source/smbd/password.c

   1 /*
   2    Unix SMB/Netbios implementation.
   3    Version 1.9.
   4    Password and authentication handling
   5    Copyright (C) Andrew Tridgell 1992-1998
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License as published by
   9    the Free Software Foundation; either version 2 of the License, or
  10    (at your option) any later version.
  11
  12    This program is distributed in the hope that it will be useful,
  13    but WITHOUT ANY WARRANTY; without even the implied warranty of
  14    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15    GNU General Public License for more details.
  16
  17    You should have received a copy of the GNU General Public License
  18    along with this program; if not, write to the Free Software
  19    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20 */
  21
  22 #include "includes.h"
  23
  24 extern int DEBUGLEVEL;
  25 extern int Protocol;
  26 extern struct in_addr ipzero;
  27
  28 /* users from session setup */
  29 static pstring session_users="";
  30
  31 extern pstring global_myname;
  32 extern fstring global_myworkgroup;
  33
  34 /* Data to do lanman1/2 password challenge. */
  35 static unsigned char saved_challenge[8];
  36 static BOOL challenge_sent=False;
  37
  38 /*******************************************************************
  39 Get the next challenge value - no repeats.
  40 ********************************************************************/
  41 void generate_next_challenge(char *challenge)
  42 {
  43 #if 0
  44         /*
  45          * Leave this ifdef'd out while we test
  46          * the new crypto random number generator.
  47          * JRA.
  48          */
  49         unsigned char buf[16];
  50         static int counter = 0;
  51         struct timeval tval;
  52         int v1,v2;
  53
  54         /* get a sort-of random number */
  55         GetTimeOfDay(&tval);
  56         v1 = (counter++) + sys_getpid() + tval.tv_sec;
  57         v2 = (counter++) * sys_getpid() + tval.tv_usec;
  58         SIVAL(challenge,0,v1);
  59         SIVAL(challenge,4,v2);
  60
  61         /* mash it up with md4 */
  62         mdfour(buf, (unsigned char *)challenge, 8);
  63 #else
  64         unsigned char buf[8];
  65
  66         generate_random_buffer(buf,8,False);
  67 #endif
  68         memcpy(saved_challenge, buf, 8);
  69         memcpy(challenge,buf,8);
  70         challenge_sent = True;
  71 }
  72
  73 /*******************************************************************
  74 set the last challenge sent, usually from a password server
  75 ********************************************************************/
  76 BOOL set_challenge(unsigned char *challenge)
  77 {
  78   memcpy(saved_challenge,challenge,8);
  79   challenge_sent = True;
  80   return(True);
  81 }
  82
  83 /*******************************************************************
  84 get the last challenge sent
  85 ********************************************************************/
  86 static BOOL last_challenge(unsigned char *challenge)
  87 {
  88   if (!challenge_sent) return(False);
  89   memcpy(challenge,saved_challenge,8);
  90   return(True);
  91 }
  92
  93 /* this holds info on user ids that are already validated for this VC */
  94 static user_struct *validated_users;
  95 static int next_vuid = VUID_OFFSET;
  96 static int num_validated_vuids;
  97
  98 /****************************************************************************
  99 check if a uid has been validated, and return an pointer to the user_struct
 100 if it has. NULL if not. vuid is biased by an offset. This allows us to
 101 tell random client vuid's (normally zero) from valid vuids.
 102 ****************************************************************************/
 103 user_struct *get_valid_user_struct(uint16 vuid)
 104 {
 105         user_struct *usp;
 106         int count=0;
 107
 108         if (vuid == UID_FIELD_INVALID)
 109                 return NULL;
 110
 111         for (usp=validated_users;usp;usp=usp->next,count++) {
 112                 if (vuid == usp->vuid) {
 113                         if (count > 10) {
 114                                 DLIST_PROMOTE(validated_users, usp);
 115                         }
 116                         return usp;
 117                 }
 118         }
 119
 120         return NULL;
 121 }
 122
 123 /****************************************************************************
 124 invalidate a uid
 125 ****************************************************************************/
 126 void invalidate_vuid(uint16 vuid)
 127 {
 128         user_struct *vuser = get_valid_user_struct(vuid);
 129
 130         if (vuser == NULL)
 131                 return;
 132
 133         session_yield(vuid);
 134
 135         DLIST_REMOVE(validated_users, vuser);
 136
 137         safe_free(vuser->groups);
 138         delete_nt_token(&vuser->nt_user_token);
 139         safe_free(vuser);
 140         num_validated_vuids--;
 141 }
 142
 143 /****************************************************************************
 144 invalidate all vuid entries for this process
 145 ****************************************************************************/
 146 void invalidate_all_vuids(void)
 147 {
 148         user_struct *usp, *next=NULL;
 149
 150         for (usp=validated_users;usp;usp=next) {
 151                 next = usp->next;
 152
 153                 invalidate_vuid(usp->vuid);
 154         }
 155 }
 156
 157 /****************************************************************************
 158 return a validated username
 159 ****************************************************************************/
 160 char *validated_username(uint16 vuid)
 161 {
 162         user_struct *vuser = get_valid_user_struct(vuid);
 163         if (vuser == NULL)
 164                 return 0;
 165         return(vuser->user.unix_name);
 166 }
 167
 168 /****************************************************************************
 169 return a validated domain
 170 ****************************************************************************/
 171 char *validated_domain(uint16 vuid)
 172 {
 173         user_struct *vuser = get_valid_user_struct(vuid);
 174         if (vuser == NULL)
 175                 return 0;
 176         return(vuser->user.domain);
 177 }
 178
 179
 180 /****************************************************************************
 181  Create the SID list for this user.
 182 ****************************************************************************/
 183
 184 NT_USER_TOKEN *create_nt_token(uid_t uid, gid_t gid, int ngroups, gid_t *groups, BOOL is_guest)
 185 {
 186         extern DOM_SID global_sid_World;
 187         extern DOM_SID global_sid_Network;
 188         extern DOM_SID global_sid_Builtin_Guests;
 189         extern DOM_SID global_sid_Authenticated_Users;
 190         NT_USER_TOKEN *token;
 191         DOM_SID *psids;
 192         int i, psid_ndx = 0;
 193         size_t num_sids = 0;
 194         fstring sid_str;
 195
 196         if ((token = (NT_USER_TOKEN *)malloc( sizeof(NT_USER_TOKEN) ) ) == NULL)
 197                 return NULL;
 198
 199         ZERO_STRUCTP(token);
 200
 201         /* We always have uid/gid plus World and Network and Authenticated Users or Guest SIDs. */
 202         num_sids = 5 + ngroups;
 203
 204         if ((token->user_sids = (DOM_SID *)malloc( num_sids*sizeof(DOM_SID))) == NULL) {
 205                 free(token);
 206                 return NULL;
 207         }
 208
 209         psids = token->user_sids;
 210
 211         /*
 212          * Note - user SID *MUST* be first in token !
 213          * se_access_check depends on this.
 214          */
 215
 216         uid_to_sid( &psids[psid_ndx++], uid);
 217
 218         /*
 219          * Primary group SID is second in token. Convention.
 220          */
 221
 222         gid_to_sid( &psids[psid_ndx++], gid);
 223
 224         /* Now add the group SIDs. */
 225
 226         for (i = 0; i < ngroups; i++) {
 227                 if (groups[i] != gid) {
 228                         gid_to_sid( &psids[psid_ndx++], groups[i]);
 229                 }
 230         }
 231
 232         /*
 233          * Finally add the "standard" SIDs.
 234          * The only difference between guest and "anonymous" (which we
 235          * don't really support) is the addition of Authenticated_Users.
 236          */
 237
 238         sid_copy( &psids[psid_ndx++], &global_sid_World);
 239         sid_copy( &psids[psid_ndx++], &global_sid_Network);
 240
 241         if (is_guest)
 242                 sid_copy( &psids[psid_ndx++], &global_sid_Builtin_Guests);
 243         else
 244                 sid_copy( &psids[psid_ndx++], &global_sid_Authenticated_Users);
 245
 246         token->num_sids = psid_ndx;
 247
 248         /* Dump list of sids in token */
 249
 250         for (i = 0; i < token->num_sids; i++) {
 251                 DEBUG(5, ("user token sid %s\n",
 252                           sid_to_string(sid_str, &token->user_sids[i])));
 253         }
 254
 255         return token;
 256 }
 257
 258 /****************************************************************************
 259 register a uid/name pair as being valid and that a valid password
 260 has been given. vuid is biased by an offset. This allows us to
 261 tell random client vuid's (normally zero) from valid vuids.
 262 ****************************************************************************/
 263
 264 int register_vuid(uid_t uid,gid_t gid, char *unix_name, char *requested_name,
 265                   char *domain,BOOL guest)
 266 {
 267         user_struct *vuser = NULL;
 268         struct passwd *pwfile; /* for getting real name from passwd file */
 269
 270         /* Ensure no vuid gets registered in share level security. */
 271         if(lp_security() == SEC_SHARE)
 272                 return UID_FIELD_INVALID;
 273
 274         /* Limit allowed vuids to 16bits - VUID_OFFSET. */
 275         if (num_validated_vuids >= 0xFFFF-VUID_OFFSET)
 276                 return UID_FIELD_INVALID;
 277
 278         if((vuser = (user_struct *)malloc( sizeof(user_struct) )) == NULL) {
 279                 DEBUG(0,("Failed to malloc users struct!\n"));
 280                 return UID_FIELD_INVALID;
 281         }
 282
 283         ZERO_STRUCTP(vuser);
 284
 285         DEBUG(10,("register_vuid: (%u,%u) %s %s %s guest=%d\n", (unsigned int)uid, (unsigned int)gid,
 286                                 unix_name, requested_name, domain, guest ));
 287
 288         /* Allocate a free vuid. Yes this is a linear search... :-) */
 289         while( get_valid_user_struct(next_vuid) != NULL ) {
 290                 next_vuid++;
 291                 /* Check for vuid wrap. */
 292                 if (next_vuid == UID_FIELD_INVALID)
 293                         next_vuid = VUID_OFFSET;
 294         }
 295
 296         DEBUG(10,("register_vuid: allocated vuid = %u\n", (unsigned int)next_vuid ));
 297
 298         vuser->vuid = next_vuid;
 299         vuser->uid = uid;
 300         vuser->gid = gid;
 301         vuser->guest = guest;
 302         fstrcpy(vuser->user.unix_name,unix_name);
 303         fstrcpy(vuser->user.smb_name,requested_name);
 304         fstrcpy(vuser->user.domain,domain);
 305
 306         vuser->n_groups = 0;
 307         vuser->groups  = NULL;
 308
 309         /* Find all the groups this uid is in and store them.
 310                 Used by become_user() */
 311         initialise_groups(unix_name, uid, gid);
 312         get_current_groups( &vuser->n_groups, &vuser->groups);
 313
 314         /* Create an NT_USER_TOKEN struct for this user. */
 315         vuser->nt_user_token = create_nt_token(uid,gid, vuser->n_groups, vuser->groups, guest);
 316
 317         next_vuid++;
 318         num_validated_vuids++;
 319
 320         DLIST_ADD(validated_users, vuser);
 321
 322         DEBUG(3,("uid %d registered to name %s\n",(int)uid,unix_name));
 323
 324         DEBUG(3, ("Clearing default real name\n"));
 325         if ((pwfile=sys_getpwnam(vuser->user.unix_name))!= NULL) {
 326                 DEBUG(3, ("User name: %s\tReal name: %s\n",vuser->user.unix_name,pwfile->pw_gecos));
 327                 fstrcpy(vuser->user.full_name, pwfile->pw_gecos);
 328         }
 329
 330         if (!session_claim(vuser->vuid)) {
 331                 DEBUG(1,("Failed to claim session for vuid=%d\n", vuser->vuid));
 332                 invalidate_vuid(vuser->vuid);
 333                 return -1;
 334         }
 335
 336         return vuser->vuid;
 337 }
 338
 339
 340 /****************************************************************************
 341 add a name to the session users list
 342 ****************************************************************************/
 343 void add_session_user(char *user)
 344 {
 345   fstring suser;
 346   StrnCpy(suser,user,sizeof(suser)-1);
 347
 348   if (!Get_Pwnam(suser,True)) return;
 349
 350   if (suser && *suser && !in_list(suser,session_users,False))
 351     {
 352       if (strlen(suser) + strlen(session_users) + 2 >= sizeof(pstring))
 353         DEBUG(1,("Too many session users??\n"));
 354       else
 355         {
 356           pstrcat(session_users," ");
 357           pstrcat(session_users,suser);
 358         }
 359     }
 360 }
 361
 362
 363 /****************************************************************************
 364 update the encrypted smbpasswd file from the plaintext username and password
 365 *****************************************************************************/
 366 static BOOL update_smbpassword_file(char *user, char *password)
 367 {
 368         struct smb_passwd *smbpw;
 369         BOOL ret;
 370
 371         become_root();
 372         smbpw = getsmbpwnam(user);
 373         unbecome_root();
 374
 375         if(smbpw == NULL) {
 376                 DEBUG(0,("getsmbpwnam returned NULL\n"));
 377                 return False;
 378         }
 379
 380         /*
 381          * Remove the account disabled flag - we are updating the
 382          * users password from a login.
 383          */
 384         smbpw->acct_ctrl &= ~ACB_DISABLED;
 385
 386         /* Here, the flag is one, because we want to ignore the
 387            XXXXXXX'd out password */
 388         ret = change_oem_password( smbpw, password, True);
 389         if (ret == False) {
 390                 DEBUG(3,("change_oem_password returned False\n"));
 391         }
 392
 393         return ret;
 394 }
 395
 396
 397
 398
 399
 400 /****************************************************************************
 401 core of smb password checking routine.
 402 ****************************************************************************/
 403 BOOL smb_password_check(char *password, unsigned char *part_passwd, unsigned char *c8)
 404 {
 405   /* Finish the encryption of part_passwd. */
 406   unsigned char p21[21];
 407   unsigned char p24[24];
 408
 409   if (part_passwd == NULL)
 410     DEBUG(10,("No password set - allowing access\n"));
 411   /* No password set - always true ! */
 412   if (part_passwd == NULL)
 413     return 1;
 414
 415   memset(p21,'\0',21);
 416   memcpy(p21,part_passwd,16);
 417   E_P24(p21, c8, p24);
 418 #if DEBUG_PASSWORD
 419   {
 420     int i;
 421     DEBUG(100,("Part password (P16) was |"));
 422     for(i = 0; i < 16; i++)
 423       DEBUG(100,("%X ", (unsigned char)part_passwd[i]));
 424     DEBUG(100,("|\n"));
 425     DEBUG(100,("Password from client was |"));
 426     for(i = 0; i < 24; i++)
 427       DEBUG(100,("%X ", (unsigned char)password[i]));
 428     DEBUG(100,("|\n"));
 429     DEBUG(100,("Given challenge was |"));
 430     for(i = 0; i < 8; i++)
 431       DEBUG(100,("%X ", (unsigned char)c8[i]));
 432     DEBUG(100,("|\n"));
 433     DEBUG(100,("Value from encryption was |"));
 434     for(i = 0; i < 24; i++)
 435       DEBUG(100,("%X ", (unsigned char)p24[i]));
 436     DEBUG(100,("|\n"));
 437   }
 438 #endif
 439   return (memcmp(p24, password, 24) == 0);
 440 }
 441
 442 /****************************************************************************
 443  Do a specific test for an smb password being correct, given a smb_password and
 444  the lanman and NT responses.
 445 ****************************************************************************/
 446 BOOL smb_password_ok(struct smb_passwd *smb_pass, uchar chal[8],
 447                      uchar lm_pass[24], uchar nt_pass[24])
 448 {
 449         uchar challenge[8];
 450
 451         if (!lm_pass || !smb_pass) return(False);
 452
 453         DEBUG(4,("smb_password_ok: Checking SMB password for user %s\n",
 454                  smb_pass->smb_name));
 455
 456         if(smb_pass->acct_ctrl & ACB_DISABLED) {
 457                 DEBUG(1,("account for user %s was disabled.\n",
 458                          smb_pass->smb_name));
 459                 return(False);
 460         }
 461
 462         if (chal == NULL)
 463         {
 464                 DEBUG(5,("use last SMBnegprot challenge\n"));
 465                 if (!last_challenge(challenge))
 466                 {
 467                         DEBUG(1,("no challenge done - password failed\n"));
 468                         return False;
 469                 }
 470         }
 471         else
 472         {
 473                 DEBUG(5,("challenge received\n"));
 474                 memcpy(challenge, chal, 8);
 475         }
 476
 477         if ((Protocol >= PROTOCOL_NT1) && (smb_pass->smb_nt_passwd != NULL)) {
 478                 /* We have the NT MD4 hash challenge available - see if we can
 479                    use it (ie. does it exist in the smbpasswd file).
 480                 */
 481                 DEBUG(4,("smb_password_ok: Checking NT MD4 password\n"));
 482                 if (smb_password_check((char *)nt_pass,
 483                                        (uchar *)smb_pass->smb_nt_passwd,
 484                                        challenge)) {
 485                         DEBUG(4,("NT MD4 password check succeeded\n"));
 486                         return(True);
 487                 }
 488                 DEBUG(4,("NT MD4 password check failed\n"));
 489         }
 490
 491         /* Try against the lanman password. smb_pass->smb_passwd == NULL means
 492            no password, allow access. */
 493
 494         if((smb_pass->smb_passwd == NULL) &&
 495            (smb_pass->acct_ctrl & ACB_PWNOTREQ)) {
 496                 DEBUG(4,("smb_password_ok: no password required for user %s\n",
 497                          smb_pass->smb_name));
 498                 return True;
 499         }
 500
 501         if(lp_lanman_auth() && (smb_pass->smb_passwd != NULL)) {
 502                 DEBUG(4,("smb_password_ok: Checking LM password\n"));
 503
 504                 if (smb_password_check((char *)lm_pass,
 505                               (uchar *)smb_pass->smb_passwd, challenge)) {
 506                         DEBUG(4,("smb_password_ok: LM password check succeeded\n"));
 507                         return(True);
 508                 }
 509                 DEBUG(4,("LM password check failed\n"));
 510         }
 511
 512         return False;
 513 }
 514
 515
 516 /****************************************************************************
 517 check if a username/password is OK assuming the password is a 24 byte
 518 SMB hash
 519 return True if the password is correct, False otherwise
 520 ****************************************************************************/
 521
 522 BOOL pass_check_smb(char *user, char *domain,
 523                 uchar *chal, uchar *lm_pwd, uchar *nt_pwd,
 524                 struct passwd *pwd)
 525 {
 526         struct passwd *pass;
 527         struct smb_passwd *smb_pass;
 528
 529         if (!lm_pwd || !nt_pwd)
 530         {
 531                 return(False);
 532         }
 533
 534         if (pwd != NULL && user == NULL)
 535         {
 536                 pass = (struct passwd *) pwd;
 537                 user = pass->pw_name;
 538         }
 539         else
 540         {
 541                 pass = smb_getpwnam(user,True);
 542         }
 543
 544         if (pass == NULL)
 545         {
 546                 DEBUG(1,("Couldn't find user '%s' in UNIX password database.\n",user));
 547                 return(False);
 548         }
 549
 550         smb_pass = getsmbpwnam(user);
 551
 552         if (smb_pass == NULL)
 553         {
 554                 DEBUG(1,("Couldn't find user '%s' in smb_passwd file.\n", user));
 555                 return(False);
 556         }
 557
 558         /* Quit if the account was disabled. */
 559         if(smb_pass->acct_ctrl & ACB_DISABLED) {
 560                 DEBUG(1,("Account for user '%s' was disabled.\n", user));
 561                 return(False);
 562         }
 563
 564         /* Ensure the uid's match */
 565         if (smb_pass->smb_userid != pass->pw_uid)
 566         {
 567                 DEBUG(0,("Error : UNIX and SMB uids in password files do not match for user '%s'!\n", user));
 568                 return(False);
 569         }
 570
 571         if (smb_pass->acct_ctrl & ACB_PWNOTREQ) {
 572                 if (lp_null_passwords()) {
 573                         DEBUG(3,("Account for user '%s' has no password and null passwords are allowed.\n", smb_pass->smb_name));
 574                         return(True);
 575                 } else {
 576                         DEBUG(3,("Account for user '%s' has no password and null passwords are NOT allowed.\n", smb_pass->smb_name));
 577                         return(False);
 578                 }
 579         }
 580
 581         if (smb_password_ok(smb_pass, chal, lm_pwd, nt_pwd))
 582         {
 583                 return(True);
 584         }
 585
 586         DEBUG(2,("pass_check_smb failed - invalid password for user [%s]\n", user));
 587         return False;
 588 }
 589
 590 /****************************************************************************
 591 check if a username/password pair is OK either via the system password
 592 database or the encrypted SMB password database
 593 return True if the password is correct, False otherwise
 594 ****************************************************************************/
 595 BOOL password_ok(char *user, char *password, int pwlen, struct passwd *pwd)
 596 {
 597
 598         BOOL ret;
 599
 600         if ((pwlen == 0) && !lp_null_passwords()) {
 601                 DEBUG(4,("Null passwords not allowed.\n"));
 602                 return False;
 603         }
 604
 605         if (pwlen == 24 || (lp_encrypted_passwords() && (pwlen == 0) && lp_null_passwords())) {
 606                 /* if 24 bytes long assume it is an encrypted password */
 607                 uchar challenge[8];
 608
 609                 if (!last_challenge(challenge)) {
 610                         DEBUG(0,("Error: challenge not done for user=%s\n", user));
 611                         return False;
 612                 }
 613
 614                 ret = pass_check_smb(user, global_myworkgroup,
 615                                       challenge, (uchar *)password, (uchar *)password, pwd);
 616
 617                 /*
 618                  * Try with PAM (may not be compiled in - returns True if not. JRA).
 619                  * FIXME ! Should this be called if we're using winbindd ? What about
 620                  * non-local accounts ? JRA.
 621                  */
 622
 623                 if (ret)
 624                   return (smb_pam_accountcheck(user) == NT_STATUS_NOPROBLEMO);
 625
 626                 return ret;
 627         }
 628
 629         return (pass_check(user, password, pwlen, pwd,
 630                           lp_update_encrypted() ?
 631                           update_smbpassword_file : NULL));
 632 }
 633
 634 /****************************************************************************
 635 check if a username is valid
 636 ****************************************************************************/
 637 BOOL user_ok(char *user,int snum)
 638 {
 639         pstring valid, invalid;
 640         BOOL ret;
 641
 642         StrnCpy(valid, lp_valid_users(snum), sizeof(pstring)-1);
 643         StrnCpy(invalid, lp_invalid_users(snum), sizeof(pstring)-1);
 644
 645         pstring_sub(valid,"%S",lp_servicename(snum));
 646         pstring_sub(invalid,"%S",lp_servicename(snum));
 647
 648         ret = !user_in_list(user,invalid);
 649
 650         if (ret && valid && *valid) {
 651                 ret = user_in_list(user,valid);
 652         }
 653
 654         if (ret && lp_onlyuser(snum)) {
 655                 char *user_list = lp_username(snum);
 656                 pstring_sub(user_list,"%S",lp_servicename(snum));
 657                 ret = user_in_list(user,user_list);
 658         }
 659
 660         return(ret);
 661 }
 662
 663
 664
 665
 666 /****************************************************************************
 667 validate a group username entry. Return the username or NULL
 668 ****************************************************************************/
 669 static char *validate_group(char *group,char *password,int pwlen,int snum)
 670 {
 671 #ifdef HAVE_NETGROUP
 672         {
 673                 char *host, *user, *domain;
 674                 setnetgrent(group);
 675                 while (getnetgrent(&host, &user, &domain)) {
 676                         if (user) {
 677                                 if (user_ok(user, snum) &&
 678                                     password_ok(user,password,pwlen,NULL)) {
 679                                         endnetgrent();
 680                                         return(user);
 681                                 }
 682                         }
 683                 }
 684                 endnetgrent();
 685         }
 686 #endif
 687
 688 #ifdef HAVE_GETGRENT
 689         {
 690                 struct group *gptr;
 691                 setgrent();
 692                 while ((gptr = (struct group *)getgrent())) {
 693                         if (strequal(gptr->gr_name,group))
 694                                 break;
 695                 }
 696
 697                 /*
 698                  * As user_ok can recurse doing a getgrent(), we must
 699                  * copy the member list into a pstring on the stack before
 700                  * use. Bug pointed out by leon@eatworms.swmed.edu.
 701                  */
 702
 703                 if (gptr) {
 704                         pstring member_list;
 705                         char *member;
 706                         size_t copied_len = 0;
 707                         int i;
 708
 709                         *member_list = '\0';
 710                         member = member_list;
 711
 712                         for(i = 0; gptr->gr_mem && gptr->gr_mem[i]; i++) {
 713                                 size_t member_len = strlen(gptr->gr_mem[i]) + 1;
 714                                 if( copied_len + member_len < sizeof(pstring)) {
 715
 716                                         DEBUG(10,("validate_group: = gr_mem = %s\n", gptr->gr_mem[i]));
 717
 718                                         safe_strcpy(member, gptr->gr_mem[i], sizeof(pstring) - copied_len - 1);
 719                                         copied_len += member_len;
 720                                         member += copied_len;
 721                                 } else {
 722                                         *member = '\0';
 723                                 }
 724                         }
 725
 726                         endgrent();
 727
 728                         member = member_list;
 729                         while (*member) {
 730                                 static fstring name;
 731                                 fstrcpy(name,member);
 732                                 if (user_ok(name,snum) &&
 733                                     password_ok(name,password,pwlen,NULL)) {
 734                                         endgrent();
 735                                         return(&name[0]);
 736                                 }
 737
 738                                 DEBUG(10,("validate_group = member = %s\n", member));
 739
 740                                 member += strlen(member) + 1;
 741                         }
 742                 } else {
 743                         endgrent();
 744                         return NULL;
 745                 }
 746         }
 747 #endif
 748         return(NULL);
 749 }
 750
 751 /****************************************************************************
 752  Check for authority to login to a service with a given username/password.
 753  Note this is *NOT* used when logging on using sessionsetup_and_X.
 754 ****************************************************************************/
 755
 756 BOOL authorise_login(int snum,char *user,char *password, int pwlen,
 757                      BOOL *guest,BOOL *force,uint16 vuid)
 758 {
 759         BOOL ok = False;
 760         user_struct *vuser = get_valid_user_struct(vuid);
 761
 762 #if DEBUG_PASSWORD
 763         DEBUG(100,("authorise_login: checking authorisation on user=%s pass=%s\n",
 764                         user,password));
 765 #endif
 766
 767         *guest = False;
 768
 769         if (GUEST_ONLY(snum))
 770                 *force = True;
 771
 772         if (!GUEST_ONLY(snum) && (lp_security() > SEC_SHARE)) {
 773
 774                 /*
 775                  * We should just use the given vuid from a sessionsetup_and_X.
 776                  */
 777
 778                 if (!vuser) {
 779                         DEBUG(1,("authorise_login: refusing user %s with no session setup\n",
 780                                         user));
 781                         return False;
 782                 }
 783
 784                 if (!vuser->guest && user_ok(vuser->user.unix_name,snum)) {
 785                         fstrcpy(user,vuser->user.unix_name);
 786                         *guest = False;
 787                         DEBUG(3,("authorise_login: ACCEPTED: validated uid ok as non-guest \
 788 (user=%s)\n", user));
 789                         return True;
 790                 }
 791         }
 792
 793         /* there are several possibilities:
 794                 1) login as the given user with given password
 795                 2) login as a previously registered username with the given password
 796                 3) login as a session list username with the given password
 797                 4) login as a previously validated user/password pair
 798                 5) login as the "user =" user with given password
 799                 6) login as the "user =" user with no password (guest connection)
 800                 7) login as guest user with no password
 801
 802                 if the service is guest_only then steps 1 to 5 are skipped
 803         */
 804
 805         if (!(GUEST_ONLY(snum) && GUEST_OK(snum))) {
 806                 /* check the given username and password */
 807                 if (!ok && (*user) && user_ok(user,snum)) {
 808                         ok = password_ok(user,password, pwlen, NULL);
 809                         if (ok)
 810                                 DEBUG(3,("authorise_login: ACCEPTED: given username (%s) password ok\n",
 811                                                 user ));
 812                 }
 813
 814                 /* check for a previously registered guest username */
 815                 if (!ok && (vuser != 0) && vuser->guest) {
 816                         if (user_ok(vuser->user.unix_name,snum) &&
 817                                         password_ok(vuser->user.unix_name, password, pwlen, NULL)) {
 818                                 fstrcpy(user, vuser->user.unix_name);
 819                                 vuser->guest = False;
 820                                 DEBUG(3,("authorise_login: ACCEPTED: given password with registered user %s\n", user));
 821                                 ok = True;
 822                         }
 823                 }
 824
 825                 /* now check the list of session users */
 826                 if (!ok) {
 827                         char *auser;
 828                         char *user_list = strdup(session_users);
 829                         if (!user_list)
 830                                 return(False);
 831
 832                         for (auser=strtok(user_list,LIST_SEP); !ok && auser;
 833                                                                         auser = strtok(NULL,LIST_SEP)) {
 834                                 fstring user2;
 835                                 fstrcpy(user2,auser);
 836                                 if (!user_ok(user2,snum))
 837                                         continue;
 838
 839                                 if (password_ok(user2,password, pwlen, NULL)) {
 840                                         ok = True;
 841                                         fstrcpy(user,user2);
 842                                         DEBUG(3,("authorise_login: ACCEPTED: session list username (%s) \
 843 and given password ok\n", user));
 844                                 }
 845                         }
 846
 847                         free(user_list);
 848                 }
 849
 850                 /* check for a previously validated username/password pair */
 851                 if (!ok && (lp_security() > SEC_SHARE) && (vuser != 0) && !vuser->guest &&
 852                                                         user_ok(vuser->user.unix_name,snum)) {
 853                         fstrcpy(user,vuser->user.unix_name);
 854                         *guest = False;
 855                         DEBUG(3,("authorise_login: ACCEPTED: validated uid (%s) as non-guest\n",
 856                                 user));
 857                         ok = True;
 858                 }
 859
 860                 /* check for a rhosts entry */
 861                 if (!ok && user_ok(user,snum) && check_hosts_equiv(user)) {
 862                         ok = True;
 863                         DEBUG(3,("authorise_login: ACCEPTED: hosts equiv or rhosts entry for %s\n",
 864                                         user));
 865                 }
 866
 867                 /* check the user= fields and the given password */
 868                 if (!ok && lp_username(snum)) {
 869                         char *auser;
 870                         pstring user_list;
 871                         StrnCpy(user_list,lp_username(snum),sizeof(pstring));
 872
 873                         pstring_sub(user_list,"%S",lp_servicename(snum));
 874
 875                         for (auser=strtok(user_list,LIST_SEP); auser && !ok;
 876                                                                                         auser = strtok(NULL,LIST_SEP)) {
 877                                 if (*auser == '@') {
 878                                         auser = validate_group(auser+1,password,pwlen,snum);
 879                                         if (auser) {
 880                                                 ok = True;
 881                                                 fstrcpy(user,auser);
 882                                                 DEBUG(3,("authorise_login: ACCEPTED: group username \
 883 and given password ok (%s)\n", user));
 884                                         }
 885                                 } else {
 886                                         fstring user2;
 887                                         fstrcpy(user2,auser);
 888                                         if (user_ok(user2,snum) && password_ok(user2,password,pwlen,NULL)) {
 889                                                 ok = True;
 890                                                 fstrcpy(user,user2);
 891                                                 DEBUG(3,("authorise_login: ACCEPTED: user list username \
 892 and given password ok (%s)\n", user));
 893                                         }
 894                                 }
 895                         }
 896                 }
 897         } /* not guest only */
 898
 899         /* check for a normal guest connection */
 900         if (!ok && GUEST_OK(snum)) {
 901                 fstring guestname;
 902                 StrnCpy(guestname,lp_guestaccount(snum),sizeof(guestname)-1);
 903                 if (Get_Pwnam(guestname,True)) {
 904                         fstrcpy(user,guestname);
 905                         ok = True;
 906                         DEBUG(3,("authorise_login: ACCEPTED: guest account and guest ok (%s)\n",
 907                                         user));
 908                 } else {
 909                         DEBUG(0,("authorise_login: Invalid guest account %s??\n",guestname));
 910                 }
 911                 *guest = True;
 912         }
 913
 914         if (ok && !user_ok(user,snum)) {
 915                 DEBUG(0,("authorise_login: rejected invalid user %s\n",user));
 916                 ok = False;
 917         }
 918
 919         return(ok);
 920 }
 921
 922 /****************************************************************************
 923  Read the a hosts.equiv or .rhosts file and check if it
 924  allows this user from this machine.
 925 ****************************************************************************/
 926
 927 static BOOL check_user_equiv(char *user, char *remote, char *equiv_file)
 928 {
 929   int plus_allowed = 1;
 930   char *file_host;
 931   char *file_user;
 932   char **lines = file_lines_load(equiv_file, NULL, False);
 933   int i;
 934
 935   DEBUG(5, ("check_user_equiv %s %s %s\n", user, remote, equiv_file));
 936   if (! lines) return False;
 937   for (i=0; lines[i]; i++) {
 938     char *buf = lines[i];
 939     trim_string(buf," "," ");
 940
 941     if (buf[0] != '#' && buf[0] != '\n')
 942     {
 943       BOOL is_group = False;
 944       int plus = 1;
 945       char *bp = buf;
 946       if (strcmp(buf, "NO_PLUS\n") == 0)
 947       {
 948         DEBUG(6, ("check_user_equiv NO_PLUS\n"));
 949         plus_allowed = 0;
 950       }
 951       else {
 952         if (buf[0] == '+')
 953         {
 954           bp++;
 955           if (*bp == '\n' && plus_allowed)
 956           {
 957             /* a bare plus means everbody allowed */
 958             DEBUG(6, ("check_user_equiv everybody allowed\n"));
 959             file_lines_free(lines);
 960             return True;
 961           }
 962         }
 963         else if (buf[0] == '-')
 964         {
 965           bp++;
 966           plus = 0;
 967         }
 968         if (*bp == '@')
 969         {
 970           is_group = True;
 971           bp++;
 972         }
 973         file_host = strtok(bp, " \t\n");
 974         file_user = strtok(NULL, " \t\n");
 975         DEBUG(7, ("check_user_equiv %s %s\n", file_host ? file_host : "(null)",
 976                  file_user ? file_user : "(null)" ));
 977         if (file_host && *file_host)
 978         {
 979           BOOL host_ok = False;
 980
 981 #if defined(HAVE_NETGROUP) && defined(HAVE_YP_GET_DEFAULT_DOMAIN)
 982           if (is_group)
 983             {
 984               static char *mydomain = NULL;
 985               if (!mydomain)
 986                 yp_get_default_domain(&mydomain);
 987               if (mydomain && innetgr(file_host,remote,user,mydomain))
 988                 host_ok = True;
 989             }
 990 #else
 991           if (is_group)
 992             {
 993               DEBUG(1,("Netgroups not configured\n"));
 994               continue;
 995             }
 996 #endif
 997
 998           /* is it this host */
 999           /* the fact that remote has come from a call of gethostbyaddr
1000            * means that it may have the fully qualified domain name
1001            * so we could look up the file version to get it into
1002            * a canonical form, but I would rather just type it
1003            * in full in the equiv file
1004            */
1005           if (!host_ok && !is_group && strequal(remote, file_host))
1006             host_ok = True;
1007
1008           if (!host_ok)
1009             continue;
1010
1011           /* is it this user */
1012           if (file_user == 0 || strequal(user, file_user))
1013             {
1014               DEBUG(5, ("check_user_equiv matched %s%s %s\n",
1015                         (plus ? "+" : "-"), file_host,
1016                         (file_user ? file_user : "")));
1017               file_lines_free(lines);
1018               return (plus ? True : False);
1019             }
1020         }
1021       }
1022     }
1023   }
1024   file_lines_free(lines);
1025   return False;
1026 }
1027
1028
1029 /****************************************************************************
1030 check for a possible hosts equiv or rhosts entry for the user
1031 ****************************************************************************/
1032 BOOL check_hosts_equiv(char *user)
1033 {
1034   char *fname = NULL;
1035   pstring rhostsfile;
1036   struct passwd *pass = Get_Pwnam(user,True);
1037
1038   if (!pass)
1039     return(False);
1040
1041   fname = lp_hosts_equiv();
1042
1043   /* note: don't allow hosts.equiv on root */
1044   if (fname && *fname && (pass->pw_uid != 0)) {
1045           if (check_user_equiv(user,client_name(),fname))
1046                   return(True);
1047   }
1048
1049   if (lp_use_rhosts())
1050     {
1051       char *home = get_user_home_dir(user);
1052       if (home) {
1053               slprintf(rhostsfile, sizeof(rhostsfile)-1, "%s/.rhosts", home);
1054               if (check_user_equiv(user,client_name(),rhostsfile))
1055                       return(True);
1056       }
1057     }
1058
1059   return(False);
1060 }
1061
1062
1063 /****************************************************************************
1064  Return the client state structure.
1065 ****************************************************************************/
1066
1067 struct cli_state *server_client(void)
1068 {
1069         static struct cli_state pw_cli;
1070         return &pw_cli;
1071 }
1072
1073 /****************************************************************************
1074  Support for server level security.
1075 ****************************************************************************/
1076
1077 struct cli_state *server_cryptkey(void)
1078 {
1079         struct cli_state *cli;
1080         fstring desthost;
1081         struct in_addr dest_ip;
1082         char *p, *pserver;
1083         BOOL connected_ok = False;
1084
1085         cli = server_client();
1086
1087         if (!cli_initialise(cli))
1088                 return NULL;
1089
1090         pserver = strdup(lp_passwordserver());
1091         p = pserver;
1092
1093         while(next_token( &p, desthost, LIST_SEP, sizeof(desthost))) {
1094                 standard_sub_basic(desthost);
1095                 strupper(desthost);
1096
1097                 if(!resolve_name( desthost, &dest_ip, 0x20)) {
1098                         DEBUG(1,("server_cryptkey: Can't resolve address for %s\n",desthost));
1099                         continue;
1100                 }
1101
1102                 if (ismyip(dest_ip)) {
1103                         DEBUG(1,("Password server loop - disabling password server %s\n",desthost));
1104                         continue;
1105                 }
1106
1107                 if (cli_connect(cli, desthost, &dest_ip)) {
1108                         DEBUG(3,("connected to password server %s\n",desthost));
1109                         connected_ok = True;
1110                         break;
1111                 }
1112         }
1113
1114         free(pserver);
1115
1116         if (!connected_ok) {
1117                 DEBUG(0,("password server not available\n"));
1118                 cli_shutdown(cli);
1119                 return NULL;
1120         }
1121
1122         if (!attempt_netbios_session_request(cli, global_myname, desthost, &dest_ip))
1123                 return NULL;
1124
1125         DEBUG(3,("got session\n"));
1126
1127         if (!cli_negprot(cli)) {
1128                 DEBUG(1,("%s rejected the negprot\n",desthost));
1129                 cli_shutdown(cli);
1130                 return NULL;
1131         }
1132
1133         if (cli->protocol < PROTOCOL_LANMAN2 ||
1134             !(cli->sec_mode & 1)) {
1135                 DEBUG(1,("%s isn't in user level security mode\n",desthost));
1136                 cli_shutdown(cli);
1137                 return NULL;
1138         }
1139
1140         DEBUG(3,("password server OK\n"));
1141
1142         return cli;
1143 }
1144
1145 /****************************************************************************
1146  Validate a password with the password server.
1147 ****************************************************************************/
1148
1149 BOOL server_validate(char *user, char *domain,
1150                      char *pass, int passlen,
1151                      char *ntpass, int ntpasslen)
1152 {
1153         struct cli_state *cli;
1154         static unsigned char badpass[24];
1155         static fstring baduser;
1156         static BOOL tested_password_server = False;
1157         static BOOL bad_password_server = False;
1158
1159         cli = server_client();
1160
1161         if (!cli->initialised) {
1162                 DEBUG(1,("password server %s is not connected\n", cli->desthost));
1163                 return(False);
1164         }
1165
1166         if(badpass[0] == 0)
1167                 memset(badpass, 0x1f, sizeof(badpass));
1168
1169         if((passlen == sizeof(badpass)) && !memcmp(badpass, pass, passlen)) {
1170                 /*
1171                  * Very unlikely, our random bad password is the same as the users
1172                  * password.
1173                  */
1174                 memset(badpass, badpass[0]+1, sizeof(badpass));
1175         }
1176
1177         if(baduser[0] == 0) {
1178                 fstrcpy(baduser, INVALID_USER_PREFIX);
1179                 fstrcat(baduser, global_myname);
1180         }
1181
1182         /*
1183          * Attempt a session setup with a totally incorrect password.
1184          * If this succeeds with the guest bit *NOT* set then the password
1185          * server is broken and is not correctly setting the guest bit. We
1186          * need to detect this as some versions of NT4.x are broken. JRA.
1187          */
1188
1189         if(!tested_password_server) {
1190                 if (cli_session_setup(cli, baduser, (char *)badpass, sizeof(badpass),
1191                                         (char *)badpass, sizeof(badpass), domain)) {
1192
1193                         /*
1194                          * We connected to the password server so we
1195                          * can say we've tested it.
1196                          */
1197                         tested_password_server = True;
1198
1199                         if ((SVAL(cli->inbuf,smb_vwv2) & 1) == 0) {
1200                                 DEBUG(0,("server_validate: password server %s allows users as non-guest \
1201 with a bad password.\n", cli->desthost));
1202                                 DEBUG(0,("server_validate: This is broken (and insecure) behaviour. Please do not \
1203 use this machine as the password server.\n"));
1204                                 cli_ulogoff(cli);
1205
1206                                 /*
1207                                  * Password server has the bug.
1208                                  */
1209                                 bad_password_server = True;
1210                                 return False;
1211                         }
1212                         cli_ulogoff(cli);
1213                 }
1214         } else {
1215
1216                 /*
1217                  * We have already tested the password server.
1218                  * Fail immediately if it has the bug.
1219                  */
1220
1221                 if(bad_password_server) {
1222                         DEBUG(0,("server_validate: [1] password server %s allows users as non-guest \
1223 with a bad password.\n", cli->desthost));
1224                         DEBUG(0,("server_validate: [1] This is broken (and insecure) behaviour. Please do not \
1225 use this machine as the password server.\n"));
1226                         return False;
1227                 }
1228         }
1229
1230         /*
1231          * Now we know the password server will correctly set the guest bit, or is
1232          * not guest enabled, we can try with the real password.
1233          */
1234
1235         if (!cli_session_setup(cli, user, pass, passlen, ntpass, ntpasslen, domain)) {
1236                 DEBUG(1,("password server %s rejected the password\n", cli->desthost));
1237                 return False;
1238         }
1239
1240         /* if logged in as guest then reject */
1241         if ((SVAL(cli->inbuf,smb_vwv2) & 1) != 0) {
1242                 DEBUG(1,("password server %s gave us guest only\n", cli->desthost));
1243                 cli_ulogoff(cli);
1244                 return(False);
1245         }
1246
1247         cli_ulogoff(cli);
1248
1249         return(True);
1250 }
1251
1252 /***********************************************************************
1253  Connect to a remote machine for domain security authentication
1254  given a name or IP address.
1255 ************************************************************************/
1256
1257 static BOOL connect_to_domain_password_server(struct cli_state *pcli,
1258                                                                 char *server, unsigned char *trust_passwd)
1259 {
1260   struct in_addr dest_ip;
1261   fstring remote_machine;
1262
1263   if(!cli_initialise(pcli)) {
1264     DEBUG(0,("connect_to_domain_password_server: unable to initialize client connection.\n"));
1265     return False;
1266   }
1267
1268   if (is_ipaddress(server)) {
1269           struct in_addr to_ip;
1270
1271           /* we shouldn't have 255.255.255.255 forthe IP address of
1272              a password server anyways */
1273           if ((to_ip.s_addr=inet_addr(server)) == 0xFFFFFFFF) {
1274                 DEBUG (0,("connect_to_domain_password_server: inet_addr(%s) returned 0xFFFFFFFF!\n", server));
1275                 return False;
1276           }
1277
1278           if (!name_status_find(0x20, to_ip, remote_machine)) {
1279                   DEBUG(1, ("connect_to_domain_password_server: Can't "
1280                             "resolve name for IP %s\n", server));
1281                   return False;
1282           }
1283   } else {
1284           fstrcpy(remote_machine, server);
1285   }
1286
1287   standard_sub_basic(remote_machine);
1288   strupper(remote_machine);
1289
1290   if(!resolve_name( remote_machine, &dest_ip, 0x20)) {
1291     DEBUG(1,("connect_to_domain_password_server: Can't resolve address for %s\n", remote_machine));
1292     cli_shutdown(pcli);
1293     return False;
1294   }
1295
1296   if (ismyip(dest_ip)) {
1297     DEBUG(1,("connect_to_domain_password_server: Password server loop - not using password server %s\n",
1298          remote_machine));
1299     cli_shutdown(pcli);
1300     return False;
1301   }
1302
1303   if (!cli_connect(pcli, remote_machine, &dest_ip)) {
1304     DEBUG(0,("connect_to_domain_password_server: unable to connect to SMB server on \
1305 machine %s. Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
1306     cli_shutdown(pcli);
1307     return False;
1308   }
1309
1310   if (!attempt_netbios_session_request(pcli, global_myname, remote_machine, &dest_ip)) {
1311     DEBUG(0,("connect_to_password_server: machine %s rejected the NetBIOS \
1312 session request. Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
1313     return False;
1314   }
1315
1316   pcli->protocol = PROTOCOL_NT1;
1317
1318   if (!cli_negprot(pcli)) {
1319     DEBUG(0,("connect_to_domain_password_server: machine %s rejected the negotiate protocol. \
1320 Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
1321     cli_shutdown(pcli);
1322     return False;
1323   }
1324
1325   if (pcli->protocol != PROTOCOL_NT1) {
1326     DEBUG(0,("connect_to_domain_password_server: machine %s didn't negotiate NT protocol.\n",
1327                    remote_machine));
1328     cli_shutdown(pcli);
1329     return False;
1330   }
1331
1332   /*
1333    * Do an anonymous session setup.
1334    */
1335
1336   if (!cli_session_setup(pcli, "", "", 0, "", 0, "")) {
1337     DEBUG(0,("connect_to_domain_password_server: machine %s rejected the session setup. \
1338 Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
1339     cli_shutdown(pcli);
1340     return False;
1341   }
1342
1343   if (!(pcli->sec_mode & 1)) {
1344     DEBUG(1,("connect_to_domain_password_server: machine %s isn't in user level security mode\n",
1345                remote_machine));
1346     cli_shutdown(pcli);
1347     return False;
1348   }
1349
1350   if (!cli_send_tconX(pcli, "IPC$", "IPC", "", 1)) {
1351     DEBUG(0,("connect_to_domain_password_server: machine %s rejected the tconX on the IPC$ share. \
1352 Error was : %s.\n", remote_machine, cli_errstr(pcli) ));
1353     cli_shutdown(pcli);
1354     return False;
1355   }
1356
1357   /*
1358    * We now have an anonymous connection to IPC$ on the domain password server.
1359    */
1360
1361   /*
1362    * Even if the connect succeeds we need to setup the netlogon
1363    * pipe here. We do this as we may just have changed the domain
1364    * account password on the PDC and yet we may be talking to
1365    * a BDC that doesn't have this replicated yet. In this case
1366    * a successful connect to a DC needs to take the netlogon connect
1367    * into account also. This patch from "Bjart Kvarme" <bjart.kvarme@usit.uio.no>.
1368    */
1369
1370   if(cli_nt_session_open(pcli, PIPE_NETLOGON) == False) {
1371     DEBUG(0,("connect_to_domain_password_server: unable to open the domain client session to \
1372 machine %s. Error was : %s.\n", remote_machine, cli_errstr(pcli)));
1373     cli_nt_session_close(pcli);
1374     cli_ulogoff(pcli);
1375     cli_shutdown(pcli);
1376     return False;
1377   }
1378
1379   if (cli_nt_setup_creds(pcli, trust_passwd) == False) {
1380     DEBUG(0,("connect_to_domain_password_server: unable to setup the PDC credentials to machine \
1381 %s. Error was : %s.\n", remote_machine, cli_errstr(pcli)));
1382     cli_nt_session_close(pcli);
1383     cli_ulogoff(pcli);
1384     cli_shutdown(pcli);
1385     return(False);
1386   }
1387
1388   return True;
1389 }
1390
1391 /***********************************************************************
1392  Utility function to attempt a connection to an IP address of a DC.
1393 ************************************************************************/
1394
1395 static BOOL attempt_connect_to_dc(struct cli_state *pcli, struct in_addr *ip, unsigned char *trust_passwd)
1396 {
1397   fstring dc_name;
1398
1399   /*
1400    * Ignore addresses we have already tried.
1401    */
1402
1403   if (ip_equal(ipzero, *ip))
1404           return False;
1405
1406   if (!lookup_pdc_name(global_myname, lp_workgroup(), ip, dc_name))
1407           return False;
1408
1409   return connect_to_domain_password_server(pcli, dc_name, trust_passwd);
1410 }
1411
1412
1413
1414 /***********************************************************************
1415  We have been asked to dynamcially determine the IP addresses of
1416  the PDC and BDC's for this DOMAIN, and query them in turn.
1417 ************************************************************************/
1418 static BOOL find_connect_pdc(struct cli_state *pcli, unsigned char *trust_passwd, time_t last_change_time)
1419 {
1420         struct in_addr *ip_list = NULL;
1421         int count = 0;
1422         int i;
1423         BOOL connected_ok = False;
1424         time_t time_now = time(NULL);
1425         BOOL use_pdc_only = False;
1426
1427         /*
1428          * If the time the machine password has changed
1429          * was less than an hour ago then we need to contact
1430          * the PDC only, as we cannot be sure domain replication
1431          * has yet taken place. Bug found by Gerald (way to go
1432          * Gerald !). JRA.
1433          */
1434
1435         if (time_now - last_change_time < 3600)
1436                 use_pdc_only = True;
1437
1438         if (!get_dc_list(use_pdc_only, lp_workgroup(), &ip_list, &count))
1439                 return False;
1440
1441         /*
1442          * Firstly try and contact a PDC/BDC who has the same
1443          * network address as any of our interfaces.
1444          */
1445         for(i = 0; i < count; i++) {
1446                 if(!is_local_net(ip_list[i]))
1447                         continue;
1448
1449                 if((connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
1450                         break;
1451
1452                 ip_list[i] = ipzero; /* Tried and failed. */
1453         }
1454
1455         /*
1456          * Secondly try and contact a random PDC/BDC.
1457          */
1458         if(!connected_ok) {
1459                 i = (sys_random() % count);
1460
1461                 if (!(connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
1462                         ip_list[i] = ipzero; /* Tried and failed. */
1463         }
1464
1465         /*
1466          * Finally go through the IP list in turn, ignoring any addresses
1467          * we have already tried.
1468          */
1469         if(!connected_ok) {
1470                 /*
1471                  * Try and connect to any of the other IP addresses in the PDC/BDC list.
1472                  * Note that from a WINS server the #1 IP address is the PDC.
1473                  */
1474                 for(i = 0; i < count; i++) {
1475                         if((connected_ok = attempt_connect_to_dc(pcli, &ip_list[i], trust_passwd)))
1476                                 break;
1477                 }
1478         }
1479
1480         if(ip_list != NULL)
1481                 free((char *)ip_list);
1482
1483
1484         return connected_ok;
1485 }
1486
1487
1488
1489 /***********************************************************************
1490  Do the same as security=server, but using NT Domain calls and a session
1491  key from the machine password.
1492 ************************************************************************/
1493
1494 BOOL domain_client_validate( char *user, char *domain,
1495                              char *smb_apasswd, int smb_apasslen,
1496                              char *smb_ntpasswd, int smb_ntpasslen,
1497                              BOOL *user_exists)
1498 {
1499   unsigned char local_challenge[8];
1500   unsigned char local_lm_response[24];
1501   unsigned char local_nt_response[24];
1502   unsigned char trust_passwd[16];
1503   fstring remote_machine;
1504   char *p, *pserver;
1505   NET_ID_INFO_CTR ctr;
1506   NET_USER_INFO_3 info3;
1507   struct cli_state cli;
1508   uint32 smb_uid_low;
1509   BOOL connected_ok = False;
1510   time_t last_change_time;
1511
1512   if(user_exists != NULL)
1513     *user_exists = True; /* Only set false on a very specific error. */
1514
1515   /*
1516    * Check that the requested domain is not our own machine name.
1517    * If it is, we should never check the PDC here, we use our own local
1518    * password file.
1519    */
1520
1521   if(strequal( domain, global_myname)) {
1522     DEBUG(3,("domain_client_validate: Requested domain was for this machine.\n"));
1523     return False;
1524   }
1525
1526   /*
1527    * Next, check that the passwords given were encrypted.
1528    */
1529
1530   if(((smb_apasslen != 24) && (smb_apasslen != 0)) ||
1531      ((smb_ntpasslen != 24) && (smb_ntpasslen != 0))) {
1532
1533     /*
1534      * Not encrypted - do so.
1535      */
1536
1537     DEBUG(3,("domain_client_validate: User passwords not in encrypted format.\n"));
1538     generate_random_buffer( local_challenge, 8, False);
1539     SMBencrypt( (uchar *)smb_apasswd, local_challenge, local_lm_response);
1540     SMBNTencrypt((uchar *)smb_ntpasswd, local_challenge, local_nt_response);
1541     smb_apasslen = 24;
1542     smb_ntpasslen = 24;
1543     smb_apasswd = (char *)local_lm_response;
1544     smb_ntpasswd = (char *)local_nt_response;
1545   } else {
1546
1547     /*
1548      * Encrypted - get the challenge we sent for these
1549      * responses.
1550      */
1551
1552     if (!last_challenge(local_challenge)) {
1553       DEBUG(0,("domain_client_validate: no challenge done - password failed\n"));
1554       return False;
1555     }
1556   }
1557
1558   /*
1559    * Get the machine account password for our primary domain
1560    */
1561   if (!secrets_fetch_trust_account_password(global_myworkgroup, trust_passwd, &last_change_time))
1562   {
1563           DEBUG(0, ("domain_client_validate: could not fetch trust account password for domain %s\n", global_myworkgroup));
1564           return False;
1565   }
1566
1567   /*
1568    * At this point, smb_apasswd points to the lanman response to
1569    * the challenge in local_challenge, and smb_ntpasswd points to
1570    * the NT response to the challenge in local_challenge. Ship
1571    * these over the secure channel to a domain controller and
1572    * see if they were valid.
1573    */
1574
1575   ZERO_STRUCT(cli);
1576
1577   /*
1578    * Treat each name in the 'password server =' line as a potential
1579    * PDC/BDC. Contact each in turn and try and authenticate.
1580    */
1581
1582   pserver = lp_passwordserver();
1583   if (! *pserver) pserver = "*";
1584   p = pserver;
1585
1586   while (!connected_ok &&
1587          next_token(&p,remote_machine,LIST_SEP,sizeof(remote_machine))) {
1588           if(strequal(remote_machine, "*")) {
1589                   connected_ok = find_connect_pdc(&cli, trust_passwd, last_change_time);
1590           } else {
1591                   connected_ok = connect_to_domain_password_server(&cli, remote_machine, trust_passwd);
1592           }
1593   }
1594
1595   if (!connected_ok) {
1596     DEBUG(0,("domain_client_validate: Domain password server not available.\n"));
1597     cli_shutdown(&cli);
1598     return False;
1599   }
1600
1601   /* We really don't care what LUID we give the user. */
1602   generate_random_buffer( (unsigned char *)&smb_uid_low, 4, False);
1603
1604   ZERO_STRUCT(info3);
1605
1606   if(cli_nt_login_network(&cli, domain, user, smb_uid_low, (char *)local_challenge,
1607                           ((smb_apasslen != 0) ? smb_apasswd : NULL),
1608                           ((smb_ntpasslen != 0) ? smb_ntpasswd : NULL),
1609                           &ctr, &info3) == False) {
1610     uint32 nt_rpc_err;
1611
1612     cli_error(&cli, NULL, NULL, &nt_rpc_err);
1613     DEBUG(0,("domain_client_validate: unable to validate password for user %s in domain \
1614 %s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli)));
1615     cli_nt_session_close(&cli);
1616     cli_ulogoff(&cli);
1617     cli_shutdown(&cli);
1618
1619     if((nt_rpc_err == NT_STATUS_NO_SUCH_USER) && (user_exists != NULL))
1620       *user_exists = False;
1621
1622     return False;
1623   }
1624
1625   /*
1626    * Here, if we really want it, we have lots of info about the user in info3.
1627    */
1628
1629 #if 0
1630   /*
1631    * We don't actually need to do this - plus it fails currently with
1632    * NT_STATUS_INVALID_INFO_CLASS - we need to know *exactly* what to
1633    * send here. JRA.
1634    */
1635
1636   if(cli_nt_logoff(&cli, &ctr) == False) {
1637     DEBUG(0,("domain_client_validate: unable to log off user %s in domain \
1638 %s to Domain controller %s. Error was %s.\n", user, domain, remote_machine, cli_errstr(&cli)));
1639     cli_nt_session_close(&cli);
1640     cli_ulogoff(&cli);
1641     cli_shutdown(&cli);
1642     return False;
1643   }
1644 #endif /* 0 */
1645
1646   /* Note - once the cli stream is shutdown the mem_ctx used
1647    to allocate the other_sids and gids structures has been deleted - so
1648    these pointers are no longer valid..... */
1649
1650   cli_nt_session_close(&cli);
1651   cli_ulogoff(&cli);
1652   cli_shutdown(&cli);
1653   return True;
1654 }