| 1 | /*
|
|---|
| 2 | Unix SMB/CIFS implementation.
|
|---|
| 3 | Authentication utility functions
|
|---|
| 4 | Copyright (C) Andrew Tridgell 1992-1998
|
|---|
| 5 | Copyright (C) Andrew Bartlett 2001
|
|---|
| 6 | Copyright (C) Jeremy Allison 2000-2001
|
|---|
| 7 | Copyright (C) Rafal Szczesniak 2002
|
|---|
| 8 | Copyright (C) Volker Lendecke 2006
|
|---|
| 9 |
|
|---|
| 10 | This program is free software; you can redistribute it and/or modify
|
|---|
| 11 | it under the terms of the GNU General Public License as published by
|
|---|
| 12 | the Free Software Foundation; either version 3 of the License, or
|
|---|
| 13 | (at your option) any later version.
|
|---|
| 14 |
|
|---|
| 15 | This program is distributed in the hope that it will be useful,
|
|---|
| 16 | but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 17 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|---|
| 18 | GNU General Public License for more details.
|
|---|
| 19 |
|
|---|
| 20 | You should have received a copy of the GNU General Public License
|
|---|
| 21 | along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|---|
| 22 | */
|
|---|
| 23 |
|
|---|
| 24 | #include "includes.h"
|
|---|
| 25 | #include "auth.h"
|
|---|
| 26 | #include "nsswitch/winbind_client.h"
|
|---|
| 27 | #include "passdb.h"
|
|---|
| 28 |
|
|---|
| 29 | #undef DBGC_CLASS
|
|---|
| 30 | #define DBGC_CLASS DBGC_AUTH
|
|---|
| 31 |
|
|---|
| 32 |
|
|---|
| 33 | /***************************************************************************
|
|---|
| 34 | Is the incoming username our own machine account ?
|
|---|
| 35 | If so, the connection is almost certainly from winbindd.
|
|---|
| 36 | ***************************************************************************/
|
|---|
| 37 |
|
|---|
| 38 | static bool is_our_machine_account(const char *username)
|
|---|
| 39 | {
|
|---|
| 40 | bool ret;
|
|---|
| 41 | char *truncname = NULL;
|
|---|
| 42 | size_t ulen = strlen(username);
|
|---|
| 43 |
|
|---|
| 44 | if (ulen == 0 || username[ulen-1] != '$') {
|
|---|
| 45 | return false;
|
|---|
| 46 | }
|
|---|
| 47 | truncname = SMB_STRDUP(username);
|
|---|
| 48 | if (!truncname) {
|
|---|
| 49 | return false;
|
|---|
| 50 | }
|
|---|
| 51 | truncname[ulen-1] = '\0';
|
|---|
| 52 | ret = strequal(truncname, global_myname());
|
|---|
| 53 | SAFE_FREE(truncname);
|
|---|
| 54 | return ret;
|
|---|
| 55 | }
|
|---|
| 56 |
|
|---|
| 57 | /***************************************************************************
|
|---|
| 58 | Make (and fill) a user_info struct from a struct samu
|
|---|
| 59 | ***************************************************************************/
|
|---|
| 60 |
|
|---|
| 61 | NTSTATUS make_server_info_sam(struct auth_serversupplied_info **server_info,
|
|---|
| 62 | struct samu *sampass)
|
|---|
| 63 | {
|
|---|
| 64 | struct passwd *pwd;
|
|---|
| 65 | struct auth_serversupplied_info *result;
|
|---|
| 66 | const char *username = pdb_get_username(sampass);
|
|---|
| 67 | NTSTATUS status;
|
|---|
| 68 |
|
|---|
| 69 | if ( !(result = make_server_info(NULL)) ) {
|
|---|
| 70 | return NT_STATUS_NO_MEMORY;
|
|---|
| 71 | }
|
|---|
| 72 |
|
|---|
| 73 | if ( !(pwd = Get_Pwnam_alloc(result, username)) ) {
|
|---|
| 74 | DEBUG(1, ("User %s in passdb, but getpwnam() fails!\n",
|
|---|
| 75 | pdb_get_username(sampass)));
|
|---|
| 76 | TALLOC_FREE(result);
|
|---|
| 77 | return NT_STATUS_NO_SUCH_USER;
|
|---|
| 78 | }
|
|---|
| 79 |
|
|---|
| 80 | status = samu_to_SamInfo3(result, sampass, global_myname(),
|
|---|
| 81 | &result->info3, &result->extra);
|
|---|
| 82 | if (!NT_STATUS_IS_OK(status)) {
|
|---|
| 83 | TALLOC_FREE(result);
|
|---|
| 84 | return status;
|
|---|
| 85 | }
|
|---|
| 86 |
|
|---|
| 87 | result->unix_name = pwd->pw_name;
|
|---|
| 88 | /* Ensure that we keep pwd->pw_name, because we will free pwd below */
|
|---|
| 89 | talloc_steal(result, pwd->pw_name);
|
|---|
| 90 | result->utok.gid = pwd->pw_gid;
|
|---|
| 91 | result->utok.uid = pwd->pw_uid;
|
|---|
| 92 |
|
|---|
| 93 | TALLOC_FREE(pwd);
|
|---|
| 94 |
|
|---|
| 95 | result->sanitized_username = sanitize_username(result,
|
|---|
| 96 | result->unix_name);
|
|---|
| 97 | if (result->sanitized_username == NULL) {
|
|---|
| 98 | TALLOC_FREE(result);
|
|---|
| 99 | return NT_STATUS_NO_MEMORY;
|
|---|
| 100 | }
|
|---|
| 101 |
|
|---|
| 102 | if (IS_DC && is_our_machine_account(username)) {
|
|---|
| 103 | /*
|
|---|
| 104 | * This is a hack of monstrous proportions.
|
|---|
| 105 | * If we know it's winbindd talking to us,
|
|---|
| 106 | * we know we must never recurse into it,
|
|---|
| 107 | * so turn off contacting winbindd for this
|
|---|
| 108 | * entire process. This will get fixed when
|
|---|
| 109 | * winbindd doesn't need to talk to smbd on
|
|---|
| 110 | * a PDC. JRA.
|
|---|
| 111 | */
|
|---|
| 112 |
|
|---|
| 113 | (void)winbind_off();
|
|---|
| 114 |
|
|---|
| 115 | DEBUG(10, ("make_server_info_sam: our machine account %s "
|
|---|
| 116 | "turning off winbindd requests.\n", username));
|
|---|
| 117 | }
|
|---|
| 118 |
|
|---|
| 119 | DEBUG(5,("make_server_info_sam: made server info for user %s -> %s\n",
|
|---|
| 120 | pdb_get_username(sampass), result->unix_name));
|
|---|
| 121 |
|
|---|
| 122 | *server_info = result;
|
|---|
| 123 |
|
|---|
| 124 | return NT_STATUS_OK;
|
|---|
| 125 | }
|
|---|
