← Back to branch summary

~ubuntu-branches/ubuntu/maverick/samba/maverick-security

« back to all changes in this revision

Viewing changes to source/rpc_server/srv_samr_nt.c

  • Committer: Bazaar Package Importer
  • Author(s): Andrew Mitchell
  • Date: 2009-05-18 13:26:04 UTC
  • mfrom: (0.28.5 sid)
  • Revision ID: james.westby@ubuntu.com-20090518132604-ebyuqimgymtr3h0k
Tags: 2:3.3.4-2ubuntu1
https://launchpad.net/bugs/312449
https://launchpad.net/bugs/300221
* Merge from debian unstable, remaining changes:
  + debian/patches/VERSION.patch:
    - setup SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted (LP: #312449)
  + debian/mksambapasswd.awk:
    - Do not add user with UID less than 1000 to smbpasswd.
  + debian/control:
    - Make libwbclient0 replace/conflict with hardy's likewise-open.
    - Don't build against ctdb.
    - Add suggests keyutils for smbfs. (LP: #300221)
  + debian/rules:
    - enable "native" PIE hardening.
    - remove --with-ctdb and --with-cluster-support=yes
  + Add ufw integration:
    - Created debian/samba.ufw profile.
    - debian/rules, debian/samba.dirs, debian/samba.files: install 
      profile
    - debian/control: have samba sugguest ufw.
* Dropped patches:
  + debian/patches/fix-upstream-bug-6186.patch: Merged upstream

Show diffs side-by-side

added added

removed removed

Lines of Context:
source/rpc_server/srv_samr_nt.c
620
620
        if ( !find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info) )
621
621
                return NT_STATUS_INVALID_HANDLE;
622
622
 
623
 
        status = access_check_samr_function(info->acc_granted,
624
 
                                            SAMR_ACCESS_OPEN_DOMAIN,
625
 
                                            "_samr_OpenDomain" );
626
 
 
627
 
        if ( !NT_STATUS_IS_OK(status) )
628
 
                return status;
629
 
 
630
623
        /*check if access can be granted as requested by client. */
631
624
        map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
632
625
 
2897
2890
        }
2898
2891
 
2899
2892
        status = access_check_samr_function(info->acc_granted,
2900
 
                                            SAMR_ACCESS_OPEN_DOMAIN,
 
2893
                                            SAMR_ACCESS_LOOKUP_DOMAIN,
2901
2894
                                            "_samr_QueryDomainInfo" );
2902
2895
 
2903
2896
        if ( !NT_STATUS_IS_OK(status) )
3322
3315
        map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3323
3316
 
3324
3317
        se_map_generic( &des_access, &sam_generic_mapping );
3325
 
        info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_OPEN_DOMAIN);
 
3318
        info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_LOOKUP_DOMAIN);
3326
3319
 
3327
3320
        /* get a (unique) handle.  open a policy on it. */
3328
3321
        if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3458
3451
           Reverted that change so we will work with RAS servers again */
3459
3452
 
3460
3453
        status = access_check_samr_function(info->acc_granted,
3461
 
                                            SAMR_ACCESS_OPEN_DOMAIN,
 
3454
                                            SAMR_ACCESS_LOOKUP_DOMAIN,
3462
3455
                                            "_samr_LookupDomain");
3463
3456
        if (!NT_STATUS_IS_OK(status)) {
3464
3457
                return status;
3743
3736
                pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
3744
3737
        }
3745
3738
 
3746
 
        if (id18->password_expired) {
3747
 
                pdb_set_pass_last_set_time(pwd, 0, PDB_CHANGED);
3748
 
        } else {
3749
 
                /* FIXME */
3750
 
                pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
3751
 
        }
 
3739
        copy_id18_to_sam_passwd(pwd, id18);
3752
3740
 
3753
3741
        return pdb_update_sam_account(pwd);
3754
3742
}
3955
3943
 set_user_info_pw
3956
3944
 ********************************************************************/
3957
3945
 
3958
 
static bool set_user_info_pw(uint8 *pass, struct samu *pwd,
3959
 
                             int level)
 
3946
static bool set_user_info_pw(uint8 *pass, struct samu *pwd)
3960
3947
{
3961
3948
        uint32 len = 0;
3962
3949
        char *plaintext_buf = NULL;
3963
3950
        uint32 acct_ctrl;
3964
 
        time_t last_set_time;
3965
 
        enum pdb_value_state last_set_state;
3966
3951
 
3967
3952
        DEBUG(5, ("Attempting administrator password change for user %s\n",
3968
3953
                  pdb_get_username(pwd)));
3969
3954
 
3970
3955
        acct_ctrl = pdb_get_acct_ctrl(pwd);
3971
 
        /* we need to know if it's expired, because this is an admin change, not a
3972
 
           user change, so it's still expired when we're done */
3973
 
        last_set_state = pdb_get_init_flags(pwd, PDB_PASSLASTSET);
3974
 
        last_set_time = pdb_get_pass_last_set_time(pwd);
3975
3956
 
3976
3957
        if (!decode_pw_buffer(talloc_tos(),
3977
3958
                                pass,
4014
3995
 
4015
3996
        memset(plaintext_buf, '\0', strlen(plaintext_buf));
4016
3997
 
4017
 
        /*
4018
 
         * A level 25 change does reset the pwdlastset field, a level 24
4019
 
         * change does not. I know this is probably not the full story, but
4020
 
         * it is needed to make XP join LDAP correctly, without it the later
4021
 
         * auth2 check can fail with PWD_MUST_CHANGE.
4022
 
         */
4023
 
        if (level != 25) {
4024
 
                /*
4025
 
                 * restore last set time as this is an admin change, not a
4026
 
                 * user pw change
4027
 
                 */
4028
 
                pdb_set_pass_last_set_time (pwd, last_set_time,
4029
 
                                            last_set_state);
4030
 
        }
4031
 
 
4032
3998
        DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4033
3999
 
4034
 
        /* update the SAMBA password */
4035
 
        if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
4036
 
                return False;
 
4000
        return True;
 
4001
}
 
4002
 
 
4003
/*******************************************************************
 
4004
 set_user_info_24
 
4005
 ********************************************************************/
 
4006
 
 
4007
static NTSTATUS set_user_info_24(TALLOC_CTX *mem_ctx,
 
4008
                                 struct samr_UserInfo24 *id24,
 
4009
                                 struct samu *pwd)
 
4010
{
 
4011
        NTSTATUS status;
 
4012
 
 
4013
        if (id24 == NULL) {
 
4014
                DEBUG(5, ("set_user_info_24: NULL id24\n"));
 
4015
                return NT_STATUS_INVALID_PARAMETER;
 
4016
        }
 
4017
 
 
4018
        if (!set_user_info_pw(id24->password.data, pwd)) {
 
4019
                return NT_STATUS_WRONG_PASSWORD;
 
4020
        }
 
4021
 
 
4022
        copy_id24_to_sam_passwd(pwd, id24);
 
4023
 
 
4024
        status = pdb_update_sam_account(pwd);
 
4025
        if (!NT_STATUS_IS_OK(status)) {
 
4026
                return status;
4037
4027
        }
4038
4028
 
4039
 
        return True;
 
4029
        return NT_STATUS_OK;
4040
4030
}
4041
4031
 
4042
4032
/*******************************************************************
4062
4052
                return NT_STATUS_ACCESS_DENIED;
4063
4053
        }
4064
4054
 
 
4055
        if ((id25->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
 
4056
            (id25->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
 
4057
 
 
4058
                if (!set_user_info_pw(id25->password.data, pwd)) {
 
4059
                        return NT_STATUS_WRONG_PASSWORD;
 
4060
                }
 
4061
        }
 
4062
 
4065
4063
        copy_id25_to_sam_passwd(pwd, id25);
4066
4064
 
4067
4065
        /* write the change out */
4088
4086
}
4089
4087
 
4090
4088
/*******************************************************************
 
4089
 set_user_info_26
 
4090
 ********************************************************************/
 
4091
 
 
4092
static NTSTATUS set_user_info_26(TALLOC_CTX *mem_ctx,
 
4093
                                 struct samr_UserInfo26 *id26,
 
4094
                                 struct samu *pwd)
 
4095
{
 
4096
        NTSTATUS status;
 
4097
 
 
4098
        if (id26 == NULL) {
 
4099
                DEBUG(5, ("set_user_info_26: NULL id26\n"));
 
4100
                return NT_STATUS_INVALID_PARAMETER;
 
4101
        }
 
4102
 
 
4103
        if (!set_user_info_pw(id26->password.data, pwd)) {
 
4104
                return NT_STATUS_WRONG_PASSWORD;
 
4105
        }
 
4106
 
 
4107
        copy_id26_to_sam_passwd(pwd, id26);
 
4108
 
 
4109
        status = pdb_update_sam_account(pwd);
 
4110
        if (!NT_STATUS_IS_OK(status)) {
 
4111
                return status;
 
4112
        }
 
4113
 
 
4114
        return NT_STATUS_OK;
 
4115
}
 
4116
 
 
4117
 
 
4118
/*******************************************************************
4091
4119
 samr_SetUserInfo
4092
4120
 ********************************************************************/
4093
4121
 
4247
4275
 
4248
4276
                        dump_data(100, info->info24.password.data, 516);
4249
4277
 
4250
 
                        if (!set_user_info_pw(info->info24.password.data, pwd,
4251
 
                                              switch_value)) {
4252
 
                                status = NT_STATUS_WRONG_PASSWORD;
4253
 
                        }
 
4278
                        status = set_user_info_24(p->mem_ctx,
 
4279
                                                  &info->info24, pwd);
4254
4280
                        break;
4255
4281
 
4256
4282
                case 25:
4265
4291
 
4266
4292
                        status = set_user_info_25(p->mem_ctx,
4267
4293
                                                  &info->info25, pwd);
4268
 
                        if (!NT_STATUS_IS_OK(status)) {
4269
 
                                goto done;
4270
 
                        }
4271
 
                        if (!set_user_info_pw(info->info25.password.data, pwd,
4272
 
                                              switch_value)) {
4273
 
                                status = NT_STATUS_WRONG_PASSWORD;
4274
 
                        }
4275
4294
                        break;
4276
4295
 
4277
4296
                case 26:
4284
4303
 
4285
4304
                        dump_data(100, info->info26.password.data, 516);
4286
4305
 
4287
 
                        if (!set_user_info_pw(info->info26.password.data, pwd,
4288
 
                                              switch_value)) {
4289
 
                                status = NT_STATUS_WRONG_PASSWORD;
4290
 
                        }
 
4306
                        status = set_user_info_26(p->mem_ctx,
 
4307
                                                  &info->info26, pwd);
4291
4308
                        break;
4292
4309
 
4293
4310
                default:
4294
4311
                        status = NT_STATUS_INVALID_INFO_CLASS;
4295
4312
        }
4296
4313
 
4297
 
 done:
4298
 
 
4299
4314
        TALLOC_FREE(pwd);
4300
4315
 
4301
4316
        if (has_enough_rights) {