Fix bug #6089 - Winbind samr_OpenDomain not possible with Samba 3.2.6+

[samba.git] / source / utils / net_rpc.c

diff --git a/source/utils/net_rpc.c b/source/utils/net_rpc.c
index 0e91144d339d218e69c60d280d5d9fc3db42969b..98605d1c8e8d3aabb7118c56ba0ea5c092936722 100644 (file)
--- a/source/utils/net_rpc.c
+++ b/source/utils/net_rpc.c
@@ -749,7 +749,9 @@ static int rpc_user_password(struct net_context *c, int argc, const char **argv)
        if (argv[1]) {
                u1003.usri1003_password = argv[1];
        } else {
-               asprintf(&prompt, "Enter new password for %s:", argv[0]);
+               if (asprintf(&prompt, "Enter new password for %s:", argv[0]) == -1) {
+                       return -1;
+               }
                u1003.usri1003_password = getpass(prompt);
                SAFE_FREE(prompt);
        }
@@ -3956,17 +3958,6 @@ static void free_user_token(NT_USER_TOKEN *token)
        SAFE_FREE(token->user_sids);
 }
 
-static bool is_sid_in_token(NT_USER_TOKEN *token, DOM_SID *sid)
-{
-       int i;
-
-       for (i=0; i<token->num_sids; i++) {
-               if (sid_compare(sid, &token->user_sids[i]) == 0)
-                       return true;
-       }
-       return false;
-}
-
 static void add_sid_to_token(NT_USER_TOKEN *token, DOM_SID *sid)
 {
        if (is_sid_in_token(token, sid))
@@ -4073,7 +4064,11 @@ static bool get_user_sids(const char *domain, const char *user, NT_USER_TOKEN *t
                return false;
        }
 
-       string_to_sid(&user_sid, sid_str);
+       if (!string_to_sid(&user_sid, sid_str)) {
+               DEBUG(1,("Could not convert sid %s from string\n", sid_str));
+               return false;
+       }
+
        wbcFreeMemory(sid_str);
        sid_str = NULL;
 
@@ -4209,7 +4204,11 @@ static bool get_user_tokens_from_file(FILE *f,
                        /* We have a SID */
 
                        DOM_SID sid;
-                       string_to_sid(&sid, &line[1]);
+                       if(!string_to_sid(&sid, &line[1])) {
+                               DEBUG(1,("get_user_tokens_from_file: Could "
+                                       "not convert sid %s \n",&line[1]));
+                               return false;
+                       }
 
                        if (token == NULL) {
                                DEBUG(0, ("File does not begin with username"));
@@ -4296,16 +4295,15 @@ static void show_userlist(struct rpc_pipe_client *pipe_hnd,
                uint32 acc_granted;
 
                if (share_sd != NULL) {
-                       if (!se_access_check(share_sd, &tokens[i].token,
-                                            1, &acc_granted, &status)) {
+                       status = se_access_check(share_sd, &tokens[i].token,
+                                            1, &acc_granted);
+
+                       if (!NT_STATUS_IS_OK(status)) {
                                DEBUG(1, ("Could not check share_sd for "
                                          "user %s\n",
                                          tokens[i].name));
                                continue;
                        }
-
-                       if (!NT_STATUS_IS_OK(status))
-                               continue;
                }
 
                if (root_sd == NULL) {
@@ -4313,16 +4311,13 @@ static void show_userlist(struct rpc_pipe_client *pipe_hnd,
                        continue;
                }
 
-               if (!se_access_check(root_sd, &tokens[i].token,
-                                    1, &acc_granted, &status)) {
+               status = se_access_check(root_sd, &tokens[i].token,
+                                    1, &acc_granted);
+               if (!NT_STATUS_IS_OK(status)) {
                        DEBUG(1, ("Could not check root_sd for user %s\n",
                                  tokens[i].name));
                        continue;
                }
-
-               if (!NT_STATUS_IS_OK(status))
-                       continue;
-
                d_printf(" %s\n", tokens[i].name);
        }
 
@@ -4383,7 +4378,6 @@ static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
 {
        int ret;
        bool r;
-       ENUM_HND hnd;
        uint32 i;
        FILE *f;
 
@@ -4416,8 +4410,6 @@ static NTSTATUS rpc_share_allowedusers_internals(struct net_context *c,
        for (i=0; i<num_tokens; i++)
                collect_alias_memberships(&tokens[i].token);
 
-       init_enum_hnd(&hnd, 0);
-
        share_list.num_shares = 0;
        share_list.shares = NULL;
 
@@ -5269,10 +5261,11 @@ static NTSTATUS rpc_trustdom_add_internals(struct net_context *c,
                                      notime, notime, notime,
                                      NULL, NULL, NULL, NULL, NULL,
                                      NULL, NULL, NULL, NULL, &parameters,
-                                     0, 0, ACB_DOMTRUST, SAMR_FIELD_ACCT_FLAGS,
+                                     0, 0, ACB_DOMTRUST,
+                                     SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_NT_PASSWORD_PRESENT,
                                      hours,
                                      0, 0, 0, 0, 0, 0, 0,
-                                     crypt_pwd.data, 24);
+                                     &crypt_pwd);
 
                result = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
                                                  &user_pol,
@@ -5551,7 +5544,9 @@ static int rpc_trustdom_establish(struct net_context *c, int argc,
        strupper_m(domain_name);
 
        /* account name used at first is our domain's name with '$' */
-       asprintf(&acct_name, "%s$", lp_workgroup());
+       if (asprintf(&acct_name, "%s$", lp_workgroup()) == -1) {
+               return -1;
+       }
        strupper_m(acct_name);
 
        /*
@@ -6132,7 +6127,7 @@ static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
        /* SamrConnect2 */
        nt_status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
                                         pipe_hnd->desthost,
-                                        SA_RIGHT_SAM_OPEN_DOMAIN,
+                                        SAMR_ACCESS_LOOKUP_DOMAIN,
                                         &connect_hnd);
        if (!NT_STATUS_IS_OK(nt_status)) {
                DEBUG(0, ("Couldn't open SAMR policy handle. Error was %s\n",
@@ -6146,7 +6141,7 @@ static int rpc_trustdom_list(struct net_context *c, int argc, const char **argv)
           able to enumerate accounts*/
        nt_status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
                                           &connect_hnd,
-                                          SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+                                          SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
                                           queried_dom_sid,
                                           &domain_hnd);
        if (!NT_STATUS_IS_OK(nt_status)) {
@@ -6389,6 +6384,14 @@ static int rpc_vampire(struct net_context *c, int argc, const char **argv)
                        "net rpc vampire keytab\n"
                        "    Dump remote SAM database to Kerberos keytab file"
                },
+               {
+                       "passdb",
+                       rpc_vampire_passdb,
+                       NET_TRANSPORT_RPC,
+                       "Dump remote SAM database to passdb",
+                       "net rpc vampire passdb\n"
+                       "    Dump remote SAM database to passdb"
+               },
 
                {NULL, NULL, 0, NULL, NULL}
        };