source3/libnet/libnet_dssync_passdb.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Guenther Deschner <gd@samba.org> 2008
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "system/passwd.h"
  22 #include "libnet/libnet_dssync.h"
  23 #include "../libcli/security/security.h"
  24 #include "../libds/common/flags.h"
  25 #include "../librpc/gen_ndr/ndr_drsuapi.h"
  26 #include "util_tdb.h"
  27 #include "dbwrap/dbwrap.h"
  28 #include "dbwrap/dbwrap_rbt.h"
  29 #include "../libds/common/flag_mapping.h"
  30 #include "passdb.h"
  31
  32 /****************************************************************
  33 ****************************************************************/
  34
  35 struct dssync_passdb {
  36         struct pdb_methods *methods;
  37         struct db_context *all;
  38         struct db_context *aliases;
  39         struct db_context *groups;
  40 };
  41
  42 struct dssync_passdb_obj {
  43         struct dssync_passdb_obj *self;
  44         uint32_t type;
  45         struct drsuapi_DsReplicaObjectListItemEx *cur;
  46         TDB_DATA key;
  47         TDB_DATA data;
  48         struct db_context *members;
  49 };
  50
  51 struct dssync_passdb_mem {
  52         struct dssync_passdb_mem *self;
  53         bool active;
  54         struct drsuapi_DsReplicaObjectIdentifier3 *cur;
  55         struct dssync_passdb_obj *obj;
  56         TDB_DATA key;
  57         TDB_DATA data;
  58 };
  59
  60 static NTSTATUS dssync_insert_obj(struct dssync_passdb *pctx,
  61                                   struct db_context *db,
  62                                   struct dssync_passdb_obj *obj)
  63 {
  64         NTSTATUS status;
  65         struct db_record *rec;
  66         TDB_DATA value;
  67
  68         rec = dbwrap_fetch_locked(db, talloc_tos(), obj->key);
  69         if (rec == NULL) {
  70                 return NT_STATUS_NO_MEMORY;
  71         }
  72
  73         value = dbwrap_record_get_value(rec);
  74         if (value.dsize != 0) {
  75                 abort();
  76         }
  77
  78         status = dbwrap_record_store(rec, obj->data, TDB_INSERT);
  79         if (!NT_STATUS_IS_OK(status)) {
  80                 TALLOC_FREE(rec);
  81                 return status;
  82         }
  83         TALLOC_FREE(rec);
  84         return NT_STATUS_OK;
  85 }
  86
  87 static struct dssync_passdb_obj *dssync_parse_obj(const TDB_DATA data)
  88 {
  89         struct dssync_passdb_obj *obj;
  90
  91         if (data.dsize != sizeof(obj)) {
  92                 return NULL;
  93         }
  94
  95         /*
  96          * we need to copy the pointer to avoid alignment problems
  97          * on some systems.
  98          */
  99         memcpy(&obj, data.dptr, sizeof(obj));
 100
 101         return talloc_get_type_abort(obj, struct dssync_passdb_obj);
 102 }
 103
 104 static struct dssync_passdb_obj *dssync_search_obj_by_guid(struct dssync_passdb *pctx,
 105                                                            struct db_context *db,
 106                                                            const struct GUID *guid)
 107 {
 108         struct dssync_passdb_obj *obj;
 109         TDB_DATA key;
 110         TDB_DATA data;
 111         NTSTATUS status;
 112
 113         key = make_tdb_data((const uint8_t *)(const void *)guid,
 114                              sizeof(*guid));
 115
 116         status = dbwrap_fetch(db, talloc_tos(), key, &data);
 117         if (!NT_STATUS_IS_OK(status)) {
 118                 return NULL;
 119         }
 120
 121         obj = dssync_parse_obj(data);
 122         return obj;
 123 }
 124
 125 static NTSTATUS dssync_create_obj(struct dssync_passdb *pctx,
 126                                   struct db_context *db,
 127                                   uint32_t type,
 128                                   struct drsuapi_DsReplicaObjectListItemEx *cur,
 129                                   struct dssync_passdb_obj **_obj)
 130 {
 131         NTSTATUS status;
 132         struct dssync_passdb_obj *obj;
 133
 134         obj = talloc_zero(pctx, struct dssync_passdb_obj);
 135         if (obj == NULL) {
 136                 return NT_STATUS_NO_MEMORY;
 137         }
 138         obj->self = obj;
 139         obj->cur = cur;
 140         obj->type = type;
 141         obj->key = make_tdb_data((const uint8_t *)(void *)&cur->object.identifier->guid,
 142                                    sizeof(cur->object.identifier->guid));
 143         obj->data = make_tdb_data((const uint8_t *)(void *)&obj->self,
 144                                   sizeof(obj->self));
 145
 146         obj->members = db_open_rbt(obj);
 147         if (obj->members == NULL) {
 148                 return NT_STATUS_NO_MEMORY;
 149         }
 150
 151         status = dssync_insert_obj(pctx, db, obj);
 152         if (!NT_STATUS_IS_OK(status)) {
 153                 TALLOC_FREE(obj);
 154                 return status;
 155         }
 156         *_obj = obj;
 157         return NT_STATUS_OK;
 158 }
 159
 160 static NTSTATUS dssync_insert_mem(struct dssync_passdb *pctx,
 161                                   struct dssync_passdb_obj *obj,
 162                                   struct dssync_passdb_mem *mem)
 163 {
 164         NTSTATUS status;
 165         struct db_record *rec;
 166         TDB_DATA value;
 167
 168         rec = dbwrap_fetch_locked(obj->members, talloc_tos(), mem->key);
 169         if (rec == NULL) {
 170                 return NT_STATUS_NO_MEMORY;
 171         }
 172
 173         value = dbwrap_record_get_value(rec);
 174         if (value.dsize != 0) {
 175                 abort();
 176         }
 177
 178         status = dbwrap_record_store(rec, mem->data, TDB_INSERT);
 179         if (!NT_STATUS_IS_OK(status)) {
 180                 TALLOC_FREE(rec);
 181                 return status;
 182         }
 183         TALLOC_FREE(rec);
 184         return NT_STATUS_OK;
 185 }
 186
 187 static NTSTATUS dssync_create_mem(struct dssync_passdb *pctx,
 188                                   struct dssync_passdb_obj *obj,
 189                                   bool active,
 190                                   struct drsuapi_DsReplicaObjectIdentifier3 *cur,
 191                                   struct dssync_passdb_mem **_mem)
 192 {
 193         NTSTATUS status;
 194         struct dssync_passdb_mem *mem;
 195
 196         mem = talloc_zero(pctx, struct dssync_passdb_mem);
 197         if (mem == NULL) {
 198                 return NT_STATUS_NO_MEMORY;
 199         }
 200         mem->self = mem;
 201         mem->cur = cur;
 202         mem->active = active;
 203         mem->obj = NULL;
 204         mem->key = make_tdb_data((const uint8_t *)(void *)&cur->guid,
 205                                    sizeof(cur->guid));
 206         mem->data = make_tdb_data((const uint8_t *)(void *)&mem->self,
 207                                   sizeof(mem->self));
 208
 209         status = dssync_insert_mem(pctx, obj, mem);
 210         if (!NT_STATUS_IS_OK(status)) {
 211                 TALLOC_FREE(obj);
 212                 return status;
 213         }
 214         *_mem = mem;
 215         return NT_STATUS_OK;
 216 }
 217
 218 static struct dssync_passdb_mem *dssync_parse_mem(const TDB_DATA data)
 219 {
 220         struct dssync_passdb_mem *mem;
 221
 222         if (data.dsize != sizeof(mem)) {
 223                 return NULL;
 224         }
 225
 226         /*
 227          * we need to copy the pointer to avoid alignment problems
 228          * on some systems.
 229          */
 230         memcpy(&mem, data.dptr, sizeof(mem));
 231
 232         return talloc_get_type_abort(mem, struct dssync_passdb_mem);
 233 }
 234
 235 static NTSTATUS passdb_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 236                                struct replUpToDateVectorBlob **pold_utdv)
 237 {
 238         NTSTATUS status;
 239         struct dssync_passdb *pctx;
 240
 241         pctx = talloc_zero(mem_ctx, struct dssync_passdb);
 242         if (pctx == NULL) {
 243                 return NT_STATUS_NO_MEMORY;
 244         }
 245
 246         if (ctx->output_filename) {
 247                 status = make_pdb_method_name(&pctx->methods, ctx->output_filename);
 248         } else {
 249                 status = make_pdb_method_name(&pctx->methods, lp_passdb_backend());
 250         }
 251
 252         if (!NT_STATUS_IS_OK(status)) {
 253                 return status;
 254         }
 255
 256         pctx->all = db_open_rbt(pctx);
 257         if (pctx->all == NULL) {
 258                 return NT_STATUS_NO_MEMORY;
 259         }
 260         pctx->aliases = db_open_rbt(pctx);
 261         if (pctx->aliases == NULL) {
 262                 return NT_STATUS_NO_MEMORY;
 263         }
 264         pctx->groups = db_open_rbt(pctx);
 265         if (pctx->groups == NULL) {
 266                 return NT_STATUS_NO_MEMORY;
 267         }
 268
 269         ctx->private_data = pctx;
 270
 271         return status;
 272 }
 273
 274 /****************************************************************
 275 ****************************************************************/
 276
 277 struct dssync_passdb_traverse_amembers {
 278         struct dssync_context *ctx;
 279         struct dssync_passdb_obj *obj;
 280         const char *name;
 281         uint32_t idx;
 282 };
 283
 284 struct dssync_passdb_traverse_aliases {
 285         struct dssync_context *ctx;
 286         const char *name;
 287         uint32_t idx;
 288 };
 289
 290 static int dssync_passdb_traverse_amembers(struct db_record *rec,
 291                                            void *private_data)
 292 {
 293         struct dssync_passdb_traverse_amembers *state =
 294                 (struct dssync_passdb_traverse_amembers *)private_data;
 295         struct dssync_passdb *pctx =
 296                 talloc_get_type_abort(state->ctx->private_data,
 297                 struct dssync_passdb);
 298         struct dssync_passdb_mem *mem;
 299         NTSTATUS status;
 300         struct dom_sid alias_sid;
 301         struct dom_sid member_sid;
 302         const char *member_dn;
 303         size_t num_members;
 304         size_t i;
 305         struct dom_sid *members;
 306         bool is_member = false;
 307         const char *action;
 308         TDB_DATA value;
 309
 310         state->idx++;
 311
 312         alias_sid = state->obj->cur->object.identifier->sid;
 313
 314         value = dbwrap_record_get_value(rec);
 315         mem = dssync_parse_mem(value);
 316         if (mem == NULL) {
 317                 return -1;
 318         }
 319
 320         member_sid = mem->cur->sid;
 321         member_dn = mem->cur->dn;
 322
 323         mem->obj = dssync_search_obj_by_guid(pctx, pctx->all, &mem->cur->guid);
 324         if (mem->obj == NULL) {
 325                 DEBUG(0,("alias[%s] member[%s] can't resolve member - ignoring\n",
 326                          sid_string_dbg(&alias_sid),
 327                          is_null_sid(&member_sid)?
 328                          sid_string_dbg(&member_sid):
 329                          member_dn));
 330                 return 0;
 331         }
 332
 333         switch (mem->obj->type) {
 334         case ATYPE_DISTRIBUTION_LOCAL_GROUP:
 335         case ATYPE_DISTRIBUTION_GLOBAL_GROUP:
 336                 DEBUG(0, ("alias[%s] ignore distribution group [%s]\n",
 337                           sid_string_dbg(&alias_sid),
 338                           member_dn));
 339                 return 0;
 340         default:
 341                 break;
 342         }
 343
 344         DEBUG(0,("alias[%s] member[%s]\n",
 345                  sid_string_dbg(&alias_sid),
 346                  sid_string_dbg(&member_sid)));
 347
 348         status = pdb_enum_aliasmem(&alias_sid, talloc_tos(),
 349                                    &members, &num_members);
 350         if (!NT_STATUS_IS_OK(status)) {
 351                 DEBUG(0, ("Could not find current alias members %s - %s\n",
 352                           sid_string_dbg(&alias_sid),
 353                           nt_errstr(status)));
 354                 return -1;
 355         }
 356
 357         for (i=0; i < num_members; i++) {
 358                 bool match;
 359
 360                 match = dom_sid_equal(&members[i], &member_sid);
 361                 if (match) {
 362                         is_member = true;
 363                         break;
 364                 }
 365         }
 366
 367         status = NT_STATUS_OK;
 368         action = "none";
 369         if (!is_member && mem->active) {
 370                 action = "add";
 371                 pdb_add_aliasmem(&alias_sid, &member_sid);
 372         } else if (is_member && !mem->active) {
 373                 action = "delete";
 374                 pdb_del_aliasmem(&alias_sid, &member_sid);
 375         }
 376         if (!NT_STATUS_IS_OK(status)) {
 377                 DEBUG(0, ("Could not %s %s as alias members of %s - %s\n",
 378                           action,
 379                           sid_string_dbg(&member_sid),
 380                           sid_string_dbg(&alias_sid),
 381                           nt_errstr(status)));
 382                 return -1;
 383         }
 384
 385         return 0;
 386 }
 387
 388 static int dssync_passdb_traverse_aliases(struct db_record *rec,
 389                                           void *private_data)
 390 {
 391         struct dssync_passdb_traverse_aliases *state =
 392                 (struct dssync_passdb_traverse_aliases *)private_data;
 393         struct dssync_passdb *pctx =
 394                 talloc_get_type_abort(state->ctx->private_data,
 395                 struct dssync_passdb);
 396         struct dssync_passdb_traverse_amembers mstate;
 397         struct dssync_passdb_obj *obj;
 398         TDB_DATA value;
 399         NTSTATUS status;
 400
 401         state->idx++;
 402         if (pctx->methods == NULL) {
 403                 return -1;
 404         }
 405
 406         value = dbwrap_record_get_value(rec);
 407         obj = dssync_parse_obj(value);
 408         if (obj == NULL) {
 409                 return -1;
 410         }
 411
 412         ZERO_STRUCT(mstate);
 413         mstate.ctx = state->ctx;
 414         mstate.name = "members";
 415         mstate.obj = obj;
 416         status = dbwrap_traverse_read(obj->members,
 417                                       dssync_passdb_traverse_amembers,
 418                                       &mstate, NULL);
 419         if (!NT_STATUS_IS_OK(status)) {
 420                 return -1;
 421         }
 422
 423         return 0;
 424 }
 425
 426 struct dssync_passdb_traverse_gmembers {
 427         struct dssync_context *ctx;
 428         struct dssync_passdb_obj *obj;
 429         const char *name;
 430         uint32_t idx;
 431 };
 432
 433 struct dssync_passdb_traverse_groups {
 434         struct dssync_context *ctx;
 435         const char *name;
 436         uint32_t idx;
 437 };
 438
 439 static int dssync_passdb_traverse_gmembers(struct db_record *rec,
 440                                            void *private_data)
 441 {
 442         struct dssync_passdb_traverse_gmembers *state =
 443                 (struct dssync_passdb_traverse_gmembers *)private_data;
 444         struct dssync_passdb *pctx =
 445                 talloc_get_type_abort(state->ctx->private_data,
 446                 struct dssync_passdb);
 447         struct dssync_passdb_mem *mem;
 448         NTSTATUS status;
 449         char *nt_member = NULL;
 450         char **unix_members;
 451         struct dom_sid group_sid;
 452         struct dom_sid member_sid;
 453         struct samu *member = NULL;
 454         const char *member_dn = NULL;
 455         GROUP_MAP *map;
 456         struct group *grp;
 457         uint32_t rid;
 458         bool is_unix_member = false;
 459         TDB_DATA value;
 460
 461         state->idx++;
 462
 463         group_sid = state->obj->cur->object.identifier->sid;
 464
 465         status = dom_sid_split_rid(talloc_tos(), &group_sid, NULL, &rid);
 466         if (!NT_STATUS_IS_OK(status)) {
 467                 return -1;
 468         }
 469
 470         value = dbwrap_record_get_value(rec);
 471
 472         mem = dssync_parse_mem(value);
 473         if (mem == NULL) {
 474                 return -1;
 475         }
 476
 477         member_sid = mem->cur->sid;
 478         member_dn = mem->cur->dn;
 479
 480         mem->obj = dssync_search_obj_by_guid(pctx, pctx->all, &mem->cur->guid);
 481         if (mem->obj == NULL) {
 482                 DEBUG(0,("group[%s] member[%s] can't resolve member - ignoring\n",
 483                          sid_string_dbg(&group_sid),
 484                          is_null_sid(&member_sid)?
 485                          sid_string_dbg(&member_sid):
 486                          member_dn));
 487                 return 0;
 488         }
 489
 490         member_sid = mem->obj->cur->object.identifier->sid;
 491         member_dn = mem->obj->cur->object.identifier->dn;
 492
 493         switch (mem->obj->type) {
 494         case ATYPE_SECURITY_LOCAL_GROUP:
 495         case ATYPE_SECURITY_GLOBAL_GROUP:
 496                 DEBUG(0, ("Group[%s] ignore member group [%s]\n",
 497                           sid_string_dbg(&group_sid),
 498                           sid_string_dbg(&member_sid)));
 499                 return 0;
 500
 501         case ATYPE_DISTRIBUTION_LOCAL_GROUP:
 502         case ATYPE_DISTRIBUTION_GLOBAL_GROUP:
 503                 DEBUG(0, ("Group[%s] ignore distribution group [%s]\n",
 504                           sid_string_dbg(&group_sid),
 505                           member_dn));
 506                 return 0;
 507         default:
 508                 break;
 509         }
 510
 511         map = talloc_zero(NULL, GROUP_MAP);
 512         if (!map) {
 513                 return -1;
 514         }
 515
 516         if (!get_domain_group_from_sid(group_sid, map)) {
 517                 DEBUG(0, ("Could not find global group %s\n",
 518                           sid_string_dbg(&group_sid)));
 519                 //return NT_STATUS_NO_SUCH_GROUP;
 520                 TALLOC_FREE(map);
 521                 return -1;
 522         }
 523
 524         if (!(grp = getgrgid(map->gid))) {
 525                 DEBUG(0, ("Could not find unix group %lu\n",
 526                                                 (unsigned long)map->gid));
 527                 //return NT_STATUS_NO_SUCH_GROUP;
 528                 TALLOC_FREE(map);
 529                 return -1;
 530         }
 531
 532         TALLOC_FREE(map);
 533
 534         DEBUG(0,("Group members of %s: ", grp->gr_name));
 535
 536         if ( !(member = samu_new(talloc_tos())) ) {
 537                 //return NT_STATUS_NO_MEMORY;
 538                 return -1;
 539         }
 540
 541         if (!pdb_getsampwsid(member, &member_sid)) {
 542                 DEBUG(1, ("Found bogus group member: (member_sid=%s group=%s)\n",
 543                           sid_string_tos(&member_sid), grp->gr_name));
 544                 TALLOC_FREE(member);
 545                 return -1;
 546         }
 547
 548         if (pdb_get_group_rid(member) == rid) {
 549                 DEBUGADD(0,("%s(primary),", pdb_get_username(member)));
 550                 TALLOC_FREE(member);
 551                 return -1;
 552         }
 553
 554         DEBUGADD(0,("%s,", pdb_get_username(member)));
 555         nt_member = talloc_strdup(talloc_tos(), pdb_get_username(member));
 556         TALLOC_FREE(member);
 557
 558         DEBUGADD(0,("\n"));
 559
 560         unix_members = grp->gr_mem;
 561
 562         while (*unix_members) {
 563                 if (strcmp(*unix_members, nt_member) == 0) {
 564                         is_unix_member = true;
 565                         break;
 566                 }
 567                 unix_members += 1;
 568         }
 569
 570         if (!is_unix_member && mem->active) {
 571                 smb_add_user_group(grp->gr_name, nt_member);
 572         } else if (is_unix_member && !mem->active) {
 573                 smb_delete_user_group(grp->gr_name, nt_member);
 574         }
 575
 576         return 0;
 577 }
 578
 579 static int dssync_passdb_traverse_groups(struct db_record *rec,
 580                                          void *private_data)
 581 {
 582         struct dssync_passdb_traverse_groups *state =
 583                 (struct dssync_passdb_traverse_groups *)private_data;
 584         struct dssync_passdb *pctx =
 585                 talloc_get_type_abort(state->ctx->private_data,
 586                 struct dssync_passdb);
 587         struct dssync_passdb_traverse_gmembers mstate;
 588         struct dssync_passdb_obj *obj;
 589         TDB_DATA value;
 590         NTSTATUS status;
 591
 592         state->idx++;
 593         if (pctx->methods == NULL) {
 594                 return -1;
 595         }
 596
 597         value = dbwrap_record_get_value(rec);
 598
 599         obj = dssync_parse_obj(value);
 600         if (obj == NULL) {
 601                 return -1;
 602         }
 603
 604         ZERO_STRUCT(mstate);
 605         mstate.ctx = state->ctx;
 606         mstate.name = "members";
 607         mstate.obj = obj;
 608         status = dbwrap_traverse_read(obj->members,
 609                                       dssync_passdb_traverse_gmembers,
 610                                       &mstate, NULL);
 611         if (!NT_STATUS_IS_OK(status)) {
 612                 return -1;
 613         }
 614
 615         return 0;
 616 }
 617
 618 static NTSTATUS passdb_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 619                               struct replUpToDateVectorBlob *new_utdv)
 620 {
 621         struct dssync_passdb *pctx =
 622                 talloc_get_type_abort(ctx->private_data,
 623                 struct dssync_passdb);
 624         struct dssync_passdb_traverse_aliases astate;
 625         struct dssync_passdb_traverse_groups gstate;
 626         NTSTATUS status;
 627
 628         ZERO_STRUCT(astate);
 629         astate.ctx = ctx;
 630         astate.name = "aliases";
 631         status = dbwrap_traverse_read(pctx->aliases,
 632                                       dssync_passdb_traverse_aliases,
 633                                       &astate, NULL);
 634         if (!NT_STATUS_IS_OK(status)) {
 635                 return NT_STATUS_INTERNAL_ERROR;
 636         }
 637
 638         ZERO_STRUCT(gstate);
 639         gstate.ctx = ctx;
 640         gstate.name = "groups";
 641         status = dbwrap_traverse_read(pctx->groups,
 642                                       dssync_passdb_traverse_groups,
 643                                       &gstate, NULL);
 644         if (!NT_STATUS_IS_OK(status)) {
 645                 return NT_STATUS_INTERNAL_ERROR;
 646         }
 647
 648         TALLOC_FREE(pctx->methods);
 649         TALLOC_FREE(pctx);
 650
 651         return NT_STATUS_OK;
 652 }
 653
 654 /****************************************************************
 655 ****************************************************************/
 656
 657 static NTSTATUS smb_create_user(TALLOC_CTX *mem_ctx,
 658                                 uint32_t acct_flags,
 659                                 const char *account,
 660                                 struct passwd **passwd_p)
 661 {
 662         struct passwd *passwd;
 663         char *add_script = NULL;
 664
 665         passwd = Get_Pwnam_alloc(mem_ctx, account);
 666         if (passwd) {
 667                 *passwd_p = passwd;
 668                 return NT_STATUS_OK;
 669         }
 670
 671         /* Create appropriate user */
 672         if (acct_flags & ACB_NORMAL) {
 673                 add_script = lp_add_user_script(mem_ctx);
 674         } else if ( (acct_flags & ACB_WSTRUST) ||
 675                     (acct_flags & ACB_SVRTRUST) ||
 676                     (acct_flags & ACB_DOMTRUST) ) {
 677                 add_script = lp_add_machine_script(mem_ctx);
 678         } else {
 679                 DEBUG(1, ("Unknown user type: %s\n",
 680                           pdb_encode_acct_ctrl(acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
 681                 return NT_STATUS_UNSUCCESSFUL;
 682         }
 683
 684         if (!add_script) {
 685                 return NT_STATUS_NO_MEMORY;
 686         }
 687
 688         if (*add_script) {
 689                 int add_ret;
 690                 add_script = talloc_all_string_sub(mem_ctx, add_script,
 691                                                    "%u", account);
 692                 if (!add_script) {
 693                         return NT_STATUS_NO_MEMORY;
 694                 }
 695                 add_ret = smbrun(add_script, NULL);
 696                 DEBUG(add_ret ? 0 : 1,("fetch_account: Running the command `%s' "
 697                          "gave %d\n", add_script, add_ret));
 698                 if (add_ret == 0) {
 699                         smb_nscd_flush_user_cache();
 700                 }
 701         }
 702
 703         /* try and find the possible unix account again */
 704         passwd = Get_Pwnam_alloc(mem_ctx, account);
 705         if (!passwd) {
 706                 return NT_STATUS_NO_SUCH_USER;
 707         }
 708
 709         *passwd_p = passwd;
 710
 711         return NT_STATUS_OK;
 712 }
 713
 714 static struct drsuapi_DsReplicaAttribute *find_drsuapi_attr(
 715                         const struct drsuapi_DsReplicaObjectListItemEx *cur,
 716                         uint32_t attid)
 717 {
 718         int i = 0;
 719
 720         for (i = 0; i < cur->object.attribute_ctr.num_attributes; i++) {
 721                 struct drsuapi_DsReplicaAttribute *attr;
 722
 723                 attr = &cur->object.attribute_ctr.attributes[i];
 724
 725                 if (attr->attid == attid) {
 726                         return attr;
 727                 }
 728         }
 729
 730         return NULL;
 731 }
 732
 733 static NTSTATUS find_drsuapi_attr_string(TALLOC_CTX *mem_ctx,
 734                                          const struct drsuapi_DsReplicaObjectListItemEx *cur,
 735                                          uint32_t attid,
 736                                          uint32_t *_count,
 737                                          char ***_array)
 738 {
 739         struct drsuapi_DsReplicaAttribute *attr;
 740         char **array;
 741         uint32_t a;
 742
 743         attr = find_drsuapi_attr(cur, attid);
 744         if (attr == NULL) {
 745                 return NT_STATUS_PROPSET_NOT_FOUND;
 746         }
 747
 748         array = talloc_array(mem_ctx, char *, attr->value_ctr.num_values);
 749         if (array == NULL) {
 750                 return NT_STATUS_NO_MEMORY;
 751         }
 752
 753         for (a = 0; a < attr->value_ctr.num_values; a++) {
 754                 const DATA_BLOB *blob;
 755                 ssize_t ret;
 756
 757                 blob = attr->value_ctr.values[a].blob;
 758
 759                 if (blob == NULL) {
 760                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 761                 }
 762
 763                 ret = pull_string_talloc(array, NULL, 0, &array[a],
 764                                          blob->data, blob->length,
 765                                          STR_UNICODE);
 766                 if (ret == -1) {
 767                         //TODO
 768                         return NT_STATUS_INTERNAL_ERROR;
 769                 }
 770         }
 771
 772         *_count = attr->value_ctr.num_values;
 773         *_array = array;
 774         return NT_STATUS_OK;
 775 }
 776
 777 static NTSTATUS find_drsuapi_attr_int32(TALLOC_CTX *mem_ctx,
 778                                         const struct drsuapi_DsReplicaObjectListItemEx *cur,
 779                                         uint32_t attid,
 780                                         uint32_t *_count,
 781                                         int32_t **_array)
 782 {
 783         struct drsuapi_DsReplicaAttribute *attr;
 784         int32_t *array;
 785         uint32_t a;
 786
 787         attr = find_drsuapi_attr(cur, attid);
 788         if (attr == NULL) {
 789                 return NT_STATUS_PROPSET_NOT_FOUND;
 790         }
 791
 792         array = talloc_array(mem_ctx, int32_t, attr->value_ctr.num_values);
 793         if (array == NULL) {
 794                 return NT_STATUS_NO_MEMORY;
 795         }
 796
 797         for (a = 0; a < attr->value_ctr.num_values; a++) {
 798                 const DATA_BLOB *blob;
 799
 800                 blob = attr->value_ctr.values[a].blob;
 801
 802                 if (blob == NULL) {
 803                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 804                 }
 805
 806                 if (blob->length != 4) {
 807                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 808                 }
 809
 810                 array[a] = IVAL(blob->data, 0);
 811         }
 812
 813         *_count = attr->value_ctr.num_values;
 814         *_array = array;
 815         return NT_STATUS_OK;
 816 }
 817
 818 static NTSTATUS find_drsuapi_attr_blob(TALLOC_CTX *mem_ctx,
 819                                        const struct drsuapi_DsReplicaObjectListItemEx *cur,
 820                                        uint32_t attid,
 821                                        uint32_t *_count,
 822                                        DATA_BLOB **_array)
 823 {
 824         struct drsuapi_DsReplicaAttribute *attr;
 825         DATA_BLOB *array;
 826         uint32_t a;
 827
 828         attr = find_drsuapi_attr(cur, attid);
 829         if (attr == NULL) {
 830                 return NT_STATUS_PROPSET_NOT_FOUND;
 831         }
 832
 833         array = talloc_array(mem_ctx, DATA_BLOB, attr->value_ctr.num_values);
 834         if (array == NULL) {
 835                 return NT_STATUS_NO_MEMORY;
 836         }
 837
 838         for (a = 0; a < attr->value_ctr.num_values; a++) {
 839                 const DATA_BLOB *blob;
 840
 841                 blob = attr->value_ctr.values[a].blob;
 842
 843                 if (blob == NULL) {
 844                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 845                 }
 846
 847                 array[a] = data_blob_talloc(array, blob->data, blob->length);
 848                 if (array[a].length != blob->length) {
 849                         return NT_STATUS_NO_MEMORY;
 850                 }
 851         }
 852         *_count = attr->value_ctr.num_values;
 853         *_array = array;
 854         return NT_STATUS_OK;
 855 }
 856
 857 static NTSTATUS find_drsuapi_attr_int64(TALLOC_CTX *mem_ctx,
 858                                         const struct drsuapi_DsReplicaObjectListItemEx *cur,
 859                                         uint32_t attid,
 860                                         uint32_t *_count,
 861                                         int64_t **_array)
 862 {
 863         struct drsuapi_DsReplicaAttribute *attr;
 864         int64_t *array;
 865         uint32_t a;
 866
 867         attr = find_drsuapi_attr(cur, attid);
 868         if (attr == NULL) {
 869                 return NT_STATUS_PROPSET_NOT_FOUND;
 870         }
 871
 872         array = talloc_array(mem_ctx, int64_t, attr->value_ctr.num_values);
 873         if (array == NULL) {
 874                 return NT_STATUS_NO_MEMORY;
 875         }
 876
 877         for (a = 0; a < attr->value_ctr.num_values; a++) {
 878                 const DATA_BLOB *blob;
 879
 880                 blob = attr->value_ctr.values[a].blob;
 881
 882                 if (blob == NULL) {
 883                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 884                 }
 885
 886                 if (blob->length != 8) {
 887                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 888                 }
 889
 890                 array[a] = BVAL(blob->data, 0);
 891         }
 892         *_count = attr->value_ctr.num_values;
 893         *_array = array;
 894         return NT_STATUS_OK;
 895 }
 896
 897 static NTSTATUS find_drsuapi_attr_dn(TALLOC_CTX *mem_ctx,
 898                                      const struct drsuapi_DsReplicaObjectListItemEx *cur,
 899                                      uint32_t attid,
 900                                      uint32_t *_count,
 901                                      struct drsuapi_DsReplicaObjectIdentifier3 **_array)
 902 {
 903         struct drsuapi_DsReplicaAttribute *attr;
 904         struct drsuapi_DsReplicaObjectIdentifier3 *array;
 905         uint32_t a;
 906
 907         attr = find_drsuapi_attr(cur, attid);
 908         if (attr == NULL) {
 909                 return NT_STATUS_PROPSET_NOT_FOUND;
 910         }
 911
 912         array = talloc_array(mem_ctx,
 913                              struct drsuapi_DsReplicaObjectIdentifier3,
 914                              attr->value_ctr.num_values);
 915         if (array == NULL) {
 916                 return NT_STATUS_NO_MEMORY;
 917         }
 918
 919         for (a = 0; a < attr->value_ctr.num_values; a++) {
 920                 const DATA_BLOB *blob;
 921                 enum ndr_err_code ndr_err;
 922                 NTSTATUS status;
 923
 924                 blob = attr->value_ctr.values[a].blob;
 925
 926                 if (blob == NULL) {
 927                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 928                 }
 929
 930                 /* windows sometimes sends an extra two pad bytes here */
 931                 ndr_err = ndr_pull_struct_blob(blob, array, &array[a],
 932                                 (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
 933                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 934                         status = ndr_map_error2ntstatus(ndr_err);
 935                         return status;
 936                 }
 937         }
 938         *_count = attr->value_ctr.num_values;
 939         *_array = array;
 940         return NT_STATUS_OK;
 941 }
 942
 943 #define GET_BLOB_EX(attr, needed) do { \
 944         NTSTATUS _status; \
 945         uint32_t _cnt; \
 946         DATA_BLOB *_vals = NULL; \
 947         attr = data_blob_null; \
 948         _status = find_drsuapi_attr_blob(mem_ctx, cur, \
 949                                          DRSUAPI_ATTID_ ## attr, \
 950                                          &_cnt, &_vals); \
 951         if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
 952                 if (!needed) { \
 953                         _status = NT_STATUS_OK; \
 954                         _cnt = 0; \
 955                 } \
 956         } \
 957         if (!NT_STATUS_IS_OK(_status)) { \
 958                 DEBUG(0,(__location__ "attr[%s] %s\n", \
 959                         #attr, nt_errstr(_status))); \
 960                 return _status; \
 961         } \
 962         if (_cnt == 0) { \
 963                 if (needed) { \
 964                         talloc_free(_vals); \
 965                         DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
 966                         return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
 967                 } \
 968         } else if (_cnt > 1) { \
 969                 talloc_free(_vals); \
 970                 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
 971                 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
 972         } else { \
 973                 attr = _vals[0]; \
 974                 (void)talloc_steal(mem_ctx, _vals[0].data); \
 975         } \
 976         talloc_free(_vals); \
 977 } while(0)
 978
 979 #define GET_STRING_EX(attr, needed) do { \
 980         NTSTATUS _status; \
 981         uint32_t _cnt; \
 982         char **_vals = NULL; \
 983         attr = NULL; \
 984         _status = find_drsuapi_attr_string(mem_ctx, cur, \
 985                                            DRSUAPI_ATTID_ ## attr, \
 986                                            &_cnt, &_vals); \
 987         if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
 988                 if (!needed) { \
 989                         _status = NT_STATUS_OK; \
 990                         _cnt = 0; \
 991                 } \
 992         } \
 993         if (!NT_STATUS_IS_OK(_status)) { \
 994                 DEBUG(0,(__location__ "attr[%s] %s\n", \
 995                         #attr, nt_errstr(_status))); \
 996                 return _status; \
 997         } \
 998         if (_cnt == 0) { \
 999                 if (needed) { \
1000                         talloc_free(_vals); \
1001                         DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1002                         return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1003                 } \
1004         } else if (_cnt > 1) { \
1005                 talloc_free(_vals); \
1006                 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1007                 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1008         } else { \
1009                 attr = talloc_move(mem_ctx, &_vals[0]); \
1010         } \
1011         talloc_free(_vals); \
1012 } while(0)
1013
1014 #define GET_UINT32_EX(attr, needed) do { \
1015         NTSTATUS _status; \
1016         uint32_t _cnt; \
1017         int32_t*_vals = NULL; \
1018         attr = 0; \
1019         _status = find_drsuapi_attr_int32(mem_ctx, cur, \
1020                                           DRSUAPI_ATTID_ ## attr, \
1021                                           &_cnt, &_vals); \
1022         if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
1023                 if (!needed) { \
1024                         _status = NT_STATUS_OK; \
1025                         _cnt = 0; \
1026                 } \
1027         } \
1028         if (!NT_STATUS_IS_OK(_status)) { \
1029                 DEBUG(0,(__location__ "attr[%s] %s\n", \
1030                         #attr, nt_errstr(_status))); \
1031                 return _status; \
1032         } \
1033         if (_cnt == 0) { \
1034                 if (needed) { \
1035                         talloc_free(_vals); \
1036                         DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1037                         return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1038                 } \
1039         } else if (_cnt > 1) { \
1040                 talloc_free(_vals); \
1041                 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1042                 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1043         } else { \
1044                 attr = (uint32_t)_vals[0]; \
1045         } \
1046         talloc_free(_vals); \
1047 } while(0)
1048
1049 #define GET_UINT64_EX(attr, needed) do { \
1050         NTSTATUS _status; \
1051         uint32_t _cnt; \
1052         int64_t *_vals = NULL; \
1053         attr = 0; \
1054         _status = find_drsuapi_attr_int64(mem_ctx, cur, \
1055                                           DRSUAPI_ATTID_ ## attr, \
1056                                           &_cnt, &_vals); \
1057         if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
1058                 if (!needed) { \
1059                         _status = NT_STATUS_OK; \
1060                         _cnt = 0; \
1061                 } \
1062         } \
1063         if (!NT_STATUS_IS_OK(_status)) { \
1064                 DEBUG(0,(__location__ "attr[%s] %s\n", \
1065                         #attr, nt_errstr(_status))); \
1066                 return _status; \
1067         } \
1068         if (_cnt == 0) { \
1069                 if (needed) { \
1070                         talloc_free(_vals); \
1071                         DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1072                         return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1073                 } \
1074         } else if (_cnt > 1) { \
1075                 talloc_free(_vals); \
1076                 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1077                 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1078         } else { \
1079                 attr = (uint64_t)_vals[0]; \
1080         } \
1081         talloc_free(_vals); \
1082 } while(0)
1083
1084 #define GET_BLOB(attr) GET_BLOB_EX(attr, false)
1085 #define GET_STRING(attr) GET_STRING_EX(attr, false)
1086 #define GET_UINT32(attr) GET_UINT32_EX(attr, false)
1087 #define GET_UINT64(attr) GET_UINT64_EX(attr, false)
1088
1089 /* Convert a struct samu_DELTA to a struct samu. */
1090 #define STRING_CHANGED (old_string && !new_string) ||\
1091                     (!old_string && new_string) ||\
1092                 (old_string && new_string && (strcmp(old_string, new_string) != 0))
1093
1094 #define STRING_CHANGED_NC(s1,s2) ((s1) && !(s2)) ||\
1095                     (!(s1) && (s2)) ||\
1096                 ((s1) && (s2) && (strcmp((s1), (s2)) != 0))
1097
1098 /****************************************************************
1099 ****************************************************************/
1100
1101 static NTSTATUS sam_account_from_object(struct samu *account,
1102                                 struct drsuapi_DsReplicaObjectListItemEx *cur)
1103 {
1104         TALLOC_CTX *mem_ctx = account;
1105         const char *old_string, *new_string;
1106         time_t unix_time, stored_time;
1107         uchar zero_buf[16];
1108         NTSTATUS status;
1109
1110         NTTIME lastLogon;
1111         NTTIME lastLogoff;
1112         NTTIME pwdLastSet;
1113         NTTIME accountExpires;
1114         const char *sAMAccountName;
1115         const char *displayName;
1116         const char *homeDirectory;
1117         const char *homeDrive;
1118         const char *scriptPath;
1119         const char *profilePath;
1120         const char *description;
1121         const char *userWorkstations;
1122         DATA_BLOB userParameters;
1123         struct dom_sid objectSid;
1124         uint32_t primaryGroupID;
1125         uint32_t userAccountControl;
1126         DATA_BLOB logonHours;
1127         uint32_t badPwdCount;
1128         uint32_t logonCount;
1129         DATA_BLOB unicodePwd;
1130         DATA_BLOB dBCSPwd;
1131
1132         uint32_t rid = 0;
1133         uint32_t acct_flags;
1134         uint32_t units_per_week;
1135
1136         memset(zero_buf, '\0', sizeof(zero_buf));
1137
1138         objectSid = cur->object.identifier->sid;
1139         GET_STRING_EX(sAMAccountName, true);
1140         DEBUG(0,("sam_account_from_object(%s, %s) start\n",
1141                  sAMAccountName, sid_string_dbg(&objectSid)));
1142         GET_UINT64(lastLogon);
1143         GET_UINT64(lastLogoff);
1144         GET_UINT64(pwdLastSet);
1145         GET_UINT64(accountExpires);
1146         GET_STRING(displayName);
1147         GET_STRING(homeDirectory);
1148         GET_STRING(homeDrive);
1149         GET_STRING(scriptPath);
1150         GET_STRING(profilePath);
1151         GET_STRING(description);
1152         GET_STRING(userWorkstations);
1153         GET_BLOB(userParameters);
1154         GET_UINT32(primaryGroupID);
1155         GET_UINT32(userAccountControl);
1156         GET_BLOB(logonHours);
1157         GET_UINT32(badPwdCount);
1158         GET_UINT32(logonCount);
1159         GET_BLOB(unicodePwd);
1160         GET_BLOB(dBCSPwd);
1161
1162         status = dom_sid_split_rid(mem_ctx, &objectSid, NULL, &rid);
1163         if (!NT_STATUS_IS_OK(status)) {
1164                 return status;
1165         }
1166         acct_flags = ds_uf2acb(userAccountControl);
1167
1168         /* Username, fullname, home dir, dir drive, logon script, acct
1169            desc, workstations, profile. */
1170
1171         if (sAMAccountName) {
1172                 old_string = pdb_get_nt_username(account);
1173                 new_string = sAMAccountName;
1174
1175                 if (STRING_CHANGED) {
1176                         pdb_set_nt_username(account, new_string, PDB_CHANGED);
1177                 }
1178
1179                 /* Unix username is the same - for sanity */
1180                 old_string = pdb_get_username( account );
1181                 if (STRING_CHANGED) {
1182                         pdb_set_username(account, new_string, PDB_CHANGED);
1183                 }
1184         }
1185
1186         if (displayName) {
1187                 old_string = pdb_get_fullname(account);
1188                 new_string = displayName;
1189
1190                 if (STRING_CHANGED)
1191                         pdb_set_fullname(account, new_string, PDB_CHANGED);
1192         }
1193
1194         if (homeDirectory) {
1195                 old_string = pdb_get_homedir(account);
1196                 new_string = homeDirectory;
1197
1198                 if (STRING_CHANGED)
1199                         pdb_set_homedir(account, new_string, PDB_CHANGED);
1200         }
1201
1202         if (homeDrive) {
1203                 old_string = pdb_get_dir_drive(account);
1204                 new_string = homeDrive;
1205
1206                 if (STRING_CHANGED)
1207                         pdb_set_dir_drive(account, new_string, PDB_CHANGED);
1208         }
1209
1210         if (scriptPath) {
1211                 old_string = pdb_get_logon_script(account);
1212                 new_string = scriptPath;
1213
1214                 if (STRING_CHANGED)
1215                         pdb_set_logon_script(account, new_string, PDB_CHANGED);
1216         }
1217
1218         if (description) {
1219                 old_string = pdb_get_acct_desc(account);
1220                 new_string = description;
1221
1222                 if (STRING_CHANGED)
1223                         pdb_set_acct_desc(account, new_string, PDB_CHANGED);
1224         }
1225
1226         if (userWorkstations) {
1227                 old_string = pdb_get_workstations(account);
1228                 new_string = userWorkstations;
1229
1230                 if (STRING_CHANGED)
1231                         pdb_set_workstations(account, new_string, PDB_CHANGED);
1232         }
1233
1234         if (profilePath) {
1235                 old_string = pdb_get_profile_path(account);
1236                 new_string = profilePath;
1237
1238                 if (STRING_CHANGED)
1239                         pdb_set_profile_path(account, new_string, PDB_CHANGED);
1240         }
1241
1242         if (userParameters.data) {
1243                 char *newstr;
1244                 old_string = pdb_get_munged_dial(account);
1245                 newstr = (userParameters.length == 0) ? NULL :
1246                         base64_encode_data_blob(talloc_tos(), userParameters);
1247
1248                 if (STRING_CHANGED_NC(old_string, newstr))
1249                         pdb_set_munged_dial(account, newstr, PDB_CHANGED);
1250                 TALLOC_FREE(newstr);
1251         }
1252
1253         /* User and group sid */
1254         if (rid != 0 && pdb_get_user_rid(account) != rid) {
1255                 pdb_set_user_sid_from_rid(account, rid, PDB_CHANGED);
1256         }
1257         if (primaryGroupID != 0 && pdb_get_group_rid(account) != primaryGroupID) {
1258                 pdb_set_group_sid_from_rid(account, primaryGroupID, PDB_CHANGED);
1259         }
1260
1261         /* Logon and password information */
1262         if (!nt_time_is_zero(&lastLogon)) {
1263                 unix_time = nt_time_to_unix(lastLogon);
1264                 stored_time = pdb_get_logon_time(account);
1265                 if (stored_time != unix_time)
1266                         pdb_set_logon_time(account, unix_time, PDB_CHANGED);
1267         }
1268
1269         if (!nt_time_is_zero(&lastLogoff)) {
1270                 unix_time = nt_time_to_unix(lastLogoff);
1271                 stored_time = pdb_get_logoff_time(account);
1272                 if (stored_time != unix_time)
1273                         pdb_set_logoff_time(account, unix_time,PDB_CHANGED);
1274         }
1275
1276         /* Logon Divs */
1277         units_per_week = logonHours.length * 8;
1278
1279         if (pdb_get_logon_divs(account) != units_per_week) {
1280                 pdb_set_logon_divs(account, units_per_week, PDB_CHANGED);
1281         }
1282
1283         /* Logon Hours Len */
1284         if (units_per_week/8 != pdb_get_hours_len(account)) {
1285                 pdb_set_hours_len(account, units_per_week/8, PDB_CHANGED);
1286         }
1287
1288         /* Logon Hours */
1289         if (logonHours.data) {
1290                 char oldstr[44], newstr[44];
1291                 pdb_sethexhours(oldstr, pdb_get_hours(account));
1292                 pdb_sethexhours(newstr, logonHours.data);
1293                 if (!strequal(oldstr, newstr)) {
1294                         pdb_set_hours(account, logonHours.data,
1295                                       logonHours.length, PDB_CHANGED);
1296                 }
1297         }
1298
1299         if (pdb_get_bad_password_count(account) != badPwdCount)
1300                 pdb_set_bad_password_count(account, badPwdCount, PDB_CHANGED);
1301
1302         if (pdb_get_logon_count(account) != logonCount)
1303                 pdb_set_logon_count(account, logonCount, PDB_CHANGED);
1304
1305         if (!nt_time_is_zero(&pwdLastSet)) {
1306                 unix_time = nt_time_to_unix(pwdLastSet);
1307                 stored_time = pdb_get_pass_last_set_time(account);
1308                 if (stored_time != unix_time)
1309                         pdb_set_pass_last_set_time(account, unix_time, PDB_CHANGED);
1310         } else {
1311                 /* no last set time, make it now */
1312                 pdb_set_pass_last_set_time(account, time(NULL), PDB_CHANGED);
1313         }
1314
1315         if (!nt_time_is_zero(&accountExpires)) {
1316                 unix_time = nt_time_to_unix(accountExpires);
1317                 stored_time = pdb_get_kickoff_time(account);
1318                 if (stored_time != unix_time)
1319                         pdb_set_kickoff_time(account, unix_time, PDB_CHANGED);
1320         }
1321
1322         /* Decode hashes from password hash
1323            Note that win2000 may send us all zeros for the hashes if it doesn't
1324            think this channel is secure enough - don't set the passwords at all
1325            in that case
1326         */
1327         if (dBCSPwd.length == 16 && memcmp(dBCSPwd.data, zero_buf, 16) != 0) {
1328                 pdb_set_lanman_passwd(account, dBCSPwd.data, PDB_CHANGED);
1329         }
1330
1331         if (unicodePwd.length == 16 && memcmp(unicodePwd.data, zero_buf, 16) != 0) {
1332                 pdb_set_nt_passwd(account, unicodePwd.data, PDB_CHANGED);
1333         }
1334
1335         /* TODO: history */
1336
1337         /* TODO: account expiry time */
1338
1339         pdb_set_acct_ctrl(account, acct_flags, PDB_CHANGED);
1340
1341         pdb_set_domain(account, lp_workgroup(), PDB_CHANGED);
1342
1343         DEBUG(0,("sam_account_from_object(%s, %s) done\n",
1344                  sAMAccountName, sid_string_dbg(&objectSid)));
1345         return NT_STATUS_OK;
1346 }
1347
1348 /****************************************************************
1349 ****************************************************************/
1350
1351 static NTSTATUS handle_account_object(struct dssync_passdb *pctx,
1352                                       TALLOC_CTX *mem_ctx,
1353                                       struct dssync_passdb_obj *obj)
1354 {
1355         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1356         NTSTATUS status;
1357         fstring account;
1358         struct samu *sam_account=NULL;
1359         GROUP_MAP *map;
1360         struct group *grp;
1361         struct dom_sid user_sid;
1362         struct dom_sid group_sid;
1363         struct passwd *passwd = NULL;
1364         uint32_t acct_flags;
1365         uint32_t rid;
1366
1367         const char *sAMAccountName;
1368         uint32_t userAccountControl;
1369
1370         user_sid = cur->object.identifier->sid;
1371         GET_STRING_EX(sAMAccountName, true);
1372         GET_UINT32_EX(userAccountControl, true);
1373
1374         status = dom_sid_split_rid(mem_ctx, &user_sid, NULL, &rid);
1375         if (!NT_STATUS_IS_OK(status)) {
1376                 return status;
1377         }
1378
1379         fstrcpy(account, sAMAccountName);
1380         if (rid == DOMAIN_RID_GUEST) {
1381                 /*
1382                  * pdb_getsampwsid() has special handling for DOMAIN_RID_GUEST
1383                  * that's why we need to ignore it here.
1384                  *
1385                  * pdb_smbpasswd.c also has some DOMAIN_RID_GUEST related
1386                  * code...
1387                  */
1388                 DEBUG(0,("Ignore %s - %s\n", account, sid_string_dbg(&user_sid)));
1389                 return NT_STATUS_OK;
1390         }
1391         DEBUG(0,("Creating account: %s\n", account));
1392
1393         if ( !(sam_account = samu_new(mem_ctx)) ) {
1394                 return NT_STATUS_NO_MEMORY;
1395         }
1396
1397         acct_flags = ds_uf2acb(userAccountControl);
1398         status = smb_create_user(sam_account, acct_flags, account, &passwd);
1399         if (!NT_STATUS_IS_OK(status)) {
1400                 DEBUG(0,("Could not create posix account info for '%s'- %s\n",
1401                         account, nt_errstr(status)));
1402                 TALLOC_FREE(sam_account);
1403                 return status;
1404         }
1405
1406         DEBUG(3, ("Attempting to find SID %s for user %s in the passdb\n",
1407                   sid_string_dbg(&user_sid), account));
1408         if (!pdb_getsampwsid(sam_account, &user_sid)) {
1409                 sam_account_from_object(sam_account, cur);
1410                 DEBUG(3, ("Attempting to add user SID %s for user %s in the passdb\n",
1411                           sid_string_dbg(&user_sid),
1412                           pdb_get_username(sam_account)));
1413                 if (!NT_STATUS_IS_OK(pdb_add_sam_account(sam_account))) {
1414                         DEBUG(1, ("SAM Account for %s failed to be added to the passdb!\n",
1415                                   account));
1416                         TALLOC_FREE(sam_account);
1417                         return NT_STATUS_ACCESS_DENIED;
1418                 }
1419         } else {
1420                 sam_account_from_object(sam_account, cur);
1421                 DEBUG(3, ("Attempting to update user SID %s for user %s in the passdb\n",
1422                           sid_string_dbg(&user_sid),
1423                           pdb_get_username(sam_account)));
1424                 if (!NT_STATUS_IS_OK(pdb_update_sam_account(sam_account))) {
1425                         DEBUG(1, ("SAM Account for %s failed to be updated in the passdb!\n",
1426                                   account));
1427                         TALLOC_FREE(sam_account);
1428                         return NT_STATUS_ACCESS_DENIED;
1429                 }
1430         }
1431
1432         if (pdb_get_group_sid(sam_account) == NULL) {
1433                 TALLOC_FREE(sam_account);
1434                 return NT_STATUS_UNSUCCESSFUL;
1435         }
1436
1437         group_sid = *pdb_get_group_sid(sam_account);
1438
1439         map = talloc_zero(NULL, GROUP_MAP);
1440         if (!map) {
1441                 return NT_STATUS_NO_MEMORY;
1442         }
1443
1444         if (!pdb_getgrsid(map, group_sid)) {
1445                 DEBUG(0, ("Primary group of %s has no mapping!\n",
1446                           pdb_get_username(sam_account)));
1447         } else {
1448                 if (map->gid != passwd->pw_gid) {
1449                         if (!(grp = getgrgid(map->gid))) {
1450                                 DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n",
1451                                           (unsigned long)map->gid, pdb_get_username(sam_account),
1452                                           sid_string_dbg(&group_sid)));
1453                         } else {
1454                                 smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account));
1455                         }
1456                 }
1457         }
1458
1459         TALLOC_FREE(map);
1460
1461         if ( !passwd ) {
1462                 DEBUG(1, ("No unix user for this account (%s), cannot adjust mappings\n",
1463                         pdb_get_username(sam_account)));
1464         }
1465
1466         TALLOC_FREE(sam_account);
1467         return NT_STATUS_OK;
1468 }
1469
1470 /****************************************************************
1471 ****************************************************************/
1472
1473 static NTSTATUS handle_alias_object(struct dssync_passdb *pctx,
1474                                     TALLOC_CTX *mem_ctx,
1475                                     struct dssync_passdb_obj *obj)
1476 {
1477         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1478         NTSTATUS status;
1479         struct group *grp = NULL;
1480         struct dom_sid group_sid;
1481         uint32_t rid = 0;
1482         struct dom_sid *dom_sid = NULL;
1483         fstring sid_string;
1484         GROUP_MAP *map;
1485         bool insert = true;
1486
1487         const char *sAMAccountName;
1488         const char *description;
1489         uint32_t i;
1490         uint32_t num_members = 0;
1491         struct drsuapi_DsReplicaObjectIdentifier3 *members = NULL;
1492
1493         group_sid = cur->object.identifier->sid;
1494         GET_STRING_EX(sAMAccountName, true);
1495         GET_STRING(description);
1496
1497         status = find_drsuapi_attr_dn(obj, cur, DRSUAPI_ATTID_member,
1498                                       &num_members, &members);
1499         if (NT_STATUS_EQUAL(status, NT_STATUS_PROPSET_NOT_FOUND)) {
1500                 status = NT_STATUS_OK;
1501         }
1502         if (!NT_STATUS_IS_OK(status)) {
1503                 return status;
1504         }
1505
1506         dom_sid_split_rid(mem_ctx, &group_sid, &dom_sid, &rid);
1507
1508         map = talloc_zero(mem_ctx, GROUP_MAP);
1509         if (map == NULL) {
1510                 status = NT_STATUS_NO_MEMORY;
1511                 goto done;
1512         }
1513
1514         map->nt_name = talloc_strdup(map, sAMAccountName);
1515         if (map->nt_name == NULL) {
1516                 status = NT_STATUS_NO_MEMORY;
1517                 goto done;
1518         }
1519
1520         if (description) {
1521                 map->comment = talloc_strdup(map, description);
1522         } else {
1523                 map->comment = talloc_strdup(map, "");
1524         }
1525         if (map->comment == NULL) {
1526                 status = NT_STATUS_NO_MEMORY;
1527                 goto done;
1528         }
1529
1530         sid_to_fstring(sid_string, &group_sid);
1531         DEBUG(0,("Creating alias[%s] - %s members[%u]\n",
1532                   map->nt_name, sid_string, num_members));
1533
1534         status = dssync_insert_obj(pctx, pctx->aliases, obj);
1535         if (!NT_STATUS_IS_OK(status)) {
1536                 goto done;
1537         }
1538
1539         if (pdb_getgrsid(map, group_sid)) {
1540                 if (map->gid != -1) {
1541                         grp = getgrgid(map->gid);
1542                 }
1543                 insert = false;
1544         }
1545
1546         if (grp == NULL) {
1547                 gid_t gid;
1548
1549                 /* No group found from mapping, find it from its name. */
1550                 if ((grp = getgrnam(map->nt_name)) == NULL) {
1551
1552                         /* No appropriate group found, create one */
1553
1554                         DEBUG(0, ("Creating unix group: '%s'\n",
1555                                                         map->nt_name));
1556
1557                         if (smb_create_group(map->nt_name, &gid) != 0) {
1558                                 status = NT_STATUS_ACCESS_DENIED;
1559                                 goto done;
1560                         }
1561
1562                         if ((grp = getgrgid(gid)) == NULL) {
1563                                 status = NT_STATUS_ACCESS_DENIED;
1564                                 goto done;
1565                         }
1566                 }
1567         }
1568
1569         map->gid = grp->gr_gid;
1570         map->sid = group_sid;
1571
1572         if (dom_sid_equal(dom_sid, &global_sid_Builtin)) {
1573                 /*
1574                  * pdb_ldap does not like SID_NAME_WKN_GRP...
1575                  *
1576                  * map.sid_name_use = SID_NAME_WKN_GRP;
1577                  */
1578                 map->sid_name_use = SID_NAME_ALIAS;
1579         } else {
1580                 map->sid_name_use = SID_NAME_ALIAS;
1581         }
1582
1583         if (insert) {
1584                 pdb_add_group_mapping_entry(map);
1585         } else {
1586                 pdb_update_group_mapping_entry(map);
1587         }
1588
1589         for (i=0; i < num_members; i++) {
1590                 struct dssync_passdb_mem *mem;
1591
1592                 status = dssync_create_mem(pctx, obj,
1593                                            true /* active */,
1594                                            &members[i], &mem);
1595                 if (!NT_STATUS_IS_OK(status)) {
1596                         goto done;
1597                 }
1598         }
1599
1600         status = NT_STATUS_OK;
1601
1602 done:
1603         TALLOC_FREE(map);
1604         return status;
1605 }
1606
1607 /****************************************************************
1608 ****************************************************************/
1609
1610 static NTSTATUS handle_group_object(struct dssync_passdb *pctx,
1611                                     TALLOC_CTX *mem_ctx,
1612                                     struct dssync_passdb_obj *obj)
1613 {
1614         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1615         NTSTATUS status;
1616         struct group *grp = NULL;
1617         struct dom_sid group_sid;
1618         fstring sid_string;
1619         GROUP_MAP *map;
1620         bool insert = true;
1621
1622         const char *sAMAccountName;
1623         const char *description;
1624         uint32_t i;
1625         uint32_t num_members = 0;
1626         struct drsuapi_DsReplicaObjectIdentifier3 *members = NULL;
1627
1628         group_sid = cur->object.identifier->sid;
1629         GET_STRING_EX(sAMAccountName, true);
1630         GET_STRING(description);
1631
1632         status = find_drsuapi_attr_dn(obj, cur, DRSUAPI_ATTID_member,
1633                                       &num_members, &members);
1634         if (NT_STATUS_EQUAL(status, NT_STATUS_PROPSET_NOT_FOUND)) {
1635                 status = NT_STATUS_OK;
1636         }
1637         if (!NT_STATUS_IS_OK(status)) {
1638                 return status;
1639         }
1640
1641         map = talloc_zero(NULL, GROUP_MAP);
1642         if (!map) {
1643                 return NT_STATUS_NO_MEMORY;
1644         }
1645
1646         map->nt_name = talloc_strdup(map, sAMAccountName);
1647         if (!map->nt_name) {
1648                 status = NT_STATUS_NO_MEMORY;
1649                 goto done;
1650         }
1651         if (description) {
1652                 map->comment = talloc_strdup(map, description);
1653         } else {
1654                 map->comment = talloc_strdup(map, "");
1655         }
1656         if (!map->comment) {
1657                 status = NT_STATUS_NO_MEMORY;
1658                 goto done;
1659         }
1660
1661         sid_to_fstring(sid_string, &group_sid);
1662         DEBUG(0,("Creating group[%s] - %s members [%u]\n",
1663                   map->nt_name, sid_string, num_members));
1664
1665         status = dssync_insert_obj(pctx, pctx->groups, obj);
1666         if (!NT_STATUS_IS_OK(status)) {
1667                 goto done;
1668         }
1669
1670         if (pdb_getgrsid(map, group_sid)) {
1671                 if (map->gid != -1) {
1672                         grp = getgrgid(map->gid);
1673                 }
1674                 insert = false;
1675         }
1676
1677         if (grp == NULL) {
1678                 gid_t gid;
1679
1680                 /* No group found from mapping, find it from its name. */
1681                 if ((grp = getgrnam(map->nt_name)) == NULL) {
1682
1683                         /* No appropriate group found, create one */
1684
1685                         DEBUG(0, ("Creating unix group: '%s'\n",
1686                                                         map->nt_name));
1687
1688                         if (smb_create_group(map->nt_name, &gid) != 0) {
1689                                 status = NT_STATUS_ACCESS_DENIED;
1690                                 goto done;
1691                         }
1692
1693                         if ((grp = getgrnam(map->nt_name)) == NULL) {
1694                                 status = NT_STATUS_ACCESS_DENIED;
1695                                 goto done;
1696                         }
1697                 }
1698         }
1699
1700         map->gid = grp->gr_gid;
1701         map->sid = group_sid;
1702         map->sid_name_use = SID_NAME_DOM_GRP;
1703
1704         if (insert) {
1705                 pdb_add_group_mapping_entry(map);
1706         } else {
1707                 pdb_update_group_mapping_entry(map);
1708         }
1709
1710         for (i=0; i < num_members; i++) {
1711                 struct dssync_passdb_mem *mem;
1712
1713                 status = dssync_create_mem(pctx, obj,
1714                                            true /* active */,
1715                                            &members[i], &mem);
1716                 if (!NT_STATUS_IS_OK(status)) {
1717                         goto done;
1718                 }
1719         }
1720
1721         status = NT_STATUS_OK;
1722
1723 done:
1724         TALLOC_FREE(map);
1725         return status;
1726 }
1727
1728 /****************************************************************
1729 ****************************************************************/
1730
1731 static NTSTATUS handle_interdomain_trust_object(struct dssync_passdb *pctx,
1732                                                 TALLOC_CTX *mem_ctx,
1733                                                 struct dssync_passdb_obj *obj)
1734 {
1735         struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1736         DEBUG(0,("trust: %s\n", cur->object.identifier->dn));
1737         return NT_STATUS_NOT_IMPLEMENTED;
1738 }
1739
1740 /****************************************************************
1741 ****************************************************************/
1742
1743 struct dssync_object_table_t {
1744         uint32_t type;
1745         NTSTATUS (*fn) (struct dssync_passdb *pctx,
1746                         TALLOC_CTX *mem_ctx,
1747                         struct dssync_passdb_obj *obj);
1748 };
1749
1750 static const struct dssync_object_table_t dssync_object_table[] = {
1751         { ATYPE_NORMAL_ACCOUNT,         handle_account_object },
1752         { ATYPE_WORKSTATION_TRUST,      handle_account_object },
1753         { ATYPE_SECURITY_LOCAL_GROUP,   handle_alias_object },
1754         { ATYPE_SECURITY_GLOBAL_GROUP,  handle_group_object },
1755         { ATYPE_INTERDOMAIN_TRUST,      handle_interdomain_trust_object },
1756 };
1757
1758 /****************************************************************
1759 ****************************************************************/
1760
1761 static NTSTATUS parse_object(struct dssync_passdb *pctx,
1762                              TALLOC_CTX *mem_ctx,
1763                              struct drsuapi_DsReplicaObjectListItemEx *cur)
1764 {
1765         NTSTATUS status = NT_STATUS_OK;
1766         DATA_BLOB *blob;
1767         int i = 0;
1768         int a = 0;
1769         struct drsuapi_DsReplicaAttribute *attr;
1770
1771         char *name = NULL;
1772         uint32_t sam_type = 0;
1773
1774         DEBUG(3, ("parsing object '%s'\n", cur->object.identifier->dn));
1775
1776         for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
1777
1778                 attr = &cur->object.attribute_ctr.attributes[i];
1779
1780                 if (attr->value_ctr.num_values != 1) {
1781                         continue;
1782                 }
1783
1784                 if (!attr->value_ctr.values[0].blob) {
1785                         continue;
1786                 }
1787
1788                 blob = attr->value_ctr.values[0].blob;
1789
1790                 switch (attr->attid) {
1791                         case DRSUAPI_ATTID_sAMAccountName:
1792                                 pull_string_talloc(mem_ctx, NULL, 0, &name,
1793                                                    blob->data, blob->length,
1794                                                    STR_UNICODE);
1795                                 break;
1796                         case DRSUAPI_ATTID_sAMAccountType:
1797                                 sam_type = IVAL(blob->data, 0);
1798                                 break;
1799                         default:
1800                                 break;
1801                 }
1802         }
1803
1804         for (a=0; a < ARRAY_SIZE(dssync_object_table); a++) {
1805                 if (sam_type == dssync_object_table[a].type) {
1806                         if (dssync_object_table[a].fn) {
1807                                 struct dssync_passdb_obj *obj;
1808                                 status = dssync_create_obj(pctx, pctx->all,
1809                                                            sam_type, cur, &obj);
1810                                 if (!NT_STATUS_IS_OK(status)) {
1811                                         break;
1812                                 }
1813                                 status = dssync_object_table[a].fn(pctx,
1814                                                                    mem_ctx,
1815                                                                    obj);
1816                                 break;
1817                         }
1818                 }
1819         }
1820
1821         return status;
1822 }
1823
1824 static NTSTATUS parse_link(struct dssync_passdb *pctx,
1825                            TALLOC_CTX *mem_ctx,
1826                            struct drsuapi_DsReplicaLinkedAttribute *cur)
1827 {
1828         struct drsuapi_DsReplicaObjectIdentifier3 *id3;
1829         const DATA_BLOB *blob;
1830         enum ndr_err_code ndr_err;
1831         NTSTATUS status;
1832         bool active = false;
1833         struct dssync_passdb_mem *mem;
1834         struct dssync_passdb_obj *obj;
1835
1836         if (cur->attid != DRSUAPI_ATTID_member) {
1837                 return NT_STATUS_OK;
1838         }
1839
1840         if (cur->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) {
1841                 active = true;
1842         }
1843
1844         DEBUG(3, ("parsing link '%s' - %s\n",
1845                   cur->identifier->dn, active?"adding":"deleting"));
1846
1847         blob = cur->value.blob;
1848
1849         if (blob == NULL) {
1850                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1851         }
1852
1853         obj = dssync_search_obj_by_guid(pctx, pctx->all, &cur->identifier->guid);
1854         if (obj == NULL) {
1855                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1856         }
1857
1858         id3 = talloc_zero(obj, struct drsuapi_DsReplicaObjectIdentifier3);
1859         if (id3 == NULL) {
1860                 return NT_STATUS_NO_MEMORY;
1861         }
1862
1863         /* windows sometimes sends an extra two pad bytes here */
1864         ndr_err = ndr_pull_struct_blob(blob, id3, id3,
1865                         (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
1866         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1867                 status = ndr_map_error2ntstatus(ndr_err);
1868                 return status;
1869         }
1870
1871         status = dssync_create_mem(pctx, obj,
1872                                    active,
1873                                    id3, &mem);
1874         if (!NT_STATUS_IS_OK(status)) {
1875                 return status;
1876         }
1877
1878         return NT_STATUS_OK;
1879 }
1880
1881 /****************************************************************
1882 ****************************************************************/
1883
1884 static NTSTATUS passdb_process_objects(struct dssync_context *ctx,
1885                                        TALLOC_CTX *mem_ctx,
1886                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
1887                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
1888 {
1889         NTSTATUS status = NT_STATUS_OK;
1890         struct dssync_passdb *pctx =
1891                 talloc_get_type_abort(ctx->private_data,
1892                 struct dssync_passdb);
1893
1894         for (; cur; cur = cur->next_object) {
1895                 status = parse_object(pctx, mem_ctx, cur);
1896                 if (!NT_STATUS_IS_OK(status)) {
1897                         goto out;
1898                 }
1899         }
1900
1901  out:
1902         return status;
1903 }
1904
1905 /****************************************************************
1906 ****************************************************************/
1907
1908 static NTSTATUS passdb_process_links(struct dssync_context *ctx,
1909                                      TALLOC_CTX *mem_ctx,
1910                                      uint32_t count,
1911                                      struct drsuapi_DsReplicaLinkedAttribute *links,
1912                                      struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
1913 {
1914         NTSTATUS status = NT_STATUS_OK;
1915         struct dssync_passdb *pctx =
1916                 talloc_get_type_abort(ctx->private_data,
1917                 struct dssync_passdb);
1918         uint32_t i;
1919
1920         for (i = 0; i < count; i++) {
1921                 status = parse_link(pctx, mem_ctx, &links[i]);
1922                 if (!NT_STATUS_IS_OK(status)) {
1923                         goto out;
1924                 }
1925         }
1926
1927  out:
1928         return status;
1929 }
1930
1931 /****************************************************************
1932 ****************************************************************/
1933
1934 const struct dssync_ops libnet_dssync_passdb_ops = {
1935         .startup                = passdb_startup,
1936         .process_objects        = passdb_process_objects,
1937         .process_links          = passdb_process_links,
1938         .finish                 = passdb_finish,
1939 };