← Back to branch summary

~ubuntu-branches/ubuntu/vivid/samba/vivid

« back to all changes in this revision

Viewing changes to source4/rpc_server/lsa/lsa_lookup.c

  • Committer: Package Import Robot
  • Author(s): Chuck Short
  • Date: 2011-12-21 13:18:04 UTC
  • mfrom: (0.39.21 sid)
  • Revision ID: package-import@ubuntu.com-20111221131804-xtlr39wx6njehxxr
Tags: 2:3.6.1-3ubuntu1
* Merge from Debian testing.  Remaining changes:
  + debian/patches/VERSION.patch:
    - set SAMBA_VERSION_SUFFIX to Ubuntu.
  + debian/patches/error-trans.fix-276472:
    - Add the translation of Unix Error code -ENOTSUP to NT Error Code
    - NT_STATUS_NOT_SUPPORTED to prevent the Permission denied error.
  + debian/smb.conf:
    - add "(Samba, Ubuntu)" to server string.
    - comment out the default [homes] share, and add a comment about
      "valid users = %S" to show users how to restrict access to
      \\server\username to only username.
    - Set 'usershare allow guests', so that usershare admins are 
      allowed to create public shares in addition to authenticated
      ones.
    - add map to guest = Bad user, maps bad username to guest access.
  + debian/samba-common.config:
    - Do not change priority to high if dhclient3 is installed.
    - Use priority medium instead of high for the workgroup question.
  + debian/control:
    - Don't build against or suggest ctdb.
    - Add dependency on samba-common-bin to samba.
  + Add ufw integration:
    - Created debian/samba.ufw.profile
    - debian/rules, debian/samba.dirs, debian/samba.files: install
      profile
    - debian/control: have samba suggest ufw
  + Add apport hook:
    - Created debian/source_samba.py.
    - debian/rules, debian/samba.dirs, debian/samba-common-bin.files: install
  + Switch to upstart:
    - Add debian/samba.{nmbd,smbd}.upstart.
  + debian/samba.logrotate, debian/samba-common.dhcp, debian/samba.if-up:
    - Make them upstart compatible
  + debian/samba.postinst: 
    - Avoid scary pdbedit warnings on first import.
  + debian/samba-common.postinst: Add more informative error message for
    the case where smb.conf was manually deleted
  + debian/patches/fix-debuglevel-name-conflict.patch: don't use 'debug_level'
    as a global variable name in an NSS module 
  + Dropped:
    - debian/patches/error-trans.fix-276472
    - debian/patches/fix-debuglevel-name-conflict.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
source4/rpc_server/lsa/lsa_lookup.c
21
21
*/
22
22
 
23
23
#include "rpc_server/lsa/lsa.h"
 
24
#include "libds/common/flag_mapping.h"
24
25
 
25
26
static const struct {
26
27
        const char *domain;
27
28
        const char *name;
28
29
        const char *sid;
29
 
        int rtype;
 
30
        enum lsa_SidType rtype;
30
31
} well_known[] = {
31
32
        {
32
33
                .name = "EVERYONE",
193
194
 
194
195
static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
195
196
                                        const char *name, const char **authority_name, 
196
 
                                        struct dom_sid **sid, uint32_t *rtype) 
 
197
                                        struct dom_sid **sid, enum lsa_SidType *rtype)
197
198
{
198
 
        int i;
 
199
        unsigned int i;
199
200
        for (i=0; well_known[i].sid; i++) {
200
201
                if (domain) {
201
202
                        if (strcasecmp_m(domain, well_known[i].domain) == 0
219
220
 
220
221
static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx, 
221
222
                                       const char *sid_str, const char **authority_name, 
222
 
                                       const char **name, uint32_t *rtype) 
 
223
                                       const char **name, enum lsa_SidType *rtype) 
223
224
{
224
 
        int i;
 
225
        unsigned int i;
225
226
        for (i=0; well_known[i].sid; i++) {
226
227
                if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
227
228
                        *authority_name = well_known[i].domain;
239
240
static NTSTATUS dcesrv_lsa_lookup_name(struct tevent_context *ev_ctx, 
240
241
                                       struct loadparm_context *lp_ctx,
241
242
                                       struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
242
 
                                const char *name, const char **authority_name, 
243
 
                                struct dom_sid **sid, enum lsa_SidType *rtype)
 
243
                                       const char *name, const char **authority_name, 
 
244
                                       struct dom_sid **sid, enum lsa_SidType *rtype,
 
245
                                       uint32_t *rid)
244
246
{
245
 
        int ret, atype, i;
 
247
        int ret, i;
 
248
        uint32_t atype;
246
249
        struct ldb_message **res;
247
250
        const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
248
251
        const char *p;
274
277
                /* Look up table of well known names */
275
278
                status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
276
279
                if (NT_STATUS_IS_OK(status)) {
 
280
                        dom_sid_split_rid(NULL, *sid, NULL, rid);
 
281
                        return NT_STATUS_OK;
 
282
                }
 
283
 
 
284
                if (username == NULL) {
 
285
                        *authority_name = NAME_BUILTIN;
 
286
                        *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
 
287
                        *rtype = SID_NAME_DOMAIN;
 
288
                        *rid = 0xFFFFFFFF;
277
289
                        return NT_STATUS_OK;
278
290
                }
279
291
 
281
293
                        *authority_name = NAME_NT_AUTHORITY;
282
294
                        *sid =  dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
283
295
                        *rtype = SID_NAME_DOMAIN;
 
296
                        dom_sid_split_rid(NULL, *sid, NULL, rid);
284
297
                        return NT_STATUS_OK;
285
298
                }
286
299
                if (strcasecmp_m(username, NAME_BUILTIN) == 0) { 
287
300
                        *authority_name = NAME_BUILTIN;
288
301
                        *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
289
302
                        *rtype = SID_NAME_DOMAIN;
 
303
                        *rid = 0xFFFFFFFF;
290
304
                        return NT_STATUS_OK;
291
305
                }
292
306
                if (strcasecmp_m(username, state->domain_dns) == 0) { 
293
307
                        *authority_name = state->domain_name;
294
308
                        *sid =  state->domain_sid;
295
309
                        *rtype = SID_NAME_DOMAIN;
 
310
                        *rid = 0xFFFFFFFF;
296
311
                        return NT_STATUS_OK;
297
312
                }
298
313
                if (strcasecmp_m(username, state->domain_name) == 0) { 
299
314
                        *authority_name = state->domain_name;
300
315
                        *sid =  state->domain_sid;
301
316
                        *rtype = SID_NAME_DOMAIN;
 
317
                        *rid = 0xFFFFFFFF;
302
318
                        return NT_STATUS_OK;
303
319
                }
304
320
                
307
323
                if (!name) {
308
324
                        return NT_STATUS_NO_MEMORY;
309
325
                }
310
 
                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
 
326
                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
311
327
                if (NT_STATUS_IS_OK(status)) {
312
328
                        return status;
313
329
                }
317
333
                if (!name) {
318
334
                        return NT_STATUS_NO_MEMORY;
319
335
                }
320
 
                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
 
336
                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
321
337
                if (NT_STATUS_IS_OK(status)) {
322
338
                        return status;
323
339
                }
327
343
                if (!name) {
328
344
                        return NT_STATUS_NO_MEMORY;
329
345
                }
330
 
                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
 
346
                status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype, rid);
331
347
                if (NT_STATUS_IS_OK(status)) {
332
348
                        return status;
333
349
                }
338
354
                        *authority_name = NAME_NT_AUTHORITY;
339
355
                        *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
340
356
                        *rtype = SID_NAME_DOMAIN;
 
357
                        dom_sid_split_rid(NULL, *sid, NULL, rid);
341
358
                        return NT_STATUS_OK;
342
359
                }
343
360
 
344
361
                /* Look up table of well known names */
345
 
                return lookup_well_known_names(mem_ctx, domain, username, authority_name, 
346
 
                                               sid, rtype);
 
362
                status = lookup_well_known_names(mem_ctx, domain, username, authority_name, 
 
363
                                                 sid, rtype);
 
364
                if (NT_STATUS_IS_OK(status)) {
 
365
                        dom_sid_split_rid(NULL, *sid, NULL, rid);
 
366
                }
 
367
                return status;
347
368
        } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
348
369
                *authority_name = NAME_BUILTIN;
349
370
                domain_dn = state->builtin_dn;
359
380
        }
360
381
 
361
382
        ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
362
 
        if (ret == 1) {
363
 
                domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
364
 
                if (domain_sid == NULL) {
365
 
                        return NT_STATUS_INVALID_SID;
366
 
                }
367
 
        } else {
 
383
        if (ret != 1) {
 
384
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
 
385
        }
 
386
        domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
 
387
        if (domain_sid == NULL) {
368
388
                return NT_STATUS_INVALID_SID;
369
389
        }
370
390
 
371
391
        if (!*username) {
372
392
                *sid = domain_sid;
373
393
                *rtype = SID_NAME_DOMAIN;
 
394
                *rid = 0xFFFFFFFF;
374
395
                return NT_STATUS_OK;
375
396
        }
376
397
        
377
398
        ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
378
399
                           "(&(sAMAccountName=%s)(objectSid=*))", 
379
400
                           ldb_binary_encode_string(mem_ctx, username));
380
 
        if (ret == -1) {
381
 
                return NT_STATUS_INVALID_SID;
 
401
        if (ret < 0) {
 
402
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
382
403
        }
383
404
 
384
405
        for (i=0; i < ret; i++) {
392
413
                        continue;
393
414
                }
394
415
 
395
 
                atype = samdb_result_uint(res[i], "sAMAccountType", 0);
 
416
                atype = ldb_msg_find_attr_as_uint(res[i], "sAMAccountType", 0);
396
417
                        
397
418
                *rtype = ds_atype_map(atype);
398
419
                if (*rtype == SID_NAME_UNKNOWN) {
399
420
                        return STATUS_SOME_UNMAPPED;
400
421
                }
401
422
 
 
423
                dom_sid_split_rid(NULL, *sid, NULL, rid);
402
424
                return NT_STATUS_OK;
403
425
        }
404
426
 
419
441
                                          uint32_t *sid_index)
420
442
{
421
443
        struct dom_sid *authority_sid;
422
 
        int i;
 
444
        uint32_t i;
423
445
 
424
446
        if (rtype != SID_NAME_DOMAIN) {
425
447
                authority_sid = dom_sid_dup(mem_ctx, sid);
489
511
                return NT_STATUS_NOT_FOUND;
490
512
        }
491
513
 
 
514
        /* need to re-add a check for an allocated sid */
 
515
 
492
516
        ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs, 
493
517
                           "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
494
 
        if (ret == 1) {
495
 
                *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
 
518
        if ((ret < 0) || (ret > 1)) {
 
519
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
 
520
        }
 
521
        if (ret == 0) {
 
522
                return NT_STATUS_NOT_FOUND;
 
523
        }
 
524
 
 
525
        *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
 
526
        if (!*name) {
 
527
                *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
496
528
                if (!*name) {
497
 
                        *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
498
 
                        if (!*name) {
499
 
                                *name = talloc_strdup(mem_ctx, sid_str);
500
 
                                NT_STATUS_HAVE_NO_MEMORY(*name);
501
 
                        }
 
529
                        *name = talloc_strdup(mem_ctx, sid_str);
 
530
                        NT_STATUS_HAVE_NO_MEMORY(*name);
502
531
                }
503
 
 
504
 
                atype = samdb_result_uint(res[0], "sAMAccountType", 0);
505
 
 
506
 
                *rtype = ds_atype_map(atype);
507
 
 
508
 
                return NT_STATUS_OK;
509
532
        }
510
533
 
511
 
        /* need to re-add a check for an allocated sid */
 
534
        atype = ldb_msg_find_attr_as_uint(res[0], "sAMAccountType", 0);
 
535
        *rtype = ds_atype_map(atype);
512
536
 
513
 
        return NT_STATUS_NOT_FOUND;
 
537
        return NT_STATUS_OK;
514
538
}
515
539
 
516
540
 
523
547
{
524
548
        struct lsa_policy_state *state;
525
549
        struct lsa_RefDomainList *domains = NULL;
526
 
        int i;
 
550
        uint32_t i;
527
551
        NTSTATUS status = NT_STATUS_OK;
528
552
 
529
553
        if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
682
706
{
683
707
        struct lsa_LookupSids2 r2;
684
708
        NTSTATUS status;
685
 
        int i;
 
709
        uint32_t i;
686
710
 
687
711
        ZERO_STRUCT(r2);
688
712
 
736
760
{
737
761
        struct lsa_policy_state *policy_state;
738
762
        struct dcesrv_handle *policy_handle;
739
 
        int i;
 
763
        uint32_t i;
740
764
        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
741
765
        struct lsa_RefDomainList *domains;
742
766
 
774
798
                const char *name = r->in.names[i].string;
775
799
                const char *authority_name;
776
800
                struct dom_sid *sid;
777
 
                uint32_t sid_index;
 
801
                uint32_t sid_index, rid;
778
802
                enum lsa_SidType rtype;
779
803
                NTSTATUS status2;
780
804
 
785
809
                r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
786
810
                r->out.sids->sids[i].flags       = 0;
787
811
 
788
 
                status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name, &authority_name, &sid, &rtype);
 
812
                status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name,
 
813
                                                 &authority_name, &sid, &rtype, &rid);
789
814
                if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
790
815
                        continue;
791
816
                }
877
902
{
878
903
        struct lsa_policy_state *state;
879
904
        struct dcesrv_handle *h;
880
 
        int i;
 
905
        uint32_t i;
881
906
        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
882
907
        struct lsa_RefDomainList *domains;
883
908
 
915
940
                const char *name = r->in.names[i].string;
916
941
                const char *authority_name;
917
942
                struct dom_sid *sid;
918
 
                uint32_t rtype, sid_index;
 
943
                uint32_t sid_index, rid=0;
 
944
                enum lsa_SidType rtype;
919
945
                NTSTATUS status2;
920
946
 
921
947
                r->out.sids->count++;
928
954
                r->out.sids->sids[i].sid_index   = 0xFFFFFFFF;
929
955
                r->out.sids->sids[i].unknown     = 0;
930
956
 
931
 
                status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name, 
932
 
                                                 &authority_name, &sid, &rtype);
 
957
                status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name,
 
958
                                                 &authority_name, &sid, &rtype, &rid);
933
959
                if (!NT_STATUS_IS_OK(status2)) {
934
960
                        continue;
935
961
                }
941
967
                }
942
968
 
943
969
                r->out.sids->sids[i].sid_type    = rtype;
944
 
                r->out.sids->sids[i].rid         = sid->sub_auths[sid->num_auths-1];
 
970
                r->out.sids->sids[i].rid         = rid;
945
971
                r->out.sids->sids[i].sid_index   = sid_index;
946
972
                r->out.sids->sids[i].unknown     = 0;
947
973
 
966
992
{
967
993
        struct lsa_LookupNames2 r2;
968
994
        NTSTATUS status;
969
 
        int i;
 
995
        uint32_t i;
970
996
 
971
997
        ZERO_STRUCT(r2);
972
998