diff options
Diffstat (limited to 'source4/lib/samba3')
| -rw-r--r-- | source4/lib/samba3/README | 8 | ||||
| -rw-r--r-- | source4/lib/samba3/STATUS | 68 | ||||
| -rw-r--r-- | source4/lib/samba3/config.mk | 10 | ||||
| -rw-r--r-- | source4/lib/samba3/samba3.h | 214 | ||||
| -rw-r--r-- | source4/lib/samba3/smbpasswd.c | 206 |
5 files changed, 506 insertions, 0 deletions
diff --git a/source4/lib/samba3/README b/source4/lib/samba3/README new file mode 100644 index 0000000000..83520f673d --- /dev/null +++ b/source4/lib/samba3/README @@ -0,0 +1,8 @@ +This directory contains various files and functions for the purpose of +Samba3 import, migration and compatibility. + +For example, the first file in this directory (smbpasswd.c) handles +portions of the smbpasswd file format. + +The other files in this directory support reading the various +TDB databases from Samba3. diff --git a/source4/lib/samba3/STATUS b/source4/lib/samba3/STATUS new file mode 100644 index 0000000000..e4644526df --- /dev/null +++ b/source4/lib/samba3/STATUS @@ -0,0 +1,68 @@ +--- Samba3 -> Samba4 Upgrade --- +(C) 2005 Jelmer Vernooij <jelmer@samba.org> +Published under the GNU GPL + +Sponsored by the Google Summer of Code program (http://code.google.com/summerofcode.html) +Mentored by Andrew Bartlett <abartlet@samba.org> +Thanks! + +Done: + - Reading wins.dat + - Reading registry.tdb + - Reading passdb.tdb + - Reading account_policy.tdb + - Reading group_mappings.tdb + - Reading winbindd_idmap.tdb + - Reading share_info.tdb + - Reading secrets.tdb + - Reading smbpasswd + - Reading + writing (generic) smb.conf files + - Testsuite for read support mentioned above + - Console utility for dumping Samba information + - Import user accounts in Samba4 + - Import groups in Samba4 + - Import secrets in Samba4 + - Import WINS data in Samba4 + - Dump idmap data to LDB + - Import registry keys/values in Samba4 + - Import account policies in Samba4 + - Testsuite for upgrade + - Console utility from upgrading from Samba3 -> Samba4 + - SWAT (Web interface) support for upgrading from Samba3 -> Samba4 + - LDB generic mapping module + - (Experimental) Samba4 LDB <-> Samba3 LDAP mapping module based on LDB generic mapping module + - Testsuite for Samba4 LDB <-> Samba3 LDAP mapping module + +Source files: +source/lib/ldb/modules/ldb_map.c +source/lib/ldb/modules/ldb_map.h +source/lib/samba3/group.c +source/lib/samba3/idmap.c +source/lib/samba3/policy.c +source/lib/samba3/registry.c +source/lib/samba3/samba3.c +source/lib/samba3/secrets.c +source/lib/samba3/share_info.c +source/lib/samba3/smbpasswd.c +source/lib/samba3/tdbsam.c +source/lib/samba3/winsdb.c +source/lib/samba3/samba3.h +source/scripting/libjs/upgrade.js +source/scripting/ejs/smbcalls_param.c +source/scripting/ejs/smbcalls_samba3.c +source/param/generic.c +source/param/generic.h +testdata/samba3/verify +testprogs/ejs/samba3sam +source/setup/upgrade +source/scripting/bin/samba3dump +source/dsdb/samdb/ldb_modules/samba3sam.c +source/script/tests/test_s3upgrade.sh +swat/install/samba3.esp + +Known remaining issues: + - [upgrade] Conversion from the smbpasswd/TDB passwords to ntPwdHash / lmPwdHash is broken. Couldn't find out why. + - [ldb_map] Conversion of attribute names in DN's is still a bit dodgy + - [ldb_map] mapped objectClass names may be mentioned multiple times in returned records + - [ldb_map] add/modify support not tested very well with LDAP yet (only LDB+TDB) + - [ldb_map] group membership is not yet mapped (only primaryGroupID / sambaPrimaryGroupSID) diff --git a/source4/lib/samba3/config.mk b/source4/lib/samba3/config.mk new file mode 100644 index 0000000000..e089149393 --- /dev/null +++ b/source4/lib/samba3/config.mk @@ -0,0 +1,10 @@ +################################################ +# Start SUBSYSTEM LIBSAMBA3 +[SUBSYSTEM::SMBPASSWD] +PRIVATE_DEPENDENCIES = CHARSET LIBSAMBA-UTIL +# End SUBSYSTEM LIBSAMBA3 +################################################ + +SMBPASSWD_OBJ_FILES = $(libsrcdir)/samba3/smbpasswd.o + +$(eval $(call proto_header_template,$(libsrcdir)/samba3/samba3_smbpasswd_proto.h,$(SMBPASSWD_OBJ_FILES:.o=.c))) diff --git a/source4/lib/samba3/samba3.h b/source4/lib/samba3/samba3.h new file mode 100644 index 0000000000..aea87dac14 --- /dev/null +++ b/source4/lib/samba3/samba3.h @@ -0,0 +1,214 @@ +/* + Unix SMB/CIFS implementation. + Samba3 interfaces + Copyright (C) Jelmer Vernooij 2005. + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +#ifndef _SAMBA3_H /* _SAMBA3_H */ +#define _SAMBA3_H + +#include "librpc/gen_ndr/security.h" +#include "librpc/gen_ndr/samr.h" +#include "param/param.h" + +struct samba3_samaccount { + uint32_t logon_time, + logoff_time, + kickoff_time, + bad_password_time, + pass_last_set_time, + pass_can_change_time, + pass_must_change_time; + char *username; + char *domain; + char *nt_username; + char *dir_drive; + char *unknown_str; + char *munged_dial; + char *fullname; + char *homedir; + char *logon_script; + char *profile_path; + char *acct_desc; + char *workstations; + uint32_t user_rid, group_rid, hours_len, unknown_6; + uint16_t acct_ctrl, logon_divs; + uint16_t bad_password_count, logon_count; + struct samr_Password lm_pw, nt_pw; + uint8_t *nt_pw_hist_ptr; + uint8_t *hours; +}; + +struct samba3_groupmapping { + gid_t gid; + struct dom_sid *sid; + int sid_name_use; + const char *nt_name; + const char *comment; +}; + +struct samba3_alias { + struct dom_sid *sid; + uint32_t member_count; + struct dom_sid **members; +}; + +struct samba3_groupdb { + uint32_t groupmap_count; + struct samba3_groupmapping *groupmappings; + + uint32_t alias_count; + struct samba3_alias *aliases; +}; + +struct samba3_idmap_mapping +{ + enum { IDMAP_GROUP, IDMAP_USER } type; + uint32_t unix_id; + struct dom_sid *sid; +}; + +struct samba3_idmapdb +{ + /* High water marks */ + uint32_t user_hwm; + uint32_t group_hwm; + + uint32_t mapping_count; + struct samba3_idmap_mapping *mappings; +}; + +struct samba3_winsdb_entry +{ + char *name; + int nb_flags; + int type; + time_t ttl; + uint32_t ip_count; + struct in_addr *ips; +}; + +struct samba3_policy +{ + uint32_t min_password_length; + uint32_t password_history; + uint32_t user_must_logon_to_change_password; + uint32_t maximum_password_age; + uint32_t minimum_password_age; + uint32_t lockout_duration; + uint32_t reset_count_minutes; + uint32_t bad_lockout_minutes; + uint32_t disconnect_time; + uint32_t refuse_machine_password_change; +}; + +struct samba3_regval { + char *name; + uint16_t type; + DATA_BLOB data; +}; + +struct samba3_regkey { + char *name; + + uint32_t value_count; + struct samba3_regval *values; + + uint32_t subkey_count; + char **subkeys; +}; + +struct samba3_regdb +{ + uint32_t key_count; + struct samba3_regkey *keys; +}; + +struct samba3_secrets +{ + struct cli_credentials *ipc_cred; + + uint32_t ldappw_count; + struct samba3_ldappw + { + char *dn; + char *password; + } *ldappws; + + uint32_t domain_count; + struct samba3_domainsecrets + { + char *name; + struct dom_sid sid; + struct GUID guid; + char *plaintext_pw; + time_t last_change_time; + struct { + uint8_t hash[16]; + time_t mod_time; + } hash_pw; + int sec_channel_type; + } *domains; + + uint32_t trusted_domain_count; + struct samba3_trusted_dom_pass { + uint32_t uni_name_len; + const char *uni_name[32]; /* unicode domain name */ + const char *pass; /* trust relationship's password */ + time_t mod_time; + struct dom_sid domain_sid; /* remote domain's sid */ + } *trusted_domains; + + uint32_t afs_keyfile_count; + + struct samba3_afs_keyfile { + uint32_t nkeys; + struct { + uint32_t kvno; + char key[8]; + } entry[8]; + char *cell; + } *afs_keyfiles; +}; + +struct samba3_share_info { + char *name; + struct security_descriptor secdesc; +}; + +struct samba3 +{ + struct param_context *configuration; + + uint32_t winsdb_count; + struct samba3_winsdb_entry *winsdb_entries; + + uint32_t samaccount_count; + struct samba3_samaccount *samaccounts; + + uint32_t share_count; + struct samba3_share_info *shares; + + struct samba3_secrets secrets; + struct samba3_groupdb group; + struct samba3_idmapdb idmap; + struct samba3_policy policy; + struct samba3_regdb registry; +}; + +#include "lib/samba3/samba3_smbpasswd_proto.h" + +#endif /* _SAMBA3_H */ diff --git a/source4/lib/samba3/smbpasswd.c b/source4/lib/samba3/smbpasswd.c new file mode 100644 index 0000000000..47c826f9df --- /dev/null +++ b/source4/lib/samba3/smbpasswd.c @@ -0,0 +1,206 @@ +/* + Unix SMB/CIFS implementation. + smbpasswd file format routines + + Copyright (C) Andrew Tridgell 1992-1998 + Modified by Jeremy Allison 1995. + Modified by Gerald (Jerry) Carter 2000-2001 + Copyright (C) Tim Potter 2001 + Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005 + Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2005 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +/*! \file lib/smbpasswd.c + + The smbpasswd file is used to store encrypted passwords in a similar + fashion to the /etc/passwd file. The format is colon separated fields + with one user per line like so: + + <username>:<uid>:<lanman hash>:<nt hash>:<acb info>:<last change time> + + The username and uid must correspond to an entry in the /etc/passwd + file. The lanman and nt password hashes are 32 hex digits corresponding + to the 16-byte lanman and nt hashes respectively. + + The password last change time is stored as a string of the format + LCD-<change time> where the change time is expressed as an + + 'N' No password + 'D' Disabled + 'H' Homedir required + 'T' Temp account. + 'U' User account (normal) + 'M' MNS logon user account - what is this ? + 'W' Workstation account + 'S' Server account + 'L' Locked account + 'X' No Xpiry on password + 'I' Interdomain trust account + +*/ + +#include "includes.h" +#include "system/locale.h" +#include "lib/samba3/samba3.h" + +/*! Convert 32 hex characters into a 16 byte array. */ + +struct samr_Password *smbpasswd_gethexpwd(TALLOC_CTX *mem_ctx, const char *p) +{ + int i; + unsigned char lonybble, hinybble; + const char *hexchars = "0123456789ABCDEF"; + const char *p1, *p2; + struct samr_Password *pwd = talloc(mem_ctx, struct samr_Password); + + if (!p) return NULL; + + for (i = 0; i < (sizeof(pwd->hash) * 2); i += 2) + { + hinybble = toupper(p[i]); + lonybble = toupper(p[i + 1]); + + p1 = strchr_m(hexchars, hinybble); + p2 = strchr_m(hexchars, lonybble); + + if (!p1 || !p2) { + return NULL; + } + + hinybble = PTR_DIFF(p1, hexchars); + lonybble = PTR_DIFF(p2, hexchars); + + pwd->hash[i / 2] = (hinybble << 4) | lonybble; + } + return pwd; +} + +/*! Convert a 16-byte array into 32 hex characters. */ + struct samr_Password *lm_hash_p = NULL; + struct samr_Password *nt_hash_p = NULL; + +char *smbpasswd_sethexpwd(TALLOC_CTX *mem_ctx, struct samr_Password *pwd, uint16_t acb_info) +{ + char *p; + if (pwd != NULL) { + int i; + p = talloc_array(mem_ctx, char, 33); + if (!p) { + return NULL; + } + + for (i = 0; i < sizeof(pwd->hash); i++) + slprintf(&p[i*2], 3, "%02X", pwd->hash[i]); + } else { + if (acb_info & ACB_PWNOTREQ) + p = talloc_strdup(mem_ctx, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX"); + else + p = talloc_strdup(mem_ctx, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"); + } + return p; +} + +/*! Decode the account control bits (ACB) info from a string. */ + +uint16_t smbpasswd_decode_acb_info(const char *p) +{ + uint16_t acb_info = 0; + bool finished = false; + + /* + * Check if the account type bits have been encoded after the + * NT password (in the form [NDHTUWSLXI]). + */ + + if (*p != '[') return 0; + + for (p++; *p && !finished; p++) + { + switch (*p) { + case 'N': /* 'N'o password. */ + acb_info |= ACB_PWNOTREQ; + break; + case 'D': /* 'D'isabled. */ + acb_info |= ACB_DISABLED; + break; + case 'H': /* 'H'omedir required. */ + acb_info |= ACB_HOMDIRREQ; + break; + case 'T': /* 'T'emp account. */ + acb_info |= ACB_TEMPDUP; + break; + case 'U': /* 'U'ser account (normal). */ + acb_info |= ACB_NORMAL; + break; + case 'M': /* 'M'NS logon user account. What is this ? */ + acb_info |= ACB_MNS; + break; + case 'W': /* 'W'orkstation account. */ + acb_info |= ACB_WSTRUST; + break; + case 'S': /* 'S'erver account. */ + acb_info |= ACB_SVRTRUST; + break; + case 'L': /* 'L'ocked account. */ + acb_info |= ACB_AUTOLOCK; + break; + case 'X': /* No 'X'piry on password */ + acb_info |= ACB_PWNOEXP; + break; + case 'I': /* 'I'nterdomain trust account. */ + acb_info |= ACB_DOMTRUST; + break; + + case ' ': + break; + case ':': + case '\n': + case ']': + default: + finished = true; + break; + } + } + + return acb_info; +} + +/*! Encode account control bits (ACBs) into a string. */ + +char *smbpasswd_encode_acb_info(TALLOC_CTX *mem_ctx, uint16_t acb_info) +{ + char *acct_str = talloc_array(mem_ctx, char, 35); + size_t i = 0; + + acct_str[i++] = '['; + + if (acb_info & ACB_PWNOTREQ ) acct_str[i++] = 'N'; + if (acb_info & ACB_DISABLED ) acct_str[i++] = 'D'; + if (acb_info & ACB_HOMDIRREQ) acct_str[i++] = 'H'; + if (acb_info & ACB_TEMPDUP ) acct_str[i++] = 'T'; + if (acb_info & ACB_NORMAL ) acct_str[i++] = 'U'; + if (acb_info & ACB_MNS ) acct_str[i++] = 'M'; + if (acb_info & ACB_WSTRUST ) acct_str[i++] = 'W'; + if (acb_info & ACB_SVRTRUST ) acct_str[i++] = 'S'; + if (acb_info & ACB_AUTOLOCK ) acct_str[i++] = 'L'; + if (acb_info & ACB_PWNOEXP ) acct_str[i++] = 'X'; + if (acb_info & ACB_DOMTRUST ) acct_str[i++] = 'I'; + + acct_str[i++] = ']'; + acct_str[i++] = '\0'; + + return acct_str; +} |