Changeset 745 for trunk/server/source3/smbd/password.c
- Timestamp:
- Nov 27, 2012, 4:43:17 PM (13 years ago)
- Location:
- trunk/server
- Files:
-
- 2 edited
-
. (modified) (1 prop)
-
source3/smbd/password.c (modified) (22 diffs)
Legend:
- Unmodified
- Added
- Removed
-
trunk/server
- Property svn:mergeinfo changed
/vendor/current merged: 581,587,591,594,597,600,615,618,740
- Property svn:mergeinfo changed
-
trunk/server/source3/smbd/password.c
r596 r745 20 20 21 21 #include "includes.h" 22 #include "system/passwd.h" 23 #include "smbd/smbd.h" 22 24 #include "smbd/globals.h" 25 #include "../librpc/gen_ndr/netlogon.h" 26 #include "auth.h" 27 28 /* Fix up prototypes for OSX 10.4, where they're missing */ 29 #ifndef HAVE_SETNETGRENT_PROTOTYPE 30 extern int setnetgrent(const char* netgroup); 31 #endif 32 #ifndef HAVE_GETNETGRENT_PROTOTYPE 33 extern int getnetgrent(char **host, char **user, char **domain); 34 #endif 35 #ifndef HAVE_ENDNETGRENT_PROTOTYPE 36 extern void endnetgrent(void); 37 #endif 23 38 24 39 enum server_allocated_state { SERVER_ALLOCATED_REQUIRED_YES, … … 42 57 switch (server_allocated) { 43 58 case SERVER_ALLOCATED_REQUIRED_YES: 44 if (usp->se rver_info == NULL) {59 if (usp->session_info == NULL) { 45 60 continue; 46 61 } 47 62 break; 48 63 case SERVER_ALLOCATED_REQUIRED_NO: 49 if (usp->se rver_info != NULL) {64 if (usp->session_info != NULL) { 50 65 continue; 51 66 } … … 110 125 111 126 if (vuser->auth_ntlmssp_state) { 112 auth_ntlmssp_end(&vuser->auth_ntlmssp_state);127 TALLOC_FREE(vuser->auth_ntlmssp_state); 113 128 } 114 129 … … 129 144 void invalidate_all_vuids(struct smbd_server_connection *sconn) 130 145 { 131 if (sconn-> allow_smb2) {146 if (sconn->using_smb2) { 132 147 return; 133 148 } … … 198 213 } 199 214 200 staticint register_homes_share(const char *username)215 int register_homes_share(const char *username) 201 216 { 202 217 int result; … … 221 236 222 237 #ifdef __OS2__ 223 224 225 226 227 228 238 /* On OS/2 we use drive letters which have a colon. This is also the field 239 separator in master.passwd, so we use a $ instead of a colon for the drive 240 separator, ie e$/user instead of e:/user. This code simply exchanges any $ 241 for a : in the user's homedir */ 242 if (pwd->pw_dir[1] == '$') 243 pwd->pw_dir[1] = ':'; 229 244 #endif 230 245 … … 240 255 /** 241 256 * register that a valid login has been performed, establish 'session'. 242 * @param se rver_info The token returned from the authentication process.257 * @param session_info The token returned from the authentication process. 243 258 * (now 'owned' by register_existing_vuid) 244 259 * … … 258 273 int register_existing_vuid(struct smbd_server_connection *sconn, 259 274 uint16 vuid, 260 auth_serversupplied_info *server_info,275 struct auth_serversupplied_info *session_info, 261 276 DATA_BLOB response_blob, 262 277 const char *smb_name) … … 271 286 272 287 /* Use this to keep tabs on all our info from the authentication */ 273 vuser->se rver_info = talloc_move(vuser, &server_info);288 vuser->session_info = talloc_move(vuser, &session_info); 274 289 275 290 /* This is a potentially untrusted username */ 276 291 alpha_strcpy(tmp, smb_name, ". _-$", sizeof(tmp)); 277 292 278 vuser->se rver_info->sanitized_username = talloc_strdup(279 vuser->se rver_info, tmp);293 vuser->session_info->sanitized_username = talloc_strdup( 294 vuser->session_info, tmp); 280 295 281 296 DEBUG(10,("register_existing_vuid: (%u,%u) %s %s %s guest=%d\n", 282 (unsigned int)vuser->se rver_info->utok.uid,283 (unsigned int)vuser->se rver_info->utok.gid,284 vuser->se rver_info->unix_name,285 vuser->se rver_info->sanitized_username,286 pdb_get_domain(vuser->server_info->sam_account),287 vuser->se rver_info->guest ));297 (unsigned int)vuser->session_info->utok.uid, 298 (unsigned int)vuser->session_info->utok.gid, 299 vuser->session_info->unix_name, 300 vuser->session_info->sanitized_username, 301 vuser->session_info->info3->base.domain.string, 302 vuser->session_info->guest )); 288 303 289 304 DEBUG(3, ("register_existing_vuid: User name: %s\t" 290 "Real name: %s\n", vuser->se rver_info->unix_name,291 pdb_get_fullname(vuser->server_info->sam_account)));292 293 if (!vuser->se rver_info->ptok) {294 DEBUG(1, ("register_existing_vuid: se rver_info does not "305 "Real name: %s\n", vuser->session_info->unix_name, 306 vuser->session_info->info3->base.full_name.string)); 307 308 if (!vuser->session_info->security_token) { 309 DEBUG(1, ("register_existing_vuid: session_info does not " 295 310 "contain a user_token - cannot continue\n")); 296 311 goto fail; … … 298 313 299 314 DEBUG(3,("register_existing_vuid: UNIX uid %d is UNIX user %s, " 300 "and will be vuid %u\n", (int)vuser->se rver_info->utok.uid,301 vuser->se rver_info->unix_name, vuser->vuid));302 303 if (!session_claim( vuser)) {315 "and will be vuid %u\n", (int)vuser->session_info->utok.uid, 316 vuser->session_info->unix_name, vuser->vuid)); 317 318 if (!session_claim(sconn, vuser)) { 304 319 DEBUG(1, ("register_existing_vuid: Failed to claim session " 305 320 "for vuid=%d\n", … … 316 331 vuser->homes_snum = -1; 317 332 318 if (!vuser->se rver_info->guest) {333 if (!vuser->session_info->guest) { 319 334 vuser->homes_snum = register_homes_share( 320 vuser->se rver_info->unix_name);321 } 322 323 if (srv_is_signing_negotiated(s mbd_server_conn) &&324 !vuser->se rver_info->guest) {335 vuser->session_info->unix_name); 336 } 337 338 if (srv_is_signing_negotiated(sconn) && 339 !vuser->session_info->guest) { 325 340 /* Try and turn on server signing on the first non-guest 326 341 * sessionsetup. */ 327 srv_set_signing(s mbd_server_conn,328 vuser->se rver_info->user_session_key,342 srv_set_signing(sconn, 343 vuser->session_info->user_session_key, 329 344 response_blob); 330 345 } … … 332 347 /* fill in the current_user_info struct */ 333 348 set_current_user_info( 334 vuser->se rver_info->sanitized_username,335 vuser->se rver_info->unix_name,336 pdb_get_domain(vuser->server_info->sam_account));349 vuser->session_info->sanitized_username, 350 vuser->session_info->unix_name, 351 vuser->session_info->info3->base.domain.string); 337 352 338 353 return vuser->vuid; … … 414 429 415 430 /**************************************************************************** 416 Check if a user is in a netgroup user list. If at first we don't succeed,417 try lower case.418 ****************************************************************************/419 420 bool user_in_netgroup(struct smbd_server_connection *sconn,421 const char *user, const char *ngname)422 {423 #ifdef HAVE_NETGROUP424 fstring lowercase_user;425 426 if (sconn->smb1.sessions.my_yp_domain == NULL) {427 yp_get_default_domain(&sconn->smb1.sessions.my_yp_domain);428 }429 430 if (sconn->smb1.sessions.my_yp_domain == NULL) {431 DEBUG(5,("Unable to get default yp domain, "432 "let's try without specifying it\n"));433 }434 435 DEBUG(5,("looking for user %s of domain %s in netgroup %s\n",436 user,437 sconn->smb1.sessions.my_yp_domain?438 sconn->smb1.sessions.my_yp_domain:"(ANY)",439 ngname));440 441 if (innetgr(ngname, NULL, user, sconn->smb1.sessions.my_yp_domain)) {442 DEBUG(5,("user_in_netgroup: Found\n"));443 return true;444 }445 446 /*447 * Ok, innetgr is case sensitive. Try once more with lowercase448 * just in case. Attempt to fix #703. JRA.449 */450 fstrcpy(lowercase_user, user);451 strlower_m(lowercase_user);452 453 if (strcmp(user,lowercase_user) == 0) {454 /* user name was already lower case! */455 return false;456 }457 458 DEBUG(5,("looking for user %s of domain %s in netgroup %s\n",459 lowercase_user,460 sconn->smb1.sessions.my_yp_domain?461 sconn->smb1.sessions.my_yp_domain:"(ANY)",462 ngname));463 464 if (innetgr(ngname, NULL, lowercase_user,465 sconn->smb1.sessions.my_yp_domain)) {466 DEBUG(5,("user_in_netgroup: Found\n"));467 return true;468 }469 #endif /* HAVE_NETGROUP */470 return false;471 }472 473 /****************************************************************************474 Check if a user is in a user list - can check combinations of UNIX475 and netgroup lists.476 ****************************************************************************/477 478 bool user_in_list(struct smbd_server_connection *sconn,479 const char *user,const char **list)480 {481 if (!list || !*list)482 return False;483 484 DEBUG(10,("user_in_list: checking user %s in list\n", user));485 486 while (*list) {487 488 DEBUG(10,("user_in_list: checking user |%s| against |%s|\n",489 user, *list));490 491 /*492 * Check raw username.493 */494 if (strequal(user, *list))495 return(True);496 497 /*498 * Now check to see if any combination499 * of UNIX and netgroups has been specified.500 */501 502 if(**list == '@') {503 /*504 * Old behaviour. Check netgroup list505 * followed by UNIX list.506 */507 if(user_in_netgroup(sconn, user, *list +1))508 return True;509 if(user_in_group(user, *list +1))510 return True;511 } else if (**list == '+') {512 513 if((*(*list +1)) == '&') {514 /*515 * Search UNIX list followed by netgroup.516 */517 if(user_in_group(user, *list +2))518 return True;519 if(user_in_netgroup(sconn, user, *list +2))520 return True;521 522 } else {523 524 /*525 * Just search UNIX list.526 */527 528 if(user_in_group(user, *list +1))529 return True;530 }531 532 } else if (**list == '&') {533 534 if(*(*list +1) == '+') {535 /*536 * Search netgroup list followed by UNIX list.537 */538 if(user_in_netgroup(sconn, user, *list +2))539 return True;540 if(user_in_group(user, *list +2))541 return True;542 } else {543 /*544 * Just search netgroup list.545 */546 if(user_in_netgroup(sconn, user, *list +1))547 return True;548 }549 }550 551 list++;552 }553 return(False);554 }555 556 /****************************************************************************557 431 Check if a username is valid. 558 432 ****************************************************************************/ 559 433 560 static bool user_ok(struct smbd_server_connection *sconn, 561 const char *user, int snum) 434 static bool user_ok(const char *user, int snum) 562 435 { 563 436 bool ret; … … 575 448 576 449 if ( invalid && str_list_sub_basic(invalid, "", "") ) { 577 ret = !user_in_list( sconn, user,450 ret = !user_in_list(talloc_tos(), user, 578 451 (const char **)invalid); 579 452 } … … 592 465 593 466 if ( valid && str_list_sub_basic(valid, "", "") ) { 594 ret = user_in_list( sconn, user,467 ret = user_in_list(talloc_tos(), user, 595 468 (const char **)valid); 596 469 } … … 605 478 str_list_substitute(user_list, "%S", 606 479 lp_servicename(snum))) { 607 ret = user_in_list( sconn, user,480 ret = user_in_list(talloc_tos(), user, 608 481 (const char **)user_list); 609 482 } … … 629 502 while (getnetgrent(&host, &user, &domain)) { 630 503 if (user) { 631 if (user_ok( sconn,user, snum) &&504 if (user_ok(user, snum) && 632 505 password_ok(actx, enc, 633 506 get_session_workgroup(sconn), … … 686 559 "%s\n", gptr->gr_mem[i])); 687 560 688 s afe_strcpy(member, gptr->gr_mem[i],561 strlcpy(member, gptr->gr_mem[i], 689 562 list_len - (member-member_list)); 690 563 member += member_len; … … 695 568 member = member_list; 696 569 while (*member) { 697 if (user_ok( sconn,member,snum) &&570 if (user_ok(member,snum) && 698 571 password_ok(actx, enc, 699 572 get_session_workgroup(sconn), … … 774 647 fstring user2; 775 648 fstrcpy(user2,auser); 776 if (!user_ok( sconn,user2,snum))649 if (!user_ok(user2,snum)) 777 650 continue; 778 651 … … 827 700 fstring user2; 828 701 fstrcpy(user2,auser); 829 if (user_ok( sconn,user2,snum) &&702 if (user_ok(user2,snum) && 830 703 password_ok(actx, enc, 831 704 get_session_workgroup(sconn), … … 863 736 } 864 737 865 if (ok && !user_ok( sconn,user, snum)) {738 if (ok && !user_ok(user, snum)) { 866 739 DEBUG(0,("authorise_login: rejected invalid user %s\n",user)); 867 740 ok = False;
Note:
See TracChangeset
for help on using the changeset viewer.
