From: Joseph Sutton Date: Thu, 15 Jun 2023 22:21:59 +0000 (+1200) Subject: s4:auth: Add audit info parameters to check_password_recv() X-Git-Tag: talloc-2.4.1~214 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ad32cf0286c212bd3644b5d6a1ba4344170eeabe;p=thirdparty%2Fsamba.git s4:auth: Add audit info parameters to check_password_recv() These pointers can be set by implementing functions in order for them to be logged in auth_check_password_recv(). Signed-off-by: Joseph Sutton Reviewed-by: Andrew Bartlett --- diff --git a/source4/auth/auth.h b/source4/auth/auth.h index d39b23eb072..1ea4f11d581 100644 --- a/source4/auth/auth.h +++ b/source4/auth/auth.h @@ -68,6 +68,8 @@ struct auth_operations { NTSTATUS (*check_password_recv)(struct tevent_req *subreq, TALLOC_CTX *mem_ctx, struct auth_user_info_dc **interim_info, + const struct authn_audit_info **client_audit_info, + const struct authn_audit_info **server_audit_info, bool *authoritative); }; diff --git a/source4/auth/ntlm/auth.c b/source4/auth/ntlm/auth.c index 570f82156f9..9f5cb92f89f 100644 --- a/source4/auth/ntlm/auth.c +++ b/source4/auth/ntlm/auth.c @@ -158,6 +158,8 @@ struct auth_check_password_state { const struct auth_usersupplied_info *user_info; struct auth_user_info_dc *user_info_dc; struct auth_method_context *method; + const struct authn_audit_info *client_audit_info; + const struct authn_audit_info *server_audit_info; uint8_t authoritative; }; @@ -335,6 +337,8 @@ static void auth_check_password_done(struct tevent_req *subreq) status = state->method->ops->check_password_recv(subreq, state, &state->user_info_dc, + &state->client_audit_info, + &state->server_audit_info, &authoritative); TALLOC_FREE(subreq); if (!authoritative || @@ -405,8 +409,8 @@ _PUBLIC_ NTSTATUS auth_check_password_recv(struct tevent_req *req, &state->auth_ctx->start_time, state->user_info, status, NULL, NULL, NULL, - NULL /* client_audit_info */, - NULL /* server_audit_info */); + state->client_audit_info, + state->server_audit_info); tevent_req_received(req); return status; } @@ -424,10 +428,14 @@ _PUBLIC_ NTSTATUS auth_check_password_recv(struct tevent_req *req, state->user_info_dc->info->domain_name, state->user_info_dc->info->account_name, &state->user_info_dc->sids[PRIMARY_USER_SID_INDEX].sid, - NULL /* client_audit_info */, - NULL /* server_audit_info */); + state->client_audit_info, + state->server_audit_info); - /* Release our handle to state->user_info_dc. */ + /* + * Release our handle to state->user_info_dc. + * state->{client,server}_audit_info, if non-NULL, becomes the new + * parent. + */ *user_info_dc = talloc_reparent(state, mem_ctx, state->user_info_dc); state->user_info_dc = NULL; diff --git a/source4/auth/ntlm/auth_anonymous.c b/source4/auth/ntlm/auth_anonymous.c index a25aacaa137..0f71830259c 100644 --- a/source4/auth/ntlm/auth_anonymous.c +++ b/source4/auth/ntlm/auth_anonymous.c @@ -124,12 +124,17 @@ static NTSTATUS anonymous_check_password_recv( struct tevent_req *req, TALLOC_CTX *mem_ctx, struct auth_user_info_dc **interim_info, + const struct authn_audit_info **client_audit_info, + const struct authn_audit_info **server_audit_info, bool *authoritative) { struct anonymous_check_password_state *state = tevent_req_data( req, struct anonymous_check_password_state); NTSTATUS status; + *client_audit_info = NULL; + *server_audit_info = NULL; + if (tevent_req_is_nterror(req, &status)) { tevent_req_received(req); return status; diff --git a/source4/auth/ntlm/auth_developer.c b/source4/auth/ntlm/auth_developer.c index 4c3ad6733cb..7b9610cc85e 100644 --- a/source4/auth/ntlm/auth_developer.c +++ b/source4/auth/ntlm/auth_developer.c @@ -182,6 +182,8 @@ static NTSTATUS name_to_ntstatus_check_password_recv( struct tevent_req *req, TALLOC_CTX *mem_ctx, struct auth_user_info_dc **interim_info, + const struct authn_audit_info **client_audit_info, + const struct authn_audit_info **server_audit_info, bool *authoritative) { struct name_to_ntstatus_check_password_state *state = tevent_req_data( @@ -189,6 +191,8 @@ static NTSTATUS name_to_ntstatus_check_password_recv( NTSTATUS status; *authoritative = state->authoritative; + *client_audit_info = NULL; + *server_audit_info = NULL; if (tevent_req_is_nterror(req, &status)) { tevent_req_received(req); diff --git a/source4/auth/ntlm/auth_sam.c b/source4/auth/ntlm/auth_sam.c index b5ac1bc858c..60b301b104f 100644 --- a/source4/auth/ntlm/auth_sam.c +++ b/source4/auth/ntlm/auth_sam.c @@ -1169,6 +1169,8 @@ static NTSTATUS authsam_check_password_recv( struct tevent_req *req, TALLOC_CTX *mem_ctx, struct auth_user_info_dc **interim_info, + const struct authn_audit_info **client_audit_info, + const struct authn_audit_info **server_audit_info, bool *authoritative) { struct authsam_check_password_state *state = tevent_req_data( @@ -1177,6 +1179,10 @@ static NTSTATUS authsam_check_password_recv( *authoritative = state->authoritative; + *client_audit_info = NULL; + + *server_audit_info = NULL; + if (tevent_req_is_nterror(req, &status)) { tevent_req_received(req); return status; diff --git a/source4/auth/ntlm/auth_winbind.c b/source4/auth/ntlm/auth_winbind.c index 719d877a170..4049c3ac209 100644 --- a/source4/auth/ntlm/auth_winbind.c +++ b/source4/auth/ntlm/auth_winbind.c @@ -281,6 +281,8 @@ static void winbind_check_password_done(struct tevent_req *subreq) static NTSTATUS winbind_check_password_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx, struct auth_user_info_dc **user_info_dc, + const struct authn_audit_info **client_audit_info, + const struct authn_audit_info **server_audit_info, bool *pauthoritative) { struct winbind_check_password_state *state = @@ -289,6 +291,8 @@ static NTSTATUS winbind_check_password_recv(struct tevent_req *req, NTSTATUS status = NT_STATUS_OK; *pauthoritative = state->authoritative; + *client_audit_info = NULL; + *server_audit_info = NULL; if (tevent_req_is_nterror(req, &status)) { tevent_req_received(req);