/*
send a close
*/
static NTSTATUS torture_smb2_close(struct smb2_tree *tree, struct smb2_handle handle)
{
struct smb2_close io;
NTSTATUS status;
TALLOC_CTX *tmp_ctx = talloc_new(tree);
ZERO_STRUCT(io);
io.in.file.handle = handle;
io.in.flags = SMB2_CLOSE_FLAGS_FULL_INFORMATION;
status = smb2_close(tree, &io);
if (!NT_STATUS_IS_OK(status)) {
printf("close failed - %s\n", nt_errstr(status));
return status;
}
if (DEBUGLVL(1)) {
printf("Close gave:\n");
printf("create_time = %s\n", nt_time_string(tmp_ctx, io.out.create_time));
printf("access_time = %s\n", nt_time_string(tmp_ctx, io.out.access_time));
printf("write_time = %s\n", nt_time_string(tmp_ctx, io.out.write_time));
printf("change_time = %s\n", nt_time_string(tmp_ctx, io.out.change_time));
printf("alloc_size = %lld\n", (long long)io.out.alloc_size);
printf("size = %lld\n", (long long)io.out.size);
printf("file_attr = 0x%x\n", io.out.file_attr);
}
talloc_free(tmp_ctx);
return status;
}
/*
send a create
*/
static struct smb2_handle torture_smb2_create(struct smb2_tree *tree,
const char *fname)
{
struct smb2_create io;
NTSTATUS status;
TALLOC_CTX *tmp_ctx = talloc_new(tree);
ZERO_STRUCT(io);
io.in.oplock_flags = 0;
io.in.access_mask = SEC_RIGHTS_FILE_ALL;
io.in.file_attr = FILE_ATTRIBUTE_NORMAL;
io.in.open_disposition = NTCREATEX_DISP_OPEN_IF;
io.in.share_access =
NTCREATEX_SHARE_ACCESS_DELETE|
NTCREATEX_SHARE_ACCESS_READ|
NTCREATEX_SHARE_ACCESS_WRITE;
io.in.create_options = NTCREATEX_OPTIONS_WRITE_THROUGH;
io.in.fname = fname;
status = smb2_create(tree, tmp_ctx, &io);
if (!NT_STATUS_IS_OK(status)) {
printf("create1 failed - %s\n", nt_errstr(status));
return io.out.file.handle;
}
if (DEBUGLVL(1)) {
printf("Open gave:\n");
printf("oplock_flags = 0x%x\n", io.out.oplock_flags);
printf("create_action = 0x%x\n", io.out.create_action);
printf("create_time = %s\n", nt_time_string(tmp_ctx, io.out.create_time));
printf("access_time = %s\n", nt_time_string(tmp_ctx, io.out.access_time));
printf("write_time = %s\n", nt_time_string(tmp_ctx, io.out.write_time));
printf("change_time = %s\n", nt_time_string(tmp_ctx, io.out.change_time));
printf("alloc_size = %lld\n", (long long)io.out.alloc_size);
printf("size = %lld\n", (long long)io.out.size);
printf("file_attr = 0x%x\n", io.out.file_attr);
printf("handle = %016llx%016llx\n",
(long long)io.out.file.handle.data[0],
(long long)io.out.file.handle.data[1]);
}
talloc_free(tmp_ctx);
return io.out.file.handle;
}
_PUBLIC_ void mapidump_freebusy_date(uint32_t t, const char *sep)
{
TALLOC_CTX *mem_ctx;
NTTIME time;
const char *date;
mem_ctx = talloc_named(NULL, 0, "mapidump_freebusy_date");
time = t;
time *= 60;
time *= 10000000;
date = nt_time_string(mem_ctx, time);
OC_DEBUG(0, "%s %-30s", sep, date);
talloc_free((char *)date);
talloc_free(mem_ctx);
}
NTSTATUS wreplsrv_periodic_schedule(struct wreplsrv_service *service, uint32_t next_interval)
{
TALLOC_CTX *tmp_mem;
struct tevent_timer *new_te;
struct timeval next_time;
/* prevent looping */
if (next_interval == 0) next_interval = 1;
next_time = timeval_current_ofs(next_interval, 5000);
if (service->periodic.te) {
/*
* if the timestamp of the new event is higher,
* as current next we don't need to reschedule
*/
if (timeval_compare(&next_time, &service->periodic.next_event) > 0) {
return NT_STATUS_OK;
}
}
/* reset the next scheduled timestamp */
service->periodic.next_event = next_time;
new_te = event_add_timed(service->task->event_ctx, service,
service->periodic.next_event,
wreplsrv_periodic_handler_te, service);
NT_STATUS_HAVE_NO_MEMORY(new_te);
tmp_mem = talloc_new(service);
DEBUG(6,("wreplsrv_periodic_schedule(%u) %sscheduled for: %s\n",
next_interval,
(service->periodic.te?"re":""),
nt_time_string(tmp_mem, timeval_to_nttime(&next_time))));
talloc_free(tmp_mem);
talloc_free(service->periodic.te);
service->periodic.te = new_te;
return NT_STATUS_OK;
}
/**
\details This function dumps a property containing a date / time to standard output
If the property does not contain a PT_SYSTIME type value, then no output will occur.
\param lpProp the property to dump
\param label the label to display prior to the time (e.g. the property tag)
\param sep a separator / spacer to insert in front of the label
\note Prior to OpenChange 0.9, this function took 2 arguments, assuming a default separator of
a tab. You can get the old behaviour by using "\t" for sep.
*/
_PUBLIC_ void mapidump_date_SPropValue(struct SPropValue lpProp, const char *label, const char *sep)
{
TALLOC_CTX *mem_ctx;
NTTIME time;
const struct FILETIME *filetime;
const char *date;
mem_ctx = talloc_named(NULL, 0, "mapidump_date_SPropValue");
filetime = (const struct FILETIME *) get_SPropValue_data(&lpProp);
if (filetime) {
time = filetime->dwHighDateTime;
time = time << 32;
time |= filetime->dwLowDateTime;
date = nt_time_string(mem_ctx, time);
printf("%s%s: %s\n", sep, label, date);
fflush(0);
}
talloc_free(mem_ctx);
}
_PUBLIC_ void mapidump_date(struct mapi_SPropValue_array *properties, uint32_t mapitag, const char *label)
{
TALLOC_CTX *mem_ctx;
NTTIME time;
const struct FILETIME *filetime;
const char *date;
mem_ctx = talloc_named(NULL, 0, "mapidump_date");
filetime = (const struct FILETIME *) find_mapi_SPropValue_data(properties, mapitag);
if (filetime) {
time = filetime->dwHighDateTime;
time = time << 32;
time |= filetime->dwLowDateTime;
date = nt_time_string(mem_ctx, time);
printf("\t%-15s: %s\n", label, date);
fflush(0);
}
talloc_free(mem_ctx);
}
static PyObject *py_nttime2string(PyObject *self, PyObject *args)
{
PyObject *ret;
NTTIME nt;
TALLOC_CTX *tmp_ctx;
const char *string;
if (!PyArg_ParseTuple(args, "K", &nt))
return NULL;
tmp_ctx = talloc_new(NULL);
if (tmp_ctx == NULL) {
PyErr_NoMemory();
return NULL;
}
string = nt_time_string(tmp_ctx, nt);
ret = PyString_FromString(string);
talloc_free(tmp_ctx);
return ret;
}
_PUBLIC_ void ndr_print_NTTIME(struct ndr_print *ndr, const char *name, NTTIME t)
{
ndr->print(ndr, "%-25s: %s", name, nt_time_string(ndr, t));
}
/* basic testing of all RAW_FILEINFO_* calls
for each call we test that it succeeds, and where possible test
for consistency between the calls.
*/
static bool torture_raw_qfileinfo_internals(struct torture_context *torture,
TALLOC_CTX *mem_ctx,
struct smbcli_tree *tree,
int fnum, const char *fname,
bool is_ipc)
{
int i;
bool ret = true;
int count;
union smb_fileinfo *s1, *s2;
NTTIME correct_time;
uint64_t correct_size;
uint32_t correct_attrib;
const char *correct_name;
bool skip_streams = false;
/* scan all the fileinfo and pathinfo levels */
for (i=0; levels[i].name; i++) {
if (!levels[i].only_paths) {
levels[i].fnum_finfo.generic.level = levels[i].level;
levels[i].fnum_finfo.generic.in.file.fnum = fnum;
levels[i].fnum_status = smb_raw_fileinfo(tree, mem_ctx,
&levels[i].fnum_finfo);
}
if (!levels[i].only_handles) {
levels[i].fname_finfo.generic.level = levels[i].level;
levels[i].fname_finfo.generic.in.file.path = talloc_strdup(mem_ctx, fname);
levels[i].fname_status = smb_raw_pathinfo(tree, mem_ctx,
&levels[i].fname_finfo);
}
}
/* check for completely broken levels */
for (count=i=0; levels[i].name; i++) {
uint32_t cap = tree->session->transport->negotiate.capabilities;
/* see if this server claims to support this level */
if ((cap & levels[i].capability_mask) != levels[i].capability_mask) {
continue;
}
if (is_ipc) {
if (levels[i].expected_ipc_access_denied && NT_STATUS_EQUAL(NT_STATUS_ACCESS_DENIED, levels[i].fname_status)) {
} else if (!levels[i].only_handles &&
NT_STATUS_EQUAL(levels[i].fname_status,
NT_STATUS_NOT_SUPPORTED)) {
torture_warning(torture, "fname level %s %s",
levels[i].name,
nt_errstr(levels[i].fname_status));
continue;
} else if (!levels[i].only_handles && !NT_STATUS_EQUAL(NT_STATUS_INVALID_DEVICE_REQUEST, levels[i].fname_status)) {
printf("ERROR: fname level %s failed, expected NT_STATUS_INVALID_DEVICE_REQUEST - %s\n",
levels[i].name, nt_errstr(levels[i].fname_status));
count++;
}
if (!levels[i].only_paths &&
(NT_STATUS_EQUAL(levels[i].fnum_status,
NT_STATUS_NOT_SUPPORTED) ||
NT_STATUS_EQUAL(levels[i].fnum_status,
NT_STATUS_NOT_IMPLEMENTED))) {
torture_warning(torture, "fnum level %s %s",
levels[i].name,
nt_errstr(levels[i].fnum_status));
continue;
}
if (!levels[i].only_paths && !NT_STATUS_EQUAL(levels[i].expected_ipc_fnum_status, levels[i].fnum_status)) {
printf("ERROR: fnum level %s failed, expected %s - %s\n",
levels[i].name, nt_errstr(levels[i].expected_ipc_fnum_status),
nt_errstr(levels[i].fnum_status));
count++;
}
} else {
if (!levels[i].only_paths &&
(NT_STATUS_EQUAL(levels[i].fnum_status,
NT_STATUS_NOT_SUPPORTED) ||
NT_STATUS_EQUAL(levels[i].fnum_status,
NT_STATUS_NOT_IMPLEMENTED))) {
torture_warning(torture, "fnum level %s %s",
levels[i].name,
nt_errstr(levels[i].fnum_status));
continue;
}
if (!levels[i].only_handles &&
(NT_STATUS_EQUAL(levels[i].fname_status,
NT_STATUS_NOT_SUPPORTED) ||
NT_STATUS_EQUAL(levels[i].fname_status,
NT_STATUS_NOT_IMPLEMENTED))) {
torture_warning(torture, "fname level %s %s",
levels[i].name,
nt_errstr(levels[i].fname_status));
continue;
}
if (!levels[i].only_paths && !NT_STATUS_IS_OK(levels[i].fnum_status)) {
printf("ERROR: fnum level %s failed - %s\n",
levels[i].name, nt_errstr(levels[i].fnum_status));
count++;
}
if (!levels[i].only_handles && !NT_STATUS_IS_OK(levels[i].fname_status)) {
printf("ERROR: fname level %s failed - %s\n",
levels[i].name, nt_errstr(levels[i].fname_status));
count++;
}
}
}
if (count != 0) {
ret = false;
printf("%d levels failed\n", count);
if (count > 35) {
torture_fail(torture, "too many level failures - giving up");
}
}
/* see if we can do streams */
s1 = fnum_find("STREAM_INFO");
if (!s1 || s1->stream_info.out.num_streams == 0) {
if (!is_ipc) {
printf("STREAM_INFO broken (%d) - skipping streams checks\n",
s1 ? s1->stream_info.out.num_streams : -1);
}
skip_streams = true;
}
/* this code is incredibly repititive but doesn't lend itself to loops, so
we use lots of macros to make it less painful */
/* first off we check the levels that are supposed to be aliases. It will be quite rare for
this code to fail, but we need to check it for completeness */
#define ALIAS_CHECK(sname1, sname2) \
do { \
s1 = fnum_find(sname1); s2 = fnum_find(sname2); \
if (s1 && s2) { INFO_CHECK } \
s1 = fname_find(is_ipc, sname1); s2 = fname_find(is_ipc, sname2); \
if (s1 && s2) { INFO_CHECK } \
s1 = fnum_find(sname1); s2 = fname_find(is_ipc, sname2); \
if (s1 && s2) { INFO_CHECK } \
} while (0)
#define INFO_CHECK \
STRUCT_EQUAL(basic_info, create_time, basic_info, create_time); \
STRUCT_EQUAL(basic_info, access_time, basic_info, access_time); \
STRUCT_EQUAL(basic_info, write_time, basic_info, write_time); \
STRUCT_EQUAL(basic_info, change_time, basic_info, change_time); \
VAL_EQUAL (basic_info, attrib, basic_info, attrib);
ALIAS_CHECK("BASIC_INFO", "BASIC_INFORMATION");
#undef INFO_CHECK
#define INFO_CHECK \
VAL_EQUAL(standard_info, alloc_size, standard_info, alloc_size); \
VAL_EQUAL(standard_info, size, standard_info, size); \
VAL_EQUAL(standard_info, nlink, standard_info, nlink); \
VAL_EQUAL(standard_info, delete_pending, standard_info, delete_pending); \
VAL_EQUAL(standard_info, directory, standard_info, directory);
ALIAS_CHECK("STANDARD_INFO", "STANDARD_INFORMATION");
#undef INFO_CHECK
#define INFO_CHECK \
VAL_EQUAL(ea_info, ea_size, ea_info, ea_size);
ALIAS_CHECK("EA_INFO", "EA_INFORMATION");
#undef INFO_CHECK
#define INFO_CHECK \
STR_EQUAL(name_info, fname, name_info, fname);
ALIAS_CHECK("NAME_INFO", "NAME_INFORMATION");
#undef INFO_CHECK
#define INFO_CHECK \
STRUCT_EQUAL(all_info, create_time, all_info, create_time); \
STRUCT_EQUAL(all_info, access_time, all_info, access_time); \
STRUCT_EQUAL(all_info, write_time, all_info, write_time); \
STRUCT_EQUAL(all_info, change_time, all_info, change_time); \
VAL_EQUAL(all_info, attrib, all_info, attrib); \
VAL_EQUAL(all_info, alloc_size, all_info, alloc_size); \
VAL_EQUAL(all_info, size, all_info, size); \
VAL_EQUAL(all_info, nlink, all_info, nlink); \
VAL_EQUAL(all_info, delete_pending, all_info, delete_pending); \
VAL_EQUAL(all_info, directory, all_info, directory); \
VAL_EQUAL(all_info, ea_size, all_info, ea_size); \
STR_EQUAL(all_info, fname, all_info, fname);
ALIAS_CHECK("ALL_INFO", "ALL_INFORMATION");
#undef INFO_CHECK
#define INFO_CHECK \
VAL_EQUAL(compression_info, compressed_size,compression_info, compressed_size); \
VAL_EQUAL(compression_info, format, compression_info, format); \
VAL_EQUAL(compression_info, unit_shift, compression_info, unit_shift); \
VAL_EQUAL(compression_info, chunk_shift, compression_info, chunk_shift); \
VAL_EQUAL(compression_info, cluster_shift, compression_info, cluster_shift);
ALIAS_CHECK("COMPRESSION_INFO", "COMPRESSION_INFORMATION");
#undef INFO_CHECK
#define INFO_CHECK \
STR_EQUAL(alt_name_info, fname, alt_name_info, fname);
ALIAS_CHECK("ALT_NAME_INFO", "ALT_NAME_INFORMATION");
#define TIME_CHECK_NT(sname, stype, tfield) do { \
s1 = fnum_find(sname); \
if (s1 && memcmp(&s1->stype.out.tfield, &correct_time, sizeof(correct_time)) != 0) { \
printf("(%d) handle %s/%s incorrect - %s should be %s\n", __LINE__, #stype, #tfield, \
nt_time_string(mem_ctx, s1->stype.out.tfield), \
nt_time_string(mem_ctx, correct_time)); \
ret = false; \
} \
s1 = fname_find(is_ipc, sname); \
if (s1 && memcmp(&s1->stype.out.tfield, &correct_time, sizeof(correct_time)) != 0) { \
printf("(%d) path %s/%s incorrect - %s should be %s\n", __LINE__, #stype, #tfield, \
nt_time_string(mem_ctx, s1->stype.out.tfield), \
nt_time_string(mem_ctx, correct_time)); \
ret = false; \
}} while (0)
#define TIME_CHECK_DOS(sname, stype, tfield) do { \
s1 = fnum_find(sname); \
if (s1 && dos_nt_time_cmp(s1->stype.out.tfield, correct_time) != 0) { \
printf("(%d) handle %s/%s incorrect - %s should be %s\n", __LINE__, #stype, #tfield, \
timestring(mem_ctx, s1->stype.out.tfield), \
nt_time_string(mem_ctx, correct_time)); \
ret = false; \
} \
s1 = fname_find(is_ipc, sname); \
if (s1 && dos_nt_time_cmp(s1->stype.out.tfield, correct_time) != 0) { \
printf("(%d) path %s/%s incorrect - %s should be %s\n", __LINE__, #stype, #tfield, \
timestring(mem_ctx, s1->stype.out.tfield), \
nt_time_string(mem_ctx, correct_time)); \
ret = false; \
}} while (0)
#if 0 /* unused */
#define TIME_CHECK_UNX(sname, stype, tfield) do { \
s1 = fnum_find(sname); \
if (s1 && unx_nt_time_cmp(s1->stype.out.tfield, correct_time) != 0) { \
printf("(%d) handle %s/%s incorrect - %s should be %s\n", __LINE__, #stype, #tfield, \
timestring(mem_ctx, s1->stype.out.tfield), \
nt_time_string(mem_ctx, correct_time)); \
ret = false; \
} \
s1 = fname_find(is_ipc, sname); \
if (s1 && unx_nt_time_cmp(s1->stype.out.tfield, correct_time) != 0) { \
printf("(%d) path %s/%s incorrect - %s should be %s\n", __LINE__, #stype, #tfield, \
timestring(mem_ctx, s1->stype.out.tfield), \
nt_time_string(mem_ctx, correct_time)); \
ret = false; \
}} while (0)
#endif
/* now check that all the times that are supposed to be equal are correct */
s1 = fnum_find("BASIC_INFO");
correct_time = s1->basic_info.out.create_time;
torture_comment(torture, "create_time: %s\n", nt_time_string(mem_ctx, correct_time));
TIME_CHECK_NT ("BASIC_INFO", basic_info, create_time);
TIME_CHECK_NT ("BASIC_INFORMATION", basic_info, create_time);
TIME_CHECK_DOS("GETATTRE", getattre, create_time);
TIME_CHECK_DOS("STANDARD", standard, create_time);
TIME_CHECK_DOS("EA_SIZE", ea_size, create_time);
TIME_CHECK_NT ("ALL_INFO", all_info, create_time);
TIME_CHECK_NT ("NETWORK_OPEN_INFORMATION", network_open_information, create_time);
s1 = fnum_find("BASIC_INFO");
correct_time = s1->basic_info.out.access_time;
torture_comment(torture, "access_time: %s\n", nt_time_string(mem_ctx, correct_time));
TIME_CHECK_NT ("BASIC_INFO", basic_info, access_time);
TIME_CHECK_NT ("BASIC_INFORMATION", basic_info, access_time);
TIME_CHECK_DOS("GETATTRE", getattre, access_time);
TIME_CHECK_DOS("STANDARD", standard, access_time);
TIME_CHECK_DOS("EA_SIZE", ea_size, access_time);
TIME_CHECK_NT ("ALL_INFO", all_info, access_time);
TIME_CHECK_NT ("NETWORK_OPEN_INFORMATION", network_open_information, access_time);
s1 = fnum_find("BASIC_INFO");
correct_time = s1->basic_info.out.write_time;
torture_comment(torture, "write_time : %s\n", nt_time_string(mem_ctx, correct_time));
TIME_CHECK_NT ("BASIC_INFO", basic_info, write_time);
TIME_CHECK_NT ("BASIC_INFORMATION", basic_info, write_time);
TIME_CHECK_DOS("GETATTR", getattr, write_time);
TIME_CHECK_DOS("GETATTRE", getattre, write_time);
TIME_CHECK_DOS("STANDARD", standard, write_time);
TIME_CHECK_DOS("EA_SIZE", ea_size, write_time);
TIME_CHECK_NT ("ALL_INFO", all_info, write_time);
TIME_CHECK_NT ("NETWORK_OPEN_INFORMATION", network_open_information, write_time);
s1 = fnum_find("BASIC_INFO");
correct_time = s1->basic_info.out.change_time;
torture_comment(torture, "change_time: %s\n", nt_time_string(mem_ctx, correct_time));
TIME_CHECK_NT ("BASIC_INFO", basic_info, change_time);
TIME_CHECK_NT ("BASIC_INFORMATION", basic_info, change_time);
TIME_CHECK_NT ("ALL_INFO", all_info, change_time);
TIME_CHECK_NT ("NETWORK_OPEN_INFORMATION", network_open_information, change_time);
#define SIZE_CHECK(sname, stype, tfield) do { \
s1 = fnum_find(sname); \
if (s1 && s1->stype.out.tfield != correct_size) { \
printf("(%d) handle %s/%s incorrect - %u should be %u\n", __LINE__, #stype, #tfield, \
(unsigned int)s1->stype.out.tfield, \
(unsigned int)correct_size); \
ret = false; \
} \
s1 = fname_find(is_ipc, sname); \
if (s1 && s1->stype.out.tfield != correct_size) { \
printf("(%d) path %s/%s incorrect - %u should be %u\n", __LINE__, #stype, #tfield, \
(unsigned int)s1->stype.out.tfield, \
(unsigned int)correct_size); \
ret = false; \
}} while (0)
s1 = fnum_find("STANDARD_INFO");
correct_size = s1->standard_info.out.size;
torture_comment(torture, "size: %u\n", (unsigned int)correct_size);
SIZE_CHECK("GETATTR", getattr, size);
SIZE_CHECK("GETATTRE", getattre, size);
SIZE_CHECK("STANDARD", standard, size);
SIZE_CHECK("EA_SIZE", ea_size, size);
SIZE_CHECK("STANDARD_INFO", standard_info, size);
SIZE_CHECK("STANDARD_INFORMATION", standard_info, size);
SIZE_CHECK("ALL_INFO", all_info, size);
SIZE_CHECK("ALL_INFORMATION", all_info, size);
SIZE_CHECK("COMPRESSION_INFO", compression_info, compressed_size);
SIZE_CHECK("COMPRESSION_INFORMATION", compression_info, compressed_size);
SIZE_CHECK("NETWORK_OPEN_INFORMATION", network_open_information, size);
if (!skip_streams) {
SIZE_CHECK("STREAM_INFO", stream_info, streams[0].size);
SIZE_CHECK("STREAM_INFORMATION", stream_info, streams[0].size);
}
s1 = fnum_find("STANDARD_INFO");
correct_size = s1->standard_info.out.alloc_size;
torture_comment(torture, "alloc_size: %u\n", (unsigned int)correct_size);
SIZE_CHECK("GETATTRE", getattre, alloc_size);
SIZE_CHECK("STANDARD", standard, alloc_size);
SIZE_CHECK("EA_SIZE", ea_size, alloc_size);
SIZE_CHECK("STANDARD_INFO", standard_info, alloc_size);
SIZE_CHECK("STANDARD_INFORMATION", standard_info, alloc_size);
SIZE_CHECK("ALL_INFO", all_info, alloc_size);
SIZE_CHECK("ALL_INFORMATION", all_info, alloc_size);
SIZE_CHECK("NETWORK_OPEN_INFORMATION", network_open_information, alloc_size);
if (!skip_streams) {
SIZE_CHECK("STREAM_INFO", stream_info, streams[0].alloc_size);
SIZE_CHECK("STREAM_INFORMATION", stream_info, streams[0].alloc_size);
}
#define ATTRIB_CHECK(sname, stype, tfield) do { \
s1 = fnum_find(sname); \
if (s1 && s1->stype.out.tfield != correct_attrib) { \
printf("(%d) handle %s/%s incorrect - 0x%x should be 0x%x\n", __LINE__, #stype, #tfield, \
(unsigned int)s1->stype.out.tfield, \
(unsigned int)correct_attrib); \
ret = false; \
} \
s1 = fname_find(is_ipc, sname); \
if (s1 && s1->stype.out.tfield != correct_attrib) { \
printf("(%d) path %s/%s incorrect - 0x%x should be 0x%x\n", __LINE__, #stype, #tfield, \
(unsigned int)s1->stype.out.tfield, \
(unsigned int)correct_attrib); \
ret = false; \
}} while (0)
s1 = fnum_find("BASIC_INFO");
correct_attrib = s1->basic_info.out.attrib;
torture_comment(torture, "attrib: 0x%x\n", (unsigned int)correct_attrib);
ATTRIB_CHECK("GETATTR", getattr, attrib);
if (!is_ipc) {
ATTRIB_CHECK("GETATTRE", getattre, attrib);
ATTRIB_CHECK("STANDARD", standard, attrib);
ATTRIB_CHECK("EA_SIZE", ea_size, attrib);
}
ATTRIB_CHECK("BASIC_INFO", basic_info, attrib);
ATTRIB_CHECK("BASIC_INFORMATION", basic_info, attrib);
ATTRIB_CHECK("ALL_INFO", all_info, attrib);
ATTRIB_CHECK("ALL_INFORMATION", all_info, attrib);
ATTRIB_CHECK("NETWORK_OPEN_INFORMATION", network_open_information, attrib);
ATTRIB_CHECK("ATTRIBUTE_TAG_INFORMATION", attribute_tag_information, attrib);
correct_name = fname;
torture_comment(torture, "name: %s\n", correct_name);
#define NAME_CHECK(sname, stype, tfield, flags) do { \
s1 = fnum_find(sname); \
if (s1 && (strcmp_safe(s1->stype.out.tfield.s, correct_name) != 0 || \
wire_bad_flags(&s1->stype.out.tfield, flags, tree->session->transport))) { \
printf("(%d) handle %s/%s incorrect - '%s/%d'\n", __LINE__, #stype, #tfield, \
s1->stype.out.tfield.s, s1->stype.out.tfield.private_length); \
ret = false; \
} \
s1 = fname_find(is_ipc, sname); \
if (s1 && (strcmp_safe(s1->stype.out.tfield.s, correct_name) != 0 || \
wire_bad_flags(&s1->stype.out.tfield, flags, tree->session->transport))) { \
printf("(%d) path %s/%s incorrect - '%s/%d'\n", __LINE__, #stype, #tfield, \
s1->stype.out.tfield.s, s1->stype.out.tfield.private_length); \
ret = false; \
}} while (0)
NAME_CHECK("NAME_INFO", name_info, fname, STR_UNICODE);
NAME_CHECK("NAME_INFORMATION", name_info, fname, STR_UNICODE);
/* the ALL_INFO file name is the full path on the filesystem */
s1 = fnum_find("ALL_INFO");
if (s1 && !s1->all_info.out.fname.s) {
torture_fail(torture, "ALL_INFO didn't give a filename");
}
if (s1 && s1->all_info.out.fname.s) {
char *p = strrchr(s1->all_info.out.fname.s, '\\');
if (!p) {
printf("Not a full path in all_info/fname? - '%s'\n",
s1->all_info.out.fname.s);
ret = false;
} else {
if (strcmp_safe(correct_name, p) != 0) {
printf("incorrect basename in all_info/fname - '%s'\n",
s1->all_info.out.fname.s);
ret = false;
}
}
if (wire_bad_flags(&s1->all_info.out.fname, STR_UNICODE, tree->session->transport)) {
printf("Should not null terminate all_info/fname\n");
ret = false;
}
}
s1 = fnum_find("ALT_NAME_INFO");
if (s1) {
correct_name = s1->alt_name_info.out.fname.s;
}
if (!correct_name) {
torture_comment(torture, "no alternate name information\n");
} else {
torture_comment(torture, "alt_name: %s\n", correct_name);
NAME_CHECK("ALT_NAME_INFO", alt_name_info, fname, STR_UNICODE);
NAME_CHECK("ALT_NAME_INFORMATION", alt_name_info, fname, STR_UNICODE);
/* and make sure we can open by alternate name */
smbcli_close(tree, fnum);
fnum = smbcli_nt_create_full(tree, correct_name, 0,
SEC_RIGHTS_FILE_ALL,
FILE_ATTRIBUTE_NORMAL,
NTCREATEX_SHARE_ACCESS_DELETE|
NTCREATEX_SHARE_ACCESS_READ|
NTCREATEX_SHARE_ACCESS_WRITE,
NTCREATEX_DISP_OVERWRITE_IF,
0, 0);
if (fnum == -1) {
printf("Unable to open by alt_name - %s\n", smbcli_errstr(tree));
ret = false;
}
if (!skip_streams) {
correct_name = "::$DATA";
torture_comment(torture, "stream_name: %s\n", correct_name);
NAME_CHECK("STREAM_INFO", stream_info, streams[0].stream_name, STR_UNICODE);
NAME_CHECK("STREAM_INFORMATION", stream_info, streams[0].stream_name, STR_UNICODE);
}
}
/* make sure the EAs look right */
s1 = fnum_find("ALL_EAS");
s2 = fnum_find("ALL_INFO");
if (s1) {
for (i=0;i<s1->all_eas.out.num_eas;i++) {
printf(" flags=%d %s=%*.*s\n",
s1->all_eas.out.eas[i].flags,
s1->all_eas.out.eas[i].name.s,
(int)s1->all_eas.out.eas[i].value.length,
(int)s1->all_eas.out.eas[i].value.length,
s1->all_eas.out.eas[i].value.data);
}
}
if (s1 && s2) {
if (s1->all_eas.out.num_eas == 0) {
if (s2->all_info.out.ea_size != 0) {
printf("ERROR: num_eas==0 but fnum all_info.out.ea_size == %d\n",
s2->all_info.out.ea_size);
}
} else {
if (s2->all_info.out.ea_size !=
ea_list_size(s1->all_eas.out.num_eas, s1->all_eas.out.eas)) {
printf("ERROR: ea_list_size=%d != fnum all_info.out.ea_size=%d\n",
(int)ea_list_size(s1->all_eas.out.num_eas, s1->all_eas.out.eas),
(int)s2->all_info.out.ea_size);
}
}
}
s2 = fname_find(is_ipc, "ALL_EAS");
if (s2) {
VAL_EQUAL(all_eas, num_eas, all_eas, num_eas);
for (i=0;i<s1->all_eas.out.num_eas;i++) {
VAL_EQUAL(all_eas, eas[i].flags, all_eas, eas[i].flags);
STR_EQUAL(all_eas, eas[i].name, all_eas, eas[i].name);
VAL_EQUAL(all_eas, eas[i].value.length, all_eas, eas[i].value.length);
}
}
#define VAL_CHECK(sname1, stype1, tfield1, sname2, stype2, tfield2) do { \
s1 = fnum_find(sname1); s2 = fnum_find(sname2); \
if (s1 && s2 && s1->stype1.out.tfield1 != s2->stype2.out.tfield2) { \
printf("(%d) handle %s/%s != %s/%s - 0x%x vs 0x%x\n", __LINE__, \
#stype1, #tfield1, #stype2, #tfield2, \
s1->stype1.out.tfield1, s2->stype2.out.tfield2); \
ret = false; \
} \
s1 = fname_find(is_ipc, sname1); s2 = fname_find(is_ipc, sname2); \
if (s1 && s2 && s1->stype1.out.tfield1 != s2->stype2.out.tfield2) { \
printf("(%d) path %s/%s != %s/%s - 0x%x vs 0x%x\n", __LINE__, \
#stype1, #tfield1, #stype2, #tfield2, \
s1->stype1.out.tfield1, s2->stype2.out.tfield2); \
ret = false; \
} \
s1 = fnum_find(sname1); s2 = fname_find(is_ipc, sname2); \
if (s1 && s2 && s1->stype1.out.tfield1 != s2->stype2.out.tfield2) { \
printf("(%d) handle %s/%s != path %s/%s - 0x%x vs 0x%x\n", __LINE__, \
#stype1, #tfield1, #stype2, #tfield2, \
s1->stype1.out.tfield1, s2->stype2.out.tfield2); \
ret = false; \
} \
s1 = fname_find(is_ipc, sname1); s2 = fnum_find(sname2); \
if (s1 && s2 && s1->stype1.out.tfield1 != s2->stype2.out.tfield2) { \
printf("(%d) path %s/%s != handle %s/%s - 0x%x vs 0x%x\n", __LINE__, \
#stype1, #tfield1, #stype2, #tfield2, \
s1->stype1.out.tfield1, s2->stype2.out.tfield2); \
ret = false; \
}} while (0)
VAL_CHECK("STANDARD_INFO", standard_info, delete_pending,
"ALL_INFO", all_info, delete_pending);
VAL_CHECK("STANDARD_INFO", standard_info, directory,
"ALL_INFO", all_info, directory);
VAL_CHECK("STANDARD_INFO", standard_info, nlink,
"ALL_INFO", all_info, nlink);
s1 = fnum_find("BASIC_INFO");
if (s1 && is_ipc) {
if (s1->basic_info.out.attrib != FILE_ATTRIBUTE_NORMAL) {
printf("(%d) attrib basic_info/nlink incorrect - %d should be %d\n", __LINE__, s1->basic_info.out.attrib, (int)FILE_ATTRIBUTE_NORMAL);
ret = false;
}
}
s1 = fnum_find("STANDARD_INFO");
if (s1 && is_ipc) {
if (s1->standard_info.out.nlink != 1) {
printf("(%d) nlinks standard_info/nlink incorrect - %d should be 1\n", __LINE__, s1->standard_info.out.nlink);
ret = false;
}
if (s1->standard_info.out.delete_pending != 1) {
printf("(%d) nlinks standard_info/delete_pending incorrect - %d should be 1\n", __LINE__, s1->standard_info.out.delete_pending);
ret = false;
}
}
VAL_CHECK("EA_INFO", ea_info, ea_size,
"ALL_INFO", all_info, ea_size);
if (!is_ipc) {
VAL_CHECK("EA_SIZE", ea_size, ea_size,
"ALL_INFO", all_info, ea_size);
}
#define NAME_PATH_CHECK(sname, stype, field) do { \
s1 = fname_find(is_ipc, sname); s2 = fnum_find(sname); \
if (s1 && s2) { \
VAL_EQUAL(stype, field, stype, field); \
} \
} while (0)
s1 = fnum_find("INTERNAL_INFORMATION");
if (s1) {
torture_comment(torture, "file_id=%.0f\n", (double)s1->internal_information.out.file_id);
}
NAME_PATH_CHECK("INTERNAL_INFORMATION", internal_information, file_id);
NAME_PATH_CHECK("POSITION_INFORMATION", position_information, position);
if (s1 && s2) {
printf("fnum pos = %.0f, fname pos = %.0f\n",
(double)s2->position_information.out.position,
(double)s1->position_information.out.position );
}
NAME_PATH_CHECK("MODE_INFORMATION", mode_information, mode);
NAME_PATH_CHECK("ALIGNMENT_INFORMATION", alignment_information, alignment_requirement);
NAME_PATH_CHECK("ATTRIBUTE_TAG_INFORMATION", attribute_tag_information, attrib);
NAME_PATH_CHECK("ATTRIBUTE_TAG_INFORMATION", attribute_tag_information, reparse_tag);
#if 0
/* these are expected to differ */
NAME_PATH_CHECK("ACCESS_INFORMATION", access_information, access_flags);
#endif
#if 0 /* unused */
#define UNKNOWN_CHECK(sname, stype, tfield) do { \
s1 = fnum_find(sname); \
if (s1 && s1->stype.out.tfield != 0) { \
printf("(%d) handle %s/%s unknown != 0 (0x%x)\n", __LINE__, \
#stype, #tfield, \
(unsigned int)s1->stype.out.tfield); \
} \
s1 = fname_find(is_ipc, sname); \
if (s1 && s1->stype.out.tfield != 0) { \
printf("(%d) path %s/%s unknown != 0 (0x%x)\n", __LINE__, \
#stype, #tfield, \
(unsigned int)s1->stype.out.tfield); \
}} while (0)
#endif
/* now get a bit fancier .... */
/* when we set the delete disposition then the link count should drop
to 0 and delete_pending should be 1 */
return ret;
}
static void smbXsrv_session_close_loop(struct tevent_req *subreq)
{
struct smbXsrv_client *client =
tevent_req_callback_data(subreq,
struct smbXsrv_client);
struct smbXsrv_session_table *table = client->session_table;
int ret;
struct messaging_rec *rec = NULL;
struct smbXsrv_session_closeB close_blob;
enum ndr_err_code ndr_err;
struct smbXsrv_session_close0 *close_info0 = NULL;
struct smbXsrv_session *session = NULL;
NTSTATUS status;
struct timeval tv = timeval_current();
NTTIME now = timeval_to_nttime(&tv);
ret = messaging_read_recv(subreq, talloc_tos(), &rec);
TALLOC_FREE(subreq);
if (ret != 0) {
goto next;
}
ndr_err = ndr_pull_struct_blob(&rec->buf, rec, &close_blob,
(ndr_pull_flags_fn_t)ndr_pull_smbXsrv_session_closeB);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(1,("smbXsrv_session_close_loop: "
"ndr_pull_struct_blob - %s\n",
nt_errstr(status)));
goto next;
}
DEBUG(10,("smbXsrv_session_close_loop: MSG_SMBXSRV_SESSION_CLOSE\n"));
if (DEBUGLVL(10)) {
NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
}
if (close_blob.version != SMBXSRV_VERSION_0) {
DEBUG(0,("smbXsrv_session_close_loop: "
"ignore invalid version %u\n", close_blob.version));
NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
goto next;
}
close_info0 = close_blob.info.info0;
if (close_info0 == NULL) {
DEBUG(0,("smbXsrv_session_close_loop: "
"ignore NULL info %u\n", close_blob.version));
NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
goto next;
}
status = smb2srv_session_lookup_client(client,
close_info0->old_session_wire_id,
now, &session);
if (NT_STATUS_EQUAL(status, NT_STATUS_USER_SESSION_DELETED)) {
DEBUG(4,("smbXsrv_session_close_loop: "
"old_session_wire_id %llu not found\n",
(unsigned long long)close_info0->old_session_wire_id));
if (DEBUGLVL(4)) {
NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
}
goto next;
}
if (!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) &&
!NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_SESSION_EXPIRED)) {
DEBUG(1,("smbXsrv_session_close_loop: "
"old_session_wire_id %llu - %s\n",
(unsigned long long)close_info0->old_session_wire_id,
nt_errstr(status)));
if (DEBUGLVL(1)) {
NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
}
goto next;
}
if (session->global->session_global_id != close_info0->old_session_global_id) {
DEBUG(1,("smbXsrv_session_close_loop: "
"old_session_wire_id %llu - global %u != %u\n",
(unsigned long long)close_info0->old_session_wire_id,
session->global->session_global_id,
close_info0->old_session_global_id));
if (DEBUGLVL(1)) {
NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
}
goto next;
}
if (session->global->creation_time != close_info0->old_creation_time) {
DEBUG(1,("smbXsrv_session_close_loop: "
"old_session_wire_id %llu - "
"creation %s (%llu) != %s (%llu)\n",
(unsigned long long)close_info0->old_session_wire_id,
nt_time_string(rec, session->global->creation_time),
(unsigned long long)session->global->creation_time,
nt_time_string(rec, close_info0->old_creation_time),
(unsigned long long)close_info0->old_creation_time));
if (DEBUGLVL(1)) {
NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
}
goto next;
}
subreq = smb2srv_session_shutdown_send(session, client->ev_ctx,
session, NULL);
if (subreq == NULL) {
status = NT_STATUS_NO_MEMORY;
DEBUG(0, ("smbXsrv_session_close_loop: "
"smb2srv_session_shutdown_send(%llu) failed: %s\n",
(unsigned long long)session->global->session_wire_id,
nt_errstr(status)));
if (DEBUGLVL(1)) {
NDR_PRINT_DEBUG(smbXsrv_session_closeB, &close_blob);
}
goto next;
}
tevent_req_set_callback(subreq,
smbXsrv_session_close_shutdown_done,
session);
next:
TALLOC_FREE(rec);
subreq = messaging_read_send(table, client->ev_ctx, client->msg_ctx,
MSG_SMBXSRV_SESSION_CLOSE);
if (subreq == NULL) {
const char *r;
r = "messaging_read_send(MSG_SMBXSRV_SESSION_CLOSE) failed";
exit_server_cleanly(r);
return;
}
tevent_req_set_callback(subreq, smbXsrv_session_close_loop, client);
}
NTSTATUS smbXsrv_open_cleanup(uint64_t persistent_id)
{
NTSTATUS status = NT_STATUS_OK;
TALLOC_CTX *frame = talloc_stackframe();
struct smbXsrv_open_global0 *op = NULL;
TDB_DATA val;
struct db_record *rec;
bool delete_open = false;
uint32_t global_id = persistent_id & UINT32_MAX;
rec = smbXsrv_open_global_fetch_locked(smbXsrv_open_global_db_ctx,
global_id,
frame);
if (rec == NULL) {
status = NT_STATUS_NOT_FOUND;
goto done;
}
val = dbwrap_record_get_value(rec);
if (val.dsize == 0) {
DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
"empty record in %s, skipping...\n",
global_id, dbwrap_name(smbXsrv_open_global_db_ctx)));
goto done;
}
status = smbXsrv_open_global_parse_record(talloc_tos(), rec, &op);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
"failed to read record: %s\n",
global_id, nt_errstr(status)));
goto done;
}
if (server_id_is_disconnected(&op->server_id)) {
struct timeval now, disconnect_time;
int64_t tdiff;
now = timeval_current();
nttime_to_timeval(&disconnect_time, op->disconnect_time);
tdiff = usec_time_diff(&now, &disconnect_time);
delete_open = (tdiff >= 1000*op->durable_timeout_msec);
DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
"disconnected at [%s] %us ago with "
"timeout of %us -%s reached\n",
global_id,
nt_time_string(frame, op->disconnect_time),
(unsigned)(tdiff/1000000),
op->durable_timeout_msec / 1000,
delete_open ? "" : " not"));
} else if (!serverid_exists(&op->server_id)) {
struct server_id_buf idbuf;
DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
"server[%s] does not exist\n",
global_id,
server_id_str_buf(op->server_id, &idbuf)));
delete_open = true;
}
if (!delete_open) {
goto done;
}
status = dbwrap_record_delete(rec);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("smbXsrv_open_cleanup[global: 0x%08x] "
"failed to delete record"
"from %s: %s\n", global_id,
dbwrap_name(smbXsrv_open_global_db_ctx),
nt_errstr(status)));
goto done;
}
DEBUG(10, ("smbXsrv_open_cleanup[global: 0x%08x] "
"delete record from %s\n",
global_id,
dbwrap_name(smbXsrv_open_global_db_ctx)));
done:
talloc_free(frame);
return status;
}
/****************************************************************************
Do a specific test for a SAM_ACCOUNT being valid for this connection
(ie not disabled, expired and the like).
****************************************************************************/
_PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
struct ldb_context *sam_ctx,
uint32_t logon_parameters,
struct ldb_dn *domain_dn,
struct ldb_message *msg,
const char *logon_workstation,
const char *name_for_logs,
bool allow_domain_trust,
bool password_change)
{
uint16_t acct_flags;
const char *workstation_list;
NTTIME acct_expiry;
NTTIME must_change_time;
NTTIME now;
DEBUG(4,("authsam_account_ok: Checking SMB password for user %s\n", name_for_logs));
acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
acct_expiry = samdb_result_account_expires(msg);
/* Check for when we must change this password, taking the
* userAccountControl flags into account */
must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx,
domain_dn, msg);
workstation_list = ldb_msg_find_attr_as_string(msg, "userWorkstations", NULL);
/* Quit if the account was disabled. */
if (acct_flags & ACB_DISABLED) {
DEBUG(2,("authsam_account_ok: Account for user '%s' was disabled.\n", name_for_logs));
return NT_STATUS_ACCOUNT_DISABLED;
}
/* Quit if the account was locked out. */
if (acct_flags & ACB_AUTOLOCK) {
DEBUG(2,("authsam_account_ok: Account for user %s was locked out.\n", name_for_logs));
return NT_STATUS_ACCOUNT_LOCKED_OUT;
}
/* Test account expire time */
unix_to_nt_time(&now, time(NULL));
if (now > acct_expiry) {
DEBUG(2,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
DEBUG(3,("authsam_account_ok: Account expired at '%s'.\n",
nt_time_string(mem_ctx, acct_expiry)));
return NT_STATUS_ACCOUNT_EXPIRED;
}
/* check for immediate expiry "must change at next logon" (but not if this is a password change request) */
if ((must_change_time == 0) && !password_change) {
DEBUG(2,("sam_account_ok: Account for user '%s' password must change!.\n",
name_for_logs));
return NT_STATUS_PASSWORD_MUST_CHANGE;
}
/* check for expired password (but not if this is a password change request) */
if ((must_change_time < now) && !password_change) {
DEBUG(2,("sam_account_ok: Account for user '%s' password expired!.\n",
name_for_logs));
DEBUG(2,("sam_account_ok: Password expired at '%s' unix time.\n",
nt_time_string(mem_ctx, must_change_time)));
return NT_STATUS_PASSWORD_EXPIRED;
}
/* Test workstation. Workstation list is comma separated. */
if (logon_workstation && workstation_list && *workstation_list) {
bool invalid_ws = true;
int i;
const char **workstations = (const char **)str_list_make(mem_ctx, workstation_list, ",");
for (i = 0; workstations && workstations[i]; i++) {
DEBUG(10,("sam_account_ok: checking for workstation match '%s' and '%s'\n",
workstations[i], logon_workstation));
if (strequal(workstations[i], logon_workstation)) {
invalid_ws = false;
break;
}
}
talloc_free(workstations);
if (invalid_ws) {
return NT_STATUS_INVALID_WORKSTATION;
}
}
if (!logon_hours_ok(msg, name_for_logs)) {
return NT_STATUS_INVALID_LOGON_HOURS;
}
if (!allow_domain_trust) {
if (acct_flags & ACB_DOMTRUST) {
DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", name_for_logs));
return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
}
}
if (!(logon_parameters & MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT)) {
if (acct_flags & ACB_SVRTRUST) {
DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", name_for_logs));
return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
}
}
if (!(logon_parameters & MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT)) {
/* TODO: this fails with current solaris client. We
need to work with Gordon to work out why */
if (acct_flags & ACB_WSTRUST) {
DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", name_for_logs));
return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
}
}
return NT_STATUS_OK;
}
/**
* @brief Decode a blob containing a NDR envoded PAC structure
*
* @param mem_ctx - The memory context
* @param pac_data_blob - The data blob containing the NDR encoded data
* @param context - The Kerberos Context
* @param service_keyblock - The Service Key used to verify the checksum
* @param client_principal - The client principal
* @param tgs_authtime - The ticket timestamp
* @param pac_data_out - [out] The decoded PAC
*
* @return - A NTSTATUS error code
*/
NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
DATA_BLOB pac_data_blob,
krb5_context context,
const krb5_keyblock *krbtgt_keyblock,
const krb5_keyblock *service_keyblock,
krb5_const_principal client_principal,
time_t tgs_authtime,
struct PAC_DATA **pac_data_out)
{
NTSTATUS status;
enum ndr_err_code ndr_err;
krb5_error_code ret;
DATA_BLOB modified_pac_blob;
NTTIME tgs_authtime_nttime;
krb5_principal client_principal_pac = NULL;
int i;
struct PAC_SIGNATURE_DATA *srv_sig_ptr = NULL;
struct PAC_SIGNATURE_DATA *kdc_sig_ptr = NULL;
struct PAC_SIGNATURE_DATA *srv_sig_wipe = NULL;
struct PAC_SIGNATURE_DATA *kdc_sig_wipe = NULL;
struct PAC_LOGON_NAME *logon_name = NULL;
struct PAC_LOGON_INFO *logon_info = NULL;
struct PAC_DATA *pac_data = NULL;
struct PAC_DATA_RAW *pac_data_raw = NULL;
DATA_BLOB *srv_sig_blob = NULL;
DATA_BLOB *kdc_sig_blob = NULL;
bool bool_ret;
*pac_data_out = NULL;
pac_data = talloc(mem_ctx, struct PAC_DATA);
pac_data_raw = talloc(mem_ctx, struct PAC_DATA_RAW);
kdc_sig_wipe = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
srv_sig_wipe = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
if (!pac_data_raw || !pac_data || !kdc_sig_wipe || !srv_sig_wipe) {
return NT_STATUS_NO_MEMORY;
}
ndr_err = ndr_pull_struct_blob(&pac_data_blob, pac_data, pac_data,
(ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't parse the PAC: %s\n",
nt_errstr(status)));
return status;
}
if (pac_data->num_buffers < 4) {
/* we need logon_ingo, service_key and kdc_key */
DEBUG(0,("less than 4 PAC buffers\n"));
return NT_STATUS_INVALID_PARAMETER;
}
ndr_err = ndr_pull_struct_blob(
&pac_data_blob, pac_data_raw, pac_data_raw,
(ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't parse the PAC: %s\n",
nt_errstr(status)));
return status;
}
if (pac_data_raw->num_buffers < 4) {
/* we need logon_ingo, service_key and kdc_key */
DEBUG(0,("less than 4 PAC buffers\n"));
return NT_STATUS_INVALID_PARAMETER;
}
if (pac_data->num_buffers != pac_data_raw->num_buffers) {
/* we need logon_ingo, service_key and kdc_key */
DEBUG(0, ("misparse! PAC_DATA has %d buffers while "
"PAC_DATA_RAW has %d\n", pac_data->num_buffers,
pac_data_raw->num_buffers));
return NT_STATUS_INVALID_PARAMETER;
}
for (i=0; i < pac_data->num_buffers; i++) {
struct PAC_BUFFER *data_buf = &pac_data->buffers[i];
struct PAC_BUFFER_RAW *raw_buf = &pac_data_raw->buffers[i];
if (data_buf->type != raw_buf->type) {
DEBUG(0, ("misparse! PAC_DATA buffer %d has type "
"%d while PAC_DATA_RAW has %d\n", i,
data_buf->type, raw_buf->type));
return NT_STATUS_INVALID_PARAMETER;
}
switch (data_buf->type) {
case PAC_TYPE_LOGON_INFO:
if (!data_buf->info) {
break;
}
logon_info = data_buf->info->logon_info.info;
break;
case PAC_TYPE_SRV_CHECKSUM:
if (!data_buf->info) {
break;
}
srv_sig_ptr = &data_buf->info->srv_cksum;
srv_sig_blob = &raw_buf->info->remaining;
break;
case PAC_TYPE_KDC_CHECKSUM:
if (!data_buf->info) {
break;
}
kdc_sig_ptr = &data_buf->info->kdc_cksum;
kdc_sig_blob = &raw_buf->info->remaining;
break;
case PAC_TYPE_LOGON_NAME:
logon_name = &data_buf->info->logon_name;
break;
default:
break;
}
}
if (!logon_info) {
DEBUG(0,("PAC no logon_info\n"));
return NT_STATUS_INVALID_PARAMETER;
}
if (!logon_name) {
DEBUG(0,("PAC no logon_name\n"));
return NT_STATUS_INVALID_PARAMETER;
}
if (!srv_sig_ptr || !srv_sig_blob) {
DEBUG(0,("PAC no srv_key\n"));
return NT_STATUS_INVALID_PARAMETER;
}
if (!kdc_sig_ptr || !kdc_sig_blob) {
DEBUG(0,("PAC no kdc_key\n"));
return NT_STATUS_INVALID_PARAMETER;
}
/* Find and zero out the signatures,
* as required by the signing algorithm */
/* We find the data blobs above,
* now we parse them to get at the exact portion we should zero */
ndr_err = ndr_pull_struct_blob(
kdc_sig_blob, kdc_sig_wipe, kdc_sig_wipe,
(ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't parse the KDC signature: %s\n",
nt_errstr(status)));
return status;
}
ndr_err = ndr_pull_struct_blob(
srv_sig_blob, srv_sig_wipe, srv_sig_wipe,
(ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't parse the SRV signature: %s\n",
nt_errstr(status)));
return status;
}
/* Now zero the decoded structure */
memset(kdc_sig_wipe->signature.data,
'\0', kdc_sig_wipe->signature.length);
memset(srv_sig_wipe->signature.data,
'\0', srv_sig_wipe->signature.length);
/* and reencode, back into the same place it came from */
ndr_err = ndr_push_struct_blob(
kdc_sig_blob, pac_data_raw, kdc_sig_wipe,
(ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't repack the KDC signature: %s\n",
nt_errstr(status)));
return status;
}
ndr_err = ndr_push_struct_blob(
srv_sig_blob, pac_data_raw, srv_sig_wipe,
(ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't repack the SRV signature: %s\n",
nt_errstr(status)));
return status;
}
/* push out the whole structure, but now with zero'ed signatures */
ndr_err = ndr_push_struct_blob(
&modified_pac_blob, pac_data_raw, pac_data_raw,
(ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't repack the RAW PAC: %s\n",
nt_errstr(status)));
return status;
}
if (service_keyblock) {
/* verify by service_key */
ret = check_pac_checksum(mem_ctx,
modified_pac_blob, srv_sig_ptr,
context,
service_keyblock);
if (ret) {
DEBUG(1, ("PAC Decode: Failed to verify the service "
"signature: %s\n", error_message(ret)));
return NT_STATUS_ACCESS_DENIED;
}
if (krbtgt_keyblock) {
/* verify the service key checksum by krbtgt_key */
ret = check_pac_checksum(mem_ctx,
srv_sig_ptr->signature, kdc_sig_ptr,
context, krbtgt_keyblock);
if (ret) {
DEBUG(1, ("PAC Decode: Failed to verify the KDC signature: %s\n",
smb_get_krb5_error_message(context, ret, mem_ctx)));
return NT_STATUS_ACCESS_DENIED;
}
}
}
if (tgs_authtime) {
/* Convert to NT time, so as not to loose accuracy in comparison */
unix_to_nt_time(&tgs_authtime_nttime, tgs_authtime);
if (tgs_authtime_nttime != logon_name->logon_time) {
DEBUG(2, ("PAC Decode: "
"Logon time mismatch between ticket and PAC!\n"));
DEBUG(2, ("PAC Decode: PAC: %s\n",
nt_time_string(mem_ctx, logon_name->logon_time)));
DEBUG(2, ("PAC Decode: Ticket: %s\n",
nt_time_string(mem_ctx, tgs_authtime_nttime)));
return NT_STATUS_ACCESS_DENIED;
}
}
if (client_principal) {
ret = smb_krb5_parse_name_norealm(context,
logon_name->account_name,
&client_principal_pac);
if (ret) {
DEBUG(2, ("Could not parse name from PAC: [%s]:%s\n",
logon_name->account_name, error_message(ret)));
return NT_STATUS_INVALID_PARAMETER;
}
bool_ret = smb_krb5_principal_compare_any_realm(context,
client_principal,
client_principal_pac);
krb5_free_principal(context, client_principal_pac);
if (!bool_ret) {
DEBUG(2, ("Name in PAC [%s] does not match principal name "
"in ticket\n", logon_name->account_name));
return NT_STATUS_ACCESS_DENIED;
}
}
DEBUG(3,("Found account name from PAC: %s [%s]\n",
logon_info->info3.base.account_name.string,
logon_info->info3.base.full_name.string));
DEBUG(10,("Successfully validated Kerberos PAC\n"));
if (DEBUGLEVEL >= 10) {
const char *s;
s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_DATA, pac_data);
if (s) {
DEBUGADD(10,("%s\n", s));
}
}
*pac_data_out = pac_data;
return NT_STATUS_OK;
}
/* basic testing of all RAW_CLOSE_* calls
*/
BOOL torture_raw_close(struct torture_context *torture)
{
struct smbcli_state *cli;
BOOL ret = True;
TALLOC_CTX *mem_ctx;
union smb_close io;
union smb_flush io_flush;
int fnum;
const char *fname = "\\torture_close.txt";
time_t basetime = (time(NULL) + 3*86400) & ~1;
union smb_fileinfo finfo, finfo2;
NTSTATUS status;
if (!torture_open_connection(&cli, 0)) {
return False;
}
mem_ctx = talloc_init("torture_raw_close");
#define REOPEN do { \
fnum = create_complex_file(cli, mem_ctx, fname); \
if (fnum == -1) { \
printf("(%d) Failed to create %s\n", __LINE__, fname); \
ret = False; \
goto done; \
}} while (0)
#define CHECK_STATUS(status, correct) do { \
if (!NT_STATUS_EQUAL(status, correct)) { \
printf("(%d) Incorrect status %s - should be %s\n", \
__LINE__, nt_errstr(status), nt_errstr(correct)); \
ret = False; \
goto done; \
}} while (0)
REOPEN;
io.close.level = RAW_CLOSE_CLOSE;
io.close.in.file.fnum = fnum;
io.close.in.write_time = basetime;
status = smb_raw_close(cli->tree, &io);
CHECK_STATUS(status, NT_STATUS_OK);
status = smb_raw_close(cli->tree, &io);
CHECK_STATUS(status, NT_STATUS_INVALID_HANDLE);
printf("testing close.in.write_time\n");
/* the file should have the write time set */
finfo.generic.level = RAW_FILEINFO_ALL_INFO;
finfo.generic.in.file.path = fname;
status = smb_raw_pathinfo(cli->tree, mem_ctx, &finfo);
CHECK_STATUS(status, NT_STATUS_OK);
if (basetime != nt_time_to_unix(finfo.all_info.out.write_time)) {
printf("Incorrect write time on file - %s - %s\n",
timestring(mem_ctx, basetime),
nt_time_string(mem_ctx, finfo.all_info.out.write_time));
dump_all_info(mem_ctx, &finfo);
ret = False;
}
printf("testing other times\n");
/* none of the other times should be set to that time */
if (nt_time_equal(&finfo.all_info.out.write_time,
&finfo.all_info.out.access_time) ||
nt_time_equal(&finfo.all_info.out.write_time,
&finfo.all_info.out.create_time) ||
nt_time_equal(&finfo.all_info.out.write_time,
&finfo.all_info.out.change_time)) {
printf("Incorrect times after close - only write time should be set\n");
dump_all_info(mem_ctx, &finfo);
ret = False;
}
smbcli_unlink(cli->tree, fname);
REOPEN;
finfo2.generic.level = RAW_FILEINFO_ALL_INFO;
finfo2.generic.in.file.path = fname;
status = smb_raw_pathinfo(cli->tree, mem_ctx, &finfo2);
CHECK_STATUS(status, NT_STATUS_OK);
io.close.level = RAW_CLOSE_CLOSE;
io.close.in.file.fnum = fnum;
io.close.in.write_time = 0;
status = smb_raw_close(cli->tree, &io);
CHECK_STATUS(status, NT_STATUS_OK);
/* the file should have the write time set equal to access time */
finfo.generic.level = RAW_FILEINFO_ALL_INFO;
finfo.generic.in.file.path = fname;
status = smb_raw_pathinfo(cli->tree, mem_ctx, &finfo);
CHECK_STATUS(status, NT_STATUS_OK);
if (!nt_time_equal(&finfo.all_info.out.write_time,
&finfo2.all_info.out.write_time)) {
printf("Incorrect write time on file - 0 time should be ignored\n");
dump_all_info(mem_ctx, &finfo);
ret = False;
}
printf("testing splclose\n");
/* check splclose on a file */
REOPEN;
io.splclose.level = RAW_CLOSE_SPLCLOSE;
io.splclose.in.file.fnum = fnum;
status = smb_raw_close(cli->tree, &io);
CHECK_STATUS(status, NT_STATUS_DOS(ERRSRV, ERRerror));
printf("testing flush\n");
smbcli_close(cli->tree, fnum);
io_flush.flush.level = RAW_FLUSH_FLUSH;
io_flush.flush.in.file.fnum = fnum;
status = smb_raw_flush(cli->tree, &io_flush);
CHECK_STATUS(status, NT_STATUS_INVALID_HANDLE);
io_flush.flush_all.level = RAW_FLUSH_ALL;
status = smb_raw_flush(cli->tree, &io_flush);
CHECK_STATUS(status, NT_STATUS_OK);
REOPEN;
io_flush.flush.level = RAW_FLUSH_FLUSH;
io_flush.flush.in.file.fnum = fnum;
status = smb_raw_flush(cli->tree, &io_flush);
CHECK_STATUS(status, NT_STATUS_OK);
printf("Testing SMBexit\n");
smb_raw_exit(cli->session);
io_flush.flush.level = RAW_FLUSH_FLUSH;
io_flush.flush.in.file.fnum = fnum;
status = smb_raw_flush(cli->tree, &io_flush);
CHECK_STATUS(status, NT_STATUS_INVALID_HANDLE);
done:
smbcli_close(cli->tree, fnum);
smbcli_unlink(cli->tree, fname);
torture_close_connection(cli);
talloc_free(mem_ctx);
return ret;
}
NTSTATUS kerberos_decode_pac(TALLOC_CTX *mem_ctx,
struct smb_iconv_convenience *iconv_convenience,
struct PAC_DATA **pac_data_out,
DATA_BLOB blob,
krb5_context context,
const krb5_keyblock *krbtgt_keyblock,
const krb5_keyblock *service_keyblock,
krb5_const_principal client_principal,
time_t tgs_authtime,
krb5_error_code *k5ret)
{
krb5_error_code ret;
NTSTATUS status;
enum ndr_err_code ndr_err;
struct PAC_SIGNATURE_DATA *srv_sig_ptr = NULL;
struct PAC_SIGNATURE_DATA *kdc_sig_ptr = NULL;
struct PAC_SIGNATURE_DATA *srv_sig_wipe = NULL;
struct PAC_SIGNATURE_DATA *kdc_sig_wipe = NULL;
struct PAC_LOGON_INFO *logon_info = NULL;
struct PAC_LOGON_NAME *logon_name = NULL;
struct PAC_DATA *pac_data;
struct PAC_DATA_RAW *pac_data_raw;
DATA_BLOB *srv_sig_blob = NULL;
DATA_BLOB *kdc_sig_blob = NULL;
DATA_BLOB modified_pac_blob;
NTTIME tgs_authtime_nttime;
krb5_principal client_principal_pac;
int i;
krb5_clear_error_message(context);
if (k5ret) {
*k5ret = KRB5_PARSE_MALFORMED;
}
pac_data = talloc(mem_ctx, struct PAC_DATA);
pac_data_raw = talloc(mem_ctx, struct PAC_DATA_RAW);
kdc_sig_wipe = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
srv_sig_wipe = talloc(mem_ctx, struct PAC_SIGNATURE_DATA);
if (!pac_data_raw || !pac_data || !kdc_sig_wipe || !srv_sig_wipe) {
if (k5ret) {
*k5ret = ENOMEM;
}
return NT_STATUS_NO_MEMORY;
}
ndr_err = ndr_pull_struct_blob(&blob, pac_data,
iconv_convenience, pac_data,
(ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't parse the PAC: %s\n",
nt_errstr(status)));
return status;
}
if (pac_data->num_buffers < 4) {
/* we need logon_ingo, service_key and kdc_key */
DEBUG(0,("less than 4 PAC buffers\n"));
return NT_STATUS_INVALID_PARAMETER;
}
ndr_err = ndr_pull_struct_blob(&blob, pac_data_raw,
iconv_convenience, pac_data_raw,
(ndr_pull_flags_fn_t)ndr_pull_PAC_DATA_RAW);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't parse the PAC: %s\n",
nt_errstr(status)));
return status;
}
if (pac_data_raw->num_buffers < 4) {
/* we need logon_ingo, service_key and kdc_key */
DEBUG(0,("less than 4 PAC buffers\n"));
return NT_STATUS_INVALID_PARAMETER;
}
if (pac_data->num_buffers != pac_data_raw->num_buffers) {
/* we need logon_ingo, service_key and kdc_key */
DEBUG(0,("misparse! PAC_DATA has %d buffers while PAC_DATA_RAW has %d\n",
pac_data->num_buffers, pac_data_raw->num_buffers));
return NT_STATUS_INVALID_PARAMETER;
}
for (i=0; i < pac_data->num_buffers; i++) {
if (pac_data->buffers[i].type != pac_data_raw->buffers[i].type) {
DEBUG(0,("misparse! PAC_DATA buffer %d has type %d while PAC_DATA_RAW has %d\n",
i, pac_data->buffers[i].type, pac_data->buffers[i].type));
return NT_STATUS_INVALID_PARAMETER;
}
switch (pac_data->buffers[i].type) {
case PAC_TYPE_LOGON_INFO:
if (!pac_data->buffers[i].info) {
break;
}
logon_info = pac_data->buffers[i].info->logon_info.info;
break;
case PAC_TYPE_SRV_CHECKSUM:
if (!pac_data->buffers[i].info) {
break;
}
srv_sig_ptr = &pac_data->buffers[i].info->srv_cksum;
srv_sig_blob = &pac_data_raw->buffers[i].info->remaining;
break;
case PAC_TYPE_KDC_CHECKSUM:
if (!pac_data->buffers[i].info) {
break;
}
kdc_sig_ptr = &pac_data->buffers[i].info->kdc_cksum;
kdc_sig_blob = &pac_data_raw->buffers[i].info->remaining;
break;
case PAC_TYPE_LOGON_NAME:
logon_name = &pac_data->buffers[i].info->logon_name;
break;
default:
break;
}
}
if (!logon_info) {
DEBUG(0,("PAC no logon_info\n"));
return NT_STATUS_INVALID_PARAMETER;
}
if (!logon_name) {
DEBUG(0,("PAC no logon_name\n"));
return NT_STATUS_INVALID_PARAMETER;
}
if (!srv_sig_ptr || !srv_sig_blob) {
DEBUG(0,("PAC no srv_key\n"));
return NT_STATUS_INVALID_PARAMETER;
}
if (!kdc_sig_ptr || !kdc_sig_blob) {
DEBUG(0,("PAC no kdc_key\n"));
return NT_STATUS_INVALID_PARAMETER;
}
/* Find and zero out the signatures, as required by the signing algorithm */
/* We find the data blobs above, now we parse them to get at the exact portion we should zero */
ndr_err = ndr_pull_struct_blob(kdc_sig_blob, kdc_sig_wipe,
iconv_convenience, kdc_sig_wipe,
(ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't parse the KDC signature: %s\n",
nt_errstr(status)));
return status;
}
ndr_err = ndr_pull_struct_blob(srv_sig_blob, srv_sig_wipe,
iconv_convenience, srv_sig_wipe,
(ndr_pull_flags_fn_t)ndr_pull_PAC_SIGNATURE_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't parse the SRV signature: %s\n",
nt_errstr(status)));
return status;
}
/* Now zero the decoded structure */
memset(kdc_sig_wipe->signature.data, '\0', kdc_sig_wipe->signature.length);
memset(srv_sig_wipe->signature.data, '\0', srv_sig_wipe->signature.length);
/* and reencode, back into the same place it came from */
ndr_err = ndr_push_struct_blob(kdc_sig_blob, pac_data_raw,
iconv_convenience,
kdc_sig_wipe,
(ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't repack the KDC signature: %s\n",
nt_errstr(status)));
return status;
}
ndr_err = ndr_push_struct_blob(srv_sig_blob, pac_data_raw,
iconv_convenience,
srv_sig_wipe,
(ndr_push_flags_fn_t)ndr_push_PAC_SIGNATURE_DATA);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't repack the SRV signature: %s\n",
nt_errstr(status)));
return status;
}
/* push out the whole structure, but now with zero'ed signatures */
ndr_err = ndr_push_struct_blob(&modified_pac_blob, pac_data_raw,
iconv_convenience,
pac_data_raw,
(ndr_push_flags_fn_t)ndr_push_PAC_DATA_RAW);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(0,("can't repack the RAW PAC: %s\n",
nt_errstr(status)));
return status;
}
/* verify by service_key */
ret = check_pac_checksum(mem_ctx,
modified_pac_blob, srv_sig_ptr,
context,
service_keyblock);
if (ret) {
DEBUG(1, ("PAC Decode: Failed to verify the service signature: %s\n",
smb_get_krb5_error_message(context, ret, mem_ctx)));
if (k5ret) {
*k5ret = ret;
}
return NT_STATUS_ACCESS_DENIED;
}
if (krbtgt_keyblock) {
ret = check_pac_checksum(mem_ctx,
srv_sig_ptr->signature, kdc_sig_ptr,
context, krbtgt_keyblock);
if (ret) {
DEBUG(1, ("PAC Decode: Failed to verify the KDC signature: %s\n",
smb_get_krb5_error_message(context, ret, mem_ctx)));
if (k5ret) {
*k5ret = ret;
}
return NT_STATUS_ACCESS_DENIED;
}
}
/* Convert to NT time, so as not to loose accuracy in comparison */
unix_to_nt_time(&tgs_authtime_nttime, tgs_authtime);
if (tgs_authtime_nttime != logon_name->logon_time) {
DEBUG(2, ("PAC Decode: Logon time mismatch between ticket and PAC!\n"));
DEBUG(2, ("PAC Decode: PAC: %s\n", nt_time_string(mem_ctx, logon_name->logon_time)));
DEBUG(2, ("PAC Decode: Ticket: %s\n", nt_time_string(mem_ctx, tgs_authtime_nttime)));
return NT_STATUS_ACCESS_DENIED;
}
ret = krb5_parse_name_flags(context, logon_name->account_name, KRB5_PRINCIPAL_PARSE_NO_REALM,
&client_principal_pac);
if (ret) {
DEBUG(2, ("Could not parse name from incoming PAC: [%s]: %s\n",
logon_name->account_name,
smb_get_krb5_error_message(context, ret, mem_ctx)));
if (k5ret) {
*k5ret = ret;
}
return NT_STATUS_INVALID_PARAMETER;
}
if (!krb5_principal_compare_any_realm(context, client_principal, client_principal_pac)) {
DEBUG(2, ("Name in PAC [%s] does not match principal name in ticket\n",
logon_name->account_name));
return NT_STATUS_ACCESS_DENIED;
}
#if 0
if (strcasecmp(logon_info->info3.base.account_name.string,
"Administrator")== 0) {
file_save("tmp_pac_data-admin.dat",blob.data,blob.length);
}
#endif
DEBUG(3,("Found account name from PAC: %s [%s]\n",
logon_info->info3.base.account_name.string,
logon_info->info3.base.full_name.string));
*pac_data_out = pac_data;
return NT_STATUS_OK;
}
