- group database API. oops and oh dear, the threat has been carried out:

  the pre-alpha "domain group" etc parameters have disappeared.

- interactive debug detection

- re-added mem_man (andrew's memory management, detects memory corruption)

- american spellings of "initialise" replaced with english spelling of
  "initialise".

- started on "lookup_name()" and "lookup_sid()" functions.  proper ones.

- moved lots of functions around.  created some modules of commonly used
  code.  e.g the password file locking code, which is used in groupfile.c
  and aliasfile.c and smbpass.c

- moved RID_TYPE_MASK up another bit.  this is really unfortunate, but
  there is no other "fast" way to identify users from groups from aliases.
  i do not believe that this code saves us anything (the multipliers)
  and puts us at a disadvantage (reduces the useable rid space).
  the designers of NT aren't silly: if they can get away with a user-
  interface-speed LsaLookupNames / LsaLookupSids, then so can we.  i
  spoke with isaac at the cifs conference, the only time for example that
  they do a security context check is on file create.  certainly not on
  individual file reads / writes, which would drastically hit their
  performance and ours, too.

- renamed myworkgroup to global_sam_name, amongst other things, when used
  in the rpc code.  there is also a global_member_name, as we are always
  responsible for a SAM database, the scope of which is limited by the role
  of the machine (e.g if a member of a workgroup, your SAM is for _local_
  logins only, and its name is the name of your server.  you even still
  have a SID.  see LsaQueryInfoPolicy, levels 3 and 5).

- updated functionality of groupname.c to be able to cope with names
  like DOMAIN\group and SERVER\alias.  used this code to be able to
  do aliases as well as groups.  this code may actually be better
  off being used in username mapping, too.

- created a connect to serverlist function in clientgen.c and used it
  in password.c

- initialisation in server.c depends on the role of the server.  well,
  it does now.

- rpctorture.  smbtorture.  EXERCISE EXTREME CAUTION.
(This used to be commit 0d21e1e6090b933f396c764af535ca3388a562db)

1 files changed, 204 insertions, 212 deletions

diff --git a/source3/rpc_server/srv_netlog.c b/source3/rpc_server/srv_netlog.c
index 04118800e2..77b17dca2f 100644
--- a/source3/rpc_server/srv_netlog.c
+++ b/source3/rpc_server/srv_netlog.c
@@ -1,4 +1,3 @@
-
 /* 
  *  Unix SMB/Netbios implementation.
  *  Version 1.9.
@@ -544,7 +543,8 @@ static uint32 net_login_interactive(NET_ID_INFO_1 *id1,
  net_login_network:
  *************************************************************************/
 static uint32 net_login_network(NET_ID_INFO_2 *id2,
-				struct smb_passwd *smb_pass)
+				struct smb_passwd *smb_pass,
+				user_struct *vuser)
 {
 	DEBUG(5,("net_login_network: lm_len: %d nt_len: %d\n",
 		id2->hdr_lm_chal_resp.str_str_len, 
@@ -593,221 +593,213 @@ static void api_net_sam_logon( uint16 vuid,
                                prs_struct *data,
                                prs_struct *rdata)
 {
-  NET_Q_SAM_LOGON q_l;
-  NET_ID_INFO_CTR ctr;	
-  NET_USER_INFO_3 usr_info;
-  uint32 status = 0x0;
-  DOM_CRED srv_cred;
-  struct smb_passwd *smb_pass = NULL;
-  UNISTR2 *uni_samlogon_user = NULL;
-
-  user_struct *vuser = NULL;
-
-  if ((vuser = get_valid_user_struct(vuid)) == NULL)
-    return;
-
-  q_l.sam_id.ctr = &ctr;
-
-  net_io_q_sam_logon("", &q_l, data, 0);
-
-  /* checks and updates credentials.  creates reply credentials */
-  if (!deal_with_creds(vuser->dc.sess_key, &(vuser->dc.clnt_cred), 
-                       &(q_l.sam_id.client.cred), &srv_cred))
-  {
-    status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
-  }
-  else
-  {
-    memcpy(&(vuser->dc.srv_cred), &(vuser->dc.clnt_cred), sizeof(vuser->dc.clnt_cred));
-  }
-
-  /* find the username */
-
-  if (status == 0)
-  {
-    switch (q_l.sam_id.logon_level)
-    {
-      case INTERACTIVE_LOGON_TYPE:
-      {
-        uni_samlogon_user = &(q_l.sam_id.ctr->auth.id1.uni_user_name);
-
-        DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
-        break;
-      }
-      case NET_LOGON_TYPE:
-      {
-        uni_samlogon_user = &(q_l.sam_id.ctr->auth.id2.uni_user_name);
-
-        DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
-        break;
-      }
-      default:
-      {
-        DEBUG(2,("SAM Logon: unsupported switch value\n"));
-        status = 0xC0000000 | NT_STATUS_INVALID_INFO_CLASS;
-        break;
-      }
-    } /* end switch */
-  } /* end if status == 0 */
-
-  /* check username exists */
-
-  if (status == 0)
-  {
-    pstrcpy(samlogon_user, unistrn2(uni_samlogon_user->buffer,
-            uni_samlogon_user->uni_str_len));
-
-    DEBUG(3,("User:[%s]\n", samlogon_user));
+	NET_Q_SAM_LOGON q_l;
+	NET_ID_INFO_CTR ctr;	
+	NET_USER_INFO_3 usr_info;
+	uint32 status = 0x0;
+	DOM_CRED srv_cred;
+	struct smb_passwd *smb_pass = NULL;
+	UNISTR2 *uni_samlogon_user = NULL;
 
-    /*
-     * Convert to a UNIX username.
-     */
-    map_username(samlogon_user);
+	user_struct *vuser = NULL;
 
-    /*
-     * Do any case conversions.
-     */
-    (void)Get_Pwnam(samlogon_user, True);
-
-    become_root(True);
-    smb_pass = getsmbpwnam(samlogon_user);
-    unbecome_root(True);
-
-    if (smb_pass == NULL)
-      status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
-    else if (smb_pass->acct_ctrl & ACB_PWNOTREQ)
-      status = 0;
-    else if (smb_pass->acct_ctrl & ACB_DISABLED)
-      status =  0xC0000000 | NT_STATUS_ACCOUNT_DISABLED;
-  }
-
-  /* Validate password - if required. */
-
-  if ((status == 0) && !(smb_pass->acct_ctrl & ACB_PWNOTREQ))
-  {
-    switch (q_l.sam_id.logon_level)
-    {
-      case INTERACTIVE_LOGON_TYPE:
-      {
-        /* interactive login. */
-        status = net_login_interactive(&q_l.sam_id.ctr->auth.id1, smb_pass, vuser);
-        break;
-      }
-      case NET_LOGON_TYPE:
-      {
-        /* network login.  lm challenge and 24 byte responses */
-        status = net_login_network(&q_l.sam_id.ctr->auth.id2, smb_pass);
-        break;
-      }
-    }
-  }
-	
-  /* lkclXXXX this is the point at which, if the login was
-     successful, that the SAM Local Security Authority should
-     record that the user is logged in to the domain.
-   */
-
-  /* return the profile plus other bits :-) */
-
-  if (status == 0)
-  {
-    DOM_GID *gids = NULL;
-    int num_gids = 0;
-    NTTIME dummy_time;
-    pstring logon_script;
-    pstring profile_path;
-    pstring home_dir;
-    pstring home_drive;
-    pstring my_name;
-    pstring my_workgroup;
-    pstring domain_groups;
-    uint32 r_uid;
-    uint32 r_gid;
-
-    /* set up pointer indicating user/password failed to be found */
-    usr_info.ptr_user_info = 0;
-
-    dummy_time.low  = 0xffffffff;
-    dummy_time.high = 0x7fffffff;
-
-    /* XXXX hack to get standard_sub_basic() to use sam logon username */
-    /* possibly a better way would be to do a become_user() call */
-    sam_logon_in_ssb = True;
-
-    pstrcpy(logon_script, lp_logon_script());
-    pstrcpy(profile_path, lp_logon_path());
-
-    pstrcpy(my_workgroup, lp_workgroup());
-
-    pstrcpy(home_drive, lp_logon_drive());
-    pstrcpy(home_dir, lp_logon_home());
-
-    pstrcpy(my_name, global_myname);
-    strupper(my_name);
+	if ((vuser = get_valid_user_struct(vuid)) == NULL)
+	return;
 
-    /*
-     * This is the point at which we get the group
-     * database - we should be getting the gid_t list
-     * from /etc/group and then turning the uids into
-     * rids and then into machine sids for this user.
-     * JRA.
-     */
+	q_l.sam_id.ctr = &ctr;
 
-    get_domain_user_groups(domain_groups, samlogon_user);
+	net_io_q_sam_logon("", &q_l, data, 0);
 
-    /*
-     * make_dom_gids allocates the gids array. JRA.
-     */
-    gids = NULL;
-    num_gids = make_dom_gids(domain_groups, &gids);
-
-    sam_logon_in_ssb = False;
-
-    if (pdb_name_to_rid(samlogon_user, &r_uid, &r_gid))
-    {
-      make_net_user_info3(&usr_info,
-                          &dummy_time, /* logon_time */
-                          &dummy_time, /* logoff_time */
-                          &dummy_time, /* kickoff_time */
-                          &dummy_time, /* pass_last_set_time */
-                          &dummy_time, /* pass_can_change_time */
-                          &dummy_time, /* pass_must_change_time */
-
-                          samlogon_user   , /* user_name */
-                          vuser->real_name, /* full_name */
-                          logon_script    , /* logon_script */
-                          profile_path    , /* profile_path */
-                          home_dir        , /* home_dir */
-                          home_drive      , /* dir_drive */
-
-                          0, /* logon_count */
-                          0, /* bad_pw_count */
-
-                          r_uid   , /* RID user_id */
-                          r_gid   , /* RID group_id */
-                          num_gids,    /* uint32 num_groups */
-                          gids    , /* DOM_GID *gids */
-                          0x20    , /* uint32 user_flgs (?) */
-
-                          NULL, /* char sess_key[16] */
-
-                          my_name     , /* char *logon_srv */
-                          my_workgroup, /* char *logon_dom */
-
-                          &global_sam_sid,     /* DOM_SID *dom_sid */
-                          NULL); /* char *other_sids */
-    }
-    else
-    {
-      status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
-    }
-
-    /* Free any allocated groups array. */
-    if(gids)
-      free((char *)gids);
-  }
-
-  net_reply_sam_logon(&q_l, rdata, &srv_cred, &usr_info, status);
+	/* checks and updates credentials.  creates reply credentials */
+	if (!deal_with_creds(vuser->dc.sess_key, &(vuser->dc.clnt_cred), 
+	                     &(q_l.sam_id.client.cred), &srv_cred))
+	{
+		status = 0xC0000000 | NT_STATUS_INVALID_HANDLE;
+	}
+	else
+	{
+		memcpy(&(vuser->dc.srv_cred), &(vuser->dc.clnt_cred), sizeof(vuser->dc.clnt_cred));
+	}
+
+	/* find the username */
+
+	if (status == 0)
+	{
+		switch (q_l.sam_id.logon_level)
+		{
+			case INTERACTIVE_LOGON_TYPE:
+			{
+				uni_samlogon_user = &(q_l.sam_id.ctr->auth.id1.uni_user_name);
+
+				DEBUG(3,("SAM Logon (Interactive). Domain:[%s].  ", lp_workgroup()));
+				break;
+			}
+			case NET_LOGON_TYPE:
+			{
+				uni_samlogon_user = &(q_l.sam_id.ctr->auth.id2.uni_user_name);
+
+				DEBUG(3,("SAM Logon (Network). Domain:[%s].  ", lp_workgroup()));
+				break;
+			}
+			default:
+			{
+				DEBUG(2,("SAM Logon: unsupported switch value\n"));
+				status = 0xC0000000 | NT_STATUS_INVALID_INFO_CLASS;
+				break;
+			}
+		} /* end switch */
+	} /* end if status == 0 */
+
+	/* check username exists */
+
+	if (status == 0)
+	{
+		pstrcpy(samlogon_user, unistrn2(uni_samlogon_user->buffer,
+		uni_samlogon_user->uni_str_len));
+
+		DEBUG(3,("User:[%s]\n", samlogon_user));
+
+		/*
+		 * Convert to a UNIX username.
+		 */
+		map_username(samlogon_user);
+
+		/*
+		 * Do any case conversions.
+		 */
+		(void)Get_Pwnam(samlogon_user, True);
+
+		become_root(True);
+		smb_pass = getsmbpwnam(samlogon_user);
+		unbecome_root(True);
+
+		if (smb_pass == NULL)
+		{
+			status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
+		}
+		else if (IS_BITS_SET_ALL(smb_pass->acct_ctrl, ACB_DISABLED) &&
+			 IS_BITS_CLR_ALL(smb_pass->acct_ctrl, ACB_PWNOTREQ))
+		{
+			status =  0xC0000000 | NT_STATUS_ACCOUNT_DISABLED;
+		}
+	}
+
+	/* validate password - if required */
+
+	if (status == 0 && !(IS_BITS_SET_ALL(smb_pass->acct_ctrl, ACB_PWNOTREQ)))
+	{
+		switch (q_l.sam_id.logon_level)
+		{
+			case INTERACTIVE_LOGON_TYPE:
+			{
+				/* interactive login. */
+				status = net_login_interactive(&q_l.sam_id.ctr->auth.id1, smb_pass, vuser);
+				break;
+			}
+			case NET_LOGON_TYPE:
+			{
+				/* network login.  lm challenge and 24 byte responses */
+				status = net_login_network(&q_l.sam_id.ctr->auth.id2, smb_pass, vuser);
+				break;
+			}
+		}
+	}
+
+	/* lkclXXXX this is the point at which, if the login was
+	successful, that the SAM Local Security Authority should
+	record that the user is logged in to the domain.
+	*/
+
+	/* return the profile plus other bits :-) */
+
+	if (status == 0)
+	{
+		DOM_GID *gids = NULL;
+		int num_gids = 0;
+		NTTIME dummy_time;
+		pstring logon_script;
+		pstring profile_path;
+		pstring home_dir;
+		pstring home_drive;
+		pstring my_name;
+		pstring my_workgroup;
+		DOMAIN_GRP *grp_mem;
+		uint32 r_uid;
+		uint32 r_gid;
+
+		/* set up pointer indicating user/password failed to be found */
+		usr_info.ptr_user_info = 0;
+
+		dummy_time.low  = 0xffffffff;
+		dummy_time.high = 0x7fffffff;
+
+		/* XXXX hack to get standard_sub_basic() to use sam logon username */
+		/* possibly a better way would be to do a become_user() call */
+		sam_logon_in_ssb = True;
+
+		pstrcpy(logon_script, lp_logon_script());
+		pstrcpy(profile_path, lp_logon_path());
+
+		pstrcpy(my_workgroup, lp_workgroup());
+
+		pstrcpy(home_drive, lp_logon_drive());
+		pstrcpy(home_dir, lp_logon_home());
+		pstrcpy(my_name, global_myname);
+		strupper(my_name);
+
+		status = lookup_user_rids(samlogon_user, &r_uid, &r_gid);
+		status = status == 0 ? getusergroupsnam(samlogon_user, &grp_mem, &num_gids) : 0xC0000000 | NT_STATUS_INVALID_PRIMARY_GROUP;
+
+		if (status == 0x0)
+		{
+			gids = NULL;
+			num_gids = make_dom_gids(grp_mem, num_gids, &gids);
+
+			make_net_user_info3(&usr_info,
+				&dummy_time, /* logon_time */
+				&dummy_time, /* logoff_time */
+				&dummy_time, /* kickoff_time */
+				&dummy_time, /* pass_last_set_time */
+				&dummy_time, /* pass_can_change_time */
+				&dummy_time, /* pass_must_change_time */
+
+				samlogon_user   , /* user_name */
+				vuser->real_name, /* full_name */
+				logon_script    , /* logon_script */
+				profile_path    , /* profile_path */
+				home_dir        , /* home_dir */
+				home_drive      , /* dir_drive */
+
+				0, /* logon_count */
+				0, /* bad_pw_count */
+
+				r_uid   , /* RID user_id */
+				r_gid   , /* RID group_id */
+				num_gids,    /* uint32 num_groups */
+				gids    , /* DOM_GID *gids */
+				0x20    , /* uint32 user_flgs (?) */
+
+				NULL, /* char sess_key[16] */
+
+				my_name     , /* char *logon_srv */
+				my_workgroup, /* char *logon_dom */
+
+				&global_sam_sid,     /* DOM_SID *dom_sid */
+				NULL); /* char *other_sids */
+		}
+		else
+		{
+			status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
+		}
+
+		/* Free any allocated groups array. */
+		if (gids)
+		{
+			free((char *)gids);
+		}
+	}
+
+	net_reply_sam_logon(&q_l, rdata, &srv_cred, &usr_info, status);
 }