Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 : Authentication utility functions
4 : Copyright (C) Volker Lendecke 2010
5 :
6 : This program is free software; you can redistribute it and/or modify
7 : it under the terms of the GNU General Public License as published by
8 : the Free Software Foundation; either version 3 of the License, or
9 : (at your option) any later version.
10 :
11 : This program is distributed in the hope that it will be useful,
12 : but WITHOUT ANY WARRANTY; without even the implied warranty of
13 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 : GNU General Public License for more details.
15 :
16 : You should have received a copy of the GNU General Public License
17 : along with this program. If not, see <http://www.gnu.org/licenses/>.
18 : */
19 :
20 : #include "includes.h"
21 : #include "libcli/security/security.h"
22 : #include "librpc/gen_ndr/netlogon.h"
23 : #include "nsswitch/libwbclient/wbclient.h"
24 : #include "librpc/gen_ndr/auth.h"
25 : #include "auth/auth_sam_reply.h"
26 :
27 : #undef DBGC_CLASS
28 : #define DBGC_CLASS DBGC_AUTH
29 :
30 1097 : static NTSTATUS wbcsids_to_samr_RidWithAttributeArray(
31 : TALLOC_CTX *mem_ctx,
32 : struct samr_RidWithAttributeArray *groups,
33 : const struct dom_sid *domain_sid,
34 : const struct wbcSidWithAttr *sids,
35 : size_t num_sids)
36 : {
37 1097 : unsigned int i, j = 0;
38 0 : bool ok;
39 :
40 1097 : groups->rids = talloc_array(mem_ctx,
41 : struct samr_RidWithAttribute, num_sids);
42 1097 : if (!groups->rids) {
43 0 : return NT_STATUS_NO_MEMORY;
44 : }
45 :
46 : /* a wbcDomainSid is the same as a dom_sid */
47 9267 : for (i = 0; i < num_sids; i++) {
48 8170 : ok = sid_peek_check_rid(domain_sid,
49 8170 : (const struct dom_sid *)&sids[i].sid,
50 8170 : &groups->rids[j].rid);
51 8170 : if (!ok) continue;
52 :
53 6688 : groups->rids[j].attributes = SE_GROUP_DEFAULT_FLAGS;
54 6688 : j++;
55 : }
56 :
57 1097 : groups->count = j;
58 1097 : return NT_STATUS_OK;
59 : }
60 :
61 1097 : static NTSTATUS wbcsids_to_netr_SidAttrArray(
62 : const struct dom_sid *domain_sid,
63 : const struct wbcSidWithAttr *sids,
64 : size_t num_sids,
65 : TALLOC_CTX *mem_ctx,
66 : struct netr_SidAttr **_info3_sids,
67 : uint32_t *info3_num_sids)
68 : {
69 1097 : unsigned int i, j = 0;
70 0 : struct netr_SidAttr *info3_sids;
71 :
72 1097 : info3_sids = talloc_array(mem_ctx, struct netr_SidAttr, num_sids);
73 1097 : if (info3_sids == NULL) {
74 0 : return NT_STATUS_NO_MEMORY;
75 : }
76 :
77 : /* a wbcDomainSid is the same as a dom_sid */
78 9267 : for (i = 0; i < num_sids; i++) {
79 0 : const struct dom_sid *sid;
80 :
81 8170 : sid = (const struct dom_sid *)&sids[i].sid;
82 :
83 8170 : if (dom_sid_in_domain(domain_sid, sid)) {
84 6688 : continue;
85 : }
86 :
87 1482 : info3_sids[j].sid = dom_sid_dup(info3_sids, sid);
88 1482 : if (info3_sids[j].sid == NULL) {
89 0 : talloc_free(info3_sids);
90 0 : return NT_STATUS_NO_MEMORY;
91 : }
92 1482 : info3_sids[j].attributes = SE_GROUP_DEFAULT_FLAGS;
93 1482 : j++;
94 : }
95 :
96 1097 : *info3_num_sids = j;
97 1097 : *_info3_sids = info3_sids;
98 1097 : return NT_STATUS_OK;
99 : }
100 :
101 : #undef RET_NOMEM
102 :
103 : #define RET_NOMEM(ptr) do { \
104 : if (!ptr) { \
105 : TALLOC_FREE(info6); \
106 : return NULL; \
107 : } } while(0)
108 :
109 1097 : struct netr_SamInfo6 *wbcAuthUserInfo_to_netr_SamInfo6(TALLOC_CTX *mem_ctx,
110 : const struct wbcAuthUserInfo *info)
111 : {
112 0 : struct netr_SamInfo6 *info6;
113 0 : struct dom_sid user_sid;
114 0 : struct dom_sid group_sid;
115 0 : struct dom_sid domain_sid;
116 0 : NTSTATUS status;
117 0 : bool ok;
118 :
119 1097 : memcpy(&user_sid, &info->sids[PRIMARY_USER_SID_INDEX].sid, sizeof(user_sid));
120 1097 : memcpy(&group_sid, &info->sids[PRIMARY_GROUP_SID_INDEX].sid, sizeof(group_sid));
121 :
122 1097 : info6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
123 1097 : if (!info6) return NULL;
124 :
125 1097 : unix_to_nt_time(&info6->base.logon_time, info->logon_time);
126 1097 : unix_to_nt_time(&info6->base.logoff_time, info->logoff_time);
127 1097 : unix_to_nt_time(&info6->base.kickoff_time, info->kickoff_time);
128 1097 : unix_to_nt_time(&info6->base.last_password_change, info->pass_last_set_time);
129 1097 : unix_to_nt_time(&info6->base.allow_password_change,
130 1097 : info->pass_can_change_time);
131 1097 : unix_to_nt_time(&info6->base.force_password_change,
132 1097 : info->pass_must_change_time);
133 :
134 1097 : if (info->account_name) {
135 1097 : info6->base.account_name.string =
136 1097 : talloc_strdup(info6, info->account_name);
137 1097 : RET_NOMEM(info6->base.account_name.string);
138 : }
139 1097 : if (info->user_principal) {
140 1024 : info6->principal_name.string =
141 1024 : talloc_strdup(info6, info->user_principal);
142 1024 : RET_NOMEM(info6->principal_name.string);
143 : }
144 1097 : if (info->full_name) {
145 1097 : info6->base.full_name.string =
146 1097 : talloc_strdup(info6, info->full_name);
147 1097 : RET_NOMEM(info6->base.full_name.string);
148 : }
149 1097 : if (info->domain_name) {
150 1097 : info6->base.logon_domain.string =
151 1097 : talloc_strdup(info6, info->domain_name);
152 1097 : RET_NOMEM(info6->base.logon_domain.string);
153 : }
154 1097 : if (info->dns_domain_name) {
155 1024 : info6->dns_domainname.string =
156 1024 : talloc_strdup(info6, info->dns_domain_name);
157 1024 : RET_NOMEM(info6->dns_domainname.string);
158 : }
159 1097 : if (info->logon_script) {
160 1097 : info6->base.logon_script.string =
161 1097 : talloc_strdup(info6, info->logon_script);
162 1097 : RET_NOMEM(info6->base.logon_script.string);
163 : }
164 1097 : if (info->profile_path) {
165 1097 : info6->base.profile_path.string =
166 1097 : talloc_strdup(info6, info->profile_path);
167 1097 : RET_NOMEM(info6->base.profile_path.string);
168 : }
169 1097 : if (info->home_directory) {
170 1097 : info6->base.home_directory.string =
171 1097 : talloc_strdup(info6, info->home_directory);
172 1097 : RET_NOMEM(info6->base.home_directory.string);
173 : }
174 1097 : if (info->home_drive) {
175 1097 : info6->base.home_drive.string =
176 1097 : talloc_strdup(info6, info->home_drive);
177 1097 : RET_NOMEM(info6->base.home_drive.string);
178 : }
179 :
180 1097 : info6->base.logon_count = info->logon_count;
181 1097 : info6->base.bad_password_count = info->bad_password_count;
182 :
183 1097 : sid_copy(&domain_sid, &user_sid);
184 1097 : sid_split_rid(&domain_sid, &info6->base.rid);
185 :
186 1097 : ok = sid_peek_check_rid(&domain_sid, &group_sid,
187 : &info6->base.primary_gid);
188 1097 : if (!ok) {
189 0 : DEBUG(1, ("The primary group sid domain does not"
190 : "match user sid domain for user: %s\n",
191 : info->account_name));
192 0 : TALLOC_FREE(info6);
193 0 : return NULL;
194 : }
195 :
196 1097 : status = wbcsids_to_samr_RidWithAttributeArray(info6,
197 : &info6->base.groups,
198 : &domain_sid,
199 1097 : &info->sids[PRIMARY_GROUP_SID_INDEX],
200 1097 : info->num_sids - 1);
201 1097 : if (!NT_STATUS_IS_OK(status)) {
202 0 : TALLOC_FREE(info6);
203 0 : return NULL;
204 : }
205 :
206 1097 : status = wbcsids_to_netr_SidAttrArray(&domain_sid,
207 1097 : &info->sids[PRIMARY_GROUP_SID_INDEX],
208 1097 : info->num_sids - 1,
209 : info6,
210 : &info6->sids,
211 : &info6->sidcount);
212 1097 : if (!NT_STATUS_IS_OK(status)) {
213 0 : TALLOC_FREE(info6);
214 0 : return NULL;
215 : }
216 :
217 1097 : info6->base.user_flags = info->user_flags;
218 1097 : memcpy(info6->base.key.key, info->user_session_key, 16);
219 :
220 1097 : if (info->logon_server) {
221 1097 : info6->base.logon_server.string =
222 1097 : talloc_strdup(info6, info->logon_server);
223 1097 : RET_NOMEM(info6->base.logon_server.string);
224 : }
225 1097 : if (info->domain_name) {
226 1097 : info6->base.logon_domain.string =
227 1097 : talloc_strdup(info6, info->domain_name);
228 1097 : RET_NOMEM(info6->base.logon_domain.string);
229 : }
230 :
231 1097 : info6->base.domain_sid = dom_sid_dup(info6, &domain_sid);
232 1097 : RET_NOMEM(info6->base.domain_sid);
233 :
234 1097 : memcpy(info6->base.LMSessKey.key, info->lm_session_key, 8);
235 1097 : info6->base.acct_flags = info->acct_flags;
236 :
237 1097 : return info6;
238 : }
|
