summaryrefslogtreecommitdiff
path: root/source3/rpc_server/srv_lsa.c
AgeCommit message (Collapse)AuthorFilesLines
2002-04-14Partly based on the work by mimir (Rafal SzczesniakAndrew Bartlett1-0/+2
<mimir@diament.ists.pwr.wroc.pl>) this patch allows samba to correctly enumerate its trusted domains - by exaimining the keys in the secrets.tdb file. This patch has been tested with both NT4 and rpcclient/wbinfo, and adds some extra functionality to talloc and rpc_parse to allow it to deal with already unicode strings. Finally, this cleans up some const warnings that were in net_rpc.c by pushing another dash of const into the rpc client code. Andrew Bartlett (This used to be commit 0bdd94cb992b40942aaf2e5e0efd2868b4686296)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2001-12-14add lsa_query_secobj server code. level 4 is the ACL, level 1 is theJean-François Micouleau1-0/+31
owner. that's basic stuff. got the POLICY_ define from TNG but they are also in an include file in the NT SDK. J.F. (This used to be commit 84289a9bf42847981926e198ad36c050904fa9ed)
2001-11-29Changed again how the privilege list is handled in the group mapping code.Jean-François Micouleau1-14/+111
This time it's a PRIVILEGE_SET struct instead of a simple uint32 array. It makes much more sense. Also added a uint32 systemaccount to the GROUP_MAP struct as some privilege showing in USRMGR.EXE are not real privs but a bitmask flag. I guess it's an heritage from NT 3.0 ! I could setup an NT 3.1 box to verify, but I'm too lazy (yes I still have my CDs). Added 3 more LSA calls: SetSystemAccount, AddPrivileges and RemovePrivileges, we can manage all this privilege from UserManager. Time to change the NT_USER_TOKEN struct and add checks in all the rpc functions. Fun, fun, fun. J.F. (This used to be commit 3f0a9ef2b8c626cfa2878394bb7b642342342bf3)
2001-10-02Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter1-2/+0
(This used to be commit 2d0922b0eabfdc0aaf1d0797482fef47ed7fde8e)
2001-07-09implement:Jean-François Micouleau1-0/+190
LSA_ENUM_PRIVS LSA_PRIV_GET_DISPNAME LSA_ENUM_ACCOUNTS LSA_OPENACCOUNT LSA_ENUMPRIVSACCOUNT LSA_GETSYSTEMACCOUNT It's a work in progress. nobody should expect it to work J.F. (This used to be commit 3056357cd8d4b2460f73ba8a8931a143f07fa2a6)
2001-06-29Added LsaGetConnectedCredentials patch from Manoj Naik <manoj@almaden.ibm.com>.Jeremy Allison1-0/+32
Jeremy. (This used to be commit 7079300da6dbd950e55dc5871851250d5a3717ff)
2001-03-11Merge of new 2.2 code into HEAD (Gerald I hate you :-) :-). Allows new SAMRJeremy Allison1-3/+0
RPC code to merge with new passdb code. Currently rpcclient doesn't compile. I'm working on it... Jeremy. (This used to be commit 0be41d5158ea4e645e93e8cd30617c038416e549)
2001-02-26Separated lsa code into interface and implementation.Jeremy Allison1-515/+58
Jeremy. (This used to be commit 1cc96e0340b9e3ac343d6a28211bf0cc5bc6573b)
2001-02-26Started conversion of lsa server code to canonical format (as srv_reg andJeremy Allison1-58/+93
srv_samr have been). Jeremy. (This used to be commit f434cda9774b4864321b37b0f8f42e6e8dee8d5b)
2001-02-13It compiles for me now :-). rpc_server/srv_lsa.c - added fix to allow w2kJeremy Allison1-4/+13
clients to join a Samba domain - odd or even domain name length. Needs more testing. Jeremy. (This used to be commit 408672d38261e34cc3714200617b35464d88f931)
2001-01-25Fixed "object picker can't determine if object in domain" bug seen from W2KJeremy Allison1-17/+44
clients. Did this by importing Samba-TNG code that correctly handles LSA lookups. *MANY* thanks to Luke, Sander, Elrond and the rest of the TNG gang ! Jeremy (This used to be commit f76dc952f70862a6a390e9f35edd651867842a01)
2001-01-15Changes from APPLIANCE_HEAD:David O'Neill1-3/+3
source/rpc_parse/parse_lsa.c - off by one unistr length bug in init_lsa_trans_name() source/lib/util_sid.c - resolve more BUILTIN sid values to names. source/nsswitch/wb_client.c - fix typo in debug message - set errno on error so we don't get bogus value from last failure. source/rpc_server/srv_spoolss_nt.c - add debug to track number of open printer handles for ease of tracking handle leaks in the future. source/rpc_server/srv_lsa.c - fix off-by-one string bug. This was preventing NT from displaying names for well-know SIDs in printer permissions dialog. (This used to be commit 59229b9025cff54cbdd05e374616ffbf9c6fee33)
2000-12-15Never free anything in the rpc_parse/prs_XXX functions. Do it in the enclosingJeremy Allison1-11/+16
function. lib/util_unistr.c: Check lengths *before* reading source - prevent uninitialised memory reads. Jeremy. (This used to be commit ce4f461965c872fbfc9fe5f6b98aed58bb3dd67a)
2000-12-15lib/util_unistr.c:Jean-François Micouleau1-1/+1
rewrote unistr2_to_ascii() to correct a bug seen on SGI boxes. rpc_parse/parse_misc.c: rpc_parse/parse_prs.c: rewrote of BUFFER5 handling to NOT byteswap when it was already in network byte order. rpc_parse/parse_samr.c: cleanup of samr_io_q_lookup_domain(), remove the over-parsing by 2 bytes. rpc_server/srv_lsa.c: UNISTR2 strings need to be NULL terminated to pleased W2K. rpc_server/srv_spoolss_nt.c: use snprintf instead of safe_strcpy as we want the string truncated at 32 chars. That should fix SUN and SGI box not able to act as printserver and the problem with joining from a W2K wks. J.F. (This used to be commit 69fe739303b105f2c488f266f13977da1b6b201d)
2000-12-15Fixed memory leaks in lsa_XX calls. Fixed memory leaks in smbcacls. MergedJeremy Allison1-19/+1
in fixes from appliance-head and 2.2. Fixed multiple connection.tdb open problem. Jeremy. (This used to be commit 0a40bc83e14c69a09948ec09bb6fc5026c4f4c14)
2000-12-13Server side changes for dynamic names in lsa_lookup_namesTim Potter1-5/+10
(This used to be commit 5c5c3a8a08efe8c2f36a55b1383e9d3dd9eca4a5)
2000-12-12Merged in Tim's changes : Removed static limit of MAX_LOOKUP_SIDS in rpc ↵Jeremy Allison1-7/+35
server and client lsa_lookup_names() and lsa_lookup_sids(). Jeremy. (This used to be commit 9e9c71c8b3194b7cd02fea0b6a000d4f2940d905)
2000-11-13Tims fixes for non-local lookup.Jeremy Allison1-23/+22
Jeremy. (This used to be commit 38e04c43cc2ce8479b8cc3ff0f87d3d150d9af83)
2000-10-25Removed erroneous +1's on length of unicode domain names for variousTim Potter1-2/+2
functions in the \\lsarpc pipe. (This used to be commit 30bb3f2df97662c6547c7994ce50efe9abf37968)
2000-10-13last part of W2K support.Jean-François Micouleau1-2/+2
the trust domain list reply on netlogon pipe was wrong, interim hack until we have full trust relationships. changed some unistr2 to parse the ending NULL char. added a prs_align_needed() function. much like a prs_align but with a condition. needed for the unistr2 parsing. J.F. (This used to be commit d8bf81553c17d9ee3419d8150b96119ebb0b8fa9)
2000-10-04Adding Herb's compile warning fixes to HEAD.Jeremy Allison1-1/+1
Jeremy. (This used to be commit d131ad1ce3f6e72e295f865a463f8dcbfa6f8d42)
2000-09-01Changes from APPLIANCE_HEAD (per Tim Potter):David O'Neill1-2/+2
- make proto - addition of function to convert from errno values to NT status codes (source/lib/error.c) - purge queue done without full access permission will purge only the jobs owned by that user, rather than failing. - unlock job database tdb before sending job to printer - in print_job_start(), ensure that we don't pick a jobid with an existing temporary file that may be owned by another user, as it causes silent failures. - fixes for printer permission checking for NT5 clients (source/include/rpc_spoolss.h, source/printing/nt_printing.c, source/printing/printing.c, source/rpc_server/srv_spoolss_nt.c) - change from uint8 to 'enum SID_NAME_USE' (source/rpc_server/srv_lsa.c) - fixed memory leaks for win95 driver download process (source/smbd/lanman.c) - properly free prs_structs and dacl in testsuite/printing/psec.c (This used to be commit 74af3e2caec7197e5d1ca389e2f78054a4197502)
2000-08-10Tidied up security rights definitions.Jeremy Allison1-2/+1
Jeremy. (This used to be commit e466c863f5540e13776f4477b6d58e3fbfe7276d)
2000-08-02Started to canonicalize our handling of uid -> sid code in order toJeremy Allison1-1/+1
get ready and fix se_access_check(). Added cannonical lookup_name(), lookup_sid(), uid_to_sid(), gid_to_sid() functions that look via winbind first the fall back on local lookup. All Samba should use these rather than trying to call winbindd code directly. Added NT_USER_TOKEN struct in user_struct, contains list of NT sids associated with this user. se_access_check() should use this (cached) value rather than attempting to do the same thing itself when given a uid/gid pair. More work needs to be done to preserve these things accross security context changes (especially with the tricky pipe problem) but I'm beginning to see how this will be done..... probably by registering a new vuid for an authenticated RPC pipe and not treating the pipe calls specially. More thoughts needed - but we're almost there... Jeremy. (This used to be commit 5e5cc6efe2e4687be59085f562caea1e2e05d0a8)
2000-07-10Moved winbind client functions from various odd locations toTim Potter1-59/+0
nsswitch/wb_client.c Merge of nsswitch/common.c rename to nsswitch/wb_common.c from TNG. (This used to be commit f866c18f6be65db67d9d2a6c0b42e1af3b421e6c)
2000-07-06Changed checking for WINBINDD_OK return value instead of NSS_STATUS_SUCCESSTim Potter1-3/+3
when looking up sids from winbindd. (This used to be commit 79fb877bf13ba462ad0a878d8975f8b5183e3ea3)
2000-07-03Renamed generic_request() to winbindd_request()Tim Potter1-1/+1
(This used to be commit d9041958558fc8e3c7b0491eb0f7e45bee9d19c5)
2000-06-26Fixed display of "Everyone" in SD's.Jeremy Allison1-1/+5
Jeremy. (This used to be commit 3c7fdaa576c09dab2e4de78ed353b1fa1d65a40d)
2000-06-24lib/util_sid.c: Uninitialized memory read.Jeremy Allison1-0/+5
rpc_parse/parse_spoolss.c: Added note about prs_align when marshalling a SEC_DESC... rpc_server/srv_lsa.c: Tim - your changes broke the display of the 'everyone' group when doing file access with no winbindd running. This is a partial fix - more when I have analysed this more. rpc_server/srv_spoolss_nt.c: Fix for the 'change driver' problem ! Hurrah ! Jeremy. (This used to be commit 151b131ee01ef916c072bcdaa9943a2e984a0f45)
2000-06-23Got a bit carried away deleting things.Tim Potter1-1/+1
(This used to be commit 211391d88e10d94edcc81b83fefcadb4a905ea56)
2000-06-23Removed unused variables.Tim Potter1-2/+0
(This used to be commit a75e738211e744adb966bcbc24371554c9642220)
2000-06-16Simplified server pipe implementation by changing arguments passed downTim Potter1-12/+32
through to the individual pipe api calls. Instead of passing two prs_struct pointers, we now pass the pipes_struct pointer which contains the former information as well as other useful stuff like the vuid. (This used to be commit 96addba216bad2189120d78f5531d5caa6f37880)
2000-06-15Removed some debugs.Tim Potter1-12/+0
(This used to be commit 6faa963b232b4c4d883c1b346c73b2f2b6da6370)
2000-06-14Changed server side lsa_lookup_sids function to look up SIDs that we areTim Potter1-28/+74
not authoritative for using winbindd. (This used to be commit a39cdffb141a8e4188b00dfb6eb3317f134cddda)
2000-05-29Fixed LsaQueryInformationPolicy level 3 to return primary domain info.Matthew Chapman1-19/+23
Domain SID is saved in secrets.tdb upon joining domain. Added "Authenticated Users" and "SYSTEM" well-known SIDs (under NT Authority). (This used to be commit 7710b4f48d3e8532df5e37f99a779758f750efdb)
2000-05-10more merging voodooAndrew Tridgell1-0/+3
this adds "#define OLD_NTDOMAIN 1" in lots of places. Don't panic - this isn't permanent, it should go after another few merge steps have been done (This used to be commit 92109d7b3c06f240452d39f669ecb8c9c86ab610)
2000-05-04rpc_server/srv_lsa.c: Bring into sync with 2.0.x.Jeremy Allison1-9/+19
rpc_server/srv_pipe_hnd.c: Bring into sync with 2.0.x. smbd/blocking.c: Improve blocking debug reporting. utils/torture.c: Added check for NT locking bug. Jeremy. (This used to be commit e8ff6d3fb5537c39611a5784bf7216ae812acd27)
2000-04-22This is a *big* checkin that may break some things, but implements theJeremy Allison1-2/+6
new open mechanism Andrew & I discussed. config.sub: configure: Included the QNX patch. include/vfs.h: smbd/vfs-wrap.c: smbd/vfs.c: Added ftruncate vfs call (needed). Note that we will also need locking calls in the vfs (to be added). lib/util_unistr.c: nmbd/nmbd_processlogon.c: Fix for NT domain logons causing nmbd to core dump. Also fix for sidsize DOS bug. locking/locking.c: Check value of ret before using it for memdup. printing/printing.c: Convert print_fsp_open to return an allocated fsp. rpc_server/srv_lsa.c: Fix for NT domain logons. I have removed all use of lp_share_modes() from the code (although I left the parameter in the table for backwards compatibility). It no longer makes sense for this to exist. smbd/close.c: Removed lp_share_modes(). smbd/fileio.c: Fixed parameters to unlock_share_entry call in panic code. smbd/files.c: Correctly set the unix_ERR_code to ERRnofids on fsp allocation fail. smbd/nttrans.c: smbd/reply.c: smbd/trans2.c: Changed all occurrences of open_file_shared/open_directory/ open_file_stat to return an fsp from the call. smbd/open.c: Changed all occurrences of open_file_shared/open_directory/ open_file_stat to return an fsp from the call. In addition I have fixed a long standing race condition in the deny mode processing w.r.t. two smbd's creating a file. Andrew, please note that your original idea of using open with O_EXCL in this case would not work (I went over the races very carefully) and so we must re-check deny modes *after* the open() call returns. This is because there is a race between the open with O_EXCL and the lock of the share mode entry. Imagine the case where the first smbd does the open with O_EXCL and a deny mode of DENY_ALL, but is pre-empted before it locks the share modes and creates the deny mode entry for DENY_ALL. A second smbd could then come in with O_RDONLY and a deny mode of DENY_NONE and the two opens would be allowed. The *only* way to fix this race is to lock the share modes after the open and then do the deny mode checks *after* this lock in the case where the file did not originally exist. This code will need extensive testing but seems to initially work. Jeremy. (This used to be commit ab0ecc39d688f16b9692fe90b991f0b89287070a)
2000-04-04Removed unused parameter vuid from rpc_server api_* calls. For the very fewTim Potter1-17/+8
functions that need to access the vuid, it can be obtained from the current_user global. Did some whitespace cleanup. (This used to be commit 738b307bd7053ede369431da7b1349befaa523d9)
2000-03-22acconfig.h configure configure.in: Added check for UT_SYSLEN for utmp code.Jeremy Allison1-24/+0
include/byteorder.h: Added alignment macros. include/nameserv.h: Added defines for msg_type field options - from rfc1002. lib/time.c: Typo fix. lib/util_unistr.c: Updates from UNICODE branch. printing/nt_printing.c: bzero -> memset. smbd/connection.c: Added check for UT_SYSLEN for utmp code. Other fixes : Rollback of unapproved commit from Luke. Please *ask* next time before doing large changes to HEAD. Jeremy. (This used to be commit f02999dbf7971b4ea05050d7206205d7737a78b2)
2000-03-22added the following message to all dce/rpc client/server code, exceptLuke Leighton1-0/+24
the spoolss code (it's cut from TNG) and the smb-dce/rpc interface code that jeremy has been working up to TNG-functionality. i also want this message to go into SAMBA_2_0 and SAMBA_2_0_RELEASE, because it is intolerable that potentially good modifications be made to code that is going to be thrown away, and people waste their time fixing bugs and adding enhancements that have already been carried out already, up to two years ago in the TNG branch. /* * THIS CODE IS OUT-OF-DATE BY TWO YEARS, IS LEGACY DESIGN AND VERY, VERY, * INCOMPLETE. PLEASE DO NOT MAKE ANY FURTHER ENHANCEMENTS TO THIS CODE * UNLESS THEY ARE ALSO CARRIED OUT IN THE SAMBA_TNG BRANCH. * * PLEASE DO NOT TREAT THIS CODE AS AUTHORITATIVE IN *ANY* WAY. * * REPEAT, PLEASE DO NOT MAKE ANY MODIFICATIONS TO THIS CODE WITHOUT * FIRST CHECKING THE EQUIVALENT MODULE IN SAMBA_TNG, UPDATING THAT * FIRST, *THEN* CONSIDER MAKING THE SAME MODIFICATION IN THIS BRANCH * * YOU WILL, ALMOST GUARANTEED, FIND THAT THE BUG-FIX OR ENHANCEMENT THAT * YOU THINK IS NECESSARY, HAS ALREADY BEEN IMPLEMENTED IN SAMBA_TNG. * IF IT HAS NOT, YOUR BUG-FIX OR ENHANCEMENT *MUST* GO INTO SAMBA_TNG * AS THE SAMBA_TNG CODE WILL REPLACE THIS MODULE WITHOUT REFERENCE TO * ANYTHING IN IT, WITH THE POSSIBLE RISK THAT THE BUG-FIX OR ENHANCEMENT * MAY BE LOST. * * PLEASE OBSERVE AND RESPECT THIS SIMPLE REQUEST. * * THANK YOU. * * lkcl@samba.org */ (This used to be commit cfaea90529be222f8df0e20a7ca1289f99c29e09)
1999-12-13first pass at updating head branch to be to be the same as the SAMBA_2_0 branchAndrew Tridgell1-255/+252
(This used to be commit 453a822a76780063dff23526c35408866d0c0154)
1999-12-12delineation between smb and msrpc more marked. smbd now constructsLuke Leighton1-10/+10
pdus, and then feeds them over either a "local" function call or a "remote" function call to an msrpc service. the "remote" msrpc daemon, on the other side of a unix socket, then calls the same "local" function that smbd would, if the msrpc service were being run from inside smbd. this allows a transition from local msrpc services (inside the same smbd process) to remote (over a unix socket). removed reference to pipes_struct in msrpc services. all msrpc processing functions take rpcsrv_struct which is a structure containing state info for the msrpc functions to decode and create pdus. created become_vuser() which does everything not related to connection_struct that become_user() does. removed, as best i could, connection_struct dependencies from the nt spoolss printing code. todo: remove dcinfo from rpcsrv_struct because this stores NETLOGON-specific info on a per-connection basis, and if the connection dies then so does the info, and that's a fairly serious problem. had to put pretty much everything that is in user_struct into parse_creds.c to feed unix user info over to the msrpc daemons. why? because it's expensive to do unix password/group database lookups, and it's definitely expensive to do nt user profile lookups, not to mention pretty difficult and if you did either of these it would introduce a complication / unnecessary interdependency. so, send uid/gid/num_groups/gid_t* + SID+num_rids+domain_group_rids* + unix username + nt username + nt domain + user session key etc. this is the MINIMUM info identified so far that's actually implemented. missing bits include the called and calling netbios names etc. (basically, anything that can be loaded into standard_sub() and standard_sub_basic()...) (This used to be commit aa3c659a8dba0437c17c60055a6ed30fdfecdb6d)
1999-11-24rewrote policy handle code to be generic (it's needed for client-side too)Luke Leighton1-5/+5
attempted to fix regsetsec command (This used to be commit eaac0923e0e5e3f4c3d944272a71f3235ac2a741)
1999-11-19nt5rc2 falling over because the LsaQueryInfoPolicy() response _must_Luke Leighton1-1/+2
have the string max length = string length + 1. if not, then it gets its knickers in a twist over whether the string is NULL-terminated or not. four days. four days i spent on this one. (This used to be commit 9795e5948c698115e34c28993cdb82ba31377f5d)
1999-11-18added regqueryval command (experimental) to get reg_io_q_info() andLuke Leighton1-14/+38
reg_io_r_info() working properly. previously they weren't well understood (well, they were the first of the registry functions i did, back in december 97, ok??? :-) set ntversion to 0x1 in SAMQUERY, so that we reply same as NT4 srv. (This used to be commit 98ddeaf442cb30972cb281bf0489a6e5f7eb2883)
1999-09-09allan hourihane sent log 100 in which showed that some really old codeLuke Leighton1-15/+4
for lsa_close response was messing up. fixed by calling lsa_io_r_close() which i've been meaning to do for over eighteen months. (This used to be commit f9a0ea09486b18a130ce1a1e5381ca61e0293c75)
1999-07-26commented location where lookup_sids(), a direct call to the passwordLuke Leighton1-0/+3
database API, needs to be replaced with over-the-wire (actually, tcp/ip loopback) to smbd. in fact, this is the location where, if we want to put in an nt5 ldap lookup system or netware NDS instead, we make the calls to resolve users-to-sids and vice-versa: NOT by replacing rpc_server/srv_samr.c. (This used to be commit fd886af3317ca806c9c28f71afca5c7b063c1226)
1999-05-03last part of RPC api change.Jean-François Micouleau1-8/+8
and of rpcclient eventlog funtion Jean Francois (This used to be commit 7fc8659e83bf0269df297016beac6793ff0bdf32)
generated by cgit (git 2.34.1) at 2024-11-14 07:57:52 +0000