r23358: Fix from Justin Maggard <jmaggard@infrant.com> - ensure we don't

[sfrench/samba-autobuild/.git] / source / auth / auth_sam.c

diff --git a/source/auth/auth_sam.c b/source/auth/auth_sam.c
index f06eb83ba1a2983eb4560a39a838ce98368aee53..b6364a6ca49537953b07ddb3cfeb31ed62c1bf56 100644 (file)
--- a/source/auth/auth_sam.c
+++ b/source/auth/auth_sam.c
@@ -23,8 +23,6 @@
 
 #include "includes.h"
 
-extern struct timeval smb_last_time;
-
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
 
@@ -40,7 +38,7 @@ static NTSTATUS sam_password_ok(const struct auth_context *auth_context,
                                DATA_BLOB *user_sess_key, 
                                DATA_BLOB *lm_sess_key)
 {
-       uint16 acct_ctrl;
+       uint32 acct_ctrl;
        const uint8 *lm_pw, *nt_pw;
        const char *username = pdb_get_username(sampass);
 
@@ -79,6 +77,7 @@ static BOOL logon_hours_ok(struct samu *sampass)
        const uint8 *hours;
        struct tm *utctime;
        time_t lasttime;
+       const char *asct;
        uint8 bitmask, bitpos;
 
        hours = pdb_get_hours(sampass);
@@ -87,22 +86,38 @@ static BOOL logon_hours_ok(struct samu *sampass)
                return True;
        }
 
-       lasttime = (time_t)smb_last_time.tv_sec;
+       lasttime = time(NULL);
        utctime = gmtime(&lasttime);
+       if (!utctime) {
+               DEBUG(1, ("logon_hours_ok: failed to get gmtime. Failing logon for user %s\n",
+                       pdb_get_username(sampass) ));
+               return False;
+       }
 
        /* find the corresponding byte and bit */
        bitpos = (utctime->tm_wday * 24 + utctime->tm_hour) % 168;
        bitmask = 1 << (bitpos % 8);
 
        if (! (hours[bitpos/8] & bitmask)) {
-               DEBUG(1,("logon_hours_ok: Account for user %s not allowed to logon at this time (%s).\n",
-                       pdb_get_username(sampass), 
-                       asctime(localtime(&lasttime)) ));
+               struct tm *t = localtime(&lasttime);
+               if (!t) {
+                       asct = "INVALID TIME";
+               } else {
+                       asct = asctime(t);
+                       if (!asct) {
+                               asct = "INVALID TIME";
+                       }
+               }
+               
+               DEBUG(1, ("logon_hours_ok: Account for user %s not allowed to "
+                         "logon at this time (%s).\n",
+                         pdb_get_username(sampass), asct ));
                return False;
        }
 
+       asct = asctime(utctime);
        DEBUG(5,("logon_hours_ok: user %s allowed to logon at this time (%s)\n",
-               pdb_get_username(sampass), asctime(utctime) ));
+               pdb_get_username(sampass), asct ? asct : "UNKNOWN TIME" ));
 
        return True;
 }
@@ -116,7 +131,7 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
                               struct samu *sampass, 
                               const auth_usersupplied_info *user_info)
 {
-       uint16  acct_ctrl = pdb_get_acct_ctrl(sampass);
+       uint32  acct_ctrl = pdb_get_acct_ctrl(sampass);
        char *workstation_list;
        time_t kickoff_time;
        
@@ -148,12 +163,12 @@ static NTSTATUS sam_account_ok(TALLOC_CTX *mem_ctx,
                return NT_STATUS_ACCOUNT_EXPIRED;
        }
 
-       if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP)) {
+       if (!(pdb_get_acct_ctrl(sampass) & ACB_PWNOEXP) && !(pdb_get_acct_ctrl(sampass) & ACB_PWNOTREQ)) {
                time_t must_change_time = pdb_get_pass_must_change_time(sampass);
                time_t last_set_time = pdb_get_pass_last_set_time(sampass);
 
                /* check for immediate expiry "must change at next logon" */
-               if (must_change_time == 0 && last_set_time != 0) {
+               if (last_set_time == 0) {
                        DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", pdb_get_username(sampass)));
                        return NT_STATUS_PASSWORD_MUST_CHANGE;
                }
@@ -240,18 +255,18 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
        BOOL ret;
        NTSTATUS nt_status;
        NTSTATUS update_login_attempts_status;
-       DATA_BLOB user_sess_key = data_blob(NULL, 0);
-       DATA_BLOB lm_sess_key = data_blob(NULL, 0);
+       DATA_BLOB user_sess_key = data_blob_null;
+       DATA_BLOB lm_sess_key = data_blob_null;
        BOOL updated_autolock = False, updated_badpw = False;
 
        if (!user_info || !auth_context) {
                return NT_STATUS_UNSUCCESSFUL;
        }
 
-       /* Can't use the talloc version here, because the returned struct gets
-          kept on the server_info */
+       /* the returned struct gets kept on the server_info, by means
+          of a steal further down */
 
-       if ( !(sampass = samu_new( NULL )) ) {
+       if ( !(sampass = samu_new( mem_ctx )) ) {
                return NT_STATUS_NO_MEMORY;
        }
 
@@ -351,6 +366,8 @@ static NTSTATUS check_sam_security(const struct auth_context *auth_context,
                                 lm_sess_key.length);
        data_blob_free(&lm_sess_key);
 
+       (*server_info)->was_mapped |= user_info->was_mapped;
+
        return nt_status;
 }