[SCM] Samba Shared Repository - branch v3-2-test updated -
initial-v3-2-test-2106-g8ee7dfa
Günther Deschner
gd at samba.org
Tue Feb 12 13:51:26 GMT 2008
The branch, v3-2-test has been updated
via 8ee7dfad2e3a40e378398ea20158d3c7e7168cba (commit)
from 51184f8aea1cf58f8358b7f7736b50873aec578a (commit)
http://gitweb.samba.org/?samba.git;a=shortlog;h=v3-2-test
- Log -----------------------------------------------------------------
commit 8ee7dfad2e3a40e378398ea20158d3c7e7168cba
Author: Günther Deschner <gd at samba.org>
Date: Tue Feb 12 02:10:40 2008 +0100
Merge _samr_SetUserInfo and _samr_SetUserInfo2 into one call.
Guenther
-----------------------------------------------------------------------
Summary of changes:
source/rpc_server/srv_samr_nt.c | 287 +++++++++++++++------------------------
1 files changed, 107 insertions(+), 180 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source/rpc_server/srv_samr_nt.c b/source/rpc_server/srv_samr_nt.c
index e87d43d..412aa9d 100644
--- a/source/rpc_server/srv_samr_nt.c
+++ b/source/rpc_server/srv_samr_nt.c
@@ -3792,30 +3792,33 @@ static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
}
/*******************************************************************
- _samr_SetUserInfo
+ samr_SetUserInfo_internal
********************************************************************/
-NTSTATUS _samr_SetUserInfo(pipes_struct *p,
- struct samr_SetUserInfo *r)
+static NTSTATUS samr_SetUserInfo_internal(const char *fn_name,
+ pipes_struct *p,
+ struct policy_handle *user_handle,
+ uint16_t level,
+ union samr_UserInfo *info)
{
NTSTATUS status;
struct samu *pwd = NULL;
DOM_SID sid;
- POLICY_HND *pol = r->in.user_handle;
- uint16 switch_value = r->in.level;
- union samr_UserInfo *info = r->in.info;
- uint32 acc_granted;
- uint32 acc_required;
+ POLICY_HND *pol = user_handle;
+ uint16_t switch_value = level;
+ uint32_t acc_granted;
+ uint32_t acc_required;
bool ret;
bool has_enough_rights = False;
- uint32 acb_info;
+ uint32_t acb_info;
DISP_INFO *disp_info = NULL;
- DEBUG(5, ("_samr_SetUserInfo: %d\n", __LINE__));
+ DEBUG(5,("%s: %d\n", fn_name, __LINE__));
/* find the policy handle. open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info))
+ if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info)) {
return NT_STATUS_INVALID_HANDLE;
+ }
/* This is tricky. A WinXP domain join sets
(SA_RIGHT_USER_SET_PASSWORD|SA_RIGHT_USER_SET_ATTRIBUTES|SA_RIGHT_USER_ACCT_FLAGS_EXPIRY)
@@ -3832,26 +3835,28 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
acc_required = SA_RIGHT_USER_SET_PASSWORD;
break;
default:
- acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
+ acc_required = SA_RIGHT_USER_SET_PASSWORD |
+ SA_RIGHT_USER_SET_ATTRIBUTES |
+ SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
break;
}
status = access_check_samr_function(acc_granted,
acc_required,
- "_samr_SetUserInfo");
+ fn_name);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
- sid_string_dbg(&sid), switch_value));
+ DEBUG(5, ("%s: sid:%s, level:%d\n",
+ fn_name, sid_string_dbg(&sid), switch_value));
if (info == NULL) {
- DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
+ DEBUG(5, ("%s: NULL info level\n", fn_name));
return NT_STATUS_INVALID_INFO_CLASS;
}
- if ( !(pwd = samu_new( NULL )) ) {
+ if (!(pwd = samu_new(NULL))) {
return NT_STATUS_NO_MEMORY;
}
@@ -3859,7 +3864,7 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
ret = pdb_getsampwsid(pwd, &sid);
unbecome_root();
- if ( !ret ) {
+ if (!ret) {
TALLOC_FREE(pwd);
return NT_STATUS_NO_SUCH_USER;
}
@@ -3868,30 +3873,74 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
/* check to see if we have the sufficient rights */
acb_info = pdb_get_acct_ctrl(pwd);
- if ( acb_info & ACB_WSTRUST )
- has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account);
- else if ( acb_info & ACB_NORMAL )
- has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
- else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) {
- if ( lp_enable_privileges() )
- has_enough_rights = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
+ if (acb_info & ACB_WSTRUST)
+ has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
+ &se_machine_account);
+ else if (acb_info & ACB_NORMAL)
+ has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
+ &se_add_users);
+ else if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
+ if (lp_enable_privileges()) {
+ has_enough_rights = nt_token_check_domain_rid(p->pipe_user.nt_user_token,
+ DOMAIN_GROUP_RID_ADMINS);
+ }
}
- DEBUG(5, ("_samr_SetUserInfo: %s does%s possess sufficient rights\n",
+ DEBUG(5, ("%s: %s does%s possess sufficient rights\n",
+ fn_name,
uidtoname(p->pipe_user.ut.uid),
has_enough_rights ? "" : " not"));
/* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
- if ( has_enough_rights )
+ if (has_enough_rights) {
become_root();
+ }
/* ok! user info levels (lots: see MSDEV help), off we go... */
switch (switch_value) {
+
+ case 7:
+ status = set_user_info_7(p->mem_ctx,
+ &info->info7, pwd);
+ break;
+
+ case 16:
+ if (!set_user_info_16(&info->info16, pwd)) {
+ status = NT_STATUS_ACCESS_DENIED;
+ }
+ break;
+
case 18:
- if (!set_user_info_18(&info->info18, pwd))
+ /* Used by AS/U JRA. */
+ if (!set_user_info_18(&info->info18, pwd)) {
status = NT_STATUS_ACCESS_DENIED;
+ }
+ break;
+
+ case 20:
+ if (!set_user_info_20(&info->info20, pwd)) {
+ status = NT_STATUS_ACCESS_DENIED;
+ }
+ break;
+
+ case 21:
+ status = set_user_info_21(p->mem_ctx,
+ &info->info21, pwd);
+ break;
+
+ case 23:
+ if (!p->session_key.length) {
+ status = NT_STATUS_NO_USER_SESSION_KEY;
+ }
+ SamOEMhashBlob(info->info23.password.data, 516,
+ &p->session_key);
+
+ dump_data(100, info->info23.password.data, 516);
+
+ status = set_user_info_23(p->mem_ctx,
+ &info->info23, pwd);
break;
case 24:
@@ -3904,15 +3953,17 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
dump_data(100, info->info24.password.data, 516);
- if (!set_user_info_pw(info->info24.password.data, pwd))
+ if (!set_user_info_pw(info->info24.password.data, pwd)) {
status = NT_STATUS_ACCESS_DENIED;
+ }
break;
case 25:
if (!p->session_key.length) {
status = NT_STATUS_NO_USER_SESSION_KEY;
}
- encode_or_decode_arc4_passwd_buffer(info->info25.password.data, &p->session_key);
+ encode_or_decode_arc4_passwd_buffer(info->info25.password.data,
+ &p->session_key);
dump_data(100, info->info25.password.data, 532);
@@ -3921,32 +3972,23 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
- if (!set_user_info_pw(info->info25.password.data, pwd))
+ if (!set_user_info_pw(info->info25.password.data, pwd)) {
status = NT_STATUS_ACCESS_DENIED;
+ }
break;
case 26:
if (!p->session_key.length) {
status = NT_STATUS_NO_USER_SESSION_KEY;
}
- encode_or_decode_arc4_passwd_buffer(info->info26.password.data, &p->session_key);
+ encode_or_decode_arc4_passwd_buffer(info->info26.password.data,
+ &p->session_key);
dump_data(100, info->info26.password.data, 516);
- if (!set_user_info_pw(info->info26.password.data, pwd))
+ if (!set_user_info_pw(info->info26.password.data, pwd)) {
status = NT_STATUS_ACCESS_DENIED;
- break;
-
- case 23:
- if (!p->session_key.length) {
- status = NT_STATUS_NO_USER_SESSION_KEY;
}
- SamOEMhashBlob(info->info23.password.data, 516, &p->session_key);
-
- dump_data(100, info->info23.password.data, 516);
-
- status = set_user_info_23(p->mem_ctx,
- &info->info23, pwd);
break;
default:
@@ -3955,8 +3997,9 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
done:
- if ( has_enough_rights )
+ if (has_enough_rights) {
unbecome_root();
+ }
/* ================ END SeMachineAccountPrivilege BLOCK ================ */
@@ -3968,147 +4011,31 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
}
/*******************************************************************
+ _samr_SetUserInfo
+ ********************************************************************/
+
+NTSTATUS _samr_SetUserInfo(pipes_struct *p,
+ struct samr_SetUserInfo *r)
+{
+ return samr_SetUserInfo_internal("_samr_SetUserInfo",
+ p,
+ r->in.user_handle,
+ r->in.level,
+ r->in.info);
+}
+
+/*******************************************************************
_samr_SetUserInfo2
********************************************************************/
NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
struct samr_SetUserInfo2 *r)
{
- NTSTATUS status;
- struct samu *pwd = NULL;
- DOM_SID sid;
- union samr_UserInfo *info = r->in.info;
- POLICY_HND *pol = r->in.user_handle;
- uint16 switch_value = r->in.level;
- uint32 acc_granted;
- uint32 acc_required;
- bool ret;
- bool has_enough_rights = False;
- uint32 acb_info;
- DISP_INFO *disp_info = NULL;
-
- DEBUG(5, ("_samr_SetUserInfo2: %d\n", __LINE__));
-
- /* find the policy handle. open a policy on it. */
- if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info))
- return NT_STATUS_INVALID_HANDLE;
-
-
-#if 0 /* this really should be applied on a per info level basis --jerry */
-
- /* observed when joining XP client to Samba domain */
- acc_required = SA_RIGHT_USER_SET_PASSWORD | SA_RIGHT_USER_SET_ATTRIBUTES | SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
-#else
- acc_required = SA_RIGHT_USER_SET_ATTRIBUTES;
-#endif
-
- status = access_check_samr_function(acc_granted,
- acc_required,
- "_samr_SetUserInfo2");
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
-
- DEBUG(5,("_samr_SetUserInfo2: sid:%s\n",
- sid_string_dbg(&sid)));
-
- if (info == NULL) {
- DEBUG(5,("_samr_SetUserInfo2: NULL info level\n"));
- return NT_STATUS_INVALID_INFO_CLASS;
- }
-
- if ( !(pwd = samu_new( NULL )) ) {
- return NT_STATUS_NO_MEMORY;
- }
-
- become_root();
- ret = pdb_getsampwsid(pwd, &sid);
- unbecome_root();
-
- if ( !ret ) {
- TALLOC_FREE(pwd);
- return NT_STATUS_NO_SUCH_USER;
- }
-
- acb_info = pdb_get_acct_ctrl(pwd);
- if ( acb_info & ACB_WSTRUST )
- has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account);
- else if ( acb_info & ACB_NORMAL )
- has_enough_rights = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
- else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) {
- if ( lp_enable_privileges() )
- has_enough_rights = nt_token_check_domain_rid( p->pipe_user.nt_user_token, DOMAIN_GROUP_RID_ADMINS );
- }
-
- DEBUG(5, ("_samr_SetUserInfo2: %s does%s possess sufficient rights\n",
- uidtoname(p->pipe_user.ut.uid),
- has_enough_rights ? "" : " not"));
-
- /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
-
- if ( has_enough_rights )
- become_root();
-
- /* ok! user info levels (lots: see MSDEV help), off we go... */
-
- switch (switch_value) {
- case 7:
- status = set_user_info_7(p->mem_ctx,
- &info->info7, pwd);
- break;
- case 16:
- if (!set_user_info_16(&info->info16, pwd))
- status = NT_STATUS_ACCESS_DENIED;
- break;
- case 18:
- /* Used by AS/U JRA. */
- if (!set_user_info_18(&info->info18, pwd))
- status = NT_STATUS_ACCESS_DENIED;
- break;
- case 20:
- if (!set_user_info_20(&info->info20, pwd))
- status = NT_STATUS_ACCESS_DENIED;
- break;
- case 21:
- status = set_user_info_21(p->mem_ctx,
- &info->info21, pwd);
- break;
- case 23:
- if (!p->session_key.length) {
- status = NT_STATUS_NO_USER_SESSION_KEY;
- }
- SamOEMhashBlob(info->info23.password.data, 516, &p->session_key);
-
- dump_data(100, info->info23.password.data, 516);
-
- status = set_user_info_23(p->mem_ctx,
- &info->info23, pwd);
- break;
- case 26:
- if (!p->session_key.length) {
- status = NT_STATUS_NO_USER_SESSION_KEY;
- }
- encode_or_decode_arc4_passwd_buffer(info->info26.password.data, &p->session_key);
-
- dump_data(100, info->info26.password.data, 516);
-
- if (!set_user_info_pw(info->info26.password.data, pwd))
- status = NT_STATUS_ACCESS_DENIED;
- break;
- default:
- status = NT_STATUS_INVALID_INFO_CLASS;
- }
-
- if ( has_enough_rights )
- unbecome_root();
-
- /* ================ END SeMachineAccountPrivilege BLOCK ================ */
-
- if (NT_STATUS_IS_OK(status)) {
- force_flush_samr_cache(disp_info);
- }
-
- return status;
+ return samr_SetUserInfo_internal("_samr_SetUserInfo2",
+ p,
+ r->in.user_handle,
+ r->in.level,
+ r->in.info);
}
/*********************************************************************
--
Samba Shared Repository
More information about the samba-cvs
mailing list