?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
tevent: expose tevent_context_init_ops
[Samba/gebeck_regimport.git] / source3 / libnet / libnet_dssync_passdb.c
blobb56c2d4451bba2cd4368f066933a726ace006ee0
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Guenther Deschner <gd@samba.org> 2008
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "system/passwd.h"
22 #include "libnet/libnet_dssync.h"
23 #include "../libcli/security/security.h"
24 #include "../libds/common/flags.h"
25 #include "../librpc/gen_ndr/ndr_drsuapi.h"
26 #include "util_tdb.h"
27 #include "dbwrap/dbwrap.h"
28 #include "dbwrap/dbwrap_rbt.h"
29 #include "../libds/common/flag_mapping.h"
30 #include "passdb.h"
31
32 /****************************************************************
33 ****************************************************************/
34
35 struct dssync_passdb {
36 struct pdb_methods *methods;
37 struct db_context *all;
38 struct db_context *aliases;
39 struct db_context *groups;
40 };
41
42 struct dssync_passdb_obj {
43 struct dssync_passdb_obj *self;
44 uint32_t type;
45 struct drsuapi_DsReplicaObjectListItemEx *cur;
46 TDB_DATA key;
47 TDB_DATA data;
48 struct db_context *members;
49 };
50
51 struct dssync_passdb_mem {
52 struct dssync_passdb_mem *self;
53 bool active;
54 struct drsuapi_DsReplicaObjectIdentifier3 *cur;
55 struct dssync_passdb_obj *obj;
56 TDB_DATA key;
57 TDB_DATA data;
58 };
59
60 static NTSTATUS dssync_insert_obj(struct dssync_passdb *pctx,
61 struct db_context *db,
62 struct dssync_passdb_obj *obj)
63 {
64 NTSTATUS status;
65 struct db_record *rec;
66 TDB_DATA value;
67
68 rec = dbwrap_fetch_locked(db, talloc_tos(), obj->key);
69 if (rec == NULL) {
70 return NT_STATUS_NO_MEMORY;
71 }
72
73 value = dbwrap_record_get_value(rec);
74 if (value.dsize != 0) {
75 abort();
76 }
77
78 status = dbwrap_record_store(rec, obj->data, TDB_INSERT);
79 if (!NT_STATUS_IS_OK(status)) {
80 TALLOC_FREE(rec);
81 return status;
82 }
83 TALLOC_FREE(rec);
84 return NT_STATUS_OK;
85 }
86
87 static struct dssync_passdb_obj *dssync_parse_obj(const TDB_DATA data)
88 {
89 struct dssync_passdb_obj *obj;
90
91 if (data.dsize != sizeof(obj)) {
92 return NULL;
93 }
94
95 /*
96 * we need to copy the pointer to avoid alignment problems
97 * on some systems.
98 */
99 memcpy(&obj, data.dptr, sizeof(obj));
100
101 return talloc_get_type_abort(obj, struct dssync_passdb_obj);
102 }
103
104 static struct dssync_passdb_obj *dssync_search_obj_by_guid(struct dssync_passdb *pctx,
105 struct db_context *db,
106 const struct GUID *guid)
107 {
108 struct dssync_passdb_obj *obj;
109 TDB_DATA key;
110 TDB_DATA data;
111 NTSTATUS status;
112
113 key = make_tdb_data((const uint8_t *)(const void *)guid,
114 sizeof(*guid));
115
116 status = dbwrap_fetch(db, talloc_tos(), key, &data);
117 if (!NT_STATUS_IS_OK(status)) {
118 return NULL;
119 }
120
121 obj = dssync_parse_obj(data);
122 return obj;
123 }
124
125 static NTSTATUS dssync_create_obj(struct dssync_passdb *pctx,
126 struct db_context *db,
127 uint32_t type,
128 struct drsuapi_DsReplicaObjectListItemEx *cur,
129 struct dssync_passdb_obj **_obj)
130 {
131 NTSTATUS status;
132 struct dssync_passdb_obj *obj;
133
134 obj = talloc_zero(pctx, struct dssync_passdb_obj);
135 if (obj == NULL) {
136 return NT_STATUS_NO_MEMORY;
137 }
138 obj->self = obj;
139 obj->cur = cur;
140 obj->type = type;
141 obj->key = make_tdb_data((const uint8_t *)(void *)&cur->object.identifier->guid,
142 sizeof(cur->object.identifier->guid));
143 obj->data = make_tdb_data((const uint8_t *)(void *)&obj->self,
144 sizeof(obj->self));
145
146 obj->members = db_open_rbt(obj);
147 if (obj->members == NULL) {
148 return NT_STATUS_NO_MEMORY;
149 }
150
151 status = dssync_insert_obj(pctx, db, obj);
152 if (!NT_STATUS_IS_OK(status)) {
153 TALLOC_FREE(obj);
154 return status;
155 }
156 *_obj = obj;
157 return NT_STATUS_OK;
158 }
159
160 static NTSTATUS dssync_insert_mem(struct dssync_passdb *pctx,
161 struct dssync_passdb_obj *obj,
162 struct dssync_passdb_mem *mem)
163 {
164 NTSTATUS status;
165 struct db_record *rec;
166 TDB_DATA value;
167
168 rec = dbwrap_fetch_locked(obj->members, talloc_tos(), mem->key);
169 if (rec == NULL) {
170 return NT_STATUS_NO_MEMORY;
171 }
172
173 value = dbwrap_record_get_value(rec);
174 if (value.dsize != 0) {
175 abort();
176 }
177
178 status = dbwrap_record_store(rec, mem->data, TDB_INSERT);
179 if (!NT_STATUS_IS_OK(status)) {
180 TALLOC_FREE(rec);
181 return status;
182 }
183 TALLOC_FREE(rec);
184 return NT_STATUS_OK;
185 }
186
187 static NTSTATUS dssync_create_mem(struct dssync_passdb *pctx,
188 struct dssync_passdb_obj *obj,
189 bool active,
190 struct drsuapi_DsReplicaObjectIdentifier3 *cur,
191 struct dssync_passdb_mem **_mem)
192 {
193 NTSTATUS status;
194 struct dssync_passdb_mem *mem;
195
196 mem = talloc_zero(pctx, struct dssync_passdb_mem);
197 if (mem == NULL) {
198 return NT_STATUS_NO_MEMORY;
199 }
200 mem->self = mem;
201 mem->cur = cur;
202 mem->active = active;
203 mem->obj = NULL;
204 mem->key = make_tdb_data((const uint8_t *)(void *)&cur->guid,
205 sizeof(cur->guid));
206 mem->data = make_tdb_data((const uint8_t *)(void *)&mem->self,
207 sizeof(mem->self));
208
209 status = dssync_insert_mem(pctx, obj, mem);
210 if (!NT_STATUS_IS_OK(status)) {
211 TALLOC_FREE(obj);
212 return status;
213 }
214 *_mem = mem;
215 return NT_STATUS_OK;
216 }
217
218 static struct dssync_passdb_mem *dssync_parse_mem(const TDB_DATA data)
219 {
220 struct dssync_passdb_mem *mem;
221
222 if (data.dsize != sizeof(mem)) {
223 return NULL;
224 }
225
226 /*
227 * we need to copy the pointer to avoid alignment problems
228 * on some systems.
229 */
230 memcpy(&mem, data.dptr, sizeof(mem));
231
232 return talloc_get_type_abort(mem, struct dssync_passdb_mem);
233 }
234
235 static NTSTATUS passdb_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
236 struct replUpToDateVectorBlob **pold_utdv)
237 {
238 NTSTATUS status;
239 struct dssync_passdb *pctx;
240
241 pctx = talloc_zero(mem_ctx, struct dssync_passdb);
242 if (pctx == NULL) {
243 return NT_STATUS_NO_MEMORY;
244 }
245
246 if (ctx->output_filename) {
247 status = make_pdb_method_name(&pctx->methods, ctx->output_filename);
248 } else {
249 status = make_pdb_method_name(&pctx->methods, lp_passdb_backend());
250 }
251
252 if (!NT_STATUS_IS_OK(status)) {
253 return status;
254 }
255
256 pctx->all = db_open_rbt(pctx);
257 if (pctx->all == NULL) {
258 return NT_STATUS_NO_MEMORY;
259 }
260 pctx->aliases = db_open_rbt(pctx);
261 if (pctx->aliases == NULL) {
262 return NT_STATUS_NO_MEMORY;
263 }
264 pctx->groups = db_open_rbt(pctx);
265 if (pctx->groups == NULL) {
266 return NT_STATUS_NO_MEMORY;
267 }
268
269 ctx->private_data = pctx;
270
271 return status;
272 }
273
274 /****************************************************************
275 ****************************************************************/
276
277 struct dssync_passdb_traverse_amembers {
278 struct dssync_context *ctx;
279 struct dssync_passdb_obj *obj;
280 const char *name;
281 uint32_t idx;
282 };
283
284 struct dssync_passdb_traverse_aliases {
285 struct dssync_context *ctx;
286 const char *name;
287 uint32_t idx;
288 };
289
290 static int dssync_passdb_traverse_amembers(struct db_record *rec,
291 void *private_data)
292 {
293 struct dssync_passdb_traverse_amembers *state =
294 (struct dssync_passdb_traverse_amembers *)private_data;
295 struct dssync_passdb *pctx =
296 talloc_get_type_abort(state->ctx->private_data,
297 struct dssync_passdb);
298 struct dssync_passdb_mem *mem;
299 NTSTATUS status;
300 struct dom_sid alias_sid;
301 struct dom_sid member_sid;
302 const char *member_dn;
303 size_t num_members;
304 size_t i;
305 struct dom_sid *members;
306 bool is_member = false;
307 const char *action;
308 TDB_DATA value;
309
310 state->idx++;
311
312 alias_sid = state->obj->cur->object.identifier->sid;
313
314 value = dbwrap_record_get_value(rec);
315 mem = dssync_parse_mem(value);
316 if (mem == NULL) {
317 return -1;
318 }
319
320 member_sid = mem->cur->sid;
321 member_dn = mem->cur->dn;
322
323 mem->obj = dssync_search_obj_by_guid(pctx, pctx->all, &mem->cur->guid);
324 if (mem->obj == NULL) {
325 DEBUG(0,("alias[%s] member[%s] can't resolve member - ignoring\n",
326 sid_string_dbg(&alias_sid),
327 is_null_sid(&member_sid)?
328 sid_string_dbg(&member_sid):
329 member_dn));
330 return 0;
331 }
332
333 switch (mem->obj->type) {
334 case ATYPE_DISTRIBUTION_LOCAL_GROUP:
335 case ATYPE_DISTRIBUTION_GLOBAL_GROUP:
336 DEBUG(0, ("alias[%s] ignore distribution group [%s]\n",
337 sid_string_dbg(&alias_sid),
338 member_dn));
339 return 0;
340 default:
341 break;
342 }
343
344 DEBUG(0,("alias[%s] member[%s]\n",
345 sid_string_dbg(&alias_sid),
346 sid_string_dbg(&member_sid)));
347
348 status = pdb_enum_aliasmem(&alias_sid, talloc_tos(),
349 &members, &num_members);
350 if (!NT_STATUS_IS_OK(status)) {
351 DEBUG(0, ("Could not find current alias members %s - %s\n",
352 sid_string_dbg(&alias_sid),
353 nt_errstr(status)));
354 return -1;
355 }
356
357 for (i=0; i < num_members; i++) {
358 bool match;
359
360 match = dom_sid_equal(&members[i], &member_sid);
361 if (match) {
362 is_member = true;
363 break;
364 }
365 }
366
367 status = NT_STATUS_OK;
368 action = "none";
369 if (!is_member && mem->active) {
370 action = "add";
371 pdb_add_aliasmem(&alias_sid, &member_sid);
372 } else if (is_member && !mem->active) {
373 action = "delete";
374 pdb_del_aliasmem(&alias_sid, &member_sid);
375 }
376 if (!NT_STATUS_IS_OK(status)) {
377 DEBUG(0, ("Could not %s %s as alias members of %s - %s\n",
378 action,
379 sid_string_dbg(&member_sid),
380 sid_string_dbg(&alias_sid),
381 nt_errstr(status)));
382 return -1;
383 }
384
385 return 0;
386 }
387
388 static int dssync_passdb_traverse_aliases(struct db_record *rec,
389 void *private_data)
390 {
391 struct dssync_passdb_traverse_aliases *state =
392 (struct dssync_passdb_traverse_aliases *)private_data;
393 struct dssync_passdb *pctx =
394 talloc_get_type_abort(state->ctx->private_data,
395 struct dssync_passdb);
396 struct dssync_passdb_traverse_amembers mstate;
397 struct dssync_passdb_obj *obj;
398 TDB_DATA value;
399 NTSTATUS status;
400
401 state->idx++;
402 if (pctx->methods == NULL) {
403 return -1;
404 }
405
406 value = dbwrap_record_get_value(rec);
407 obj = dssync_parse_obj(value);
408 if (obj == NULL) {
409 return -1;
410 }
411
412 ZERO_STRUCT(mstate);
413 mstate.ctx = state->ctx;
414 mstate.name = "members";
415 mstate.obj = obj;
416 status = dbwrap_traverse_read(obj->members,
417 dssync_passdb_traverse_amembers,
418 &mstate, NULL);
419 if (!NT_STATUS_IS_OK(status)) {
420 return -1;
421 }
422
423 return 0;
424 }
425
426 struct dssync_passdb_traverse_gmembers {
427 struct dssync_context *ctx;
428 struct dssync_passdb_obj *obj;
429 const char *name;
430 uint32_t idx;
431 };
432
433 struct dssync_passdb_traverse_groups {
434 struct dssync_context *ctx;
435 const char *name;
436 uint32_t idx;
437 };
438
439 static int dssync_passdb_traverse_gmembers(struct db_record *rec,
440 void *private_data)
441 {
442 struct dssync_passdb_traverse_gmembers *state =
443 (struct dssync_passdb_traverse_gmembers *)private_data;
444 struct dssync_passdb *pctx =
445 talloc_get_type_abort(state->ctx->private_data,
446 struct dssync_passdb);
447 struct dssync_passdb_mem *mem;
448 NTSTATUS status;
449 char *nt_member = NULL;
450 char **unix_members;
451 struct dom_sid group_sid;
452 struct dom_sid member_sid;
453 struct samu *member = NULL;
454 const char *member_dn = NULL;
455 GROUP_MAP *map;
456 struct group *grp;
457 uint32_t rid;
458 bool is_unix_member = false;
459 TDB_DATA value;
460
461 state->idx++;
462
463 group_sid = state->obj->cur->object.identifier->sid;
464
465 status = dom_sid_split_rid(talloc_tos(), &group_sid, NULL, &rid);
466 if (!NT_STATUS_IS_OK(status)) {
467 return -1;
468 }
469
470 value = dbwrap_record_get_value(rec);
471
472 mem = dssync_parse_mem(value);
473 if (mem == NULL) {
474 return -1;
475 }
476
477 member_sid = mem->cur->sid;
478 member_dn = mem->cur->dn;
479
480 mem->obj = dssync_search_obj_by_guid(pctx, pctx->all, &mem->cur->guid);
481 if (mem->obj == NULL) {
482 DEBUG(0,("group[%s] member[%s] can't resolve member - ignoring\n",
483 sid_string_dbg(&group_sid),
484 is_null_sid(&member_sid)?
485 sid_string_dbg(&member_sid):
486 member_dn));
487 return 0;
488 }
489
490 member_sid = mem->obj->cur->object.identifier->sid;
491 member_dn = mem->obj->cur->object.identifier->dn;
492
493 switch (mem->obj->type) {
494 case ATYPE_SECURITY_LOCAL_GROUP:
495 case ATYPE_SECURITY_GLOBAL_GROUP:
496 DEBUG(0, ("Group[%s] ignore member group [%s]\n",
497 sid_string_dbg(&group_sid),
498 sid_string_dbg(&member_sid)));
499 return 0;
500
501 case ATYPE_DISTRIBUTION_LOCAL_GROUP:
502 case ATYPE_DISTRIBUTION_GLOBAL_GROUP:
503 DEBUG(0, ("Group[%s] ignore distribution group [%s]\n",
504 sid_string_dbg(&group_sid),
505 member_dn));
506 return 0;
507 default:
508 break;
509 }
510
511 map = talloc_zero(NULL, GROUP_MAP);
512 if (!map) {
513 return -1;
514 }
515
516 if (!get_domain_group_from_sid(group_sid, map)) {
517 DEBUG(0, ("Could not find global group %s\n",
518 sid_string_dbg(&group_sid)));
519 //return NT_STATUS_NO_SUCH_GROUP;
520 TALLOC_FREE(map);
521 return -1;
522 }
523
524 if (!(grp = getgrgid(map->gid))) {
525 DEBUG(0, ("Could not find unix group %lu\n",
526 (unsigned long)map->gid));
527 //return NT_STATUS_NO_SUCH_GROUP;
528 TALLOC_FREE(map);
529 return -1;
530 }
531
532 TALLOC_FREE(map);
533
534 DEBUG(0,("Group members of %s: ", grp->gr_name));
535
536 if ( !(member = samu_new(talloc_tos())) ) {
537 //return NT_STATUS_NO_MEMORY;
538 return -1;
539 }
540
541 if (!pdb_getsampwsid(member, &member_sid)) {
542 DEBUG(1, ("Found bogus group member: (member_sid=%s group=%s)\n",
543 sid_string_tos(&member_sid), grp->gr_name));
544 TALLOC_FREE(member);
545 return -1;
546 }
547
548 if (pdb_get_group_rid(member) == rid) {
549 DEBUGADD(0,("%s(primary),", pdb_get_username(member)));
550 TALLOC_FREE(member);
551 return -1;
552 }
553
554 DEBUGADD(0,("%s,", pdb_get_username(member)));
555 nt_member = talloc_strdup(talloc_tos(), pdb_get_username(member));
556 TALLOC_FREE(member);
557
558 DEBUGADD(0,("\n"));
559
560 unix_members = grp->gr_mem;
561
562 while (*unix_members) {
563 if (strcmp(*unix_members, nt_member) == 0) {
564 is_unix_member = true;
565 break;
566 }
567 unix_members += 1;
568 }
569
570 if (!is_unix_member && mem->active) {
571 smb_add_user_group(grp->gr_name, nt_member);
572 } else if (is_unix_member && !mem->active) {
573 smb_delete_user_group(grp->gr_name, nt_member);
574 }
575
576 return 0;
577 }
578
579 static int dssync_passdb_traverse_groups(struct db_record *rec,
580 void *private_data)
581 {
582 struct dssync_passdb_traverse_groups *state =
583 (struct dssync_passdb_traverse_groups *)private_data;
584 struct dssync_passdb *pctx =
585 talloc_get_type_abort(state->ctx->private_data,
586 struct dssync_passdb);
587 struct dssync_passdb_traverse_gmembers mstate;
588 struct dssync_passdb_obj *obj;
589 TDB_DATA value;
590 NTSTATUS status;
591
592 state->idx++;
593 if (pctx->methods == NULL) {
594 return -1;
595 }
596
597 value = dbwrap_record_get_value(rec);
598
599 obj = dssync_parse_obj(value);
600 if (obj == NULL) {
601 return -1;
602 }
603
604 ZERO_STRUCT(mstate);
605 mstate.ctx = state->ctx;
606 mstate.name = "members";
607 mstate.obj = obj;
608 status = dbwrap_traverse_read(obj->members,
609 dssync_passdb_traverse_gmembers,
610 &mstate, NULL);
611 if (!NT_STATUS_IS_OK(status)) {
612 return -1;
613 }
614
615 return 0;
616 }
617
618 static NTSTATUS passdb_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
619 struct replUpToDateVectorBlob *new_utdv)
620 {
621 struct dssync_passdb *pctx =
622 talloc_get_type_abort(ctx->private_data,
623 struct dssync_passdb);
624 struct dssync_passdb_traverse_aliases astate;
625 struct dssync_passdb_traverse_groups gstate;
626 NTSTATUS status;
627
628 ZERO_STRUCT(astate);
629 astate.ctx = ctx;
630 astate.name = "aliases";
631 status = dbwrap_traverse_read(pctx->aliases,
632 dssync_passdb_traverse_aliases,
633 &astate, NULL);
634 if (!NT_STATUS_IS_OK(status)) {
635 return NT_STATUS_INTERNAL_ERROR;
636 }
637
638 ZERO_STRUCT(gstate);
639 gstate.ctx = ctx;
640 gstate.name = "groups";
641 status = dbwrap_traverse_read(pctx->groups,
642 dssync_passdb_traverse_groups,
643 &gstate, NULL);
644 if (!NT_STATUS_IS_OK(status)) {
645 return NT_STATUS_INTERNAL_ERROR;
646 }
647
648 TALLOC_FREE(pctx->methods);
649 TALLOC_FREE(pctx);
650
651 return NT_STATUS_OK;
652 }
653
654 /****************************************************************
655 ****************************************************************/
656
657 static NTSTATUS smb_create_user(TALLOC_CTX *mem_ctx,
658 uint32_t acct_flags,
659 const char *account,
660 struct passwd **passwd_p)
661 {
662 struct passwd *passwd;
663 char *add_script = NULL;
664
665 passwd = Get_Pwnam_alloc(mem_ctx, account);
666 if (passwd) {
667 *passwd_p = passwd;
668 return NT_STATUS_OK;
669 }
670
671 /* Create appropriate user */
672 if (acct_flags & ACB_NORMAL) {
673 add_script = talloc_strdup(mem_ctx, lp_adduser_script());
674 } else if ( (acct_flags & ACB_WSTRUST) ||
675 (acct_flags & ACB_SVRTRUST) ||
676 (acct_flags & ACB_DOMTRUST) ) {
677 add_script = talloc_strdup(mem_ctx, lp_addmachine_script());
678 } else {
679 DEBUG(1, ("Unknown user type: %s\n",
680 pdb_encode_acct_ctrl(acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
681 return NT_STATUS_UNSUCCESSFUL;
682 }
683
684 if (!add_script) {
685 return NT_STATUS_NO_MEMORY;
686 }
687
688 if (*add_script) {
689 int add_ret;
690 add_script = talloc_all_string_sub(mem_ctx, add_script,
691 "%u", account);
692 if (!add_script) {
693 return NT_STATUS_NO_MEMORY;
694 }
695 add_ret = smbrun(add_script, NULL);
696 DEBUG(add_ret ? 0 : 1,("fetch_account: Running the command `%s' "
697 "gave %d\n", add_script, add_ret));
698 if (add_ret == 0) {
699 smb_nscd_flush_user_cache();
700 }
701 }
702
703 /* try and find the possible unix account again */
704 passwd = Get_Pwnam_alloc(mem_ctx, account);
705 if (!passwd) {
706 return NT_STATUS_NO_SUCH_USER;
707 }
708
709 *passwd_p = passwd;
710
711 return NT_STATUS_OK;
712 }
713
714 static struct drsuapi_DsReplicaAttribute *find_drsuapi_attr(
715 const struct drsuapi_DsReplicaObjectListItemEx *cur,
716 uint32_t attid)
717 {
718 int i = 0;
719
720 for (i = 0; i < cur->object.attribute_ctr.num_attributes; i++) {
721 struct drsuapi_DsReplicaAttribute *attr;
722
723 attr = &cur->object.attribute_ctr.attributes[i];
724
725 if (attr->attid == attid) {
726 return attr;
727 }
728 }
729
730 return NULL;
731 }
732
733 static NTSTATUS find_drsuapi_attr_string(TALLOC_CTX *mem_ctx,
734 const struct drsuapi_DsReplicaObjectListItemEx *cur,
735 uint32_t attid,
736 uint32_t *_count,
737 char ***_array)
738 {
739 struct drsuapi_DsReplicaAttribute *attr;
740 char **array;
741 uint32_t a;
742
743 attr = find_drsuapi_attr(cur, attid);
744 if (attr == NULL) {
745 return NT_STATUS_PROPSET_NOT_FOUND;
746 }
747
748 array = talloc_array(mem_ctx, char *, attr->value_ctr.num_values);
749 if (array == NULL) {
750 return NT_STATUS_NO_MEMORY;
751 }
752
753 for (a = 0; a < attr->value_ctr.num_values; a++) {
754 const DATA_BLOB *blob;
755 ssize_t ret;
756
757 blob = attr->value_ctr.values[a].blob;
758
759 if (blob == NULL) {
760 return NT_STATUS_INTERNAL_DB_CORRUPTION;
761 }
762
763 ret = pull_string_talloc(array, NULL, 0, &array[a],
764 blob->data, blob->length,
765 STR_UNICODE);
766 if (ret == -1) {
767 //TODO
768 return NT_STATUS_INTERNAL_ERROR;
769 }
770 }
771
772 *_count = attr->value_ctr.num_values;
773 *_array = array;
774 return NT_STATUS_OK;
775 }
776
777 static NTSTATUS find_drsuapi_attr_int32(TALLOC_CTX *mem_ctx,
778 const struct drsuapi_DsReplicaObjectListItemEx *cur,
779 uint32_t attid,
780 uint32_t *_count,
781 int32_t **_array)
782 {
783 struct drsuapi_DsReplicaAttribute *attr;
784 int32_t *array;
785 uint32_t a;
786
787 attr = find_drsuapi_attr(cur, attid);
788 if (attr == NULL) {
789 return NT_STATUS_PROPSET_NOT_FOUND;
790 }
791
792 array = talloc_array(mem_ctx, int32_t, attr->value_ctr.num_values);
793 if (array == NULL) {
794 return NT_STATUS_NO_MEMORY;
795 }
796
797 for (a = 0; a < attr->value_ctr.num_values; a++) {
798 const DATA_BLOB *blob;
799
800 blob = attr->value_ctr.values[a].blob;
801
802 if (blob == NULL) {
803 return NT_STATUS_INTERNAL_DB_CORRUPTION;
804 }
805
806 if (blob->length != 4) {
807 return NT_STATUS_INTERNAL_DB_CORRUPTION;
808 }
809
810 array[a] = IVAL(blob->data, 0);
811 }
812
813 *_count = attr->value_ctr.num_values;
814 *_array = array;
815 return NT_STATUS_OK;
816 }
817
818 static NTSTATUS find_drsuapi_attr_blob(TALLOC_CTX *mem_ctx,
819 const struct drsuapi_DsReplicaObjectListItemEx *cur,
820 uint32_t attid,
821 uint32_t *_count,
822 DATA_BLOB **_array)
823 {
824 struct drsuapi_DsReplicaAttribute *attr;
825 DATA_BLOB *array;
826 uint32_t a;
827
828 attr = find_drsuapi_attr(cur, attid);
829 if (attr == NULL) {
830 return NT_STATUS_PROPSET_NOT_FOUND;
831 }
832
833 array = talloc_array(mem_ctx, DATA_BLOB, attr->value_ctr.num_values);
834 if (array == NULL) {
835 return NT_STATUS_NO_MEMORY;
836 }
837
838 for (a = 0; a < attr->value_ctr.num_values; a++) {
839 const DATA_BLOB *blob;
840
841 blob = attr->value_ctr.values[a].blob;
842
843 if (blob == NULL) {
844 return NT_STATUS_INTERNAL_DB_CORRUPTION;
845 }
846
847 array[a] = data_blob_talloc(array, blob->data, blob->length);
848 if (array[a].length != blob->length) {
849 return NT_STATUS_NO_MEMORY;
850 }
851 }
852 *_count = attr->value_ctr.num_values;
853 *_array = array;
854 return NT_STATUS_OK;
855 }
856
857 static NTSTATUS find_drsuapi_attr_int64(TALLOC_CTX *mem_ctx,
858 const struct drsuapi_DsReplicaObjectListItemEx *cur,
859 uint32_t attid,
860 uint32_t *_count,
861 int64_t **_array)
862 {
863 struct drsuapi_DsReplicaAttribute *attr;
864 int64_t *array;
865 uint32_t a;
866
867 attr = find_drsuapi_attr(cur, attid);
868 if (attr == NULL) {
869 return NT_STATUS_PROPSET_NOT_FOUND;
870 }
871
872 array = talloc_array(mem_ctx, int64_t, attr->value_ctr.num_values);
873 if (array == NULL) {
874 return NT_STATUS_NO_MEMORY;
875 }
876
877 for (a = 0; a < attr->value_ctr.num_values; a++) {
878 const DATA_BLOB *blob;
879
880 blob = attr->value_ctr.values[a].blob;
881
882 if (blob == NULL) {
883 return NT_STATUS_INTERNAL_DB_CORRUPTION;
884 }
885
886 if (blob->length != 8) {
887 return NT_STATUS_INTERNAL_DB_CORRUPTION;
888 }
889
890 array[a] = BVAL(blob->data, 0);
891 }
892 *_count = attr->value_ctr.num_values;
893 *_array = array;
894 return NT_STATUS_OK;
895 }
896
897 static NTSTATUS find_drsuapi_attr_dn(TALLOC_CTX *mem_ctx,
898 const struct drsuapi_DsReplicaObjectListItemEx *cur,
899 uint32_t attid,
900 uint32_t *_count,
901 struct drsuapi_DsReplicaObjectIdentifier3 **_array)
902 {
903 struct drsuapi_DsReplicaAttribute *attr;
904 struct drsuapi_DsReplicaObjectIdentifier3 *array;
905 uint32_t a;
906
907 attr = find_drsuapi_attr(cur, attid);
908 if (attr == NULL) {
909 return NT_STATUS_PROPSET_NOT_FOUND;
910 }
911
912 array = talloc_array(mem_ctx,
913 struct drsuapi_DsReplicaObjectIdentifier3,
914 attr->value_ctr.num_values);
915 if (array == NULL) {
916 return NT_STATUS_NO_MEMORY;
917 }
918
919 for (a = 0; a < attr->value_ctr.num_values; a++) {
920 const DATA_BLOB *blob;
921 enum ndr_err_code ndr_err;
922 NTSTATUS status;
923
924 blob = attr->value_ctr.values[a].blob;
925
926 if (blob == NULL) {
927 return NT_STATUS_INTERNAL_DB_CORRUPTION;
928 }
929
930 /* windows sometimes sends an extra two pad bytes here */
931 ndr_err = ndr_pull_struct_blob(blob, array, &array[a],
932 (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
933 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
934 status = ndr_map_error2ntstatus(ndr_err);
935 return status;
936 }
937 }
938 *_count = attr->value_ctr.num_values;
939 *_array = array;
940 return NT_STATUS_OK;
941 }
942
943 #define GET_BLOB_EX(attr, needed) do { \
944 NTSTATUS _status; \
945 uint32_t _cnt; \
946 DATA_BLOB *_vals = NULL; \
947 attr = data_blob_null; \
948 _status = find_drsuapi_attr_blob(mem_ctx, cur, \
949 DRSUAPI_ATTID_ ## attr, \
950 &_cnt, &_vals); \
951 if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
952 if (!needed) { \
953 _status = NT_STATUS_OK; \
954 _cnt = 0; \
955 } \
956 } \
957 if (!NT_STATUS_IS_OK(_status)) { \
958 DEBUG(0,(__location__ "attr[%s] %s\n", \
959 #attr, nt_errstr(_status))); \
960 return _status; \
961 } \
962 if (_cnt == 0) { \
963 if (needed) { \
964 talloc_free(_vals); \
965 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
966 return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
967 } \
968 } else if (_cnt > 1) { \
969 talloc_free(_vals); \
970 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
971 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
972 } else { \
973 attr = _vals[0]; \
974 (void)talloc_steal(mem_ctx, _vals[0].data); \
975 } \
976 talloc_free(_vals); \
977 } while(0)
978
979 #define GET_STRING_EX(attr, needed) do { \
980 NTSTATUS _status; \
981 uint32_t _cnt; \
982 char **_vals = NULL; \
983 attr = NULL; \
984 _status = find_drsuapi_attr_string(mem_ctx, cur, \
985 DRSUAPI_ATTID_ ## attr, \
986 &_cnt, &_vals); \
987 if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
988 if (!needed) { \
989 _status = NT_STATUS_OK; \
990 _cnt = 0; \
991 } \
992 } \
993 if (!NT_STATUS_IS_OK(_status)) { \
994 DEBUG(0,(__location__ "attr[%s] %s\n", \
995 #attr, nt_errstr(_status))); \
996 return _status; \
997 } \
998 if (_cnt == 0) { \
999 if (needed) { \
1000 talloc_free(_vals); \
1001 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1002 return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1003 } \
1004 } else if (_cnt > 1) { \
1005 talloc_free(_vals); \
1006 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1007 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1008 } else { \
1009 attr = talloc_move(mem_ctx, &_vals[0]); \
1010 } \
1011 talloc_free(_vals); \
1012 } while(0)
1013
1014 #define GET_UINT32_EX(attr, needed) do { \
1015 NTSTATUS _status; \
1016 uint32_t _cnt; \
1017 int32_t*_vals = NULL; \
1018 attr = 0; \
1019 _status = find_drsuapi_attr_int32(mem_ctx, cur, \
1020 DRSUAPI_ATTID_ ## attr, \
1021 &_cnt, &_vals); \
1022 if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
1023 if (!needed) { \
1024 _status = NT_STATUS_OK; \
1025 _cnt = 0; \
1026 } \
1027 } \
1028 if (!NT_STATUS_IS_OK(_status)) { \
1029 DEBUG(0,(__location__ "attr[%s] %s\n", \
1030 #attr, nt_errstr(_status))); \
1031 return _status; \
1032 } \
1033 if (_cnt == 0) { \
1034 if (needed) { \
1035 talloc_free(_vals); \
1036 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1037 return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1038 } \
1039 } else if (_cnt > 1) { \
1040 talloc_free(_vals); \
1041 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1042 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1043 } else { \
1044 attr = (uint32_t)_vals[0]; \
1045 } \
1046 talloc_free(_vals); \
1047 } while(0)
1048
1049 #define GET_UINT64_EX(attr, needed) do { \
1050 NTSTATUS _status; \
1051 uint32_t _cnt; \
1052 int64_t *_vals = NULL; \
1053 attr = 0; \
1054 _status = find_drsuapi_attr_int64(mem_ctx, cur, \
1055 DRSUAPI_ATTID_ ## attr, \
1056 &_cnt, &_vals); \
1057 if (NT_STATUS_EQUAL(_status, NT_STATUS_PROPSET_NOT_FOUND)) { \
1058 if (!needed) { \
1059 _status = NT_STATUS_OK; \
1060 _cnt = 0; \
1061 } \
1062 } \
1063 if (!NT_STATUS_IS_OK(_status)) { \
1064 DEBUG(0,(__location__ "attr[%s] %s\n", \
1065 #attr, nt_errstr(_status))); \
1066 return _status; \
1067 } \
1068 if (_cnt == 0) { \
1069 if (needed) { \
1070 talloc_free(_vals); \
1071 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1072 return NT_STATUS_OBJECT_NAME_NOT_FOUND; \
1073 } \
1074 } else if (_cnt > 1) { \
1075 talloc_free(_vals); \
1076 DEBUG(0,(__location__ "attr[%s] count[%u]\n", #attr, _cnt)); \
1077 return NT_STATUS_INTERNAL_DB_CORRUPTION; \
1078 } else { \
1079 attr = (uint64_t)_vals[0]; \
1080 } \
1081 talloc_free(_vals); \
1082 } while(0)
1083
1084 #define GET_BLOB(attr) GET_BLOB_EX(attr, false)
1085 #define GET_STRING(attr) GET_STRING_EX(attr, false)
1086 #define GET_UINT32(attr) GET_UINT32_EX(attr, false)
1087 #define GET_UINT64(attr) GET_UINT64_EX(attr, false)
1088
1089 /* Convert a struct samu_DELTA to a struct samu. */
1090 #define STRING_CHANGED (old_string && !new_string) ||\
1091 (!old_string && new_string) ||\
1092 (old_string && new_string && (strcmp(old_string, new_string) != 0))
1093
1094 #define STRING_CHANGED_NC(s1,s2) ((s1) && !(s2)) ||\
1095 (!(s1) && (s2)) ||\
1096 ((s1) && (s2) && (strcmp((s1), (s2)) != 0))
1097
1098 /****************************************************************
1099 ****************************************************************/
1100
1101 static NTSTATUS sam_account_from_object(struct samu *account,
1102 struct drsuapi_DsReplicaObjectListItemEx *cur)
1103 {
1104 TALLOC_CTX *mem_ctx = account;
1105 const char *old_string, *new_string;
1106 time_t unix_time, stored_time;
1107 uchar zero_buf[16];
1108 NTSTATUS status;
1109
1110 NTTIME lastLogon;
1111 NTTIME lastLogoff;
1112 NTTIME pwdLastSet;
1113 NTTIME accountExpires;
1114 const char *sAMAccountName;
1115 const char *displayName;
1116 const char *homeDirectory;
1117 const char *homeDrive;
1118 const char *scriptPath;
1119 const char *profilePath;
1120 const char *description;
1121 const char *userWorkstations;
1122 const char *comment;
1123 DATA_BLOB userParameters;
1124 struct dom_sid objectSid;
1125 uint32_t primaryGroupID;
1126 uint32_t userAccountControl;
1127 DATA_BLOB logonHours;
1128 uint32_t badPwdCount;
1129 uint32_t logonCount;
1130 DATA_BLOB unicodePwd;
1131 DATA_BLOB dBCSPwd;
1132
1133 uint32_t rid = 0;
1134 uint32_t acct_flags;
1135 uint32_t units_per_week;
1136
1137 memset(zero_buf, '\0', sizeof(zero_buf));
1138
1139 objectSid = cur->object.identifier->sid;
1140 GET_STRING_EX(sAMAccountName, true);
1141 DEBUG(0,("sam_account_from_object(%s, %s) start\n",
1142 sAMAccountName, sid_string_dbg(&objectSid)));
1143 GET_UINT64(lastLogon);
1144 GET_UINT64(lastLogoff);
1145 GET_UINT64(pwdLastSet);
1146 GET_UINT64(accountExpires);
1147 GET_STRING(displayName);
1148 GET_STRING(homeDirectory);
1149 GET_STRING(homeDrive);
1150 GET_STRING(scriptPath);
1151 GET_STRING(profilePath);
1152 GET_STRING(description);
1153 GET_STRING(userWorkstations);
1154 GET_STRING(comment);
1155 GET_BLOB(userParameters);
1156 GET_UINT32(primaryGroupID);
1157 GET_UINT32(userAccountControl);
1158 GET_BLOB(logonHours);
1159 GET_UINT32(badPwdCount);
1160 GET_UINT32(logonCount);
1161 GET_BLOB(unicodePwd);
1162 GET_BLOB(dBCSPwd);
1163
1164 status = dom_sid_split_rid(mem_ctx, &objectSid, NULL, &rid);
1165 if (!NT_STATUS_IS_OK(status)) {
1166 return status;
1167 }
1168 acct_flags = ds_uf2acb(userAccountControl);
1169
1170 /* Username, fullname, home dir, dir drive, logon script, acct
1171 desc, workstations, profile. */
1172
1173 if (sAMAccountName) {
1174 old_string = pdb_get_nt_username(account);
1175 new_string = sAMAccountName;
1176
1177 if (STRING_CHANGED) {
1178 pdb_set_nt_username(account, new_string, PDB_CHANGED);
1179 }
1180
1181 /* Unix username is the same - for sanity */
1182 old_string = pdb_get_username( account );
1183 if (STRING_CHANGED) {
1184 pdb_set_username(account, new_string, PDB_CHANGED);
1185 }
1186 }
1187
1188 if (displayName) {
1189 old_string = pdb_get_fullname(account);
1190 new_string = displayName;
1191
1192 if (STRING_CHANGED)
1193 pdb_set_fullname(account, new_string, PDB_CHANGED);
1194 }
1195
1196 if (homeDirectory) {
1197 old_string = pdb_get_homedir(account);
1198 new_string = homeDirectory;
1199
1200 if (STRING_CHANGED)
1201 pdb_set_homedir(account, new_string, PDB_CHANGED);
1202 }
1203
1204 if (homeDrive) {
1205 old_string = pdb_get_dir_drive(account);
1206 new_string = homeDrive;
1207
1208 if (STRING_CHANGED)
1209 pdb_set_dir_drive(account, new_string, PDB_CHANGED);
1210 }
1211
1212 if (scriptPath) {
1213 old_string = pdb_get_logon_script(account);
1214 new_string = scriptPath;
1215
1216 if (STRING_CHANGED)
1217 pdb_set_logon_script(account, new_string, PDB_CHANGED);
1218 }
1219
1220 if (description) {
1221 old_string = pdb_get_acct_desc(account);
1222 new_string = description;
1223
1224 if (STRING_CHANGED)
1225 pdb_set_acct_desc(account, new_string, PDB_CHANGED);
1226 }
1227
1228 if (userWorkstations) {
1229 old_string = pdb_get_workstations(account);
1230 new_string = userWorkstations;
1231
1232 if (STRING_CHANGED)
1233 pdb_set_workstations(account, new_string, PDB_CHANGED);
1234 }
1235
1236 if (profilePath) {
1237 old_string = pdb_get_profile_path(account);
1238 new_string = profilePath;
1239
1240 if (STRING_CHANGED)
1241 pdb_set_profile_path(account, new_string, PDB_CHANGED);
1242 }
1243
1244 if (userParameters.data) {
1245 char *newstr;
1246 old_string = pdb_get_munged_dial(account);
1247 newstr = (userParameters.length == 0) ? NULL :
1248 base64_encode_data_blob(talloc_tos(), userParameters);
1249
1250 if (STRING_CHANGED_NC(old_string, newstr))
1251 pdb_set_munged_dial(account, newstr, PDB_CHANGED);
1252 TALLOC_FREE(newstr);
1253 }
1254
1255 /* User and group sid */
1256 if (rid != 0 && pdb_get_user_rid(account) != rid) {
1257 pdb_set_user_sid_from_rid(account, rid, PDB_CHANGED);
1258 }
1259 if (primaryGroupID != 0 && pdb_get_group_rid(account) != primaryGroupID) {
1260 pdb_set_group_sid_from_rid(account, primaryGroupID, PDB_CHANGED);
1261 }
1262
1263 /* Logon and password information */
1264 if (!nt_time_is_zero(&lastLogon)) {
1265 unix_time = nt_time_to_unix(lastLogon);
1266 stored_time = pdb_get_logon_time(account);
1267 if (stored_time != unix_time)
1268 pdb_set_logon_time(account, unix_time, PDB_CHANGED);
1269 }
1270
1271 if (!nt_time_is_zero(&lastLogoff)) {
1272 unix_time = nt_time_to_unix(lastLogoff);
1273 stored_time = pdb_get_logoff_time(account);
1274 if (stored_time != unix_time)
1275 pdb_set_logoff_time(account, unix_time,PDB_CHANGED);
1276 }
1277
1278 /* Logon Divs */
1279 units_per_week = logonHours.length * 8;
1280
1281 if (pdb_get_logon_divs(account) != units_per_week) {
1282 pdb_set_logon_divs(account, units_per_week, PDB_CHANGED);
1283 }
1284
1285 /* Logon Hours Len */
1286 if (units_per_week/8 != pdb_get_hours_len(account)) {
1287 pdb_set_hours_len(account, units_per_week/8, PDB_CHANGED);
1288 }
1289
1290 /* Logon Hours */
1291 if (logonHours.data) {
1292 char oldstr[44], newstr[44];
1293 pdb_sethexhours(oldstr, pdb_get_hours(account));
1294 pdb_sethexhours(newstr, logonHours.data);
1295 if (!strequal(oldstr, newstr)) {
1296 pdb_set_hours(account, logonHours.data,
1297 logonHours.length, PDB_CHANGED);
1298 }
1299 }
1300
1301 if (pdb_get_bad_password_count(account) != badPwdCount)
1302 pdb_set_bad_password_count(account, badPwdCount, PDB_CHANGED);
1303
1304 if (pdb_get_logon_count(account) != logonCount)
1305 pdb_set_logon_count(account, logonCount, PDB_CHANGED);
1306
1307 if (!nt_time_is_zero(&pwdLastSet)) {
1308 unix_time = nt_time_to_unix(pwdLastSet);
1309 stored_time = pdb_get_pass_last_set_time(account);
1310 if (stored_time != unix_time)
1311 pdb_set_pass_last_set_time(account, unix_time, PDB_CHANGED);
1312 } else {
1313 /* no last set time, make it now */
1314 pdb_set_pass_last_set_time(account, time(NULL), PDB_CHANGED);
1315 }
1316
1317 if (!nt_time_is_zero(&accountExpires)) {
1318 unix_time = nt_time_to_unix(accountExpires);
1319 stored_time = pdb_get_kickoff_time(account);
1320 if (stored_time != unix_time)
1321 pdb_set_kickoff_time(account, unix_time, PDB_CHANGED);
1322 }
1323
1324 /* Decode hashes from password hash
1325 Note that win2000 may send us all zeros for the hashes if it doesn't
1326 think this channel is secure enough - don't set the passwords at all
1327 in that case
1328 */
1329 if (dBCSPwd.length == 16 && memcmp(dBCSPwd.data, zero_buf, 16) != 0) {
1330 pdb_set_lanman_passwd(account, dBCSPwd.data, PDB_CHANGED);
1331 }
1332
1333 if (unicodePwd.length == 16 && memcmp(unicodePwd.data, zero_buf, 16) != 0) {
1334 pdb_set_nt_passwd(account, unicodePwd.data, PDB_CHANGED);
1335 }
1336
1337 /* TODO: history */
1338
1339 /* TODO: account expiry time */
1340
1341 pdb_set_acct_ctrl(account, acct_flags, PDB_CHANGED);
1342
1343 pdb_set_domain(account, lp_workgroup(), PDB_CHANGED);
1344
1345 DEBUG(0,("sam_account_from_object(%s, %s) done\n",
1346 sAMAccountName, sid_string_dbg(&objectSid)));
1347 return NT_STATUS_OK;
1348 }
1349
1350 /****************************************************************
1351 ****************************************************************/
1352
1353 static NTSTATUS handle_account_object(struct dssync_passdb *pctx,
1354 TALLOC_CTX *mem_ctx,
1355 struct dssync_passdb_obj *obj)
1356 {
1357 struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1358 NTSTATUS status;
1359 fstring account;
1360 struct samu *sam_account=NULL;
1361 GROUP_MAP *map;
1362 struct group *grp;
1363 struct dom_sid user_sid;
1364 struct dom_sid group_sid;
1365 struct passwd *passwd = NULL;
1366 uint32_t acct_flags;
1367 uint32_t rid;
1368
1369 const char *sAMAccountName;
1370 uint32_t sAMAccountType;
1371 uint32_t userAccountControl;
1372
1373 user_sid = cur->object.identifier->sid;
1374 GET_STRING_EX(sAMAccountName, true);
1375 GET_UINT32_EX(sAMAccountType, true);
1376 GET_UINT32_EX(userAccountControl, true);
1377
1378 status = dom_sid_split_rid(mem_ctx, &user_sid, NULL, &rid);
1379 if (!NT_STATUS_IS_OK(status)) {
1380 return status;
1381 }
1382
1383 fstrcpy(account, sAMAccountName);
1384 if (rid == DOMAIN_RID_GUEST) {
1385 /*
1386 * pdb_getsampwsid() has special handling for DOMAIN_RID_GUEST
1387 * that's why we need to ignore it here.
1388 *
1389 * pdb_smbpasswd.c also has some DOMAIN_RID_GUEST related
1390 * code...
1391 */
1392 DEBUG(0,("Ignore %s - %s\n", account, sid_string_dbg(&user_sid)));
1393 return NT_STATUS_OK;
1394 }
1395 DEBUG(0,("Creating account: %s\n", account));
1396
1397 if ( !(sam_account = samu_new(mem_ctx)) ) {
1398 return NT_STATUS_NO_MEMORY;
1399 }
1400
1401 acct_flags = ds_uf2acb(userAccountControl);
1402 status = smb_create_user(sam_account, acct_flags, account, &passwd);
1403 if (!NT_STATUS_IS_OK(status)) {
1404 DEBUG(0,("Could not create posix account info for '%s'- %s\n",
1405 account, nt_errstr(status)));
1406 TALLOC_FREE(sam_account);
1407 return status;
1408 }
1409
1410 DEBUG(3, ("Attempting to find SID %s for user %s in the passdb\n",
1411 sid_string_dbg(&user_sid), account));
1412 if (!pdb_getsampwsid(sam_account, &user_sid)) {
1413 sam_account_from_object(sam_account, cur);
1414 DEBUG(3, ("Attempting to add user SID %s for user %s in the passdb\n",
1415 sid_string_dbg(&user_sid),
1416 pdb_get_username(sam_account)));
1417 if (!NT_STATUS_IS_OK(pdb_add_sam_account(sam_account))) {
1418 DEBUG(1, ("SAM Account for %s failed to be added to the passdb!\n",
1419 account));
1420 TALLOC_FREE(sam_account);
1421 return NT_STATUS_ACCESS_DENIED;
1422 }
1423 } else {
1424 sam_account_from_object(sam_account, cur);
1425 DEBUG(3, ("Attempting to update user SID %s for user %s in the passdb\n",
1426 sid_string_dbg(&user_sid),
1427 pdb_get_username(sam_account)));
1428 if (!NT_STATUS_IS_OK(pdb_update_sam_account(sam_account))) {
1429 DEBUG(1, ("SAM Account for %s failed to be updated in the passdb!\n",
1430 account));
1431 TALLOC_FREE(sam_account);
1432 return NT_STATUS_ACCESS_DENIED;
1433 }
1434 }
1435
1436 if (pdb_get_group_sid(sam_account) == NULL) {
1437 TALLOC_FREE(sam_account);
1438 return NT_STATUS_UNSUCCESSFUL;
1439 }
1440
1441 group_sid = *pdb_get_group_sid(sam_account);
1442
1443 map = talloc_zero(NULL, GROUP_MAP);
1444 if (!map) {
1445 return NT_STATUS_NO_MEMORY;
1446 }
1447
1448 if (!pdb_getgrsid(map, group_sid)) {
1449 DEBUG(0, ("Primary group of %s has no mapping!\n",
1450 pdb_get_username(sam_account)));
1451 } else {
1452 if (map->gid != passwd->pw_gid) {
1453 if (!(grp = getgrgid(map->gid))) {
1454 DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n",
1455 (unsigned long)map->gid, pdb_get_username(sam_account),
1456 sid_string_dbg(&group_sid)));
1457 } else {
1458 smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account));
1459 }
1460 }
1461 }
1462
1463 TALLOC_FREE(map);
1464
1465 if ( !passwd ) {
1466 DEBUG(1, ("No unix user for this account (%s), cannot adjust mappings\n",
1467 pdb_get_username(sam_account)));
1468 }
1469
1470 TALLOC_FREE(sam_account);
1471 return NT_STATUS_OK;
1472 }
1473
1474 /****************************************************************
1475 ****************************************************************/
1476
1477 static NTSTATUS handle_alias_object(struct dssync_passdb *pctx,
1478 TALLOC_CTX *mem_ctx,
1479 struct dssync_passdb_obj *obj)
1480 {
1481 struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1482 NTSTATUS status;
1483 struct group *grp = NULL;
1484 struct dom_sid group_sid;
1485 uint32_t rid = 0;
1486 struct dom_sid *dom_sid = NULL;
1487 fstring sid_string;
1488 GROUP_MAP *map;
1489 bool insert = true;
1490
1491 const char *sAMAccountName;
1492 uint32_t sAMAccountType;
1493 uint32_t groupType;
1494 const char *description;
1495 uint32_t i;
1496 uint32_t num_members = 0;
1497 struct drsuapi_DsReplicaObjectIdentifier3 *members = NULL;
1498
1499 group_sid = cur->object.identifier->sid;
1500 GET_STRING_EX(sAMAccountName, true);
1501 GET_UINT32_EX(sAMAccountType, true);
1502 GET_UINT32_EX(groupType, true);
1503 GET_STRING(description);
1504
1505 status = find_drsuapi_attr_dn(obj, cur, DRSUAPI_ATTID_member,
1506 &num_members, &members);
1507 if (NT_STATUS_EQUAL(status, NT_STATUS_PROPSET_NOT_FOUND)) {
1508 status = NT_STATUS_OK;
1509 }
1510 if (!NT_STATUS_IS_OK(status)) {
1511 return status;
1512 }
1513
1514 dom_sid_split_rid(mem_ctx, &group_sid, &dom_sid, &rid);
1515
1516 map = talloc_zero(mem_ctx, GROUP_MAP);
1517 if (map == NULL) {
1518 status = NT_STATUS_NO_MEMORY;
1519 goto done;
1520 }
1521
1522 map->nt_name = talloc_strdup(map, sAMAccountName);
1523 if (map->nt_name == NULL) {
1524 status = NT_STATUS_NO_MEMORY;
1525 goto done;
1526 }
1527
1528 if (description) {
1529 map->comment = talloc_strdup(map, description);
1530 } else {
1531 map->comment = talloc_strdup(map, "");
1532 }
1533 if (map->comment == NULL) {
1534 status = NT_STATUS_NO_MEMORY;
1535 goto done;
1536 }
1537
1538 sid_to_fstring(sid_string, &group_sid);
1539 DEBUG(0,("Creating alias[%s] - %s members[%u]\n",
1540 map->nt_name, sid_string, num_members));
1541
1542 status = dssync_insert_obj(pctx, pctx->aliases, obj);
1543 if (!NT_STATUS_IS_OK(status)) {
1544 goto done;
1545 }
1546
1547 if (pdb_getgrsid(map, group_sid)) {
1548 if (map->gid != -1) {
1549 grp = getgrgid(map->gid);
1550 }
1551 insert = false;
1552 }
1553
1554 if (grp == NULL) {
1555 gid_t gid;
1556
1557 /* No group found from mapping, find it from its name. */
1558 if ((grp = getgrnam(map->nt_name)) == NULL) {
1559
1560 /* No appropriate group found, create one */
1561
1562 DEBUG(0, ("Creating unix group: '%s'\n",
1563 map->nt_name));
1564
1565 if (smb_create_group(map->nt_name, &gid) != 0) {
1566 status = NT_STATUS_ACCESS_DENIED;
1567 goto done;
1568 }
1569
1570 if ((grp = getgrgid(gid)) == NULL) {
1571 status = NT_STATUS_ACCESS_DENIED;
1572 goto done;
1573 }
1574 }
1575 }
1576
1577 map->gid = grp->gr_gid;
1578 map->sid = group_sid;
1579
1580 if (dom_sid_equal(dom_sid, &global_sid_Builtin)) {
1581 /*
1582 * pdb_ldap does not like SID_NAME_WKN_GRP...
1583 *
1584 * map.sid_name_use = SID_NAME_WKN_GRP;
1585 */
1586 map->sid_name_use = SID_NAME_ALIAS;
1587 } else {
1588 map->sid_name_use = SID_NAME_ALIAS;
1589 }
1590
1591 if (insert) {
1592 pdb_add_group_mapping_entry(map);
1593 } else {
1594 pdb_update_group_mapping_entry(map);
1595 }
1596
1597 for (i=0; i < num_members; i++) {
1598 struct dssync_passdb_mem *mem;
1599
1600 status = dssync_create_mem(pctx, obj,
1601 true /* active */,
1602 &members[i], &mem);
1603 if (!NT_STATUS_IS_OK(status)) {
1604 goto done;
1605 }
1606 }
1607
1608 status = NT_STATUS_OK;
1609
1610 done:
1611 TALLOC_FREE(map);
1612 return status;
1613 }
1614
1615 /****************************************************************
1616 ****************************************************************/
1617
1618 static NTSTATUS handle_group_object(struct dssync_passdb *pctx,
1619 TALLOC_CTX *mem_ctx,
1620 struct dssync_passdb_obj *obj)
1621 {
1622 struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1623 NTSTATUS status;
1624 struct group *grp = NULL;
1625 struct dom_sid group_sid;
1626 fstring sid_string;
1627 GROUP_MAP *map;
1628 bool insert = true;
1629
1630 const char *sAMAccountName;
1631 uint32_t sAMAccountType;
1632 uint32_t groupType;
1633 const char *description;
1634 uint32_t i;
1635 uint32_t num_members = 0;
1636 struct drsuapi_DsReplicaObjectIdentifier3 *members = NULL;
1637
1638 group_sid = cur->object.identifier->sid;
1639 GET_STRING_EX(sAMAccountName, true);
1640 GET_UINT32_EX(sAMAccountType, true);
1641 GET_UINT32_EX(groupType, true);
1642 GET_STRING(description);
1643
1644 status = find_drsuapi_attr_dn(obj, cur, DRSUAPI_ATTID_member,
1645 &num_members, &members);
1646 if (NT_STATUS_EQUAL(status, NT_STATUS_PROPSET_NOT_FOUND)) {
1647 status = NT_STATUS_OK;
1648 }
1649 if (!NT_STATUS_IS_OK(status)) {
1650 return status;
1651 }
1652
1653 map = talloc_zero(NULL, GROUP_MAP);
1654 if (!map) {
1655 return NT_STATUS_NO_MEMORY;
1656 }
1657
1658 map->nt_name = talloc_strdup(map, sAMAccountName);
1659 if (!map->nt_name) {
1660 status = NT_STATUS_NO_MEMORY;
1661 goto done;
1662 }
1663 if (description) {
1664 map->comment = talloc_strdup(map, description);
1665 } else {
1666 map->comment = talloc_strdup(map, "");
1667 }
1668 if (!map->comment) {
1669 status = NT_STATUS_NO_MEMORY;
1670 goto done;
1671 }
1672
1673 sid_to_fstring(sid_string, &group_sid);
1674 DEBUG(0,("Creating group[%s] - %s members [%u]\n",
1675 map->nt_name, sid_string, num_members));
1676
1677 status = dssync_insert_obj(pctx, pctx->groups, obj);
1678 if (!NT_STATUS_IS_OK(status)) {
1679 goto done;
1680 }
1681
1682 if (pdb_getgrsid(map, group_sid)) {
1683 if (map->gid != -1) {
1684 grp = getgrgid(map->gid);
1685 }
1686 insert = false;
1687 }
1688
1689 if (grp == NULL) {
1690 gid_t gid;
1691
1692 /* No group found from mapping, find it from its name. */
1693 if ((grp = getgrnam(map->nt_name)) == NULL) {
1694
1695 /* No appropriate group found, create one */
1696
1697 DEBUG(0, ("Creating unix group: '%s'\n",
1698 map->nt_name));
1699
1700 if (smb_create_group(map->nt_name, &gid) != 0) {
1701 status = NT_STATUS_ACCESS_DENIED;
1702 goto done;
1703 }
1704
1705 if ((grp = getgrnam(map->nt_name)) == NULL) {
1706 status = NT_STATUS_ACCESS_DENIED;
1707 goto done;
1708 }
1709 }
1710 }
1711
1712 map->gid = grp->gr_gid;
1713 map->sid = group_sid;
1714 map->sid_name_use = SID_NAME_DOM_GRP;
1715
1716 if (insert) {
1717 pdb_add_group_mapping_entry(map);
1718 } else {
1719 pdb_update_group_mapping_entry(map);
1720 }
1721
1722 for (i=0; i < num_members; i++) {
1723 struct dssync_passdb_mem *mem;
1724
1725 status = dssync_create_mem(pctx, obj,
1726 true /* active */,
1727 &members[i], &mem);
1728 if (!NT_STATUS_IS_OK(status)) {
1729 goto done;
1730 }
1731 }
1732
1733 status = NT_STATUS_OK;
1734
1735 done:
1736 TALLOC_FREE(map);
1737 return status;
1738 }
1739
1740 /****************************************************************
1741 ****************************************************************/
1742
1743 static NTSTATUS handle_interdomain_trust_object(struct dssync_passdb *pctx,
1744 TALLOC_CTX *mem_ctx,
1745 struct dssync_passdb_obj *obj)
1746 {
1747 struct drsuapi_DsReplicaObjectListItemEx *cur = obj->cur;
1748 DEBUG(0,("trust: %s\n", cur->object.identifier->dn));
1749 return NT_STATUS_NOT_IMPLEMENTED;
1750 }
1751
1752 /****************************************************************
1753 ****************************************************************/
1754
1755 struct dssync_object_table_t {
1756 uint32_t type;
1757 NTSTATUS (*fn) (struct dssync_passdb *pctx,
1758 TALLOC_CTX *mem_ctx,
1759 struct dssync_passdb_obj *obj);
1760 };
1761
1762 static const struct dssync_object_table_t dssync_object_table[] = {
1763 { ATYPE_NORMAL_ACCOUNT, handle_account_object },
1764 { ATYPE_WORKSTATION_TRUST, handle_account_object },
1765 { ATYPE_SECURITY_LOCAL_GROUP, handle_alias_object },
1766 { ATYPE_SECURITY_GLOBAL_GROUP, handle_group_object },
1767 { ATYPE_INTERDOMAIN_TRUST, handle_interdomain_trust_object },
1768 };
1769
1770 /****************************************************************
1771 ****************************************************************/
1772
1773 static NTSTATUS parse_object(struct dssync_passdb *pctx,
1774 TALLOC_CTX *mem_ctx,
1775 struct drsuapi_DsReplicaObjectListItemEx *cur)
1776 {
1777 NTSTATUS status = NT_STATUS_OK;
1778 DATA_BLOB *blob;
1779 int i = 0;
1780 int a = 0;
1781 struct drsuapi_DsReplicaAttribute *attr;
1782
1783 char *name = NULL;
1784 uint32_t uacc = 0;
1785 uint32_t sam_type = 0;
1786
1787 DEBUG(3, ("parsing object '%s'\n", cur->object.identifier->dn));
1788
1789 for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
1790
1791 attr = &cur->object.attribute_ctr.attributes[i];
1792
1793 if (attr->value_ctr.num_values != 1) {
1794 continue;
1795 }
1796
1797 if (!attr->value_ctr.values[0].blob) {
1798 continue;
1799 }
1800
1801 blob = attr->value_ctr.values[0].blob;
1802
1803 switch (attr->attid) {
1804 case DRSUAPI_ATTID_sAMAccountName:
1805 pull_string_talloc(mem_ctx, NULL, 0, &name,
1806 blob->data, blob->length,
1807 STR_UNICODE);
1808 break;
1809 case DRSUAPI_ATTID_sAMAccountType:
1810 sam_type = IVAL(blob->data, 0);
1811 break;
1812 case DRSUAPI_ATTID_userAccountControl:
1813 uacc = IVAL(blob->data, 0);
1814 break;
1815 default:
1816 break;
1817 }
1818 }
1819
1820 for (a=0; a < ARRAY_SIZE(dssync_object_table); a++) {
1821 if (sam_type == dssync_object_table[a].type) {
1822 if (dssync_object_table[a].fn) {
1823 struct dssync_passdb_obj *obj;
1824 status = dssync_create_obj(pctx, pctx->all,
1825 sam_type, cur, &obj);
1826 if (!NT_STATUS_IS_OK(status)) {
1827 break;
1828 }
1829 status = dssync_object_table[a].fn(pctx,
1830 mem_ctx,
1831 obj);
1832 break;
1833 }
1834 }
1835 }
1836
1837 return status;
1838 }
1839
1840 static NTSTATUS parse_link(struct dssync_passdb *pctx,
1841 TALLOC_CTX *mem_ctx,
1842 struct drsuapi_DsReplicaLinkedAttribute *cur)
1843 {
1844 struct drsuapi_DsReplicaObjectIdentifier3 *id3;
1845 const DATA_BLOB *blob;
1846 enum ndr_err_code ndr_err;
1847 NTSTATUS status;
1848 bool active = false;
1849 struct dssync_passdb_mem *mem;
1850 struct dssync_passdb_obj *obj;
1851
1852 if (cur->attid != DRSUAPI_ATTID_member) {
1853 return NT_STATUS_OK;
1854 }
1855
1856 if (cur->flags & DRSUAPI_DS_LINKED_ATTRIBUTE_FLAG_ACTIVE) {
1857 active = true;
1858 }
1859
1860 DEBUG(3, ("parsing link '%s' - %s\n",
1861 cur->identifier->dn, active?"adding":"deleting"));
1862
1863 blob = cur->value.blob;
1864
1865 if (blob == NULL) {
1866 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1867 }
1868
1869 obj = dssync_search_obj_by_guid(pctx, pctx->all, &cur->identifier->guid);
1870 if (obj == NULL) {
1871 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1872 }
1873
1874 id3 = talloc_zero(obj, struct drsuapi_DsReplicaObjectIdentifier3);
1875 if (id3 == NULL) {
1876 return NT_STATUS_NO_MEMORY;
1877 }
1878
1879 /* windows sometimes sends an extra two pad bytes here */
1880 ndr_err = ndr_pull_struct_blob(blob, id3, id3,
1881 (ndr_pull_flags_fn_t)ndr_pull_drsuapi_DsReplicaObjectIdentifier3);
1882 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1883 status = ndr_map_error2ntstatus(ndr_err);
1884 return status;
1885 }
1886
1887 status = dssync_create_mem(pctx, obj,
1888 active,
1889 id3, &mem);
1890 if (!NT_STATUS_IS_OK(status)) {
1891 return status;
1892 }
1893
1894 return NT_STATUS_OK;
1895 }
1896
1897 /****************************************************************
1898 ****************************************************************/
1899
1900 static NTSTATUS passdb_process_objects(struct dssync_context *ctx,
1901 TALLOC_CTX *mem_ctx,
1902 struct drsuapi_DsReplicaObjectListItemEx *cur,
1903 struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
1904 {
1905 NTSTATUS status = NT_STATUS_OK;
1906 struct dssync_passdb *pctx =
1907 talloc_get_type_abort(ctx->private_data,
1908 struct dssync_passdb);
1909
1910 for (; cur; cur = cur->next_object) {
1911 status = parse_object(pctx, mem_ctx, cur);
1912 if (!NT_STATUS_IS_OK(status)) {
1913 goto out;
1914 }
1915 }
1916
1917 out:
1918 return status;
1919 }
1920
1921 /****************************************************************
1922 ****************************************************************/
1923
1924 static NTSTATUS passdb_process_links(struct dssync_context *ctx,
1925 TALLOC_CTX *mem_ctx,
1926 uint32_t count,
1927 struct drsuapi_DsReplicaLinkedAttribute *links,
1928 struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
1929 {
1930 NTSTATUS status = NT_STATUS_OK;
1931 struct dssync_passdb *pctx =
1932 talloc_get_type_abort(ctx->private_data,
1933 struct dssync_passdb);
1934 uint32_t i;
1935
1936 for (i = 0; i < count; i++) {
1937 status = parse_link(pctx, mem_ctx, &links[i]);
1938 if (!NT_STATUS_IS_OK(status)) {
1939 goto out;
1940 }
1941 }
1942
1943 out:
1944 return status;
1945 }
1946
1947 /****************************************************************
1948 ****************************************************************/
1949
1950 const struct dssync_ops libnet_dssync_passdb_ops = {
1951 .startup = passdb_startup,
1952 .process_objects = passdb_process_objects,
1953 .process_links = passdb_process_links,
1954 .finish = passdb_finish,
1955 };
reg import