?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
libsmbclient: Read the file type from the server with posix enabled
[Samba.git] / source3 / passdb / pdb_smbpasswd.c
blob04cf419d89053bf66a85262c7b81ceff39fb44f6
1 /*
2 * Unix SMB/CIFS implementation.
3 * SMB parameters and setup
4 * Copyright (C) Andrew Tridgell 1992-1998
5 * Modified by Jeremy Allison 1995.
6 * Modified by Gerald (Jerry) Carter 2000-2001,2003
7 * Modified by Andrew Bartlett 2002.
8 *
9 * This program is free software; you can redistribute it and/or modify it under
10 * the terms of the GNU General Public License as published by the Free
11 * Software Foundation; either version 3 of the License, or (at your option)
12 * any later version.
13 *
14 * This program is distributed in the hope that it will be useful, but WITHOUT
15 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
16 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
17 * more details.
18 *
19 * You should have received a copy of the GNU General Public License along with
20 * this program; if not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "passdb.h"
25 #include "system/passwd.h"
26 #include "system/filesys.h"
27 #include "../librpc/gen_ndr/samr.h"
28 #include "../libcli/security/security.h"
29 #include "passdb/pdb_smbpasswd.h"
30 #include "lib/util/string_wrappers.h"
31
32 #undef DBGC_CLASS
33 #define DBGC_CLASS DBGC_PASSDB
34
35 /*
36 smb_passwd is analogous to sam_passwd used everywhere
37 else. However, smb_passwd is limited to the information
38 stored by an smbpasswd entry
39 */
40
41 struct smb_passwd
42 {
43 uint32_t smb_userid; /* this is actually the unix uid_t */
44 const char *smb_name; /* username string */
45
46 const unsigned char *smb_passwd; /* Null if no password */
47 const unsigned char *smb_nt_passwd; /* Null if no password */
48
49 uint16_t acct_ctrl; /* account info (ACB_xxxx bit-mask) */
50 time_t pass_last_set_time; /* password last set time */
51 };
52
53 struct smbpasswd_privates
54 {
55 /* used for maintain locks on the smbpasswd file */
56 int pw_file_lock_depth;
57
58 /* Global File pointer */
59 FILE *pw_file;
60
61 /* formerly static variables */
62 struct smb_passwd pw_buf;
63 fstring user_name;
64 unsigned char smbpwd[16];
65 unsigned char smbntpwd[16];
66
67 /* retrieve-once info */
68 const char *smbpasswd_file;
69 };
70
71 enum pwf_access_type { PWF_READ, PWF_UPDATE, PWF_CREATE };
72
73 static SIG_ATOMIC_T gotalarm;
74
75 /***************************************************************
76 Signal function to tell us we timed out.
77 ****************************************************************/
78
79 static void gotalarm_sig(int signum)
80 {
81 gotalarm = 1;
82 }
83
84 /***************************************************************
85 Lock or unlock a fd for a known lock type. Abandon after waitsecs
86 seconds.
87 ****************************************************************/
88
89 static bool do_file_lock(int fd, int waitsecs, int type)
90 {
91 struct flock lock;
92 int ret;
93 void (*oldsig_handler)(int);
94
95 gotalarm = 0;
96 oldsig_handler = CatchSignal(SIGALRM, gotalarm_sig);
97
98 lock.l_type = type;
99 lock.l_whence = SEEK_SET;
100 lock.l_start = 0;
101 lock.l_len = 1;
102 lock.l_pid = 0;
103
104 alarm(waitsecs);
105 /* Note we must *NOT* use sys_fcntl here ! JRA */
106 ret = fcntl(fd, F_SETLKW, &lock);
107 alarm(0);
108 CatchSignal(SIGALRM, oldsig_handler);
109
110 if (gotalarm && ret == -1) {
111 DEBUG(0, ("do_file_lock: failed to %s file.\n",
112 type == F_UNLCK ? "unlock" : "lock"));
113 return False;
114 }
115
116 return (ret == 0);
117 }
118
119 /***************************************************************
120 Lock an fd. Abandon after waitsecs seconds.
121 ****************************************************************/
122
123 static bool pw_file_lock(int fd, int type, int secs, int *plock_depth)
124 {
125 if (fd < 0) {
126 return False;
127 }
128
129 if(*plock_depth == 0) {
130 if (!do_file_lock(fd, secs, type)) {
131 DEBUG(10,("pw_file_lock: locking file failed, error = %s.\n",
132 strerror(errno)));
133 return False;
134 }
135 }
136
137 (*plock_depth)++;
138
139 return True;
140 }
141
142 /***************************************************************
143 Unlock an fd. Abandon after waitsecs seconds.
144 ****************************************************************/
145
146 static bool pw_file_unlock(int fd, int *plock_depth)
147 {
148 bool ret=True;
149
150 if (fd == 0 || *plock_depth == 0) {
151 return True;
152 }
153
154 if(*plock_depth == 1) {
155 ret = do_file_lock(fd, 5, F_UNLCK);
156 }
157
158 if (*plock_depth > 0) {
159 (*plock_depth)--;
160 }
161
162 if(!ret) {
163 DEBUG(10,("pw_file_unlock: unlocking file failed, error = %s.\n",
164 strerror(errno)));
165 }
166 return ret;
167 }
168
169 /**************************************************************
170 Initialize a smb_passwd struct
171 *************************************************************/
172
173 static void pdb_init_smb(struct smb_passwd *user)
174 {
175 if (user == NULL)
176 return;
177 ZERO_STRUCTP (user);
178
179 user->pass_last_set_time = (time_t)0;
180 }
181
182 /***************************************************************
183 Internal fn to enumerate the smbpasswd list. Returns a void pointer
184 to ensure no modification outside this module. Checks for atomic
185 rename of smbpasswd file on update or create once the lock has
186 been granted to prevent race conditions. JRA.
187 ****************************************************************/
188
189 static FILE *startsmbfilepwent(const char *pfile, enum pwf_access_type type, int *lock_depth)
190 {
191 FILE *fp = NULL;
192 const char *open_mode = NULL;
193 int race_loop = 0;
194 int lock_type = F_RDLCK;
195
196 if (!*pfile) {
197 DEBUG(0, ("startsmbfilepwent: No SMB password file set\n"));
198 return (NULL);
199 }
200
201 switch(type) {
202 case PWF_READ:
203 open_mode = "rb";
204 lock_type = F_RDLCK;
205 break;
206 case PWF_UPDATE:
207 open_mode = "r+b";
208 lock_type = F_WRLCK;
209 break;
210 case PWF_CREATE:
211 /*
212 * Ensure atomic file creation.
213 */
214 {
215 int i, fd = -1;
216
217 for(i = 0; i < 5; i++) {
218 if((fd = open(pfile, O_CREAT|O_TRUNC|O_EXCL|O_RDWR, 0600))!=-1) {
219 break;
220 }
221 usleep(200); /* Spin, spin... */
222 }
223 if(fd == -1) {
224 DEBUG(0,("startsmbfilepwent_internal: too many race conditions \
225 creating file %s\n", pfile));
226 return NULL;
227 }
228 close(fd);
229 open_mode = "r+b";
230 lock_type = F_WRLCK;
231 break;
232 }
233 default:
234 DEBUG(10, ("Invalid open mode: %d\n", type));
235 return NULL;
236 }
237
238 for(race_loop = 0; race_loop < 5; race_loop++) {
239 DEBUG(10, ("startsmbfilepwent_internal: opening file %s\n", pfile));
240
241 if((fp = fopen(pfile, open_mode)) == NULL) {
242
243 /*
244 * If smbpasswd file doesn't exist, then create new one. This helps to avoid
245 * confusing error msg when adding user account first time.
246 */
247 if (errno == ENOENT) {
248 if ((fp = fopen(pfile, "a+")) != NULL) {
249 DEBUG(0, ("startsmbfilepwent_internal: file %s did not \
250 exist. File successfully created.\n", pfile));
251 } else {
252 DEBUG(0, ("startsmbfilepwent_internal: file %s did not \
253 exist. Couldn't create new one. Error was: %s\n",
254 pfile, strerror(errno)));
255 return NULL;
256 }
257 } else {
258 DEBUG(0, ("startsmbfilepwent_internal: unable to open file %s. \
259 Error was: %s\n", pfile, strerror(errno)));
260 return NULL;
261 }
262 }
263
264 if (!pw_file_lock(fileno(fp), lock_type, 5, lock_depth)) {
265 DEBUG(0, ("startsmbfilepwent_internal: unable to lock file %s. \
266 Error was %s\n", pfile, strerror(errno) ));
267 fclose(fp);
268 return NULL;
269 }
270
271 /*
272 * Only check for replacement races on update or create.
273 * For read we don't mind if the data is one record out of date.
274 */
275
276 if(type == PWF_READ) {
277 break;
278 } else {
279 SMB_STRUCT_STAT sbuf1, sbuf2;
280
281 /*
282 * Avoid the potential race condition between the open and the lock
283 * by doing a stat on the filename and an fstat on the fd. If the
284 * two inodes differ then someone did a rename between the open and
285 * the lock. Back off and try the open again. Only do this 5 times to
286 * prevent infinite loops. JRA.
287 */
288
289 if (sys_stat(pfile, &sbuf1, false) != 0) {
290 DEBUG(0, ("startsmbfilepwent_internal: unable to stat file %s. \
291 Error was %s\n", pfile, strerror(errno)));
292 pw_file_unlock(fileno(fp), lock_depth);
293 fclose(fp);
294 return NULL;
295 }
296
297 if (sys_fstat(fileno(fp), &sbuf2, false) != 0) {
298 DEBUG(0, ("startsmbfilepwent_internal: unable to fstat file %s. \
299 Error was %s\n", pfile, strerror(errno)));
300 pw_file_unlock(fileno(fp), lock_depth);
301 fclose(fp);
302 return NULL;
303 }
304
305 if( sbuf1.st_ex_ino == sbuf2.st_ex_ino) {
306 /* No race. */
307 break;
308 }
309
310 /*
311 * Race occurred - back off and try again...
312 */
313
314 pw_file_unlock(fileno(fp), lock_depth);
315 fclose(fp);
316 }
317 }
318
319 if(race_loop == 5) {
320 DEBUG(0, ("startsmbfilepwent_internal: too many race conditions opening file %s\n", pfile));
321 return NULL;
322 }
323
324 /* Set a buffer to do more efficient reads */
325 setvbuf(fp, (char *)NULL, _IOFBF, 1024);
326
327 /* Make sure it is only rw by the owner */
328 #ifdef HAVE_FCHMOD
329 if(fchmod(fileno(fp), S_IRUSR|S_IWUSR) == -1) {
330 #else
331 if(chmod(pfile, S_IRUSR|S_IWUSR) == -1) {
332 #endif
333 DEBUG(0, ("startsmbfilepwent_internal: failed to set 0600 permissions on password file %s. \
334 Error was %s\n.", pfile, strerror(errno) ));
335 pw_file_unlock(fileno(fp), lock_depth);
336 fclose(fp);
337 return NULL;
338 }
339
340 /* We have a lock on the file. */
341 return fp;
342 }
343
344 /***************************************************************
345 End enumeration of the smbpasswd list.
346 ****************************************************************/
347
348 static void endsmbfilepwent(FILE *fp, int *lock_depth)
349 {
350 if (!fp) {
351 return;
352 }
353
354 pw_file_unlock(fileno(fp), lock_depth);
355 fclose(fp);
356 DEBUG(7, ("endsmbfilepwent_internal: closed password file.\n"));
357 }
358
359 /*************************************************************************
360 Routine to return the next entry in the smbpasswd list.
361 *************************************************************************/
362
363 static struct smb_passwd *getsmbfilepwent(struct smbpasswd_privates *smbpasswd_state, FILE *fp)
364 {
365 /* Static buffers we will return. */
366 struct smb_passwd *pw_buf = &smbpasswd_state->pw_buf;
367 char *user_name = smbpasswd_state->user_name;
368 unsigned char *smbpwd = smbpasswd_state->smbpwd;
369 unsigned char *smbntpwd = smbpasswd_state->smbntpwd;
370 char linebuf[256];
371 unsigned char *p;
372 long uidval;
373 size_t linebuf_len;
374 char *status;
375
376 if(fp == NULL) {
377 DEBUG(0,("getsmbfilepwent: Bad password file pointer.\n"));
378 return NULL;
379 }
380
381 pdb_init_smb(pw_buf);
382 pw_buf->acct_ctrl = ACB_NORMAL;
383
384 /*
385 * Scan the file, a line at a time and check if the name matches.
386 */
387 status = linebuf;
388 while (status && !feof(fp)) {
389 linebuf[0] = '\0';
390
391 status = fgets(linebuf, 256, fp);
392 if (status == NULL && ferror(fp)) {
393 return NULL;
394 }
395
396 /*
397 * Check if the string is terminated with a newline - if not
398 * then we must keep reading and discard until we get one.
399 */
400 if ((linebuf_len = strlen(linebuf)) == 0) {
401 continue;
402 }
403
404 if (linebuf[linebuf_len - 1] != '\n') {
405 while (!ferror(fp) && !feof(fp)) {
406 int c;
407 c = fgetc(fp);
408 if (c == '\n') {
409 break;
410 }
411 }
412 } else {
413 linebuf[linebuf_len - 1] = '\0';
414 }
415
416 #ifdef DEBUG_PASSWORD
417 DEBUG(100, ("getsmbfilepwent: got line |%s|\n", linebuf));
418 #endif
419 if ((linebuf[0] == 0) && feof(fp)) {
420 DEBUG(4, ("getsmbfilepwent: end of file reached\n"));
421 break;
422 }
423
424 /*
425 * The line we have should be of the form :-
426 *
427 * username:uid:32hex bytes:[Account type]:LCT-12345678....other flags presently
428 * ignored....
429 *
430 * or,
431 *
432 * username:uid:32hex bytes:32hex bytes:[Account type]:LCT-12345678....ignored....
433 *
434 * if Windows NT compatible passwords are also present.
435 * [Account type] is an ascii encoding of the type of account.
436 * LCT-(8 hex digits) is the time_t value of the last change time.
437 */
438
439 if (linebuf[0] == '#' || linebuf[0] == '\0') {
440 DEBUG(6, ("getsmbfilepwent: skipping comment or blank line\n"));
441 continue;
442 }
443 p = (unsigned char *) strchr_m(linebuf, ':');
444 if (p == NULL) {
445 DEBUG(0, ("getsmbfilepwent: malformed password entry (no :)\n"));
446 continue;
447 }
448
449 strncpy(user_name, linebuf, PTR_DIFF(p, linebuf));
450 user_name[PTR_DIFF(p, linebuf)] = '\0';
451
452 /* Get smb uid. */
453
454 p++; /* Go past ':' */
455
456 if(*p == '-') {
457 DEBUG(0, ("getsmbfilepwent: user name %s has a negative uid.\n", user_name));
458 continue;
459 }
460
461 if (!isdigit(*p)) {
462 DEBUG(0, ("getsmbfilepwent: malformed password entry for user %s (uid not number)\n",
463 user_name));
464 continue;
465 }
466
467 uidval = atoi((char *) p);
468
469 while (*p && isdigit(*p)) {
470 p++;
471 }
472
473 if (*p != ':') {
474 DEBUG(0, ("getsmbfilepwent: malformed password entry for user %s (no : after uid)\n",
475 user_name));
476 continue;
477 }
478
479 pw_buf->smb_name = user_name;
480 pw_buf->smb_userid = uidval;
481
482 /*
483 * Now get the password value - this should be 32 hex digits
484 * which are the ascii representations of a 16 byte string.
485 * Get two at a time and put them into the password.
486 */
487
488 /* Skip the ':' */
489 p++;
490
491 if (linebuf_len < (PTR_DIFF(p, linebuf) + 33)) {
492 DEBUG(0, ("getsmbfilepwent: malformed password entry for user %s (passwd too short)\n",
493 user_name ));
494 continue;
495 }
496
497 if (p[32] != ':') {
498 DEBUG(0, ("getsmbfilepwent: malformed password entry for user %s (no terminating :)\n",
499 user_name));
500 continue;
501 }
502
503 if (strnequal((char *) p, "NO PASSWORD", 11)) {
504 pw_buf->smb_passwd = NULL;
505 pw_buf->acct_ctrl |= ACB_PWNOTREQ;
506 } else {
507 if (*p == '*' || *p == 'X') {
508 /* NULL LM password */
509 pw_buf->smb_passwd = NULL;
510 DEBUG(10, ("getsmbfilepwent: LM password for user %s invalidated\n", user_name));
511 } else if (pdb_gethexpwd((char *)p, smbpwd)) {
512 pw_buf->smb_passwd = smbpwd;
513 } else {
514 pw_buf->smb_passwd = NULL;
515 DEBUG(0, ("getsmbfilepwent: Malformed Lanman password entry for user %s \
516 (non hex chars)\n", user_name));
517 }
518 }
519
520 /*
521 * Now check if the NT compatible password is
522 * available.
523 */
524 pw_buf->smb_nt_passwd = NULL;
525 p += 33; /* Move to the first character of the line after the lanman password. */
526 if ((linebuf_len >= (PTR_DIFF(p, linebuf) + 33)) && (p[32] == ':')) {
527 if (*p != '*' && *p != 'X') {
528 if(pdb_gethexpwd((char *)p,smbntpwd)) {
529 pw_buf->smb_nt_passwd = smbntpwd;
530 }
531 }
532 p += 33; /* Move to the first character of the line after the NT password. */
533 }
534
535 DEBUG(5,("getsmbfilepwent: returning passwd entry for user %s, uid %ld\n",
536 user_name, uidval));
537
538 if (*p == '[') {
539 unsigned char *end_p = (unsigned char *)strchr_m((char *)p, ']');
540 pw_buf->acct_ctrl = pdb_decode_acct_ctrl((char*)p);
541
542 /* Must have some account type set. */
543 if(pw_buf->acct_ctrl == 0) {
544 pw_buf->acct_ctrl = ACB_NORMAL;
545 }
546
547 /* Now try and get the last change time. */
548 if(end_p) {
549 p = end_p + 1;
550 }
551 if(*p == ':') {
552 p++;
553 if(*p && (strncasecmp_m((char *)p, "LCT-", 4)==0)) {
554 int i;
555 p += 4;
556 for(i = 0; i < 8; i++) {
557 if(p[i] == '\0' || !isxdigit(p[i])) {
558 break;
559 }
560 }
561 if(i == 8) {
562 /*
563 * p points at 8 characters of hex digits -
564 * read into a time_t as the seconds since
565 * 1970 that the password was last changed.
566 */
567 pw_buf->pass_last_set_time = (time_t)strtol((char *)p, NULL, 16);
568 }
569 }
570 }
571 } else {
572 /* 'Old' style file. Fake up based on user name. */
573 /*
574 * Currently trust accounts are kept in the same
575 * password file as 'normal accounts'. If this changes
576 * we will have to fix this code. JRA.
577 */
578 if(pw_buf->smb_name[strlen(pw_buf->smb_name) - 1] == '$') {
579 pw_buf->acct_ctrl &= ~ACB_NORMAL;
580 pw_buf->acct_ctrl |= ACB_WSTRUST;
581 }
582 }
583
584 return pw_buf;
585 }
586
587 DEBUG(5,("getsmbfilepwent: end of file reached.\n"));
588 return NULL;
589 }
590
591 /************************************************************************
592 Create a new smbpasswd entry - malloced space returned.
593 *************************************************************************/
594
595 static char *format_new_smbpasswd_entry(const struct smb_passwd *newpwd)
596 {
597 int new_entry_length;
598 char *new_entry;
599 char *p;
600
601 new_entry_length = strlen(newpwd->smb_name) + 1 + 15 + 1 + 32 + 1 + 32 + 1 +
602 NEW_PW_FORMAT_SPACE_PADDED_LEN + 1 + 13 + 2;
603
604 if((new_entry = (char *)SMB_MALLOC( new_entry_length )) == NULL) {
605 DEBUG(0, ("format_new_smbpasswd_entry: Malloc failed adding entry for user %s.\n",
606 newpwd->smb_name ));
607 return NULL;
608 }
609
610 slprintf(new_entry, new_entry_length - 1, "%s:%u:", newpwd->smb_name, (unsigned)newpwd->smb_userid);
611
612 p = new_entry+strlen(new_entry);
613 pdb_sethexpwd(p, newpwd->smb_passwd, newpwd->acct_ctrl);
614 p+=strlen(p);
615 *p = ':';
616 p++;
617
618 pdb_sethexpwd(p, newpwd->smb_nt_passwd, newpwd->acct_ctrl);
619 p+=strlen(p);
620 *p = ':';
621 p++;
622
623 /* Add the account encoding and the last change time. */
624 slprintf((char *)p, new_entry_length - 1 - (p - new_entry), "%s:LCT-%08X:\n",
625 pdb_encode_acct_ctrl(newpwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN),
626 (uint32_t)newpwd->pass_last_set_time);
627
628 return new_entry;
629 }
630
631 /************************************************************************
632 Routine to add an entry to the smbpasswd file.
633 *************************************************************************/
634
635 static NTSTATUS add_smbfilepwd_entry(struct smbpasswd_privates *smbpasswd_state,
636 struct smb_passwd *newpwd)
637 {
638 const char *pfile = smbpasswd_state->smbpasswd_file;
639 struct smb_passwd *pwd = NULL;
640 FILE *fp = NULL;
641 int wr_len;
642 int fd;
643 size_t new_entry_length;
644 char *new_entry;
645 off_t offpos;
646
647 /* Open the smbpassword file - for update. */
648 fp = startsmbfilepwent(pfile, PWF_UPDATE, &smbpasswd_state->pw_file_lock_depth);
649
650 if (fp == NULL && errno == ENOENT) {
651 /* Try again - create. */
652 fp = startsmbfilepwent(pfile, PWF_CREATE, &smbpasswd_state->pw_file_lock_depth);
653 }
654
655 if (fp == NULL) {
656 DEBUG(0, ("add_smbfilepwd_entry: unable to open file.\n"));
657 return map_nt_error_from_unix(errno);
658 }
659
660 /*
661 * Scan the file, a line at a time and check if the name matches.
662 */
663
664 while ((pwd = getsmbfilepwent(smbpasswd_state, fp)) != NULL) {
665 if (strequal(newpwd->smb_name, pwd->smb_name)) {
666 DEBUG(0, ("add_smbfilepwd_entry: entry with name %s already exists\n", pwd->smb_name));
667 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
668 return NT_STATUS_USER_EXISTS;
669 }
670 }
671
672 /* Ok - entry doesn't exist. We can add it */
673
674 /* Create a new smb passwd entry and set it to the given password. */
675 /*
676 * The add user write needs to be atomic - so get the fd from
677 * the fp and do a raw write() call.
678 */
679 fd = fileno(fp);
680
681 if((offpos = lseek(fd, 0, SEEK_END)) == -1) {
682 NTSTATUS result = map_nt_error_from_unix(errno);
683 DEBUG(0, ("add_smbfilepwd_entry(lseek): Failed to add entry for user %s to file %s. \
684 Error was %s\n", newpwd->smb_name, pfile, strerror(errno)));
685 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
686 return result;
687 }
688
689 if((new_entry = format_new_smbpasswd_entry(newpwd)) == NULL) {
690 DEBUG(0, ("add_smbfilepwd_entry(malloc): Failed to add entry for user %s to file %s. \
691 Error was %s\n", newpwd->smb_name, pfile, strerror(errno)));
692 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
693 return NT_STATUS_NO_MEMORY;
694 }
695
696 new_entry_length = strlen(new_entry);
697
698 #ifdef DEBUG_PASSWORD
699 DEBUG(100, ("add_smbfilepwd_entry(%d): new_entry_len %d made line |%s|",
700 fd, (int)new_entry_length, new_entry));
701 #endif
702
703 if ((wr_len = write(fd, new_entry, new_entry_length)) != new_entry_length) {
704 NTSTATUS result = map_nt_error_from_unix(errno);
705 DEBUG(0, ("add_smbfilepwd_entry(write): %d Failed to add entry for user %s to file %s. \
706 Error was %s\n", wr_len, newpwd->smb_name, pfile, strerror(errno)));
707
708 /* Remove the entry we just wrote. */
709 if(ftruncate(fd, offpos) == -1) {
710 DEBUG(0, ("add_smbfilepwd_entry: ERROR failed to ftruncate file %s. \
711 Error was %s. Password file may be corrupt ! Please examine by hand !\n",
712 newpwd->smb_name, strerror(errno)));
713 }
714
715 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
716 free(new_entry);
717 return result;
718 }
719
720 free(new_entry);
721 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
722 return NT_STATUS_OK;
723 }
724
725 /************************************************************************
726 Routine to search the smbpasswd file for an entry matching the username.
727 and then modify its password entry. We can't use the startsmbpwent()/
728 getsmbpwent()/endsmbpwent() interfaces here as we depend on looking
729 in the actual file to decide how much room we have to write data.
730 override = False, normal
731 override = True, override XXXXXXXX'd out password or NO PASS
732 ************************************************************************/
733
734 static bool mod_smbfilepwd_entry(struct smbpasswd_privates *smbpasswd_state, const struct smb_passwd* pwd)
735 {
736 /* Static buffers we will return. */
737 fstring user_name;
738
739 char *status;
740 #define LINEBUF_SIZE 255
741 char linebuf[LINEBUF_SIZE + 1];
742 char readbuf[1024];
743 char ascii_p16[FSTRING_LEN + 20];
744 fstring encode_bits;
745 unsigned char *p = NULL;
746 size_t linebuf_len = 0;
747 FILE *fp;
748 int lockfd;
749 const char *pfile = smbpasswd_state->smbpasswd_file;
750 bool found_entry = False;
751 bool got_pass_last_set_time = False;
752
753 off_t pwd_seekpos = 0;
754
755 int i;
756 int wr_len;
757 int fd;
758
759 if (!*pfile) {
760 DEBUG(0, ("No SMB password file set\n"));
761 return False;
762 }
763 DEBUG(10, ("mod_smbfilepwd_entry: opening file %s\n", pfile));
764
765 fp = fopen(pfile, "r+");
766
767 if (fp == NULL) {
768 DEBUG(0, ("mod_smbfilepwd_entry: unable to open file %s\n", pfile));
769 return False;
770 }
771 /* Set a buffer to do more efficient reads */
772 setvbuf(fp, readbuf, _IOFBF, sizeof(readbuf));
773
774 lockfd = fileno(fp);
775
776 if (!pw_file_lock(lockfd, F_WRLCK, 5, &smbpasswd_state->pw_file_lock_depth)) {
777 DEBUG(0, ("mod_smbfilepwd_entry: unable to lock file %s\n", pfile));
778 fclose(fp);
779 return False;
780 }
781
782 /* Make sure it is only rw by the owner */
783 chmod(pfile, 0600);
784
785 /* We have a write lock on the file. */
786 /*
787 * Scan the file, a line at a time and check if the name matches.
788 */
789 status = linebuf;
790 while (status && !feof(fp)) {
791 pwd_seekpos = ftell(fp);
792
793 linebuf[0] = '\0';
794
795 status = fgets(linebuf, LINEBUF_SIZE, fp);
796 if (status == NULL && ferror(fp)) {
797 pw_file_unlock(lockfd, &smbpasswd_state->pw_file_lock_depth);
798 fclose(fp);
799 return False;
800 }
801
802 /*
803 * Check if the string is terminated with a newline - if not
804 * then we must keep reading and discard until we get one.
805 */
806 linebuf_len = strlen(linebuf);
807 if (linebuf[linebuf_len - 1] != '\n') {
808 while (!ferror(fp) && !feof(fp)) {
809 int c;
810 c = fgetc(fp);
811 if (c == '\n') {
812 break;
813 }
814 }
815 } else {
816 linebuf[linebuf_len - 1] = '\0';
817 }
818
819 #ifdef DEBUG_PASSWORD
820 DEBUG(100, ("mod_smbfilepwd_entry: got line |%s|\n", linebuf));
821 #endif
822
823 if ((linebuf[0] == 0) && feof(fp)) {
824 DEBUG(4, ("mod_smbfilepwd_entry: end of file reached\n"));
825 break;
826 }
827
828 /*
829 * The line we have should be of the form :-
830 *
831 * username:uid:[32hex bytes]:....other flags presently
832 * ignored....
833 *
834 * or,
835 *
836 * username:uid:[32hex bytes]:[32hex bytes]:[attributes]:LCT-XXXXXXXX:...ignored.
837 *
838 * if Windows NT compatible passwords are also present.
839 */
840
841 if (linebuf[0] == '#' || linebuf[0] == '\0') {
842 DEBUG(6, ("mod_smbfilepwd_entry: skipping comment or blank line\n"));
843 continue;
844 }
845
846 p = (unsigned char *) strchr_m(linebuf, ':');
847
848 if (p == NULL) {
849 DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry (no :)\n"));
850 continue;
851 }
852
853 strncpy(user_name, linebuf, PTR_DIFF(p, linebuf));
854 user_name[PTR_DIFF(p, linebuf)] = '\0';
855 if (strequal(user_name, pwd->smb_name)) {
856 found_entry = True;
857 break;
858 }
859 }
860
861 if (!found_entry) {
862 pw_file_unlock(lockfd, &smbpasswd_state->pw_file_lock_depth);
863 fclose(fp);
864
865 DEBUG(2, ("Cannot update entry for user %s, as they don't exist in the smbpasswd file!\n",
866 pwd->smb_name));
867 return False;
868 }
869
870 DEBUG(6, ("mod_smbfilepwd_entry: entry exists for user %s\n", pwd->smb_name));
871
872 /* User name matches - get uid and password */
873 p++; /* Go past ':' */
874
875 if (!isdigit(*p)) {
876 DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry for user %s (uid not number)\n",
877 pwd->smb_name));
878 pw_file_unlock(lockfd, &smbpasswd_state->pw_file_lock_depth);
879 fclose(fp);
880 return False;
881 }
882
883 while (*p && isdigit(*p)) {
884 p++;
885 }
886 if (*p != ':') {
887 DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry for user %s (no : after uid)\n",
888 pwd->smb_name));
889 pw_file_unlock(lockfd, &smbpasswd_state->pw_file_lock_depth);
890 fclose(fp);
891 return False;
892 }
893
894 /*
895 * Now get the password value - this should be 32 hex digits
896 * which are the ascii representations of a 16 byte string.
897 * Get two at a time and put them into the password.
898 */
899 p++;
900
901 /* Record exact password position */
902 pwd_seekpos += PTR_DIFF(p, linebuf);
903
904 if (linebuf_len < (PTR_DIFF(p, linebuf) + 33)) {
905 DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry for user %s (passwd too short)\n",
906 pwd->smb_name));
907 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
908 fclose(fp);
909 return (False);
910 }
911
912 if (p[32] != ':') {
913 DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry for user %s (no terminating :)\n",
914 pwd->smb_name));
915 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
916 fclose(fp);
917 return False;
918 }
919
920 /* Now check if the NT compatible password is available. */
921 p += 33; /* Move to the first character of the line after the lanman password. */
922 if (linebuf_len < (PTR_DIFF(p, linebuf) + 33)) {
923 DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry for user %s (passwd too short)\n",
924 pwd->smb_name));
925 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
926 fclose(fp);
927 return (False);
928 }
929
930 if (p[32] != ':') {
931 DEBUG(0, ("mod_smbfilepwd_entry: malformed password entry for user %s (no terminating :)\n",
932 pwd->smb_name));
933 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
934 fclose(fp);
935 return False;
936 }
937
938 /*
939 * Now check if the account info and the password last
940 * change time is available.
941 */
942 p += 33; /* Move to the first character of the line after the NT password. */
943
944 if (*p == '[') {
945 i = 0;
946 encode_bits[i++] = *p++;
947 while((linebuf_len > PTR_DIFF(p, linebuf)) && (*p != ']')) {
948 encode_bits[i++] = *p++;
949 }
950
951 encode_bits[i++] = ']';
952 encode_bits[i++] = '\0';
953
954 if(i == NEW_PW_FORMAT_SPACE_PADDED_LEN) {
955 /*
956 * We are using a new format, space padded
957 * acct ctrl field. Encode the given acct ctrl
958 * bits into it.
959 */
960 fstrcpy(encode_bits, pdb_encode_acct_ctrl(pwd->acct_ctrl, NEW_PW_FORMAT_SPACE_PADDED_LEN));
961 } else {
962 DEBUG(0,("mod_smbfilepwd_entry: Using old smbpasswd format for user %s. \
963 This is no longer supported.!\n", pwd->smb_name));
964 DEBUG(0,("mod_smbfilepwd_entry: No changes made, failing.!\n"));
965 pw_file_unlock(lockfd, &smbpasswd_state->pw_file_lock_depth);
966 fclose(fp);
967 return False;
968 }
969
970 /* Go past the ']' */
971 if(linebuf_len > PTR_DIFF(p, linebuf)) {
972 p++;
973 }
974
975 if((linebuf_len > PTR_DIFF(p, linebuf)) && (*p == ':')) {
976 p++;
977
978 /* We should be pointing at the LCT entry. */
979 if((linebuf_len > (PTR_DIFF(p, linebuf) + 13)) && (strncasecmp_m((char *)p, "LCT-", 4) == 0)) {
980 p += 4;
981 for(i = 0; i < 8; i++) {
982 if(p[i] == '\0' || !isxdigit(p[i])) {
983 break;
984 }
985 }
986 if(i == 8) {
987 /*
988 * p points at 8 characters of hex digits -
989 * read into a time_t as the seconds since
990 * 1970 that the password was last changed.
991 */
992 got_pass_last_set_time = True;
993 } /* i == 8 */
994 } /* *p && strncasecmp_m() */
995 } /* p == ':' */
996 } /* p == '[' */
997
998 /* Entry is correctly formed. */
999
1000 /* Create the 32 byte representation of the new p16 */
1001 pdb_sethexpwd(ascii_p16, pwd->smb_passwd, pwd->acct_ctrl);
1002
1003 /* Add on the NT md4 hash */
1004 ascii_p16[32] = ':';
1005 wr_len = 66;
1006 pdb_sethexpwd(ascii_p16+33, pwd->smb_nt_passwd, pwd->acct_ctrl);
1007 ascii_p16[65] = ':';
1008 ascii_p16[66] = '\0'; /* null-terminate the string so that strlen works */
1009
1010 /* Add on the account info bits and the time of last password change. */
1011 if(got_pass_last_set_time) {
1012 slprintf(&ascii_p16[strlen(ascii_p16)],
1013 sizeof(ascii_p16)-(strlen(ascii_p16)+1),
1014 "%s:LCT-%08X:",
1015 encode_bits, (uint32_t)pwd->pass_last_set_time );
1016 wr_len = strlen(ascii_p16);
1017 }
1018
1019 #ifdef DEBUG_PASSWORD
1020 DEBUG(100,("mod_smbfilepwd_entry: "));
1021 dump_data(100, (uint8_t *)ascii_p16, wr_len);
1022 #endif
1023
1024 if(wr_len > LINEBUF_SIZE) {
1025 DEBUG(0, ("mod_smbfilepwd_entry: line to write (%d) is too long.\n", wr_len+1));
1026 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
1027 fclose(fp);
1028 return (False);
1029 }
1030
1031 /*
1032 * Do an atomic write into the file at the position defined by
1033 * seekpos.
1034 */
1035
1036 /* The mod user write needs to be atomic - so get the fd from
1037 the fp and do a raw write() call.
1038 */
1039
1040 fd = fileno(fp);
1041
1042 if (lseek(fd, pwd_seekpos - 1, SEEK_SET) != pwd_seekpos - 1) {
1043 DEBUG(0, ("mod_smbfilepwd_entry: seek fail on file %s.\n", pfile));
1044 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
1045 fclose(fp);
1046 return False;
1047 }
1048
1049 /* Sanity check - ensure the areas we are writing are framed by ':' */
1050 if (read(fd, linebuf, wr_len+1) != wr_len+1) {
1051 DEBUG(0, ("mod_smbfilepwd_entry: read fail on file %s.\n", pfile));
1052 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
1053 fclose(fp);
1054 return False;
1055 }
1056
1057 if ((linebuf[0] != ':') || (linebuf[wr_len] != ':')) {
1058 DEBUG(0, ("mod_smbfilepwd_entry: check on passwd file %s failed.\n", pfile));
1059 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
1060 fclose(fp);
1061 return False;
1062 }
1063
1064 if (lseek(fd, pwd_seekpos, SEEK_SET) != pwd_seekpos) {
1065 DEBUG(0, ("mod_smbfilepwd_entry: seek fail on file %s.\n", pfile));
1066 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
1067 fclose(fp);
1068 return False;
1069 }
1070
1071 if (write(fd, ascii_p16, wr_len) != wr_len) {
1072 DEBUG(0, ("mod_smbfilepwd_entry: write failed in passwd file %s\n", pfile));
1073 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
1074 fclose(fp);
1075 return False;
1076 }
1077
1078 pw_file_unlock(lockfd,&smbpasswd_state->pw_file_lock_depth);
1079 fclose(fp);
1080 return True;
1081 }
1082
1083 /************************************************************************
1084 Routine to delete an entry in the smbpasswd file by name.
1085 *************************************************************************/
1086
1087 static bool del_smbfilepwd_entry(struct smbpasswd_privates *smbpasswd_state, const char *name)
1088 {
1089 const char *pfile = smbpasswd_state->smbpasswd_file;
1090 char *pfile2 = NULL;
1091 struct smb_passwd *pwd = NULL;
1092 FILE *fp = NULL;
1093 FILE *fp_write = NULL;
1094 int pfile2_lockdepth = 0;
1095
1096 pfile2 = talloc_asprintf(talloc_tos(),
1097 "%s.%u",
1098 pfile, (unsigned)getpid());
1099 if (!pfile2) {
1100 return false;
1101 }
1102
1103 /*
1104 * Open the smbpassword file - for update. It needs to be update
1105 * as we need any other processes to wait until we have replaced
1106 * it.
1107 */
1108
1109 if((fp = startsmbfilepwent(pfile, PWF_UPDATE, &smbpasswd_state->pw_file_lock_depth)) == NULL) {
1110 DEBUG(0, ("del_smbfilepwd_entry: unable to open file %s.\n", pfile));
1111 return False;
1112 }
1113
1114 /*
1115 * Create the replacement password file.
1116 */
1117 if((fp_write = startsmbfilepwent(pfile2, PWF_CREATE, &pfile2_lockdepth)) == NULL) {
1118 DEBUG(0, ("del_smbfilepwd_entry: unable to open file %s.\n", pfile));
1119 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
1120 return False;
1121 }
1122
1123 /*
1124 * Scan the file, a line at a time and check if the name matches.
1125 */
1126
1127 while ((pwd = getsmbfilepwent(smbpasswd_state, fp)) != NULL) {
1128 char *new_entry;
1129 size_t new_entry_length;
1130
1131 if (strequal(name, pwd->smb_name)) {
1132 DEBUG(10, ("del_smbfilepwd_entry: found entry with "
1133 "name %s - deleting it.\n", name));
1134 continue;
1135 }
1136
1137 /*
1138 * We need to copy the entry out into the second file.
1139 */
1140
1141 if((new_entry = format_new_smbpasswd_entry(pwd)) == NULL) {
1142 DEBUG(0, ("del_smbfilepwd_entry(malloc): Failed to copy entry for user %s to file %s. \
1143 Error was %s\n", pwd->smb_name, pfile2, strerror(errno)));
1144 unlink(pfile2);
1145 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
1146 endsmbfilepwent(fp_write, &pfile2_lockdepth);
1147 return False;
1148 }
1149
1150 new_entry_length = strlen(new_entry);
1151
1152 if(fwrite(new_entry, 1, new_entry_length, fp_write) != new_entry_length) {
1153 DEBUG(0, ("del_smbfilepwd_entry(write): Failed to copy entry for user %s to file %s. \
1154 Error was %s\n", pwd->smb_name, pfile2, strerror(errno)));
1155 unlink(pfile2);
1156 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
1157 endsmbfilepwent(fp_write, &pfile2_lockdepth);
1158 free(new_entry);
1159 return False;
1160 }
1161
1162 free(new_entry);
1163 }
1164
1165 /*
1166 * Ensure pfile2 is flushed before rename.
1167 */
1168
1169 if(fflush(fp_write) != 0) {
1170 DEBUG(0, ("del_smbfilepwd_entry: Failed to flush file %s. Error was %s\n", pfile2, strerror(errno)));
1171 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
1172 endsmbfilepwent(fp_write,&pfile2_lockdepth);
1173 return False;
1174 }
1175
1176 /*
1177 * Do an atomic rename - then release the locks.
1178 */
1179
1180 if(rename(pfile2,pfile) != 0) {
1181 unlink(pfile2);
1182 }
1183
1184 endsmbfilepwent(fp, &smbpasswd_state->pw_file_lock_depth);
1185 endsmbfilepwent(fp_write,&pfile2_lockdepth);
1186 return True;
1187 }
1188
1189 /*********************************************************************
1190 Create a smb_passwd struct from a struct samu.
1191 We will not allocate any new memory. The smb_passwd struct
1192 should only stay around as long as the struct samu does.
1193 ********************************************************************/
1194
1195 static bool build_smb_pass (struct smb_passwd *smb_pw, const struct samu *sampass)
1196 {
1197 uint32_t rid;
1198
1199 if (sampass == NULL)
1200 return False;
1201 ZERO_STRUCTP(smb_pw);
1202
1203 if (!IS_SAM_DEFAULT(sampass, PDB_USERSID)) {
1204 rid = pdb_get_user_rid(sampass);
1205
1206 /* If the user specified a RID, make sure its able to be both stored and retrieved */
1207 if (rid == DOMAIN_RID_GUEST) {
1208 struct passwd *passwd = Get_Pwnam_alloc(NULL, lp_guest_account());
1209 if (!passwd) {
1210 DEBUG(0, ("Could not find guest account via Get_Pwnam_alloc()! (%s)\n", lp_guest_account()));
1211 return False;
1212 }
1213 smb_pw->smb_userid=passwd->pw_uid;
1214 TALLOC_FREE(passwd);
1215 } else if (algorithmic_pdb_rid_is_user(rid)) {
1216 smb_pw->smb_userid=algorithmic_pdb_user_rid_to_uid(rid);
1217 } else {
1218 DEBUG(0,("build_sam_pass: Failing attempt to store user with non-uid based user RID. \n"));
1219 return False;
1220 }
1221 }
1222
1223 smb_pw->smb_name=(const char*)pdb_get_username(sampass);
1224
1225 smb_pw->smb_passwd=pdb_get_lanman_passwd(sampass);
1226 smb_pw->smb_nt_passwd=pdb_get_nt_passwd(sampass);
1227
1228 smb_pw->acct_ctrl=pdb_get_acct_ctrl(sampass);
1229 smb_pw->pass_last_set_time=pdb_get_pass_last_set_time(sampass);
1230
1231 return True;
1232 }
1233
1234 /*********************************************************************
1235 Create a struct samu from a smb_passwd struct
1236 ********************************************************************/
1237
1238 static bool build_sam_account(struct smbpasswd_privates *smbpasswd_state,
1239 struct samu *sam_pass, const struct smb_passwd *pw_buf)
1240 {
1241 struct passwd *pwfile;
1242
1243 if ( !sam_pass ) {
1244 DEBUG(5,("build_sam_account: struct samu is NULL\n"));
1245 return False;
1246 }
1247
1248 /* verify the user account exists */
1249
1250 if ( !(pwfile = Get_Pwnam_alloc(NULL, pw_buf->smb_name )) ) {
1251 DEBUG(0,("build_sam_account: smbpasswd database is corrupt! username %s with uid "
1252 "%u is not in unix passwd database!\n", pw_buf->smb_name, pw_buf->smb_userid));
1253 return False;
1254 }
1255
1256 if ( !NT_STATUS_IS_OK( samu_set_unix(sam_pass, pwfile )) )
1257 return False;
1258
1259 TALLOC_FREE(pwfile);
1260
1261 /* set remaining fields */
1262
1263 if (!pdb_set_nt_passwd (sam_pass, pw_buf->smb_nt_passwd, PDB_SET))
1264 return False;
1265 if (!pdb_set_lanman_passwd (sam_pass, pw_buf->smb_passwd, PDB_SET))
1266 return False;
1267 pdb_set_acct_ctrl (sam_pass, pw_buf->acct_ctrl, PDB_SET);
1268 pdb_set_pass_last_set_time (sam_pass, pw_buf->pass_last_set_time, PDB_SET);
1269 pdb_set_pass_can_change_time (sam_pass, pw_buf->pass_last_set_time, PDB_SET);
1270
1271 return True;
1272 }
1273
1274 /*****************************************************************
1275 Functions to be implemented by the new passdb API
1276 ****************************************************************/
1277
1278 /****************************************************************
1279 Search smbpasswd file by iterating over the entries. Do not
1280 call getpwnam() for unix account information until we have found
1281 the correct entry
1282 ***************************************************************/
1283
1284 static NTSTATUS smbpasswd_getsampwnam(struct pdb_methods *my_methods,
1285 struct samu *sam_acct, const char *username)
1286 {
1287 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
1288 struct smbpasswd_privates *smbpasswd_state = (struct smbpasswd_privates*)my_methods->private_data;
1289 struct smb_passwd *smb_pw;
1290 FILE *fp = NULL;
1291
1292 DEBUG(10, ("getsampwnam (smbpasswd): search by name: %s\n", username));
1293
1294 /* startsmbfilepwent() is used here as we don't want to lookup
1295 the UNIX account in the local system password file until
1296 we have a match. */
1297 fp = startsmbfilepwent(smbpasswd_state->smbpasswd_file, PWF_READ, &(smbpasswd_state->pw_file_lock_depth));
1298
1299 if (fp == NULL) {
1300 DEBUG(0, ("Unable to open passdb database.\n"));
1301 return nt_status;
1302 }
1303
1304 while ( ((smb_pw=getsmbfilepwent(smbpasswd_state, fp)) != NULL)&& (!strequal(smb_pw->smb_name, username)) )
1305 /* do nothing....another loop */ ;
1306
1307 endsmbfilepwent(fp, &(smbpasswd_state->pw_file_lock_depth));
1308
1309
1310 /* did we locate the username in smbpasswd */
1311 if (smb_pw == NULL)
1312 return nt_status;
1313
1314 DEBUG(10, ("getsampwnam (smbpasswd): found by name: %s\n", smb_pw->smb_name));
1315
1316 if (!sam_acct) {
1317 DEBUG(10,("getsampwnam (smbpasswd): struct samu is NULL\n"));
1318 return nt_status;
1319 }
1320
1321 /* now build the struct samu */
1322 if (!build_sam_account(smbpasswd_state, sam_acct, smb_pw))
1323 return nt_status;
1324
1325 /* success */
1326 return NT_STATUS_OK;
1327 }
1328
1329 static NTSTATUS smbpasswd_getsampwsid(struct pdb_methods *my_methods, struct samu *sam_acct, const struct dom_sid *sid)
1330 {
1331 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
1332 struct smbpasswd_privates *smbpasswd_state = (struct smbpasswd_privates*)my_methods->private_data;
1333 struct smb_passwd *smb_pw;
1334 struct dom_sid_buf buf;
1335 FILE *fp = NULL;
1336 uint32_t rid;
1337
1338 DEBUG(10, ("smbpasswd_getsampwrid: search by sid: %s\n",
1339 dom_sid_str_buf(sid, &buf)));
1340
1341 if (!sid_peek_check_rid(get_global_sam_sid(), sid, &rid))
1342 return NT_STATUS_UNSUCCESSFUL;
1343
1344 /* More special case 'guest account' hacks... */
1345 if (rid == DOMAIN_RID_GUEST) {
1346 const char *guest_account = lp_guest_account();
1347 if (!(guest_account && *guest_account)) {
1348 DEBUG(1, ("Guest account not specified!\n"));
1349 return nt_status;
1350 }
1351 return smbpasswd_getsampwnam(my_methods, sam_acct, guest_account);
1352 }
1353
1354 /* Open the sam password file - not for update. */
1355 fp = startsmbfilepwent(smbpasswd_state->smbpasswd_file, PWF_READ, &(smbpasswd_state->pw_file_lock_depth));
1356
1357 if (fp == NULL) {
1358 DEBUG(0, ("Unable to open passdb database.\n"));
1359 return nt_status;
1360 }
1361
1362 while ( ((smb_pw=getsmbfilepwent(smbpasswd_state, fp)) != NULL) && (algorithmic_pdb_uid_to_user_rid(smb_pw->smb_userid) != rid) )
1363 /* do nothing */ ;
1364
1365 endsmbfilepwent(fp, &(smbpasswd_state->pw_file_lock_depth));
1366
1367
1368 /* did we locate the username in smbpasswd */
1369 if (smb_pw == NULL)
1370 return nt_status;
1371
1372 DEBUG(10, ("getsampwrid (smbpasswd): found by name: %s\n", smb_pw->smb_name));
1373
1374 if (!sam_acct) {
1375 DEBUG(10,("getsampwrid: (smbpasswd) struct samu is NULL\n"));
1376 return nt_status;
1377 }
1378
1379 /* now build the struct samu */
1380 if (!build_sam_account (smbpasswd_state, sam_acct, smb_pw))
1381 return nt_status;
1382
1383 /* build_sam_account might change the SID on us, if the name was for the guest account */
1384 if (NT_STATUS_IS_OK(nt_status) && !dom_sid_equal(pdb_get_user_sid(sam_acct), sid)) {
1385 struct dom_sid_buf buf1, buf2;
1386 DEBUG(1, ("looking for user with sid %s instead returned %s "
1387 "for account %s!?!\n",
1388 dom_sid_str_buf(sid, &buf1),
1389 dom_sid_str_buf(pdb_get_user_sid(sam_acct), &buf2),
1390 pdb_get_username(sam_acct)));
1391 return NT_STATUS_NO_SUCH_USER;
1392 }
1393
1394 /* success */
1395 return NT_STATUS_OK;
1396 }
1397
1398 static NTSTATUS smbpasswd_add_sam_account(struct pdb_methods *my_methods, struct samu *sampass)
1399 {
1400 struct smbpasswd_privates *smbpasswd_state = (struct smbpasswd_privates*)my_methods->private_data;
1401 struct smb_passwd smb_pw;
1402
1403 /* convert the struct samu */
1404 if (!build_smb_pass(&smb_pw, sampass)) {
1405 return NT_STATUS_UNSUCCESSFUL;
1406 }
1407
1408 /* add the entry */
1409 return add_smbfilepwd_entry(smbpasswd_state, &smb_pw);
1410 }
1411
1412 static NTSTATUS smbpasswd_update_sam_account(struct pdb_methods *my_methods, struct samu *sampass)
1413 {
1414 struct smbpasswd_privates *smbpasswd_state = (struct smbpasswd_privates*)my_methods->private_data;
1415 struct smb_passwd smb_pw;
1416
1417 /* convert the struct samu */
1418 if (!build_smb_pass(&smb_pw, sampass)) {
1419 DEBUG(0, ("smbpasswd_update_sam_account: build_smb_pass failed!\n"));
1420 return NT_STATUS_UNSUCCESSFUL;
1421 }
1422
1423 /* update the entry */
1424 if(!mod_smbfilepwd_entry(smbpasswd_state, &smb_pw)) {
1425 DEBUG(0, ("smbpasswd_update_sam_account: mod_smbfilepwd_entry failed!\n"));
1426 return NT_STATUS_UNSUCCESSFUL;
1427 }
1428
1429 return NT_STATUS_OK;
1430 }
1431
1432 static NTSTATUS smbpasswd_delete_sam_account (struct pdb_methods *my_methods, struct samu *sampass)
1433 {
1434 struct smbpasswd_privates *smbpasswd_state = (struct smbpasswd_privates*)my_methods->private_data;
1435
1436 const char *username = pdb_get_username(sampass);
1437
1438 if (del_smbfilepwd_entry(smbpasswd_state, username))
1439 return NT_STATUS_OK;
1440
1441 return NT_STATUS_UNSUCCESSFUL;
1442 }
1443
1444 static NTSTATUS smbpasswd_rename_sam_account (struct pdb_methods *my_methods,
1445 struct samu *old_acct,
1446 const char *newname)
1447 {
1448 const struct loadparm_substitution *lp_sub =
1449 loadparm_s3_global_substitution();
1450 char *rename_script = NULL;
1451 struct samu *new_acct = NULL;
1452 bool interim_account = False;
1453 TALLOC_CTX *ctx = talloc_tos();
1454 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
1455
1456 if (!*(lp_rename_user_script(talloc_tos(), lp_sub)))
1457 goto done;
1458
1459 if ( !(new_acct = samu_new( NULL )) ) {
1460 return NT_STATUS_NO_MEMORY;
1461 }
1462
1463 if ( !pdb_copy_sam_account( new_acct, old_acct )
1464 || !pdb_set_username(new_acct, newname, PDB_CHANGED))
1465 {
1466 goto done;
1467 }
1468
1469 ret = smbpasswd_add_sam_account(my_methods, new_acct);
1470 if (!NT_STATUS_IS_OK(ret))
1471 goto done;
1472
1473 interim_account = True;
1474
1475 /* rename the posix user */
1476 rename_script = lp_rename_user_script(ctx, lp_sub);
1477 if (!rename_script) {
1478 ret = NT_STATUS_NO_MEMORY;
1479 goto done;
1480 }
1481
1482 if (*rename_script) {
1483 int rename_ret;
1484
1485 rename_script = talloc_string_sub2(ctx,
1486 rename_script,
1487 "%unew",
1488 newname,
1489 true,
1490 false,
1491 true);
1492 if (!rename_script) {
1493 ret = NT_STATUS_NO_MEMORY;
1494 goto done;
1495 }
1496 rename_script = talloc_string_sub2(ctx,
1497 rename_script,
1498 "%uold",
1499 pdb_get_username(old_acct),
1500 true,
1501 false,
1502 true);
1503 if (!rename_script) {
1504 ret = NT_STATUS_NO_MEMORY;
1505 goto done;
1506 }
1507
1508 rename_ret = smbrun(rename_script, NULL, NULL);
1509
1510 DEBUG(rename_ret ? 0 : 3,("Running the command `%s' gave %d\n", rename_script, rename_ret));
1511
1512 if (rename_ret == 0) {
1513 smb_nscd_flush_user_cache();
1514 }
1515
1516 if (rename_ret)
1517 goto done;
1518 } else {
1519 goto done;
1520 }
1521
1522 smbpasswd_delete_sam_account(my_methods, old_acct);
1523 interim_account = False;
1524
1525 done:
1526 /* cleanup */
1527 if (interim_account)
1528 smbpasswd_delete_sam_account(my_methods, new_acct);
1529
1530 if (new_acct)
1531 TALLOC_FREE(new_acct);
1532
1533 return (ret);
1534 }
1535
1536 static uint32_t smbpasswd_capabilities(struct pdb_methods *methods)
1537 {
1538 return 0;
1539 }
1540
1541 static void free_private_data(void **vp)
1542 {
1543 struct smbpasswd_privates **privates = (struct smbpasswd_privates**)vp;
1544
1545 endsmbfilepwent((*privates)->pw_file, &((*privates)->pw_file_lock_depth));
1546
1547 *privates = NULL;
1548 /* No need to free any further, as it is talloc()ed */
1549 }
1550
1551 struct smbpasswd_search_state {
1552 uint32_t acct_flags;
1553
1554 struct samr_displayentry *entries;
1555 uint32_t num_entries;
1556 ssize_t array_size;
1557 uint32_t current;
1558 };
1559
1560 static void smbpasswd_search_end(struct pdb_search *search)
1561 {
1562 struct smbpasswd_search_state *state = talloc_get_type_abort(
1563 search->private_data, struct smbpasswd_search_state);
1564 TALLOC_FREE(state);
1565 }
1566
1567 static bool smbpasswd_search_next_entry(struct pdb_search *search,
1568 struct samr_displayentry *entry)
1569 {
1570 struct smbpasswd_search_state *state = talloc_get_type_abort(
1571 search->private_data, struct smbpasswd_search_state);
1572
1573 if (state->current == state->num_entries) {
1574 return false;
1575 }
1576
1577 entry->idx = state->entries[state->current].idx;
1578 entry->rid = state->entries[state->current].rid;
1579 entry->acct_flags = state->entries[state->current].acct_flags;
1580
1581 entry->account_name = talloc_strdup(
1582 search, state->entries[state->current].account_name);
1583 entry->fullname = talloc_strdup(
1584 search, state->entries[state->current].fullname);
1585 entry->description = talloc_strdup(
1586 search, state->entries[state->current].description);
1587
1588 if ((entry->account_name == NULL) || (entry->fullname == NULL)
1589 || (entry->description == NULL)) {
1590 DEBUG(0, ("talloc_strdup failed\n"));
1591 return false;
1592 }
1593
1594 state->current += 1;
1595 return true;
1596 }
1597
1598 static bool smbpasswd_search_users(struct pdb_methods *methods,
1599 struct pdb_search *search,
1600 uint32_t acct_flags)
1601 {
1602 struct smbpasswd_privates *smbpasswd_state =
1603 (struct smbpasswd_privates*)methods->private_data;
1604
1605 struct smbpasswd_search_state *search_state;
1606 struct smb_passwd *pwd;
1607 FILE *fp;
1608
1609 search_state = talloc_zero(search, struct smbpasswd_search_state);
1610 if (search_state == NULL) {
1611 DEBUG(0, ("talloc failed\n"));
1612 return false;
1613 }
1614 search_state->acct_flags = acct_flags;
1615
1616 fp = startsmbfilepwent(smbpasswd_state->smbpasswd_file, PWF_READ,
1617 &smbpasswd_state->pw_file_lock_depth);
1618
1619 if (fp == NULL) {
1620 DEBUG(10, ("Unable to open smbpasswd file.\n"));
1621 TALLOC_FREE(search_state);
1622 return false;
1623 }
1624
1625 while ((pwd = getsmbfilepwent(smbpasswd_state, fp)) != NULL) {
1626 struct samr_displayentry entry;
1627 struct samu *user;
1628
1629 if ((acct_flags != 0)
1630 && ((acct_flags & pwd->acct_ctrl) == 0)) {
1631 continue;
1632 }
1633
1634 user = samu_new(talloc_tos());
1635 if (user == NULL) {
1636 DEBUG(0, ("samu_new failed\n"));
1637 break;
1638 }
1639
1640 if (!build_sam_account(smbpasswd_state, user, pwd)) {
1641 /* Already got debug msgs... */
1642 break;
1643 }
1644
1645 ZERO_STRUCT(entry);
1646
1647 entry.acct_flags = pdb_get_acct_ctrl(user);
1648 sid_peek_rid(pdb_get_user_sid(user), &entry.rid);
1649 entry.account_name = talloc_strdup(
1650 search_state, pdb_get_username(user));
1651 entry.fullname = talloc_strdup(
1652 search_state, pdb_get_fullname(user));
1653 entry.description = talloc_strdup(
1654 search_state, pdb_get_acct_desc(user));
1655
1656 TALLOC_FREE(user);
1657
1658 if ((entry.account_name == NULL) || (entry.fullname == NULL)
1659 || (entry.description == NULL)) {
1660 DEBUG(0, ("talloc_strdup failed\n"));
1661 break;
1662 }
1663
1664 ADD_TO_LARGE_ARRAY(search_state, struct samr_displayentry,
1665 entry, &search_state->entries,
1666 &search_state->num_entries,
1667 &search_state->array_size);
1668 }
1669
1670 endsmbfilepwent(fp, &(smbpasswd_state->pw_file_lock_depth));
1671
1672 search->private_data = search_state;
1673 search->next_entry = smbpasswd_search_next_entry;
1674 search->search_end = smbpasswd_search_end;
1675
1676 return true;
1677 }
1678
1679 static NTSTATUS pdb_init_smbpasswd( struct pdb_methods **pdb_method, const char *location )
1680 {
1681 NTSTATUS nt_status;
1682 struct smbpasswd_privates *privates;
1683
1684 if ( !NT_STATUS_IS_OK(nt_status = make_pdb_method( pdb_method )) ) {
1685 return nt_status;
1686 }
1687
1688 (*pdb_method)->name = "smbpasswd";
1689
1690 (*pdb_method)->getsampwnam = smbpasswd_getsampwnam;
1691 (*pdb_method)->getsampwsid = smbpasswd_getsampwsid;
1692 (*pdb_method)->add_sam_account = smbpasswd_add_sam_account;
1693 (*pdb_method)->update_sam_account = smbpasswd_update_sam_account;
1694 (*pdb_method)->delete_sam_account = smbpasswd_delete_sam_account;
1695 (*pdb_method)->rename_sam_account = smbpasswd_rename_sam_account;
1696 (*pdb_method)->search_users = smbpasswd_search_users;
1697
1698 (*pdb_method)->capabilities = smbpasswd_capabilities;
1699
1700 /* Setup private data and free function */
1701
1702 if ( !(privates = talloc_zero( *pdb_method, struct smbpasswd_privates )) ) {
1703 DEBUG(0, ("talloc() failed for smbpasswd private_data!\n"));
1704 return NT_STATUS_NO_MEMORY;
1705 }
1706
1707 /* Store some config details */
1708
1709 if (location) {
1710 privates->smbpasswd_file = talloc_strdup(*pdb_method, location);
1711 } else {
1712 privates->smbpasswd_file = talloc_strdup(*pdb_method, lp_smb_passwd_file());
1713 }
1714
1715 if (!privates->smbpasswd_file) {
1716 DEBUG(0, ("talloc_strdp() failed for storing smbpasswd location!\n"));
1717 return NT_STATUS_NO_MEMORY;
1718 }
1719
1720 (*pdb_method)->private_data = privates;
1721
1722 (*pdb_method)->free_private_data = free_private_data;
1723
1724 return NT_STATUS_OK;
1725 }
1726
1727 NTSTATUS pdb_smbpasswd_init(TALLOC_CTX *ctx)
1728 {
1729 return smb_register_passdb(PASSDB_INTERFACE_VERSION, "smbpasswd", pdb_init_smbpasswd);
1730 }
Samba GIT mirror