kernel.git - Linux vanilla kernels for Fedora – https://fedoraproject.org/wiki/Kernel_Vanilla

diff options

Diffstat (limited to '0001-Add-efi_status_to_str-and-rework-efi_status_to_err.patch')

-rw-r--r--

0001-Add-efi_status_to_str-and-rework-efi_status_to_err.patch

1 files changed, 5 insertions, 5 deletions

/* Unix SMB/CIFS implementation. Samba utility functions Copyright (C) Andrew Tridgell 2004 Copyright (C) Volker Lendecke 2004 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>. */ #include "includes.h" #include "events/events.h" #include "ldb.h" #include "ldb_errors.h" #include "../lib/util/util_ldb.h" #include "../lib/crypto/crypto.h" #include "dsdb/samdb/samdb.h" #include "libcli/security/security.h" #include "librpc/gen_ndr/ndr_security.h" #include "librpc/gen_ndr/ndr_misc.h" #include "dsdb/common/flags.h" #include "dsdb/common/proto.h" #include "libcli/ldap/ldap_ndr.h" #include "param/param.h" #include "libcli/auth/libcli_auth.h" /* search the sam for the specified attributes in a specific domain, filter on objectSid being in domain_sid. */ int samdb_search_domain(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *basedn, struct ldb_message ***res, const char * const *attrs, const struct dom_sid *domain_sid, const char *format, ...) _PRINTF_ATTRIBUTE(7,8) { va_list ap; int i, count; va_start(ap, format); count = gendb_search_v(sam_ldb, mem_ctx, basedn, res, attrs, format, ap); va_end(ap); i=0; while (i<count) { struct dom_sid *entry_sid; entry_sid = samdb_result_dom_sid(mem_ctx, (*res)[i], "objectSid"); if ((entry_sid == NULL) || (!dom_sid_in_domain(domain_sid, entry_sid))) { /* Delete that entry from the result set */ (*res)[i] = (*res)[count-1]; count -= 1; talloc_free(entry_sid); continue; } talloc_free(entry_sid); i += 1; } return count; } /* search the sam for a single string attribute in exactly 1 record */ const char *samdb_search_string_v(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *basedn, const char *attr_name, const char *format, va_list ap) _PRINTF_ATTRIBUTE(5,0) { int count; const char *attrs[2] = { NULL, NULL }; struct ldb_message **res = NULL; attrs[0] = attr_name; count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap); if (count > 1) { DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n", attr_name, format, count)); } if (count != 1) { talloc_free(res); return NULL; } return samdb_result_string(res[0], attr_name, NULL); } /* search the sam for a single string attribute in exactly 1 record */ const char *samdb_search_string(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *basedn, const char *attr_name, const char *format, ...) _PRINTF_ATTRIBUTE(5,6) { va_list ap; const char *str; va_start(ap, format); str = samdb_search_string_v(sam_ldb, mem_ctx, basedn, attr_name, format, ap); va_end(ap); return str; } struct ldb_dn *samdb_search_dn(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *basedn, const char *format, ...) _PRINTF_ATTRIBUTE(4,5) { va_list ap; struct ldb_dn *ret; struct ldb_message **res = NULL; int count; va_start(ap, format); count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, NULL, format, ap); va_end(ap); if (count != 1) return NULL; ret = talloc_steal(mem_ctx, res[0]->dn); talloc_free(res); return ret; } /* search the sam for a dom_sid attribute in exactly 1 record */ struct dom_sid *samdb_search_dom_sid(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *basedn, const char *attr_name, const char *format, ...) _PRINTF_ATTRIBUTE(5,6) { va_list ap; int count; struct ldb_message **res; const char *attrs[2] = { NULL, NULL }; struct dom_sid *sid; attrs[0] = attr_name; va_start(ap, format); count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap); va_end(ap); if (count > 1) { DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n", attr_name, format, count)); } if (count != 1) { talloc_free(res); return NULL; } sid = samdb_result_dom_sid(mem_ctx, res[0], attr_name); talloc_free(res); return sid; } /* return the count of the number of records in the sam matching the query */ int samdb_search_count(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *basedn, const char *format, ...) _PRINTF_ATTRIBUTE(4,5) { va_list ap; struct ldb_message **res; const char * const attrs[] = { NULL }; int ret; va_start(ap, format); ret = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap); va_end(ap); return ret; } /* search the sam for a single integer attribute in exactly 1 record */ uint_t samdb_search_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, uint_t default_value, struct ldb_dn *basedn, const char *attr_name, const char *format, ...) _PRINTF_ATTRIBUTE(6,7) { va_list ap; int count; struct ldb_message **res; const char *attrs[2] = { NULL, NULL }; attrs[0] = attr_name; va_start(ap, format); count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap); va_end(ap); if (count != 1) { return default_value; } return samdb_result_uint(res[0], attr_name, default_value); } /* search the sam for a single signed 64 bit integer attribute in exactly 1 record */ int64_t samdb_search_int64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, int64_t default_value, struct ldb_dn *basedn, const char *attr_name, const char *format, ...) _PRINTF_ATTRIBUTE(6,7) { va_list ap; int count; struct ldb_message **res; const char *attrs[2] = { NULL, NULL }; attrs[0] = attr_name; va_start(ap, format); count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap); va_end(ap); if (count != 1) { return default_value; } return samdb_result_int64(res[0], attr_name, default_value); } /* search the sam for multipe records each giving a single string attribute return the number of matches, or -1 on error */ int samdb_search_string_multiple(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *basedn, const char ***strs, const char *attr_name, const char *format, ...) _PRINTF_ATTRIBUTE(6,7) { va_list ap; int count, i; const char *attrs[2] = { NULL, NULL }; struct ldb_message **res = NULL; attrs[0] = attr_name; va_start(ap, format); count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap); va_end(ap); if (count <= 0) { return count; } /* make sure its single valued */ for (i=0;i<count;i++) { if (res[i]->num_elements != 1) { DEBUG(1,("samdb: search for %s %s not single valued\n", attr_name, format)); talloc_free(res); return -1; } } *strs = talloc_array(mem_ctx, const char *, count+1); if (! *strs) { talloc_free(res); return -1; } for (i=0;i<count;i++) { (*strs)[i] = samdb_result_string(res[i], attr_name, NULL); } (*strs)[count] = NULL; return count; } /* pull a uint from a result set. */ uint_t samdb_result_uint(const struct ldb_message *msg, const char *attr, uint_t default_value) { return ldb_msg_find_attr_as_uint(msg, attr, default_value); } /* pull a (signed) int64 from a result set. */ int64_t samdb_result_int64(const struct ldb_message *msg, const char *attr, int64_t default_value) { return ldb_msg_find_attr_as_int64(msg, attr, default_value); } /* pull a string from a result set. */ const char *samdb_result_string(const struct ldb_message *msg, const char *attr, const char *default_value) { return ldb_msg_find_attr_as_string(msg, attr, default_value); } struct ldb_dn *samdb_result_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const struct ldb_message *msg, const char *attr, struct ldb_dn *default_value) { struct ldb_dn *ret_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, msg, attr); if (!ret_dn) { return default_value; } return ret_dn; } /* pull a rid from a objectSid in a result set. */ uint32_t samdb_result_rid_from_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg, const char *attr, uint32_t default_value) { struct dom_sid *sid; uint32_t rid; sid = samdb_result_dom_sid(mem_ctx, msg, attr); if (sid == NULL) { return default_value; } rid = sid->sub_auths[sid->num_auths-1]; talloc_free(sid); return rid; } /* pull a dom_sid structure from a objectSid in a result set. */ struct dom_sid *samdb_result_dom_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg, const char *attr) { const struct ldb_val *v; struct dom_sid *sid; enum ndr_err_code ndr_err; v = ldb_msg_find_ldb_val(msg, attr); if (v == NULL) { return NULL; } sid = talloc(mem_ctx, struct dom_sid); if (sid == NULL) { return NULL; } ndr_err = ndr_pull_struct_blob(v, sid, NULL, sid, (ndr_pull_flags_fn_t)ndr_pull_dom_sid); if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { talloc_free(sid); return NULL; } return sid; } /* pull a guid structure from a objectGUID in a result set. */ struct GUID samdb_result_guid(const struct ldb_message *msg, const char *attr) { const struct ldb_val *v; enum ndr_err_code ndr_err; struct GUID guid; TALLOC_CTX *mem_ctx; ZERO_STRUCT(guid); v = ldb_msg_find_ldb_val(msg, attr); if (!v) return guid; mem_ctx = talloc_named_const(NULL, 0, "samdb_result_guid"); if (!mem_ctx) return guid; ndr_err = ndr_pull_struct_blob(v, mem_ctx, NULL, &guid, (ndr_pull_flags_fn_t)ndr_pull_GUID); talloc_free(mem_ctx); if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { return guid; } return guid; } /* pull a sid prefix from a objectSid in a result set. this is used to find the domain sid for a user */ struct dom_sid *samdb_result_sid_prefix(TALLOC_CTX *mem_ctx, const struct ldb_message *msg, const char *attr) { struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg, attr); if (!sid || sid->num_auths < 1) return NULL; sid->num_auths--; return sid; } /* pull a NTTIME in a result set. */ NTTIME samdb_result_nttime(struct ldb_message *msg, const char *attr, NTTIME default_value) { return ldb_msg_find_attr_as_uint64(msg, attr, default_value); } /* * Windows uses both 0 and 9223372036854775807 (0x7FFFFFFFFFFFFFFFULL) to * indicate an account doesn't expire. * * When Windows initially creates an account, it sets * accountExpires = 9223372036854775807 (0x7FFFFFFFFFFFFFFF). However, * when changing from an account having a specific expiration date to * that account never expiring, it sets accountExpires = 0. * * Consolidate that logic here to allow clearer logic for account expiry in * the rest of the code. */ NTTIME samdb_result_account_expires(struct ldb_message *msg) { NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "accountExpires", 0); if (ret == 0) ret = 0x7FFFFFFFFFFFFFFFULL; return ret; } /* pull a uint64_t from a result set. */ uint64_t samdb_result_uint64(struct ldb_message *msg, const char *attr, uint64_t default_value) { return ldb_msg_find_attr_as_uint64(msg, attr, default_value); } /* construct the allow_password_change field from the PwdLastSet attribute and the domain password settings */ NTTIME samdb_result_allow_password_change(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *domain_dn, struct ldb_message *msg, const char *attr) { uint64_t attr_time = samdb_result_uint64(msg, attr, 0); int64_t minPwdAge; if (attr_time == 0) { return 0; } minPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "minPwdAge", NULL); /* yes, this is a -= not a += as minPwdAge is stored as the negative of the number of 100-nano-seconds */ attr_time -= minPwdAge; return attr_time; } /* construct the force_password_change field from the PwdLastSet attribute, the userAccountControl and the domain password settings */ NTTIME samdb_result_force_password_change(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *domain_dn, struct ldb_message *msg) { uint64_t attr_time = samdb_result_uint64(msg, "pwdLastSet", 0); uint32_t userAccountControl = samdb_result_uint64(msg, "userAccountControl", 0); int64_t maxPwdAge; /* Machine accounts don't expire, and there is a flag for 'no expiry' */ if (!(userAccountControl & UF_NORMAL_ACCOUNT) || (userAccountControl & UF_DONT_EXPIRE_PASSWD)) { return 0x7FFFFFFFFFFFFFFFULL; } if (attr_time == 0) { return 0; } maxPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "maxPwdAge", NULL); if (maxPwdAge == 0) { return 0x7FFFFFFFFFFFFFFFULL; } else { attr_time -= maxPwdAge; } return attr_time; } /* pull a samr_Password structutre from a result set. */ struct samr_Password *samdb_result_hash(TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr) { struct samr_Password *hash = NULL; const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr); if (val && (val->length >= sizeof(hash->hash))) { hash = talloc(mem_ctx, struct samr_Password); memcpy(hash->hash, val->data, MIN(val->length, sizeof(hash->hash))); } return hash; } /* pull an array of samr_Password structutres from a result set. */ uint_t samdb_result_hashes(TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr, struct samr_Password **hashes) { uint_t count = 0; const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr); int i; *hashes = NULL; if (!val) { return 0; } count = val->length / 16; if (count == 0) { return 0; } *hashes = talloc_array(mem_ctx, struct samr_Password, count); if (! *hashes) { return 0; } for (i=0;i<count;i++) { memcpy((*hashes)[i].hash, (i*16)+(char *)val->data, 16); } return count; } NTSTATUS samdb_result_passwords(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, struct ldb_message *msg, struct samr_Password **lm_pwd, struct samr_Password **nt_pwd) { struct samr_Password *lmPwdHash, *ntPwdHash; if (nt_pwd) { int num_nt; num_nt = samdb_result_hashes(mem_ctx, msg, "unicodePwd", &ntPwdHash); if (num_nt == 0) { *nt_pwd = NULL; } else if (num_nt > 1) { return NT_STATUS_INTERNAL_DB_CORRUPTION; } else { *nt_pwd = &ntPwdHash[0]; } } if (lm_pwd) { /* Ensure that if we have turned off LM * authentication, that we never use the LM hash, even * if we store it */ if (lp_lanman_auth(lp_ctx)) { int num_lm; num_lm = samdb_result_hashes(mem_ctx, msg, "dBCSPwd", &lmPwdHash); if (num_lm == 0) { *lm_pwd = NULL; } else if (num_lm > 1) { return NT_STATUS_INTERNAL_DB_CORRUPTION; } else { *lm_pwd = &lmPwdHash[0]; } } else { *lm_pwd = NULL; } } return NT_STATUS_OK; } /* pull a samr_LogonHours structutre from a result set. */ struct samr_LogonHours samdb_result_logon_hours(TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr) { struct samr_LogonHours hours; const int units_per_week = 168; const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr); ZERO_STRUCT(hours); hours.bits = talloc_array(mem_ctx, uint8_t, units_per_week); if (!hours.bits) { return hours; } hours.units_per_week = units_per_week; memset(hours.bits, 0xFF, units_per_week); if (val) { memcpy(hours.bits, val->data, MIN(val->length, units_per_week)); } return hours; } /* pull a set of account_flags from a result set. This requires that the attributes: pwdLastSet userAccountControl be included in 'msg' */ uint32_t samdb_result_acct_flags(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, struct ldb_message *msg, struct ldb_dn *domain_dn) { uint32_t userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0); uint32_t acct_flags = samdb_uf2acb(userAccountControl); NTTIME must_change_time; NTTIME now; must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx, domain_dn, msg); /* Test account expire time */ unix_to_nt_time(&now, time(NULL)); /* check for expired password */ if (must_change_time < now) { acct_flags |= ACB_PW_EXPIRED; } return acct_flags; } struct lsa_BinaryString samdb_result_parameters(TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr) { struct lsa_BinaryString s; const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr); ZERO_STRUCT(s); if (!val) { return s; } s.array = talloc_array(mem_ctx, uint16_t, val->length/2); if (!s.array) { return s; } s.length = s.size = val->length/2; memcpy(s.array, val->data, val->length); return s; } /* Find an attribute, with a particular value */ /* The current callers of this function expect a very specific * behaviour: In particular, objectClass subclass equivilance is not * wanted. This means that we should not lookup the schema for the * comparison function */ struct ldb_message_element *samdb_find_attribute(struct ldb_context *ldb, const struct ldb_message *msg, const char *name, const char *value) { int i; struct ldb_message_element *el = ldb_msg_find_element(msg, name); if (!el) { return NULL; } for (i=0;i<el->num_values;i++) { if (ldb_attr_cmp(value, (char *)el->values[i].data) == 0) { return el; } } return NULL; } int samdb_find_or_add_value(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value) { if (samdb_find_attribute(ldb, msg, name, set_value) == NULL) { return samdb_msg_add_string(ldb, msg, msg, name, set_value); } return LDB_SUCCESS; } int samdb_find_or_add_attribute(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value) { struct ldb_message_element *el; el = ldb_msg_find_element(msg, name); if (el) { return LDB_SUCCESS; } return samdb_msg_add_string(ldb, msg, msg, name, set_value); } /* add a string element to a message */ int samdb_msg_add_string(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr_name, const char *str) { char *s = talloc_strdup(mem_ctx, str); char *a = talloc_strdup(mem_ctx, attr_name); if (s == NULL || a == NULL) { return LDB_ERR_OPERATIONS_ERROR; } return ldb_msg_add_string(msg, a, s); } /* add a dom_sid element to a message */ int samdb_msg_add_dom_sid(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr_name, struct dom_sid *sid) {


context:
space:
mode: