Changeset 124 for branches/samba-3.0/source/passdb

Timestamp:

Mar 12, 2008, 9:08:18 AM (17 years ago)

Author:

Paul Smedley

Message:

Update source to 3.0.28a

Location:

branches/samba-3.0/source/passdb

Files:

• lookup_sid.c (modified) (11 diffs)
• pdb_ldap.c (modified) (4 diffs)
• secrets.c (modified) (5 diffs)

branches/samba-3.0/source/passdb/lookup_sid.c

@@ -61 +61 @@
         }
 
-        DEBUG(10,("lookup_name: %s => %s (domain), %s (name)\n", 
-                full_name, domain, name));
-
         if ((domain == NULL) || (name == NULL)) {
                 DEBUG(0, ("talloc failed\n"));
@@ -70 +67 @@
         }
 
-        if (strequal(domain, get_global_sam_name())) {
+        DEBUG(10,("lookup_name: %s => %s (domain), %s (name)\n",
+                full_name, domain, name));
+        DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags));
+
+        if ((flags & LOOKUP_NAME_DOMAIN) &&
+            strequal(domain, get_global_sam_name()))
+        {
 
                 /* It's our own domain, lookup the name in passdb */
@@ -82 +85 @@
         }
 
-        if (strequal(domain, builtin_domain_name())) {
-
+        if ((flags & LOOKUP_NAME_BUILTIN) &&
+            strequal(domain, builtin_domain_name()))
+        {
                 /* Explicit request for a name in BUILTIN */
                 if (lookup_builtin_name(name, &rid)) {
@@ -99 +103 @@
 
         if ((domain[0] != '\0') &&
+            (flags & ~(LOOKUP_NAME_DOMAIN|LOOKUP_NAME_ISOLATED)) &&
             (winbind_lookup_name(domain, name, &sid, &type))) {
                         goto ok;
@@ -133 +138 @@
         /* 1. well-known names */
 
-        if (lookup_wellknown_name(tmp_ctx, name, &sid, &domain)) {
+        if ((flags & LOOKUP_NAME_WKN) &&
+            lookup_wellknown_name(tmp_ctx, name, &sid, &domain))
+        {
                 type = SID_NAME_WKN_GRP;
                 goto ok;
@@ -140 +147 @@
         /* 2. Builtin domain as such */
 
-        if (strequal(name, builtin_domain_name())) {
+        if ((flags & (LOOKUP_NAME_BUILTIN|LOOKUP_NAME_REMOTE)) &&
+            strequal(name, builtin_domain_name()))
+        {
                 /* Swap domain and name */
                 tmp = name; name = domain; domain = tmp;
@@ -150 +159 @@
         /* 3. Account domain */
 
-        if (strequal(name, get_global_sam_name())) {
+        if ((flags & LOOKUP_NAME_DOMAIN) &&
+            strequal(name, get_global_sam_name()))
+        {
                 if (!secrets_fetch_domain_sid(name, &sid)) {
                         DEBUG(3, ("Could not fetch my SID\n"));
@@ -164 +175 @@
         /* 4. Primary domain */
 
-        if (!IS_DC && strequal(name, lp_workgroup())) {
+        if ((flags & LOOKUP_NAME_DOMAIN) && !IS_DC &&
+            strequal(name, lp_workgroup()))
+        {
                 if (!secrets_fetch_domain_sid(name, &sid)) {
                         DEBUG(3, ("Could not fetch the domain SID\n"));
@@ -179 +192 @@
               this, tested an XP workstation in a NT domain -- vl */
 
-        if (IS_DC && (secrets_fetch_trusted_domain_password(name, NULL,
-                                                            &sid, NULL))) {
+        if ((flags & LOOKUP_NAME_REMOTE) && IS_DC &&
+            (secrets_fetch_trusted_domain_password(name, NULL, &sid, NULL)))
+        {
                 /* Swap domain and name */
                 tmp = name; name = domain; domain = tmp;
@@ -189 +203 @@
         /* 6. Builtin aliases */        
 
-        if (lookup_builtin_name(name, &rid)) {
+        if ((flags & LOOKUP_NAME_BUILTIN) &&
+            lookup_builtin_name(name, &rid))
+        {
                 domain = talloc_strdup(tmp_ctx, builtin_domain_name());
                 sid_copy(&sid, &global_sid_Builtin);
@@ -202 +218 @@
         /* Both cases are done by looking at our passdb */
 
-        if (lookup_global_sam_name(name, flags, &rid, &type)) {
+        if ((flags & LOOKUP_NAME_DOMAIN) &&
+            lookup_global_sam_name(name, flags, &rid, &type))
+        {
                 domain = talloc_strdup(tmp_ctx, get_global_sam_name());
                 sid_copy(&sid, get_global_sam_sid());

branches/samba-3.0/source/passdb/pdb_ldap.c

@@ -1652 +1652 @@
                         SAFE_FREE(ld_error);
                         ber_bvfree(bv);
+#if defined(LDAP_CONSTRAINT_VIOLATION)
+                        if (rc == LDAP_CONSTRAINT_VIOLATION)
+                                return NT_STATUS_PASSWORD_RESTRICTION;
+#endif
                         return NT_STATUS_UNSUCCESSFUL;
                 } else {
@@ -2455 +2459 @@
                 }
 
-                rc = smbldap_search(conn, lp_ldap_user_suffix(),
+                rc = smbldap_search(conn, lp_ldap_suffix(),
                                     LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
                                     &result);
@@ -2511 +2515 @@
                                  gidstr);
 
-        rc = smbldap_search(conn, lp_ldap_user_suffix(),
+        rc = smbldap_search(conn, lp_ldap_suffix(),
                             LDAP_SCOPE_SUBTREE, filter, sid_attrs, 0,
                             &result);
@@ -2595 +2599 @@
         }
 
-        rc = smbldap_search(conn, lp_ldap_user_suffix(),
+        rc = smbldap_search(conn, lp_ldap_suffix(),
                             LDAP_SCOPE_SUBTREE, filter, attrs, 0, &result);
 

branches/samba-3.0/source/passdb/secrets.c

@@ -269 +269 @@
 /************************************************************************
  Routine to get the trust account password for a domain.
+ This only tries to get the legacy hashed version of the password.
  The user of this function must have locked the trust password file using
  the above secrets_lock_trust_account_password().
 ************************************************************************/
 
+BOOL secrets_fetch_trust_account_password_legacy(const char *domain,
+                                                 uint8 ret_pwd[16],
+                                                 time_t *pass_last_set_time,
+                                                 uint32 *channel)
+{
+        struct machine_acct_pass *pass;
+        size_t size = 0;
+
+        if (!(pass = (struct machine_acct_pass *)secrets_fetch(
+                      trust_keystr(domain), &size))) {
+                DEBUG(5, ("secrets_fetch failed!\n"));
+                return False;
+        }
+        
+        if (size != sizeof(*pass)) {
+                DEBUG(0, ("secrets were of incorrect size!\n"));
+                return False;
+        }
+
+        if (pass_last_set_time) {
+                *pass_last_set_time = pass->mod_time;
+        }
+        memcpy(ret_pwd, pass->hash, 16);
+
+        if (channel) {
+                *channel = get_default_sec_channel();
+        }
+
+        /* Test if machine password has expired and needs to be changed */
+        if (lp_machine_password_timeout()) {
+                if (pass->mod_time > 0 && time(NULL) > (pass->mod_time +
+                                (time_t)lp_machine_password_timeout())) {
+                        global_machine_password_needs_changing = True;
+                }
+        }
+
+        SAFE_FREE(pass);
+        return True;
+}
+
+/************************************************************************
+ Routine to get the trust account password for a domain.
+ The user of this function must have locked the trust password file using
+ the above secrets_lock_trust_account_password().
+************************************************************************/
+
 BOOL secrets_fetch_trust_account_password(const char *domain, uint8 ret_pwd[16],
                                           time_t *pass_last_set_time,
                                           uint32 *channel)
 {
-        struct machine_acct_pass *pass;
         char *plaintext;
-        size_t size = 0;
-
-        plaintext = secrets_fetch_machine_password(domain, pass_last_set_time, 
+
+        plaintext = secrets_fetch_machine_password(domain, pass_last_set_time,
                                                    channel);
         if (plaintext) {
@@ -290 +335 @@
         }
 
-        if (!(pass = (struct machine_acct_pass *)secrets_fetch(
-                      trust_keystr(domain), &size))) {
-                DEBUG(5, ("secrets_fetch failed!\n"));
-                return False;
-        }
-        
-        if (size != sizeof(*pass)) {
-                DEBUG(0, ("secrets were of incorrect size!\n"));
-                return False;
-        }
-
-        if (pass_last_set_time) {
-                *pass_last_set_time = pass->mod_time;
-        }
-        memcpy(ret_pwd, pass->hash, 16);
-
-        if (channel) {
-                *channel = get_default_sec_channel();
-        }
-
-        /* Test if machine password has expired and needs to be changed */
-        if (lp_machine_password_timeout()) {
-                if (pass->mod_time > 0 && time(NULL) > (pass->mod_time +
-                                (time_t)lp_machine_password_timeout())) {
-                        global_machine_password_needs_changing = True;
-                }
-        }
-
-        SAFE_FREE(pass);
-        return True;
+        return secrets_fetch_trust_account_password_legacy(domain, ret_pwd,
+                                                           pass_last_set_time,
+                                                           channel);
 }
 
@@ -499 +517 @@
                 
         return True;
-}
-
-/************************************************************************
- Routine to set the trust account password for a domain.
-************************************************************************/
-
-BOOL secrets_store_trust_account_password(const char *domain, uint8 new_pwd[16])
-{
-        struct machine_acct_pass pass;
-
-        pass.mod_time = time(NULL);
-        memcpy(pass.hash, new_pwd, 16);
-
-        return secrets_store(trust_keystr(domain), (void *)&pass, sizeof(pass));
 }
 
@@ -656 +660 @@
 }
 
+BOOL is_trusted_domain_situation(const char *domain_name)
+{
+        return IS_DC &&
+                lp_allow_trusted_domains() &&
+                !strequal(domain_name, lp_workgroup());
+}
+ 
 /*******************************************************************
- Wrapper around retrieving the trust account password
+ Wrapper around retrieving the clear text trust account password.
+ appropriate account name is stored in account_name.
+ Caller must free password, but not account_name.
 *******************************************************************/
-                                                                                                                     
-BOOL get_trust_pw(const char *domain, uint8 ret_pwd[16], uint32 *channel)
-{
-        DOM_SID sid;
+
+BOOL get_trust_pw_clear(const char *domain, char **ret_pwd,
+                        const char **account_name, uint32 *channel)
+{
         char *pwd;
         time_t last_set_time;
-                                                                                                                     
+
         /* if we are a DC and this is not our domain, then lookup an account
-                for the domain trust */
-                                                                                                                     
-        if ( IS_DC && !strequal(domain, lp_workgroup()) && lp_allow_trusted_domains() ) {
-                if (!secrets_fetch_trusted_domain_password(domain, &pwd, &sid,
-                                                        &last_set_time)) {
+         * for the domain trust */
+
+        if (is_trusted_domain_situation(domain)) {
+                if (!secrets_fetch_trusted_domain_password(domain, ret_pwd,
+                                                           NULL, &last_set_time))
+                {
                         DEBUG(0, ("get_trust_pw: could not fetch trust "
                                 "account password for trusted domain %s\n",
@@ -677 +691 @@
                         return False;
                 }
-                                                                                                                     
-                *channel = SEC_CHAN_DOMAIN;
+
+                if (channel != NULL) {
+                        *channel = SEC_CHAN_DOMAIN;
+                }
+
+                if (account_name != NULL) {
+                        *account_name = lp_workgroup();
+                }
+
+                return True;
+        }
+
+        /* Just get the account for the requested domain. In the future this
+         * might also cover to be member of more than one domain. */
+
+        pwd = secrets_fetch_machine_password(domain, &last_set_time, channel);
+
+        if (pwd != NULL) {
+                *ret_pwd = pwd;
+                if (account_name != NULL) {
+                        *account_name = global_myname();
+                }
+
+                return True;
+        }
+
+        DEBUG(5, ("get_trust_pw_clear: could not fetch clear text trust "
+                  "account password for domain %s\n", domain));
+        return False;
+}
+
+/*******************************************************************
+ Wrapper around retrieving the trust account password.
+ appropriate account name is stored in account_name.
+*******************************************************************/
+
+BOOL get_trust_pw_hash(const char *domain, uint8 ret_pwd[16],
+                       const char **account_name, uint32 *channel)
+{
+        char *pwd = NULL;
+        time_t last_set_time;
+
+        if (get_trust_pw_clear(domain, &pwd, account_name, channel)) {
                 E_md4hash(pwd, ret_pwd);
                 SAFE_FREE(pwd);
-
                 return True;
-        }
-                                                                                                                     
-        /* Just get the account for the requested domain. In the future this
-         * might also cover to be member of more than one domain. */
-                                                                                                                     
-        if (secrets_fetch_trust_account_password(domain, ret_pwd,
-                                                &last_set_time, channel))
+        } else if (is_trusted_domain_situation(domain)) {
+                return False;
+        }
+
+        /* as a fallback, try to get the hashed pwd directly from the tdb... */
+
+        if (secrets_fetch_trust_account_password_legacy(domain, ret_pwd,
+                                                        &last_set_time,
+                                                        channel))
+        {
+                if (account_name != NULL) {
+                        *account_name = global_myname();
+                }
+
                 return True;
-
-        DEBUG(5, ("get_trust_pw: could not fetch trust account "
+        }
+
+        DEBUG(5, ("get_trust_pw_hash: could not fetch trust account "
                 "password for domain %s\n", domain));
         return False;
-}
-
-/************************************************************************
- Routine to delete the machine trust account password file for a domain.
-************************************************************************/
-
-BOOL trust_password_delete(const char *domain)
-{
-        return secrets_delete(trust_keystr(domain));
 }