);
lp_ldap_group_suffix (), scope,
filter, attr_list, 0, result);
TALLOC_FREE(attr_list);
static bool init_group_from_ldap(struct ldapsam_privates *ldap_state,
GROUP_MAP *map, LDAPMessage *entry)
{
static bool init_group_from_ldap(struct ldapsam_privates *ldap_state,
GROUP_MAP *map, LDAPMessage *entry)
{
+ char *temp = NULL;
+ TALLOC_CTX *ctx = talloc_init("init_group_from_ldap");
if (ldap_state == NULL || map == NULL || entry == NULL ||
ldap_state->smbldap_state->ldap_struct == NULL) {
DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
if (ldap_state == NULL || map == NULL || entry == NULL ||
ldap_state->smbldap_state->ldap_struct == NULL) {
DEBUG(0, ("init_group_from_ldap: NULL parameters found!\n"));
+ TALLOC_FREE(ctx);
+ return false;
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER), temp)) {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_attr_key2string(groupmap_attr_list,
+ LDAP_ATTR_GIDNUMBER),
+ ctx);
+ if (!temp) {
DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GIDNUMBER)));
+ TALLOC_FREE(ctx);
+ return false;
}
DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
map->gid = (gid_t)atol(temp);
}
DEBUG(2, ("init_group_from_ldap: Entry found for group: %s\n", temp));
map->gid = (gid_t)atol(temp);
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID), temp)) {
+ TALLOC_FREE(temp);
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_attr_key2string(groupmap_attr_list,
+ LDAP_ATTR_GROUP_SID),
+ ctx);
+ if (!temp) {
DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_SID)));
+ TALLOC_FREE(ctx);
+ return false;
if (!string_to_sid(&map->sid, temp)) {
DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
if (!string_to_sid(&map->sid, temp)) {
DEBUG(1, ("SID string [%s] could not be read as a valid SID\n", temp));
+ TALLOC_FREE(ctx);
+ return false;
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE), temp)) {
+ TALLOC_FREE(temp);
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_attr_key2string(groupmap_attr_list,
+ LDAP_ATTR_GROUP_TYPE),
+ ctx);
+ if (!temp) {
DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
DEBUG(0, ("init_group_from_ldap: Mandatory attribute %s not found\n",
get_attr_key2string( groupmap_attr_list, LDAP_ATTR_GROUP_TYPE)));
+ TALLOC_FREE(ctx);
+ return false;
}
map->sid_name_use = (enum lsa_SidType)atol(temp);
if ((map->sid_name_use < SID_NAME_USER) ||
(map->sid_name_use > SID_NAME_UNKNOWN)) {
DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
}
map->sid_name_use = (enum lsa_SidType)atol(temp);
if ((map->sid_name_use < SID_NAME_USER) ||
(map->sid_name_use > SID_NAME_UNKNOWN)) {
DEBUG(0, ("init_group_from_ldap: Unknown Group type: %d\n", map->sid_name_use));
+ TALLOC_FREE(ctx);
+ return false;
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), temp)) {
- temp[0] = '\0';
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_attr_key2string( groupmap_attr_list, LDAP_ATTR_CN), temp))
- {
+ TALLOC_FREE(temp);
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_attr_key2string(groupmap_attr_list,
+ LDAP_ATTR_DISPLAY_NAME),
+ ctx);
+ if (!temp) {
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_attr_key2string(groupmap_attr_list,
+ LDAP_ATTR_CN),
+ ctx);
+ if (!temp) {
DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
for gidNumber(%lu)\n",(unsigned long)map->gid));
DEBUG(0, ("init_group_from_ldap: Attributes cn not found either \
for gidNumber(%lu)\n",(unsigned long)map->gid));
+ TALLOC_FREE(ctx);
+ return false;
}
}
fstrcpy(map->nt_name, temp);
}
}
fstrcpy(map->nt_name, temp);
- if (!smbldap_get_single_pstring(ldap_state->smbldap_state->ldap_struct, entry,
- get_attr_key2string( groupmap_attr_list, LDAP_ATTR_DESC), temp)) {
- temp[0] = '\0';
+ TALLOC_FREE(temp);
+ temp = smbldap_talloc_single_attribute(
+ ldap_state->smbldap_state->ldap_struct,
+ entry,
+ get_attr_key2string(groupmap_attr_list,
+ LDAP_ATTR_DESC),
+ ctx);
+ if (!temp) {
+ temp = talloc_strdup(ctx, "");
+ if (!temp) {
+ TALLOC_FREE(ctx);
+ return false;
+ }
}
fstrcpy(map->comment, temp);
}
fstrcpy(map->comment, temp);
- if (lp_parm_bool(-1, "ldapsam", "trusted", False)) {
+ if (lp_parm_bool(-1, "ldapsam", "trusted", false)) {
store_gid_sid_cache(&map->sid, map->gid);
}
store_gid_sid_cache(&map->sid, map->gid);
}
+ TALLOC_FREE(ctx);
+ return true;
}
/**********************************************************************
}
/**********************************************************************
static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
DOM_SID sid)
{
static NTSTATUS ldapsam_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
DOM_SID sid)
{
+ char *filter = NULL;
+ NTSTATUS status;
- pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))",
- LDAP_OBJ_GROUPMAP,
+ if (asprintf(&filter, "(&(objectClass=%s)(%s=%s))",
+ LDAP_OBJ_GROUPMAP,
get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GROUP_SID),
- sid_string_static(&sid));
+ sid_string_static(&sid)) < 0) {
+ return NT_STATUS_NO_MEMORY;
+ }
- return ldapsam_getgroup(methods, filter, map);
+ status = ldapsam_getgroup(methods, filter, map);
+ SAFE_FREE(filter);
+ return status;
}
/**********************************************************************
}
/**********************************************************************
static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
gid_t gid)
{
static NTSTATUS ldapsam_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
gid_t gid)
{
+ char *filter = NULL;
+ NTSTATUS status;
- pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))",
+ if (asprintf(&filter, "(&(objectClass=%s)(%s=%lu))",
LDAP_OBJ_GROUPMAP,
get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
LDAP_OBJ_GROUPMAP,
get_attr_key2string(groupmap_attr_list, LDAP_ATTR_GIDNUMBER),
+ (unsigned long)gid) < 0) {
+ return NT_STATUS_NO_MEMORY;
+ }
- return ldapsam_getgroup(methods, filter, map);
+ status = ldapsam_getgroup(methods, filter, map);
+ SAFE_FREE(filter);
+ return status;
}
/**********************************************************************
}
/**********************************************************************
static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
const char *name)
{
static NTSTATUS ldapsam_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
const char *name)
{
char *escape_name = escape_ldap_string_alloc(name);
char *escape_name = escape_ldap_string_alloc(name);
if (!escape_name) {
return NT_STATUS_NO_MEMORY;
}
if (!escape_name) {
return NT_STATUS_NO_MEMORY;
}
- pstr_sprintf(filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
+ if (asprintf(&filter, "(&(objectClass=%s)(|(%s=%s)(%s=%s)))",
LDAP_OBJ_GROUPMAP,
get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
LDAP_OBJ_GROUPMAP,
get_attr_key2string(groupmap_attr_list, LDAP_ATTR_DISPLAY_NAME), escape_name,
- get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN), escape_name);
+ get_attr_key2string(groupmap_attr_list, LDAP_ATTR_CN),
+ escape_name) < 0) {
+ SAFE_FREE(escape_name);
+ return NT_STATUS_NO_MEMORY;
+ }
-
- return ldapsam_getgroup(methods, filter, map);
+ status = ldapsam_getgroup(methods, filter, map);
+ SAFE_FREE(filter);
+ return status;
}
static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
}
static bool ldapsam_extract_rid_from_entry(LDAP *ldap_struct,
{
struct ldapsam_privates *ldap_state =
(struct ldapsam_privates *)methods->private_data;
{
struct ldapsam_privates *ldap_state =
(struct ldapsam_privates *)methods->private_data;
LDAPMessage *result = NULL;
LDAPMessage *entry = NULL;
int count;
LDAPMessage *result = NULL;
LDAPMessage *entry = NULL;
int count;
int rc;
enum lsa_SidType type = SID_NAME_USE_NONE;
int rc;
enum lsa_SidType type = SID_NAME_USE_NONE;
if (sid_check_is_in_builtin(alias)) {
type = SID_NAME_ALIAS;
if (sid_check_is_in_builtin(alias)) {
type = SID_NAME_ALIAS;
return NT_STATUS_NO_SUCH_ALIAS;
}
return NT_STATUS_NO_SUCH_ALIAS;
}
"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
LDAP_OBJ_GROUPMAP, sid_string_static(alias),
"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
LDAP_OBJ_GROUPMAP, sid_string_static(alias),
+ type) < 0) {
+ return NT_STATUS_NO_MEMORY;
+ }
if (ldapsam_search_one_group(ldap_state, filter,
if (ldapsam_search_one_group(ldap_state, filter,
- &result) != LDAP_SUCCESS)
+ &result) != LDAP_SUCCESS) {
+ SAFE_FREE(filter);
return NT_STATUS_NO_SUCH_ALIAS;
return NT_STATUS_NO_SUCH_ALIAS;
count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
result);
count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
result);
if (count < 1) {
DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
ldap_msgfree(result);
if (count < 1) {
DEBUG(4, ("ldapsam_modify_aliasmem: Did not find alias\n"));
ldap_msgfree(result);
return NT_STATUS_NO_SUCH_ALIAS;
}
return NT_STATUS_NO_SUCH_ALIAS;
}
DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for "
"filter %s: count=%d\n", filter, count));
ldap_msgfree(result);
DEBUG(1, ("ldapsam_modify_aliasmem: Duplicate entries for "
"filter %s: count=%d\n", filter, count));
ldap_msgfree(result);
return NT_STATUS_NO_SUCH_ALIAS;
}
return NT_STATUS_NO_SUCH_ALIAS;
}
entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
result);
entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
result);
LDAPMessage *result = NULL;
LDAPMessage *entry = NULL;
int count;
LDAPMessage *result = NULL;
LDAPMessage *entry = NULL;
int count;
size_t num_members = 0;
enum lsa_SidType type = SID_NAME_USE_NONE;
size_t num_members = 0;
enum lsa_SidType type = SID_NAME_USE_NONE;
return NT_STATUS_NO_SUCH_ALIAS;
}
return NT_STATUS_NO_SUCH_ALIAS;
}
"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
LDAP_OBJ_GROUPMAP, sid_string_static(alias),
"(&(objectClass=%s)(sambaSid=%s)(sambaGroupType=%d))",
LDAP_OBJ_GROUPMAP, sid_string_static(alias),
+ type) < 0) {
+ return NT_STATUS_NO_MEMORY;
+ }
if (ldapsam_search_one_group(ldap_state, filter,
if (ldapsam_search_one_group(ldap_state, filter,
- &result) != LDAP_SUCCESS)
+ &result) != LDAP_SUCCESS) {
+ SAFE_FREE(filter);
return NT_STATUS_NO_SUCH_ALIAS;
return NT_STATUS_NO_SUCH_ALIAS;
count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
result);
count = ldap_count_entries(ldap_state->smbldap_state->ldap_struct,
result);
if (count < 1) {
DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
ldap_msgfree(result);
if (count < 1) {
DEBUG(4, ("ldapsam_enum_aliasmem: Did not find alias\n"));
ldap_msgfree(result);
return NT_STATUS_NO_SUCH_ALIAS;
}
return NT_STATUS_NO_SUCH_ALIAS;
}
DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for "
"filter %s: count=%d\n", filter, count));
ldap_msgfree(result);
DEBUG(1, ("ldapsam_enum_aliasmem: Duplicate entries for "
"filter %s: count=%d\n", filter, count));
ldap_msgfree(result);
return NT_STATUS_NO_SUCH_ALIAS;
}
return NT_STATUS_NO_SUCH_ALIAS;
}
entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
result);
entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
result);
NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
{
NTSTATUS nt_status;
NTSTATUS pdb_init_ldapsam(struct pdb_methods **pdb_method, const char *location)
{
NTSTATUS nt_status;
- struct ldapsam_privates *ldap_state;
+ struct ldapsam_privates *ldap_state = NULL;
- pstring alg_rid_base_string;
+ char *alg_rid_base_string = NULL;
LDAPMessage *result = NULL;
LDAPMessage *entry = NULL;
DOM_SID ldap_domain_sid;
DOM_SID secrets_domain_sid;
LDAPMessage *result = NULL;
LDAPMessage *entry = NULL;
DOM_SID ldap_domain_sid;
DOM_SID secrets_domain_sid;
- pstring domain_sid_string;
- char *dn;
+ char *domain_sid_string = NULL;
+ char *dn = NULL;
char *uri = talloc_strdup( NULL, location );
trim_char( uri, '\"', '\"' );
nt_status = pdb_init_ldapsam_common(pdb_method, uri);
char *uri = talloc_strdup( NULL, location );
trim_char( uri, '\"', '\"' );
nt_status = pdb_init_ldapsam_common(pdb_method, uri);
- if ( uri )
- TALLOC_FREE( uri );
+ if (uri) {
+ TALLOC_FREE(uri);
+ }
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
ldapsam_enum_group_memberships;
(*pdb_method)->lookup_rids = ldapsam_lookup_rids;
(*pdb_method)->sid_to_id = ldapsam_sid_to_id;
ldapsam_enum_group_memberships;
(*pdb_method)->lookup_rids = ldapsam_lookup_rids;
(*pdb_method)->sid_to_id = ldapsam_sid_to_id;
if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
(*pdb_method)->create_user = ldapsam_create_user;
(*pdb_method)->delete_user = ldapsam_delete_user;
if (lp_parm_bool(-1, "ldapsam", "editposix", False)) {
(*pdb_method)->create_user = ldapsam_create_user;
(*pdb_method)->delete_user = ldapsam_delete_user;
ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
/* Try to setup the Domain Name, Domain SID, algorithmic rid base */
ldap_state->schema_ver = SCHEMAVER_SAMBASAMACCOUNT;
/* Try to setup the Domain Name, Domain SID, algorithmic rid base */
nt_status = smbldap_search_domain_info(ldap_state->smbldap_state,
nt_status = smbldap_search_domain_info(ldap_state->smbldap_state,
ldap_state->domain_name, True);
ldap_state->domain_name, True);
if ( !NT_STATUS_IS_OK(nt_status) ) {
DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
"info, nor add one to the domain\n"));
if ( !NT_STATUS_IS_OK(nt_status) ) {
DEBUG(2, ("pdb_init_ldapsam: WARNING: Could not get domain "
"info, nor add one to the domain\n"));
/* Given that the above might fail, everything below this must be
* optional */
/* Given that the above might fail, everything below this must be
* optional */
entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
result);
if (!entry) {
entry = ldap_first_entry(ldap_state->smbldap_state->ldap_struct,
result);
if (!entry) {
ldap_state->domain_dn = smb_xstrdup(dn);
ldap_memfree(dn);
ldap_state->domain_dn = smb_xstrdup(dn);
ldap_memfree(dn);
- if (smbldap_get_single_pstring(
+ domain_sid_string = smbldap_talloc_single_attribute(
ldap_state->smbldap_state->ldap_struct,
ldap_state->smbldap_state->ldap_struct,
get_userattr_key2string(ldap_state->schema_ver,
get_userattr_key2string(ldap_state->schema_ver,
- LDAP_ATTR_USER_SID),
- domain_sid_string)) {
+ LDAP_ATTR_USER_SID),
+ NULL);
+
+ if (domain_sid_string) {
bool found_sid;
if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "
"read as a valid SID\n", domain_sid_string));
ldap_msgfree(result);
bool found_sid;
if (!string_to_sid(&ldap_domain_sid, domain_sid_string)) {
DEBUG(1, ("pdb_init_ldapsam: SID [%s] could not be "
"read as a valid SID\n", domain_sid_string));
ldap_msgfree(result);
+ TALLOC_FREE(domain_sid_string);
return NT_STATUS_INVALID_PARAMETER;
}
found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
return NT_STATUS_INVALID_PARAMETER;
}
found_sid = secrets_fetch_domain_sid(ldap_state->domain_name,
&secrets_domain_sid),
sid_to_string(new_sid_str,
&ldap_domain_sid)));
&secrets_domain_sid),
sid_to_string(new_sid_str,
&ldap_domain_sid)));
/* reset secrets.tdb sid */
secrets_store_domain_sid(ldap_state->domain_name,
&ldap_domain_sid);
/* reset secrets.tdb sid */
secrets_store_domain_sid(ldap_state->domain_name,
&ldap_domain_sid);
get_global_sam_sid())));
}
sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
get_global_sam_sid())));
}
sid_copy(&ldap_state->domain_sid, &ldap_domain_sid);
+ TALLOC_FREE(domain_sid_string);
- if (smbldap_get_single_pstring(
+ alg_rid_base_string = smbldap_talloc_single_attribute(
ldap_state->smbldap_state->ldap_struct,
ldap_state->smbldap_state->ldap_struct,
get_attr_key2string( dominfo_attr_list,
LDAP_ATTR_ALGORITHMIC_RID_BASE ),
get_attr_key2string( dominfo_attr_list,
LDAP_ATTR_ALGORITHMIC_RID_BASE ),
- alg_rid_base_string)) {
+ NULL);
+ if (alg_rid_base_string) {
alg_rid_base = (uint32)atol(alg_rid_base_string);
if (alg_rid_base != algorithmic_rid_base()) {
DEBUG(0, ("The value of 'algorithmic RID base' has "
"changed since the LDAP\n"
"database was initialised. Aborting. \n"));
ldap_msgfree(result);
alg_rid_base = (uint32)atol(alg_rid_base_string);
if (alg_rid_base != algorithmic_rid_base()) {
DEBUG(0, ("The value of 'algorithmic RID base' has "
"changed since the LDAP\n"
"database was initialised. Aborting. \n"));
ldap_msgfree(result);
+ TALLOC_FREE(alg_rid_base_string);
return NT_STATUS_UNSUCCESSFUL;
}
return NT_STATUS_UNSUCCESSFUL;
}
+ TALLOC_FREE(alg_rid_base_string);
git.samba.org / kai / samba.git / commitdiff