s3-samr: Fix Bug #5859, renaming of samr objects failed due to samr setuserinfo acces...

[samba.git] / source3 / rpc_server / srv_samr_nt.c

diff --git a/source3/rpc_server/srv_samr_nt.c b/source3/rpc_server/srv_samr_nt.c
index 6bd5635f2dabba24f153941c7d298829e5ae334d..b2503dce1d9728984b87990ef94b40765cfbd02c 100644 (file)
--- a/source3/rpc_server/srv_samr_nt.c
+++ b/source3/rpc_server/srv_samr_nt.c
@@ -1671,6 +1671,9 @@ NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
                alias_info->all.num_members             = 1; /* ??? */
                alias_info->all.description.string      = alias_description;
                break;
+       case ALIASINFONAME:
+               alias_info->name.string                 = alias_name;
+               break;
        case ALIASINFODESCRIPTION:
                alias_info->description.string          = alias_description;
                break;
@@ -1812,6 +1815,11 @@ NTSTATUS _samr_ChangePasswordUser(pipes_struct *p,
                lm_pass = pdb_get_lanman_passwd(pwd);
                nt_pass = pdb_get_nt_passwd(pwd);
 
+               if (!lm_pass || !nt_pass) {
+                       status = NT_STATUS_WRONG_PASSWORD;
+                       goto out;
+               }
+
                memcpy(&lm_pwd.hash, lm_pass, sizeof(lm_pwd.hash));
                memcpy(&nt_pwd.hash, nt_pass, sizeof(nt_pwd.hash));
        }
@@ -3265,6 +3273,66 @@ NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
                        dom_info->info8.sequence_num = seq_num;
                        dom_info->info8.domain_create_time = 0;
 
+                       break;
+               case 0x09:
+
+                       dom_info->info9.domain_server_state             = DOMAIN_SERVER_ENABLED;
+
+                       break;
+               case 0x0b:
+
+                       /* AS ROOT !!! */
+
+                       become_root();
+
+                       dom_info->general2.general.num_users    = count_sam_users(
+                               dinfo->disp_info, ACB_NORMAL);
+                       dom_info->general2.general.num_groups   = count_sam_groups(
+                               dinfo->disp_info);
+                       dom_info->general2.general.num_aliases  = count_sam_aliases(
+                               dinfo->disp_info);
+
+                       pdb_get_account_policy(AP_TIME_TO_LOGOUT, &u_logout);
+
+                       unix_to_nt_time_abs(&dom_info->general2.general.force_logoff_time, u_logout);
+
+                       if (!pdb_get_seq_num(&seq_num))
+                               seq_num = time(NULL);
+
+                       pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
+                       u_lock_duration = account_policy_temp;
+                       if (u_lock_duration != -1) {
+                               u_lock_duration *= 60;
+                       }
+
+                       pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
+                       u_reset_time = account_policy_temp * 60;
+
+                       pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT,
+                                              &account_policy_temp);
+                       dom_info->general2.lockout_threshold = account_policy_temp;
+
+                       /* !AS ROOT */
+
+                       unbecome_root();
+
+                       server_role = ROLE_DOMAIN_PDC;
+                       if (lp_server_role() == ROLE_DOMAIN_BDC)
+                               server_role = ROLE_DOMAIN_BDC;
+
+                       dom_info->general2.general.oem_information.string       = lp_serverstring();
+                       dom_info->general2.general.domain_name.string           = lp_workgroup();
+                       dom_info->general2.general.primary.string               = global_myname();
+                       dom_info->general2.general.sequence_num                 = seq_num;
+                       dom_info->general2.general.domain_server_state          = DOMAIN_SERVER_ENABLED;
+                       dom_info->general2.general.role                         = server_role;
+                       dom_info->general2.general.unknown3                     = 1;
+
+                       unix_to_nt_time_abs(&dom_info->general2.lockout_duration,
+                                           u_lock_duration);
+                       unix_to_nt_time_abs(&dom_info->general2.lockout_window,
+                                           u_reset_time);
+
                        break;
                case 0x0c:
 
@@ -3294,6 +3362,25 @@ NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
                        unix_to_nt_time_abs(&dom_info->info12.lockout_window,
                                            u_reset_time);
 
+                       break;
+               case 0x0d:
+
+                       become_root();
+
+                       /* AS ROOT !!! */
+
+                       if (!pdb_get_seq_num(&seq_num)) {
+                               seq_num = time(NULL);
+                       }
+
+                       /* !AS ROOT */
+
+                       unbecome_root();
+
+                       dom_info->info13.sequence_num = seq_num;
+                       dom_info->info13.domain_create_time = 0;
+                       dom_info->info13.modified_count_at_last_promotion = 0;
+
                        break;
                default:
                        return NT_STATUS_INVALID_INFO_CLASS;
@@ -3926,6 +4013,12 @@ static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
           code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
 
        rc = can_create(mem_ctx, id7->account_name.string);
+
+       /* when there is nothing to change, we're done here */
+       if (NT_STATUS_EQUAL(rc, NT_STATUS_USER_EXISTS) &&
+           strequal(id7->account_name.string, pdb_get_username(pwd))) {
+               return NT_STATUS_OK;
+       }
        if (!NT_STATUS_IS_OK(rc)) {
                return rc;
        }
@@ -4580,6 +4673,9 @@ NTSTATUS _samr_SetUserInfo(pipes_struct *p,
          we'll use the set from the WinXP join as the basis. */
 
        switch (switch_value) {
+       case 7:
+               acc_required = SAMR_USER_ACCESS_SET_ATTRIBUTES;
+               break;
        case 18:
        case 24:
        case 25:
@@ -6026,18 +6122,18 @@ NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
                        pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (int)u_expire);
                        pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (int)u_min_age);
                        break;
-               case 0x02:
-                       break;
                case 0x03:
                        u_logout=nt_time_to_unix_abs((NTTIME *)&r->in.info->info3.force_logoff_time);
                        pdb_set_account_policy(AP_TIME_TO_LOGOUT, (int)u_logout);
                        break;
-               case 0x05:
+               case 0x04:
                        break;
                case 0x06:
                        break;
                case 0x07:
                        break;
+               case 0x09:
+                       break;
                case 0x0c:
                        u_lock_duration=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_duration);
                        if (u_lock_duration != -1)