Commit dd15d948 authored by jan.koester's avatar jan.koester
Browse files

test

parent b8609e71

src/smb.cpp

+16 −3
Changes for src/smb.cpp: 16 added lines, 3 removed lines.
Original line number Diff line number Diff line
@@ -340,11 +340,21 @@ struct Account { 
    std::string name;

    uint32_t uid = 65534, gid = 65534;  // classic ids (the overflow id for others)

    bool idR = false;                   // the uid or gid is a UUID or GUID

    bool external = false;              // of another source (adconnect): its password isn't ours

#ifdef SHAREDD_UID_R

    uid_r_t ruid, rgid;

#endif

};



// a user of an external source (<userdb.h>: Active Directory, ...): no

// shadow entry and "*" as password, like fresh's login sees them

bool externalUser(const char *name, const char *passwd) {

    if (!passwd || std::string(passwd) != "*") return false;

    struct spwd *sp = getspnam(name);

    endspent();

    return !sp;

}



#ifdef SHAREDD_UID_R

bool kernelHasUidR() {

    static int have = -1;
@@ -374,6 +384,7 @@ bool lookupAccount(const std::string &account, Account &a) { 
    a.uid = uid_r_to_legacy(&p->pw_uid);

    a.gid = uid_r_to_legacy(&p->pw_gid);

    a.idR = !uid_r_is_legacy(&p->pw_uid) || !uid_r_is_legacy(&p->pw_gid);

    a.external = externalUser(p->pw_name, p->pw_passwd);

    endpwent_id_r();

    return !a.idR || kernelHasUidR();

#else
@@ -382,6 +393,7 @@ bool lookupAccount(const std::string &account, Account &a) { 
    a.name = pw->pw_name;

    a.uid = pw->pw_uid;

    a.gid = pw->pw_gid;

    a.external = externalUser(pw->pw_name, pw->pw_passwd);

    endpwent();

    return true;

#endif
@@ -709,8 +721,8 @@ void SmbServer::login(const unsigned char *payload, size_t len) { 
        if (groupsOf(acct.name.c_str(), acct.gid).size() > 1) resp.status |= UserExtension;

#endif

        copy(resp.account, sizeof(resp.account), acct.name);

    } else if (found && !root && !locked(acct.name.c_str()) && adconnectPresent()) {

        // an AD user has no local NT hash: tell ksmbd to pass the NTLM

    } else if (found && !root && acct.external && adconnectPresent()) {

        // an AD user needs no local NT hash: tell ksmbd to pass the NTLM

        // response through to the domain controller (NTLM_AUTHEN_REQUEST)

        resp.uid = acct.uid;

        resp.gid = acct.gid;
@@ -732,7 +744,8 @@ void SmbServer::login(const unsigned char *payload, size_t len) { 
        std::cerr << "sharedd: SMB: login as " << account << " refused ("

                  << (!found ? "no such user (or a UUID/GUID user and a kernel without uid_r)"

                      : root ? "root may not log in over SMB"

                      : locked(acct.name.c_str()) ? "account locked" : "no SMB password") << ")"

                      : locked(acct.name.c_str()) ? "account locked"

                      : acct.external ? "a domain user, but adconnectd isn't running" : "no SMB password") << ")"

                  << std::endl;

    }

    endpwent();