The branch, master has been updated
via 2d22bbf s3-selftest Look only under source3 for smb.conf files
via ff9b668 s3-auth Rename user_session_key -> session_key to match
auth_session_info
via 17d8f0a s3-auth use create_local_token() to transform server_info
-> session_info
from 2ec4826 Move SET_STAT_INVALID call added by Volker as fix for bug
8042 - Newly create files are always failed with NT_STATUS_FILE_IS_A_DIRECTORY
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 2d22bbf2c0af57c1bb7665590960a9b888ee8a4d
Author: Andrew Bartlett <abart...@samba.org>
Date: Mon Apr 4 21:01:40 2011 +1000
s3-selftest Look only under source3 for smb.conf files
This test looks for any .conf file with [global] in it, and assumes
it's a Samba3 format smb.conf file. If 'make test' has been run in
the top level build, it was finding the smb.conf files it generated.
Andrew Bartlett
Autobuild-User: Andrew Bartlett <abart...@samba.org>
Autobuild-Date: Mon Apr 4 23:50:06 CEST 2011 on sn-devel-104
commit ff9b6682a014f47e3b367c3286407bfc39fd286c
Author: Andrew Bartlett <abart...@samba.org>
Date: Mon Feb 14 11:35:21 2011 +1100
s3-auth Rename user_session_key -> session_key to match auth_session_info
commit 17d8f0ad30847bb940f645ee1817d782ddaaee74
Author: Andrew Bartlett <abart...@samba.org>
Date: Fri Feb 11 11:50:37 2011 +1100
s3-auth use create_local_token() to transform server_info -> session_info
Before a auth_serversupplied_info struct can be used for
authorization, the local groups and privileges must be calculated.
create_local_token() now copies the server_info, and then sets the
calulated token and unix groups.
Soon, it will also transform the result into an expanded struct
auth_session_info. Until then, the variable name (server_info vs
session_info provides a clue to the developer about what information
has been entered in the structure).
By moving the calls to create_local_token within the codebase, we
remove duplication, and ensure that the session key (where modified)
is consistently copied into the new structure.
Andrew Bartlett
-----------------------------------------------------------------------
Summary of changes:
source3/auth/auth_ntlmssp.c | 45 ++---
source3/auth/auth_util.c | 186 ++++++++++++-------
source3/auth/check_samsec.c | 2 +-
source3/auth/proto.h | 20 ++-
source3/auth/server_info.c | 18 +-
source3/auth/user_krb5.c | 43 +++---
source3/include/auth.h | 2 +-
source3/rpc_server/dcesrv_gssapi.c | 5 +-
source3/rpc_server/lsa/srv_lsa_nt.c | 2 +-
source3/rpc_server/netlogon/srv_netlog_nt.c | 2 +-
source3/rpc_server/rpc_ncacn_np.c | 2 +-
source3/rpc_server/rpc_server.c | 12 +-
source3/rpc_server/samr/srv_samr_nt.c | 20 +-
source3/rpc_server/wkssvc/srv_wkssvc_nt.c | 4 +-
.../script/tests/test_net_registry_roundtrip.sh | 2 +-
source3/smbd/password.c | 2 +-
source3/smbd/service.c | 6 +-
source3/smbd/sesssetup.c | 64 +++----
source3/smbd/smb2_sesssetup.c | 27 +--
19 files changed, 237 insertions(+), 227 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c
index ae29c30..5897421 100644
--- a/source3/auth/auth_ntlmssp.c
+++ b/source3/auth/auth_ntlmssp.c
@@ -31,23 +31,16 @@ NTSTATUS auth_ntlmssp_steal_session_info(TALLOC_CTX
*mem_ctx,
struct auth_ntlmssp_state
*auth_ntlmssp_state,
struct auth_serversupplied_info
**session_info)
{
- /* Free the current server_info user_session_key and reset it from the
- * current ntlmssp_state session_key */
- data_blob_free(&auth_ntlmssp_state->server_info->user_session_key);
- /* Set up the final session key for the connection */
- auth_ntlmssp_state->server_info->user_session_key =
- data_blob_talloc(
- auth_ntlmssp_state->server_info,
- auth_ntlmssp_state->ntlmssp_state->session_key.data,
- auth_ntlmssp_state->ntlmssp_state->session_key.length);
- if (auth_ntlmssp_state->ntlmssp_state->session_key.length &&
- !auth_ntlmssp_state->server_info->user_session_key.data) {
- *session_info = NULL;
- return NT_STATUS_NO_MEMORY;
+ NTSTATUS nt_status = create_local_token(mem_ctx,
+ auth_ntlmssp_state->server_info,
+
&auth_ntlmssp_state->ntlmssp_state->session_key,
+ session_info);
+
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ DEBUG(10, ("create_local_token failed: %s\n",
+ nt_errstr(nt_status)));
}
- /* Steal session_info away from auth_ntlmssp_state */
- *session_info = talloc_move(mem_ctx, &auth_ntlmssp_state->server_info);
- return NT_STATUS_OK;
+ return nt_status;
}
/**
@@ -109,7 +102,7 @@ static NTSTATUS auth_ntlmssp_set_challenge(struct
ntlmssp_state *ntlmssp_state,
*/
static NTSTATUS auth_ntlmssp_check_password(struct ntlmssp_state
*ntlmssp_state, TALLOC_CTX *mem_ctx,
- DATA_BLOB *user_session_key,
DATA_BLOB *lm_session_key)
+ DATA_BLOB *session_key, DATA_BLOB
*lm_session_key)
{
struct auth_ntlmssp_state *auth_ntlmssp_state =
(struct auth_ntlmssp_state *)ntlmssp_state->callback_private;
@@ -156,25 +149,17 @@ static NTSTATUS auth_ntlmssp_check_password(struct
ntlmssp_state *ntlmssp_state,
auth_ntlmssp_state->server_info->nss_token |= username_was_mapped;
- nt_status = create_local_token(auth_ntlmssp_state->server_info);
-
- if (!NT_STATUS_IS_OK(nt_status)) {
- DEBUG(10, ("create_local_token failed: %s\n",
- nt_errstr(nt_status)));
- return nt_status;
- }
-
/* Clear out the session keys, and pass them to the caller.
* They will not be used in this form again - instead the
* NTLMSSP code will decide on the final correct session key,
* and put it back here at the end of
* auth_ntlmssp_steal_server_info */
- if (auth_ntlmssp_state->server_info->user_session_key.length) {
+ if (auth_ntlmssp_state->server_info->session_key.length) {
DEBUG(10, ("Got NT session key of length %u\n",
- (unsigned
int)auth_ntlmssp_state->server_info->user_session_key.length));
- *user_session_key =
auth_ntlmssp_state->server_info->user_session_key;
- talloc_steal(mem_ctx,
auth_ntlmssp_state->server_info->user_session_key.data);
- auth_ntlmssp_state->server_info->user_session_key =
data_blob_null;
+ (unsigned
int)auth_ntlmssp_state->server_info->session_key.length));
+ *session_key = auth_ntlmssp_state->server_info->session_key;
+ talloc_steal(mem_ctx,
auth_ntlmssp_state->server_info->session_key.data);
+ auth_ntlmssp_state->server_info->session_key = data_blob_null;
}
if (auth_ntlmssp_state->server_info->lm_session_key.length) {
DEBUG(10, ("Got LM session key of length %u\n",
diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index c84e3d3..e2a687d 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -442,11 +442,46 @@ static NTSTATUS log_nt_token(struct security_token *token)
* server_info->sids (the info3/sam groups). Find the unix gids.
*/
-NTSTATUS create_local_token(struct auth_serversupplied_info *server_info)
+NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
+ struct auth_serversupplied_info *server_info,
+ DATA_BLOB *session_key,
+ struct auth_serversupplied_info **session_info_out)
{
NTSTATUS status;
size_t i;
struct dom_sid tmp_sid;
+ struct auth_serversupplied_info *session_info;
+
+ /* Ensure we can't possible take a code path leading to a
+ * null defref. */
+ if (!server_info) {
+ return NT_STATUS_LOGON_FAILURE;
+ }
+
+ session_info = copy_serverinfo(mem_ctx, server_info);
+
+ if (!session_info) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (session_key) {
+ data_blob_free(&session_info->session_key);
+ session_info->session_key = data_blob_talloc(session_info,
+
session_key->data,
+
session_key->length);
+ if (!session_info->session_key.data && session_key->length) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
+
+ if (session_info->security_token) {
+ /* Just copy the token, it has already been finalised
+ * (nasty hack to support a cached guest session_info,
+ * and a possible strategy for auth_samba4 to pass in
+ * a finalised session) */
+ *session_info_out = session_info;
+ return NT_STATUS_OK;
+ }
/*
* If winbind is not around, we can not make much use of the SIDs the
@@ -455,21 +490,21 @@ NTSTATUS create_local_token(struct
auth_serversupplied_info *server_info)
*/
if (((lp_server_role() == ROLE_DOMAIN_MEMBER) && !winbind_ping()) ||
- (server_info->nss_token)) {
- status = create_token_from_username(server_info,
- server_info->unix_name,
- server_info->guest,
- &server_info->utok.uid,
- &server_info->utok.gid,
- &server_info->unix_name,
-
&server_info->security_token);
+ (session_info->nss_token)) {
+ status = create_token_from_username(session_info,
+ session_info->unix_name,
+ session_info->guest,
+ &session_info->utok.uid,
+ &session_info->utok.gid,
+ &session_info->unix_name,
+
&session_info->security_token);
} else {
- status = create_local_nt_token_from_info3(server_info,
- server_info->guest,
- server_info->info3,
- &server_info->extra,
-
&server_info->security_token);
+ status = create_local_nt_token_from_info3(session_info,
+ session_info->guest,
+ session_info->info3,
+ &session_info->extra,
+
&session_info->security_token);
}
if (!NT_STATUS_IS_OK(status)) {
@@ -478,14 +513,14 @@ NTSTATUS create_local_token(struct
auth_serversupplied_info *server_info)
/* Convert the SIDs to gids. */
- server_info->utok.ngroups = 0;
- server_info->utok.groups = NULL;
+ session_info->utok.ngroups = 0;
+ session_info->utok.groups = NULL;
/* Start at index 1, where the groups start. */
- for (i=1; i<server_info->security_token->num_sids; i++) {
+ for (i=1; i<session_info->security_token->num_sids; i++) {
gid_t gid;
- struct dom_sid *sid = &server_info->security_token->sids[i];
+ struct dom_sid *sid = &session_info->security_token->sids[i];
if (!sid_to_gid(sid, &gid)) {
DEBUG(10, ("Could not convert SID %s to gid, "
@@ -493,8 +528,8 @@ NTSTATUS create_local_token(struct auth_serversupplied_info
*server_info)
continue;
}
if (!add_gid_to_array_unique(server_info, gid,
- &server_info->utok.groups,
- &server_info->utok.ngroups)) {
+ &session_info->utok.groups,
+ &session_info->utok.ngroups)) {
return NT_STATUS_NO_MEMORY;
}
}
@@ -512,28 +547,33 @@ NTSTATUS create_local_token(struct
auth_serversupplied_info *server_info)
* the nt token.
*/
- uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid);
+ uid_to_unix_users_sid(session_info->utok.uid, &tmp_sid);
- add_sid_to_array_unique(server_info->security_token, &tmp_sid,
- &server_info->security_token->sids,
- &server_info->security_token->num_sids);
+ add_sid_to_array_unique(session_info->security_token, &tmp_sid,
+ &session_info->security_token->sids,
+ &session_info->security_token->num_sids);
- for ( i=0; i<server_info->utok.ngroups; i++ ) {
- gid_to_unix_groups_sid(server_info->utok.groups[i], &tmp_sid);
- add_sid_to_array_unique(server_info->security_token, &tmp_sid,
- &server_info->security_token->sids,
- &server_info->security_token->num_sids);
+ for ( i=0; i<session_info->utok.ngroups; i++ ) {
+ gid_to_unix_groups_sid(session_info->utok.groups[i], &tmp_sid);
+ add_sid_to_array_unique(session_info->security_token, &tmp_sid,
+ &session_info->security_token->sids,
+
&session_info->security_token->num_sids);
}
- security_token_debug(DBGC_AUTH, 10, server_info->security_token);
+ security_token_debug(DBGC_AUTH, 10, session_info->security_token);
debug_unix_user_token(DBGC_AUTH, 10,
- server_info->utok.uid,
- server_info->utok.gid,
- server_info->utok.ngroups,
- server_info->utok.groups);
+ session_info->utok.uid,
+ session_info->utok.gid,
+ session_info->utok.ngroups,
+ session_info->utok.groups);
- status = log_nt_token(server_info->security_token);
- return status;
+ status = log_nt_token(session_info->security_token);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ *session_info_out = session_info;
+ return NT_STATUS_OK;
}
/***************************************************************************
@@ -693,10 +733,16 @@ static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,
Make (and fill) a user_info struct for a guest login.
This *must* succeed for smbd to start. If there is no mapping entry for
the guest gid, then create one.
+
+ The resulting structure is a 'session_info' because
+ create_local_token() has already been called on it. This is quite
+ nasty, as the auth subsystem isn't expect this, but the behaviour is
+ left as-is for now.
***************************************************************************/
-static NTSTATUS make_new_server_info_guest(struct auth_serversupplied_info
**server_info)
+static NTSTATUS make_new_server_info_guest(struct auth_serversupplied_info
**session_info)
{
+ struct auth_serversupplied_info *server_info;
static const char zeros[16] = {0};
const char *guest_account = lp_guestaccount();
const char *domain = global_myname();
@@ -720,29 +766,34 @@ static NTSTATUS make_new_server_info_guest(struct
auth_serversupplied_info **ser
status = make_server_info_info3(tmp_ctx,
guest_account,
domain,
- server_info,
+ &server_info,
&info3);
if (!NT_STATUS_IS_OK(status)) {
goto done;
}
- (*server_info)->guest = True;
+ server_info->guest = True;
- status = create_local_token(*server_info);
+ /* This should not be done here (we should produce a server
+ * info, and later construct a session info from it), but for
+ * now this does not change the previous behaviours */
+ status = create_local_token(tmp_ctx, server_info, NULL, session_info);
+ TALLOC_FREE(server_info);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(10, ("create_local_token failed: %s\n",
nt_errstr(status)));
goto done;
}
+ talloc_steal(NULL, *session_info);
/* annoying, but the Guest really does have a session key, and it is
all zeros! */
- (*server_info)->user_session_key = data_blob(zeros, sizeof(zeros));
- (*server_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
+ (*session_info)->session_key = data_blob(zeros, sizeof(zeros));
+ (*session_info)->lm_session_key = data_blob(zeros, sizeof(zeros));
- alpha_strcpy(tmp, (*server_info)->info3->base.account_name.string,
+ alpha_strcpy(tmp, (*session_info)->info3->base.account_name.string,
". _-$", sizeof(tmp));
- (*server_info)->sanitized_username = talloc_strdup(*server_info, tmp);
+ (*session_info)->sanitized_username = talloc_strdup(*session_info, tmp);
status = NT_STATUS_OK;
done:
@@ -766,10 +817,10 @@ static NTSTATUS make_new_session_info_system(TALLOC_CTX
*mem_ctx,
return NT_STATUS_NO_SUCH_USER;
}
- status = make_serverinfo_from_username(mem_ctx,
- pwd->pw_name,
- false,
- session_info);
+ status = make_session_info_from_username(mem_ctx,
+ pwd->pw_name,
+ false,
+ session_info);
TALLOC_FREE(pwd);
if (!NT_STATUS_IS_OK(status)) {
return status;
@@ -790,13 +841,15 @@ static NTSTATUS make_new_session_info_system(TALLOC_CTX
*mem_ctx,
}
/****************************************************************************
- Fake a auth_serversupplied_info just from a username
+ Fake a auth_serversupplied_info just from a username (as a
+ session_info structure, with create_local_token() already called on
+ it.
****************************************************************************/
-NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
- const char *username,
- bool is_guest,
- struct auth_serversupplied_info
**presult)
+NTSTATUS make_session_info_from_username(TALLOC_CTX *mem_ctx,
+ const char *username,
+ bool is_guest,
+ struct auth_serversupplied_info
**session_info)
{
struct auth_serversupplied_info *result;
struct passwd *pwd;
@@ -818,15 +871,10 @@ NTSTATUS make_serverinfo_from_username(TALLOC_CTX
*mem_ctx,
result->nss_token = true;
result->guest = is_guest;
- status = create_local_token(result);
-
- if (!NT_STATUS_IS_OK(status)) {
- TALLOC_FREE(result);
- return status;
- }
-
- *presult = talloc_steal(mem_ctx, result);
- return NT_STATUS_OK;
+ /* Now turn the server_info into a session_info with the full token etc
*/
+ status = create_local_token(mem_ctx, result, NULL, session_info);
+ talloc_free(result);
+ return status;
}
@@ -861,8 +909,8 @@ struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX
*mem_ctx,
}
}
- dst->user_session_key = data_blob_talloc( dst,
src->user_session_key.data,
- src->user_session_key.length);
+ dst->session_key = data_blob_talloc( dst, src->session_key.data,
+ src->session_key.length);
dst->lm_session_key = data_blob_talloc(dst, src->lm_session_key.data,
src->lm_session_key.length);
@@ -897,12 +945,12 @@ struct auth_serversupplied_info
*copy_serverinfo(TALLOC_CTX *mem_ctx,
bool session_info_set_session_key(struct auth_serversupplied_info *info,
DATA_BLOB session_key)
{
- TALLOC_FREE(info->user_session_key.data);
+ TALLOC_FREE(info->session_key.data);
- info->user_session_key = data_blob_talloc(
+ info->session_key = data_blob_talloc(
info, session_key.data, session_key.length);
- return (info->user_session_key.data != NULL);
+ return (info->session_key.data != NULL);
}
static struct auth_serversupplied_info *guest_info = NULL;
@@ -1247,9 +1295,9 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
/* ensure we are never given NULL session keys */
if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {
- result->user_session_key = data_blob_null;
+ result->session_key = data_blob_null;
} else {
- result->user_session_key = data_blob_talloc(
+ result->session_key = data_blob_talloc(
result, info3->base.key.key,
sizeof(info3->base.key.key));
}
diff --git a/source3/auth/check_samsec.c b/source3/auth/check_samsec.c
index f918dc0..c4bcda4 100644
--- a/source3/auth/check_samsec.c
+++ b/source3/auth/check_samsec.c
@@ -492,7 +492,7 @@ NTSTATUS check_sam_security(const DATA_BLOB *challenge,
goto done;
}
- (*server_info)->user_session_key =
+ (*server_info)->session_key =
data_blob_talloc(*server_info, user_sess_key.data,
user_sess_key.length);
data_blob_free(&user_sess_key);
diff --git a/source3/auth/proto.h b/source3/auth/proto.h
index 3bf325e..15e79dd 100644
--- a/source3/auth/proto.h
+++ b/source3/auth/proto.h
@@ -101,7 +101,10 @@ bool make_user_info_guest(struct auth_usersupplied_info
**user_info) ;
struct samu;
NTSTATUS make_server_info_sam(struct auth_serversupplied_info **server_info,
struct samu *sampass);
-NTSTATUS create_local_token(struct auth_serversupplied_info *server_info);
+NTSTATUS create_local_token(TALLOC_CTX *mem_ctx,
+ struct auth_serversupplied_info *server_info,
+ DATA_BLOB *session_key,
+ struct auth_serversupplied_info **session_info_out);
NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
bool is_guest,
uid_t *uid, gid_t *gid,
@@ -113,10 +116,10 @@ struct passwd;
NTSTATUS make_server_info_pw(struct auth_serversupplied_info **server_info,
char *unix_username,
struct passwd *pwd);
-NTSTATUS make_serverinfo_from_username(TALLOC_CTX *mem_ctx,
- const char *username,
- bool is_guest,
- struct auth_serversupplied_info
**presult);
+NTSTATUS make_session_info_from_username(TALLOC_CTX *mem_ctx,
+ const char *username,
+ bool is_guest,
+ struct auth_serversupplied_info
**session_info);
struct auth_serversupplied_info *copy_serverinfo(TALLOC_CTX *mem_ctx,
const struct
auth_serversupplied_info *src);
bool init_guest_info(void);
@@ -258,11 +261,12 @@ NTSTATUS get_user_from_kerberos_info(TALLOC_CTX *mem_ctx,
char **ntdomain,
char **username,
struct passwd **_pw);
-NTSTATUS make_server_info_krb5(TALLOC_CTX *mem_ctx,
+NTSTATUS make_session_info_krb5(TALLOC_CTX *mem_ctx,
char *ntuser,
char *ntdomain,
char *username,
struct passwd *pw,
struct PAC_LOGON_INFO *logon_info,
- bool mapped_to_guest, bool username_was_mapped,
- struct auth_serversupplied_info **server_info);
+ bool mapped_to_guest, bool username_was_mapped,
+ DATA_BLOB *session_key,
+ struct auth_serversupplied_info **session_info);
diff --git a/source3/auth/server_info.c b/source3/auth/server_info.c
index 3190b75..440e45c 100644
--- a/source3/auth/server_info.c
+++ b/source3/auth/server_info.c
@@ -80,11 +80,11 @@ NTSTATUS serverinfo_to_SamInfo2(struct
auth_serversupplied_info *server_info,
return NT_STATUS_NO_MEMORY;
}
- if (server_info->user_session_key.length) {
+ if (server_info->session_key.length) {
memcpy(info3->base.key.key,
- server_info->user_session_key.data,
+ server_info->session_key.data,
MIN(sizeof(info3->base.key.key),
- server_info->user_session_key.length));
+ server_info->session_key.length));
if (pipe_session_key) {
arcfour_crypt(info3->base.key.key,
pipe_session_key, 16);
@@ -123,11 +123,11 @@ NTSTATUS serverinfo_to_SamInfo3(const struct
auth_serversupplied_info *server_in
return NT_STATUS_NO_MEMORY;
}
- if (server_info->user_session_key.length) {
+ if (server_info->session_key.length) {
memcpy(info3->base.key.key,
- server_info->user_session_key.data,
+ server_info->session_key.data,
MIN(sizeof(info3->base.key.key),
- server_info->user_session_key.length));
+ server_info->session_key.length));
if (pipe_session_key) {
arcfour_crypt(info3->base.key.key,
pipe_session_key, 16);
@@ -181,11 +181,11 @@ NTSTATUS serverinfo_to_SamInfo6(struct
auth_serversupplied_info *server_info,
return NT_STATUS_NO_MEMORY;
}
- if (server_info->user_session_key.length) {
+ if (server_info->session_key.length) {
memcpy(info3->base.key.key,
--
Samba Shared Repository
