diff options
Diffstat (limited to 'source3/smbd/password.c')
| -rw-r--r-- | source3/smbd/password.c | 397 |
1 files changed, 0 insertions, 397 deletions
diff --git a/source3/smbd/password.c b/source3/smbd/password.c index 9df99ef6b1..27ba3bd01b 100644 --- a/source3/smbd/password.c +++ b/source3/smbd/password.c @@ -172,12 +172,6 @@ int register_initial_vuid(struct smbd_server_connection *sconn) { user_struct *vuser; - /* Paranoia check. */ - if(lp_security() == SEC_SHARE) { - smb_panic("register_initial_vuid: " - "Tried to register uid in security=share"); - } - /* Limit allowed vuids to 16bits - VUID_OFFSET. */ if (sconn->smb1.sessions.num_validated_vuids >= 0xFFFF-VUID_OFFSET) { return UID_FIELD_INVALID; @@ -352,394 +346,3 @@ int register_existing_vuid(struct smbd_server_connection *sconn, } return UID_FIELD_INVALID; } - -/**************************************************************************** - Add a name to the session users list. -****************************************************************************/ - -void add_session_user(struct smbd_server_connection *sconn, - const char *user) -{ - struct passwd *pw; - char *tmp; - - pw = Get_Pwnam_alloc(talloc_tos(), user); - - if (pw == NULL) { - return; - } - - if (sconn->smb1.sessions.session_userlist == NULL) { - sconn->smb1.sessions.session_userlist = SMB_STRDUP(pw->pw_name); - goto done; - } - - if (in_list(pw->pw_name,sconn->smb1.sessions.session_userlist,false)) { - goto done; - } - - if (strlen(sconn->smb1.sessions.session_userlist) > 128 * 1024) { - DEBUG(3,("add_session_user: session userlist already " - "too large.\n")); - goto done; - } - - if (asprintf(&tmp, "%s %s", - sconn->smb1.sessions.session_userlist, pw->pw_name) == -1) { - DEBUG(3, ("asprintf failed\n")); - goto done; - } - - SAFE_FREE(sconn->smb1.sessions.session_userlist); - sconn->smb1.sessions.session_userlist = tmp; - done: - TALLOC_FREE(pw); -} - -/**************************************************************************** - In security=share mode we need to store the client workgroup, as that's - what Vista uses for the NTLMv2 calculation. -****************************************************************************/ - -void add_session_workgroup(struct smbd_server_connection *sconn, - const char *workgroup) -{ - if (sconn->smb1.sessions.session_workgroup) { - SAFE_FREE(sconn->smb1.sessions.session_workgroup); - } - sconn->smb1.sessions.session_workgroup = smb_xstrdup(workgroup); -} - -/**************************************************************************** - In security=share mode we need to return the client workgroup, as that's - what Vista uses for the NTLMv2 calculation. -****************************************************************************/ - -const char *get_session_workgroup(struct smbd_server_connection *sconn) -{ - return sconn->smb1.sessions.session_workgroup; -} - -/**************************************************************************** - Check if a username is valid. -****************************************************************************/ - -static bool user_ok(const char *user, int snum) -{ - bool ret; - - ret = True; - - if (lp_invalid_users(snum)) { - char **invalid = str_list_copy(talloc_tos(), - lp_invalid_users(snum)); - if (invalid && - str_list_substitute(invalid, "%S", lp_servicename(snum))) { - - /* This is used in sec=share only, so no current user - * around to pass to str_list_sub_basic() */ - - if ( invalid && str_list_sub_basic(invalid, "", "") ) { - ret = !user_in_list(talloc_tos(), user, - (const char **)invalid); - } - } - TALLOC_FREE(invalid); - } - - if (ret && lp_valid_users(snum)) { - char **valid = str_list_copy(talloc_tos(), - lp_valid_users(snum)); - if ( valid && - str_list_substitute(valid, "%S", lp_servicename(snum)) ) { - - /* This is used in sec=share only, so no current user - * around to pass to str_list_sub_basic() */ - - if ( valid && str_list_sub_basic(valid, "", "") ) { - ret = user_in_list(talloc_tos(), user, - (const char **)valid); - } - } - TALLOC_FREE(valid); - } - - if (ret && lp_onlyuser(snum)) { - char **user_list = str_list_make_v3( - talloc_tos(), lp_username(snum), NULL); - if (user_list && - str_list_substitute(user_list, "%S", - lp_servicename(snum))) { - ret = user_in_list(talloc_tos(), user, - (const char **)user_list); - } - TALLOC_FREE(user_list); - } - - return(ret); -} - -/**************************************************************************** - Validate a group username entry. Return the username or NULL. -****************************************************************************/ - -static char *validate_group(struct smbd_server_connection *sconn, - char *group, DATA_BLOB password,int snum) -{ -#ifdef HAVE_NETGROUP - { - char *host, *user, *domain; - struct auth_context *actx = sconn->smb1.negprot.auth_context; - bool enc = sconn->smb1.negprot.encrypted_passwords; - setnetgrent(group); - while (getnetgrent(&host, &user, &domain)) { - if (user) { - if (user_ok(user, snum) && - password_ok(actx, enc, - get_session_workgroup(sconn), - user, - sconn->remote_address, - password)) { - endnetgrent(); - return(user); - } - } - } - endnetgrent(); - } -#endif - -#ifdef HAVE_GETGRENT - { - struct group *gptr; - struct auth_context *actx = sconn->smb1.negprot.auth_context; - bool enc = sconn->smb1.negprot.encrypted_passwords; - - setgrent(); - while ((gptr = (struct group *)getgrent())) { - if (strequal(gptr->gr_name,group)) - break; - } - - /* - * As user_ok can recurse doing a getgrent(), we must - * copy the member list onto the heap before - * use. Bug pointed out by leon@eatworms.swmed.edu. - */ - - if (gptr) { - char *member_list = NULL; - size_t list_len = 0; - char *member; - int i; - - for(i = 0; gptr->gr_mem && gptr->gr_mem[i]; i++) { - list_len += strlen(gptr->gr_mem[i])+1; - } - list_len++; - - member_list = (char *)SMB_MALLOC(list_len); - if (!member_list) { - endgrent(); - return NULL; - } - - *member_list = '\0'; - member = member_list; - - for(i = 0; gptr->gr_mem && gptr->gr_mem[i]; i++) { - size_t member_len = strlen(gptr->gr_mem[i])+1; - - DEBUG(10,("validate_group: = gr_mem = " - "%s\n", gptr->gr_mem[i])); - - strlcpy(member, gptr->gr_mem[i], - list_len - (member-member_list)); - member += member_len; - } - - endgrent(); - - member = member_list; - while (*member) { - if (user_ok(member,snum) && - password_ok(actx, enc, - get_session_workgroup(sconn), - member, - sconn->remote_address, - password)) { - char *name = talloc_strdup(talloc_tos(), - member); - SAFE_FREE(member_list); - return name; - } - - DEBUG(10,("validate_group = member = %s\n", - member)); - - member += strlen(member) + 1; - } - - SAFE_FREE(member_list); - } else { - endgrent(); - return NULL; - } - } -#endif - return(NULL); -} - -/**************************************************************************** - Check for authority to login to a service with a given username/password. - Note this is *NOT* used when logging on using sessionsetup_and_X. -****************************************************************************/ - -bool authorise_login(struct smbd_server_connection *sconn, - int snum, fstring user, DATA_BLOB password, - bool *guest) -{ - bool ok = False; - struct auth_context *actx = sconn->smb1.negprot.auth_context; - bool enc = sconn->smb1.negprot.encrypted_passwords; - -#ifdef DEBUG_PASSWORD - DEBUG(100,("authorise_login: checking authorisation on " - "user=%s pass=%s\n", user,password.data)); -#endif - - *guest = False; - - /* there are several possibilities: - 1) login as the given user with given password - 2) login as a previously registered username with the given - password - 3) login as a session list username with the given password - 4) login as a previously validated user/password pair - 5) login as the "user =" user with given password - 6) login as the "user =" user with no password - (guest connection) - 7) login as guest user with no password - - if the service is guest_only then steps 1 to 5 are skipped - */ - - /* now check the list of session users */ - if (!ok) { - char *auser; - char *user_list = NULL; - char *saveptr; - - if (sconn->smb1.sessions.session_userlist) - user_list = SMB_STRDUP(sconn->smb1.sessions.session_userlist); - else - user_list = SMB_STRDUP(""); - - if (!user_list) - return(False); - - for (auser = strtok_r(user_list, LIST_SEP, &saveptr); - !ok && auser; - auser = strtok_r(NULL, LIST_SEP, &saveptr)) { - fstring user2; - fstrcpy(user2,auser); - if (!user_ok(user2,snum)) - continue; - - if (password_ok(actx, enc, - get_session_workgroup(sconn), - user2, - sconn->remote_address, - password)) { - ok = True; - strlcpy(user,user2,sizeof(fstring)); - DEBUG(3,("authorise_login: ACCEPTED: session " - "list username (%s) and given " - "password ok\n", user)); - } - } - - SAFE_FREE(user_list); - } - - /* check the user= fields and the given password */ - if (!ok && lp_username(snum)) { - TALLOC_CTX *ctx = talloc_tos(); - char *auser; - char *user_list = talloc_strdup(ctx, lp_username(snum)); - char *saveptr; - - if (!user_list) { - goto check_guest; - } - - user_list = talloc_string_sub(ctx, - user_list, - "%S", - lp_servicename(snum)); - - if (!user_list) { - goto check_guest; - } - - for (auser = strtok_r(user_list, LIST_SEP, &saveptr); - auser && !ok; - auser = strtok_r(NULL, LIST_SEP, &saveptr)) { - if (*auser == '@') { - auser = validate_group(sconn,auser+1, - password,snum); - if (auser) { - ok = True; - fstrcpy(user,auser); - DEBUG(3,("authorise_login: ACCEPTED: " - "group username and given " - "password ok (%s)\n", user)); - } - } else { - fstring user2; - fstrcpy(user2,auser); - if (user_ok(user2,snum) && - password_ok(actx, enc, - get_session_workgroup(sconn), - user2, - sconn->remote_address, - password)) { - ok = True; - strlcpy(user,user2,sizeof(fstring)); - DEBUG(3,("authorise_login: ACCEPTED: " - "user list username and " - "given password ok (%s)\n", - user)); - } - } - } - } - - check_guest: - - /* check for a normal guest connection */ - if (!ok && GUEST_OK(snum)) { - struct passwd *guest_pw; - fstring guestname; - fstrcpy(guestname,lp_guestaccount()); - guest_pw = Get_Pwnam_alloc(talloc_tos(), guestname); - if (guest_pw != NULL) { - strlcpy(user,guestname,sizeof(fstring)); - ok = True; - DEBUG(3,("authorise_login: ACCEPTED: guest account " - "and guest ok (%s)\n", user)); - } else { - DEBUG(0,("authorise_login: Invalid guest account " - "%s??\n",guestname)); - } - TALLOC_FREE(guest_pw); - *guest = True; - } - - if (ok && !user_ok(user, snum)) { - DEBUG(0,("authorise_login: rejected invalid user %s\n",user)); - ok = False; - } - - return(ok); -} |