svn commit: samba r1777 - trunk/source/auth

[jra at samba.org]

Author: jra
Date: 2004-08-12 18:19:57 +0000 (Thu, 12 Aug 2004)
New Revision: 1777
WebSVN: http://websvn.samba.org/websvn/changeset.php?rep=samba&path=/&rev=1777&nolog=1
Log:
Fix based on code from Richard Renard <rrenard at idealx.com> to
enforce logon hours. ldap fixes to follow.
Jeremy.

Modified:
   trunk/source/auth/auth_sam.c

Changeset:
Modified: trunk/source/auth/auth_sam.c
===================================================================
--- trunk/source/auth/auth_sam.c	2004-08-12 17:50:14 UTC (rev 1776)
+++ trunk/source/auth/auth_sam.c	2004-08-12 18:19:57 UTC (rev 1777)
@@ -65,7 +65,44 @@
 				   lm_pw, nt_pw, user_sess_key, lm_sess_key);
 }
 
+/****************************************************************************
+ Check if a user is allowed to logon at this time. Note this is the
+ servers local time, as logon hours are just specified as a weekly
+ bitmask.
+****************************************************************************/
+                                                                                                              
+static BOOL logon_hours_ok(SAM_ACCOUNT *sampass)
+{
+	/* In logon hours first bit is Sunday from 12AM to 1AM */
+	extern struct timeval smb_last_time;
+	const uint8 *hours;
+	struct tm *utctime;
+	uint8 bitmask, bitpos;
 
+	hours = pdb_get_hours(sampass);
+	if (!hours) {
+		DEBUG(5,("logon_hours_ok: No hours restrictions for user %s\n",pdb_get_username(sampass)));
+		return True;
+	}
+
+	utctime = localtime(&smb_last_time.tv_sec);
+
+	/* find the corresponding byte and bit */
+	bitpos = (utctime->tm_wday * 24 + utctime->tm_hour) % 168;
+	bitmask = 1 << (bitpos % 8);
+
+	if (! (hours[bitpos/8] & bitmask)) {
+		DEBUG(1,("logon_hours_ok: Account for user %s not allowed to logon at this time (UTC %s).\n",
+			pdb_get_username(sampass), asctime(utctime) ));
+		return False;
+	}
+
+	DEBUG(5,("logon_hours_ok: user %s allowed to logon at this time (UTC %s)\n",
+		pdb_get_username(sampass), asctime(utctime) ));
+
+	return True;
+}
+
 /****************************************************************************
  Do a specific test for a SAM_ACCOUNT being vaild for this connection 
  (ie not disabled, expired and the like).
@@ -93,6 +130,11 @@
 		return NT_STATUS_ACCOUNT_LOCKED_OUT;
 	}
 
+	/* Quit if the account is not allowed to logon at this time. */
+	if (! logon_hours_ok(sampass)) {
+		return NT_STATUS_INVALID_LOGON_HOURS;
+	}
+
 	/* Test account expire time */
 	
 	kickoff_time = pdb_get_kickoff_time(sampass);