?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:password_hash LDB module - we might not have a cleartext password at all
[Samba/ekacnet.git] / source4 / dsdb / samdb / ldb_modules / password_hash.c
blob0334c6d95e220a89954c4a0d5d31cef21ee43c7c
1 /*
2 ldb database module
3
4 Copyright (C) Simo Sorce 2004-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2006
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Stefan Metzmacher 2007-2010
8 Copyright (C) Matthias Dieter Wallnöfer 2009-2010
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 /*
25 * Name: ldb
26 *
27 * Component: ldb password_hash module
28 *
29 * Description: correctly handle AD password changes fields
30 *
31 * Author: Andrew Bartlett
32 * Author: Stefan Metzmacher
33 */
34
35 #include "includes.h"
36 #include "libcli/ldap/ldap_ndr.h"
37 #include "ldb_module.h"
38 #include "librpc/gen_ndr/misc.h"
39 #include "librpc/gen_ndr/samr.h"
40 #include "libcli/auth/libcli_auth.h"
41 #include "libcli/security/security.h"
42 #include "system/kerberos.h"
43 #include "auth/kerberos/kerberos.h"
44 #include "system/time.h"
45 #include "dsdb/samdb/samdb.h"
46 #include "../libds/common/flags.h"
47 #include "dsdb/samdb/ldb_modules/password_modules.h"
48 #include "librpc/ndr/libndr.h"
49 #include "librpc/gen_ndr/ndr_drsblobs.h"
50 #include "../lib/crypto/crypto.h"
51 #include "param/param.h"
52
53 /* If we have decided there is a reason to work on this request, then
54 * setup all the password hash types correctly.
55 *
56 * If we haven't the hashes yet but the password given as plain-text (attributes
57 * 'unicodePwd', 'userPassword' and 'clearTextPassword') we have to check for
58 * the constraints. Once this is done, we calculate the password hashes.
59 *
60 * Notice: unlike the real AD which only supports the UTF16 special based
61 * 'unicodePwd' and the UTF8 based 'userPassword' plaintext attribute we
62 * understand also a UTF16 based 'clearTextPassword' one.
63 * The latter is also accessible through LDAP so it can also be set by external
64 * tools and scripts. But be aware that this isn't portable on non SAMBA 4 ADs!
65 *
66 * Also when the module receives only the password hashes (possible through
67 * specifying an internal LDB control - for security reasons) some checks are
68 * performed depending on the operation mode (see below) (e.g. if the password
69 * has been in use before if the password memory policy was activated).
70 *
71 * Attention: There is a difference between "modify" and "reset" operations
72 * (see MS-ADTS 3.1.1.3.1.5). If the client sends a "add" and "remove"
73 * operation for a password attribute we thread this as a "modify"; if it sends
74 * only a "replace" one we have an (administrative) reset.
75 *
76 * Finally, if the administrator has requested that a password history
77 * be maintained, then this should also be written out.
78 *
79 */
80
81 /* TODO: [consider always MS-ADTS 3.1.1.3.1.5]
82 * - Check for right connection encryption
83 */
84
85 /* Notice: Definition of "dsdb_control_password_change_status" moved into
86 * "samdb.h" */
87
88 struct ph_context {
89 struct ldb_module *module;
90 struct ldb_request *req;
91
92 struct ldb_request *dom_req;
93 struct ldb_reply *dom_res;
94
95 struct ldb_reply *search_res;
96
97 struct dsdb_control_password_change_status *status;
98
99 bool pwd_reset;
100
101 bool change_status;
102 bool hash_values;
103 bool change_old_pw_checked;
104 };
105
106
107 struct setup_password_fields_io {
108 struct ph_context *ac;
109
110 struct smb_krb5_context *smb_krb5_context;
111
112 /* infos about the user account */
113 struct {
114 uint32_t userAccountControl;
115 NTTIME pwdLastSet;
116 const char *sAMAccountName;
117 const char *user_principal_name;
118 bool is_computer;
119 uint32_t restrictions;
120 } u;
121
122 /* new credentials and old given credentials */
123 struct setup_password_fields_given {
124 const struct ldb_val *cleartext_utf8;
125 const struct ldb_val *cleartext_utf16;
126 struct samr_Password *nt_hash;
127 struct samr_Password *lm_hash;
128 } n, og;
129
130 /* old credentials */
131 struct {
132 struct samr_Password *nt_hash;
133 struct samr_Password *lm_hash;
134 uint32_t nt_history_len;
135 struct samr_Password *nt_history;
136 uint32_t lm_history_len;
137 struct samr_Password *lm_history;
138 const struct ldb_val *supplemental;
139 struct supplementalCredentialsBlob scb;
140 } o;
141
142 /* generated credentials */
143 struct {
144 struct samr_Password *nt_hash;
145 struct samr_Password *lm_hash;
146 uint32_t nt_history_len;
147 struct samr_Password *nt_history;
148 uint32_t lm_history_len;
149 struct samr_Password *lm_history;
150 const char *salt;
151 DATA_BLOB aes_256;
152 DATA_BLOB aes_128;
153 DATA_BLOB des_md5;
154 DATA_BLOB des_crc;
155 struct ldb_val supplemental;
156 NTTIME last_set;
157 } g;
158 };
159
160 /* Get the NT hash, and fill it in as an entry in the password history,
161 and specify it into io->g.nt_hash */
162
163 static int setup_nt_fields(struct setup_password_fields_io *io)
164 {
165 struct ldb_context *ldb;
166 uint32_t i;
167
168 io->g.nt_hash = io->n.nt_hash;
169 ldb = ldb_module_get_ctx(io->ac->module);
170
171 if (io->ac->status->domain_data.pwdHistoryLength == 0) {
172 return LDB_SUCCESS;
173 }
174
175 /* We might not have an old NT password */
176 io->g.nt_history = talloc_array(io->ac,
177 struct samr_Password,
178 io->ac->status->domain_data.pwdHistoryLength);
179 if (!io->g.nt_history) {
180 ldb_oom(ldb);
181 return LDB_ERR_OPERATIONS_ERROR;
182 }
183
184 for (i = 0; i < MIN(io->ac->status->domain_data.pwdHistoryLength-1,
185 io->o.nt_history_len); i++) {
186 io->g.nt_history[i+1] = io->o.nt_history[i];
187 }
188 io->g.nt_history_len = i + 1;
189
190 if (io->g.nt_hash) {
191 io->g.nt_history[0] = *io->g.nt_hash;
192 } else {
193 /*
194 * TODO: is this correct?
195 * the simular behavior is correct for the lm history case
196 */
197 E_md4hash("", io->g.nt_history[0].hash);
198 }
199
200 return LDB_SUCCESS;
201 }
202
203 /* Get the LANMAN hash, and fill it in as an entry in the password history,
204 and specify it into io->g.lm_hash */
205
206 static int setup_lm_fields(struct setup_password_fields_io *io)
207 {
208 struct ldb_context *ldb;
209 uint32_t i;
210
211 io->g.lm_hash = io->n.lm_hash;
212 ldb = ldb_module_get_ctx(io->ac->module);
213
214 if (io->ac->status->domain_data.pwdHistoryLength == 0) {
215 return LDB_SUCCESS;
216 }
217
218 /* We might not have an old NT password */
219 io->g.lm_history = talloc_array(io->ac,
220 struct samr_Password,
221 io->ac->status->domain_data.pwdHistoryLength);
222 if (!io->g.lm_history) {
223 ldb_oom(ldb);
224 return LDB_ERR_OPERATIONS_ERROR;
225 }
226
227 for (i = 0; i < MIN(io->ac->status->domain_data.pwdHistoryLength-1,
228 io->o.lm_history_len); i++) {
229 io->g.lm_history[i+1] = io->o.lm_history[i];
230 }
231 io->g.lm_history_len = i + 1;
232
233 if (io->g.lm_hash) {
234 io->g.lm_history[0] = *io->g.lm_hash;
235 } else {
236 E_deshash("", io->g.lm_history[0].hash);
237 }
238
239 return LDB_SUCCESS;
240 }
241
242 static int setup_kerberos_keys(struct setup_password_fields_io *io)
243 {
244 struct ldb_context *ldb;
245 krb5_error_code krb5_ret;
246 Principal *salt_principal;
247 krb5_salt salt;
248 krb5_keyblock key;
249 krb5_data cleartext_data;
250
251 ldb = ldb_module_get_ctx(io->ac->module);
252 cleartext_data.data = io->n.cleartext_utf8->data;
253 cleartext_data.length = io->n.cleartext_utf8->length;
254
255 /* Many, many thanks to lukeh@padl.com for this
256 * algorithm, described in his Nov 10 2004 mail to
257 * samba-technical@samba.org */
258
259 /*
260 * Determine a salting principal
261 */
262 if (io->u.is_computer) {
263 char *name;
264 char *saltbody;
265
266 name = strlower_talloc(io->ac, io->u.sAMAccountName);
267 if (!name) {
268 ldb_oom(ldb);
269 return LDB_ERR_OPERATIONS_ERROR;
270 }
271
272 if (name[strlen(name)-1] == '$') {
273 name[strlen(name)-1] = '\0';
274 }
275
276 saltbody = talloc_asprintf(io->ac, "%s.%s", name,
277 io->ac->status->domain_data.dns_domain);
278 if (!saltbody) {
279 ldb_oom(ldb);
280 return LDB_ERR_OPERATIONS_ERROR;
281 }
282
283 krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
284 &salt_principal,
285 io->ac->status->domain_data.realm,
286 "host", saltbody, NULL);
287 } else if (io->u.user_principal_name) {
288 char *user_principal_name;
289 char *p;
290
291 user_principal_name = talloc_strdup(io->ac, io->u.user_principal_name);
292 if (!user_principal_name) {
293 ldb_oom(ldb);
294 return LDB_ERR_OPERATIONS_ERROR;
295 }
296
297 p = strchr(user_principal_name, '@');
298 if (p) {
299 p[0] = '\0';
300 }
301
302 krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
303 &salt_principal,
304 io->ac->status->domain_data.realm,
305 user_principal_name, NULL);
306 } else {
307 krb5_ret = krb5_make_principal(io->smb_krb5_context->krb5_context,
308 &salt_principal,
309 io->ac->status->domain_data.realm,
310 io->u.sAMAccountName, NULL);
311 }
312 if (krb5_ret) {
313 ldb_asprintf_errstring(ldb,
314 "setup_kerberos_keys: "
315 "generation of a salting principal failed: %s",
316 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
317 krb5_ret, io->ac));
318 return LDB_ERR_OPERATIONS_ERROR;
319 }
320
321 /*
322 * create salt from salt_principal
323 */
324 krb5_ret = krb5_get_pw_salt(io->smb_krb5_context->krb5_context,
325 salt_principal, &salt);
326 krb5_free_principal(io->smb_krb5_context->krb5_context, salt_principal);
327 if (krb5_ret) {
328 ldb_asprintf_errstring(ldb,
329 "setup_kerberos_keys: "
330 "generation of krb5_salt failed: %s",
331 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
332 krb5_ret, io->ac));
333 return LDB_ERR_OPERATIONS_ERROR;
334 }
335 /* create a talloc copy */
336 io->g.salt = talloc_strndup(io->ac,
337 (char *)salt.saltvalue.data,
338 salt.saltvalue.length);
339 krb5_free_salt(io->smb_krb5_context->krb5_context, salt);
340 if (!io->g.salt) {
341 ldb_oom(ldb);
342 return LDB_ERR_OPERATIONS_ERROR;
343 }
344 salt.saltvalue.data = discard_const(io->g.salt);
345 salt.saltvalue.length = strlen(io->g.salt);
346
347 /*
348 * create ENCTYPE_AES256_CTS_HMAC_SHA1_96 key out of
349 * the salt and the cleartext password
350 */
351 krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
352 ENCTYPE_AES256_CTS_HMAC_SHA1_96,
353 cleartext_data,
354 salt,
355 &key);
356 if (krb5_ret) {
357 ldb_asprintf_errstring(ldb,
358 "setup_kerberos_keys: "
359 "generation of a aes256-cts-hmac-sha1-96 key failed: %s",
360 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
361 krb5_ret, io->ac));
362 return LDB_ERR_OPERATIONS_ERROR;
363 }
364 io->g.aes_256 = data_blob_talloc(io->ac,
365 key.keyvalue.data,
366 key.keyvalue.length);
367 krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
368 if (!io->g.aes_256.data) {
369 ldb_oom(ldb);
370 return LDB_ERR_OPERATIONS_ERROR;
371 }
372
373 /*
374 * create ENCTYPE_AES128_CTS_HMAC_SHA1_96 key out of
375 * the salt and the cleartext password
376 */
377 krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
378 ENCTYPE_AES128_CTS_HMAC_SHA1_96,
379 cleartext_data,
380 salt,
381 &key);
382 if (krb5_ret) {
383 ldb_asprintf_errstring(ldb,
384 "setup_kerberos_keys: "
385 "generation of a aes128-cts-hmac-sha1-96 key failed: %s",
386 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
387 krb5_ret, io->ac));
388 return LDB_ERR_OPERATIONS_ERROR;
389 }
390 io->g.aes_128 = data_blob_talloc(io->ac,
391 key.keyvalue.data,
392 key.keyvalue.length);
393 krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
394 if (!io->g.aes_128.data) {
395 ldb_oom(ldb);
396 return LDB_ERR_OPERATIONS_ERROR;
397 }
398
399 /*
400 * create ENCTYPE_DES_CBC_MD5 key out of
401 * the salt and the cleartext password
402 */
403 krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
404 ENCTYPE_DES_CBC_MD5,
405 cleartext_data,
406 salt,
407 &key);
408 if (krb5_ret) {
409 ldb_asprintf_errstring(ldb,
410 "setup_kerberos_keys: "
411 "generation of a des-cbc-md5 key failed: %s",
412 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
413 krb5_ret, io->ac));
414 return LDB_ERR_OPERATIONS_ERROR;
415 }
416 io->g.des_md5 = data_blob_talloc(io->ac,
417 key.keyvalue.data,
418 key.keyvalue.length);
419 krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
420 if (!io->g.des_md5.data) {
421 ldb_oom(ldb);
422 return LDB_ERR_OPERATIONS_ERROR;
423 }
424
425 /*
426 * create ENCTYPE_DES_CBC_CRC key out of
427 * the salt and the cleartext password
428 */
429 krb5_ret = krb5_string_to_key_data_salt(io->smb_krb5_context->krb5_context,
430 ENCTYPE_DES_CBC_CRC,
431 cleartext_data,
432 salt,
433 &key);
434 if (krb5_ret) {
435 ldb_asprintf_errstring(ldb,
436 "setup_kerberos_keys: "
437 "generation of a des-cbc-crc key failed: %s",
438 smb_get_krb5_error_message(io->smb_krb5_context->krb5_context,
439 krb5_ret, io->ac));
440 return LDB_ERR_OPERATIONS_ERROR;
441 }
442 io->g.des_crc = data_blob_talloc(io->ac,
443 key.keyvalue.data,
444 key.keyvalue.length);
445 krb5_free_keyblock_contents(io->smb_krb5_context->krb5_context, &key);
446 if (!io->g.des_crc.data) {
447 ldb_oom(ldb);
448 return LDB_ERR_OPERATIONS_ERROR;
449 }
450
451 return LDB_SUCCESS;
452 }
453
454 static int setup_primary_kerberos(struct setup_password_fields_io *io,
455 const struct supplementalCredentialsBlob *old_scb,
456 struct package_PrimaryKerberosBlob *pkb)
457 {
458 struct ldb_context *ldb;
459 struct package_PrimaryKerberosCtr3 *pkb3 = &pkb->ctr.ctr3;
460 struct supplementalCredentialsPackage *old_scp = NULL;
461 struct package_PrimaryKerberosBlob _old_pkb;
462 struct package_PrimaryKerberosCtr3 *old_pkb3 = NULL;
463 uint32_t i;
464 enum ndr_err_code ndr_err;
465
466 ldb = ldb_module_get_ctx(io->ac->module);
467
468 /*
469 * prepare generation of keys
470 *
471 * ENCTYPE_DES_CBC_MD5
472 * ENCTYPE_DES_CBC_CRC
473 */
474 pkb->version = 3;
475 pkb3->salt.string = io->g.salt;
476 pkb3->num_keys = 2;
477 pkb3->keys = talloc_array(io->ac,
478 struct package_PrimaryKerberosKey3,
479 pkb3->num_keys);
480 if (!pkb3->keys) {
481 ldb_oom(ldb);
482 return LDB_ERR_OPERATIONS_ERROR;
483 }
484
485 pkb3->keys[0].keytype = ENCTYPE_DES_CBC_MD5;
486 pkb3->keys[0].value = &io->g.des_md5;
487 pkb3->keys[1].keytype = ENCTYPE_DES_CBC_CRC;
488 pkb3->keys[1].value = &io->g.des_crc;
489
490 /* initialize the old keys to zero */
491 pkb3->num_old_keys = 0;
492 pkb3->old_keys = NULL;
493
494 /* if there're no old keys, then we're done */
495 if (!old_scb) {
496 return LDB_SUCCESS;
497 }
498
499 for (i=0; i < old_scb->sub.num_packages; i++) {
500 if (strcmp("Primary:Kerberos", old_scb->sub.packages[i].name) != 0) {
501 continue;
502 }
503
504 if (!old_scb->sub.packages[i].data || !old_scb->sub.packages[i].data[0]) {
505 continue;
506 }
507
508 old_scp = &old_scb->sub.packages[i];
509 break;
510 }
511 /* Primary:Kerberos element of supplementalCredentials */
512 if (old_scp) {
513 DATA_BLOB blob;
514
515 blob = strhex_to_data_blob(io->ac, old_scp->data);
516 if (!blob.data) {
517 ldb_oom(ldb);
518 return LDB_ERR_OPERATIONS_ERROR;
519 }
520
521 /* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
522 ndr_err = ndr_pull_struct_blob(&blob, io->ac, lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")), &_old_pkb,
523 (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
524 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
525 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
526 ldb_asprintf_errstring(ldb,
527 "setup_primary_kerberos: "
528 "failed to pull old package_PrimaryKerberosBlob: %s",
529 nt_errstr(status));
530 return LDB_ERR_OPERATIONS_ERROR;
531 }
532
533 if (_old_pkb.version != 3) {
534 ldb_asprintf_errstring(ldb,
535 "setup_primary_kerberos: "
536 "package_PrimaryKerberosBlob version[%u] expected[3]",
537 _old_pkb.version);
538 return LDB_ERR_OPERATIONS_ERROR;
539 }
540
541 old_pkb3 = &_old_pkb.ctr.ctr3;
542 }
543
544 /* if we didn't found the old keys we're done */
545 if (!old_pkb3) {
546 return LDB_SUCCESS;
547 }
548
549 /* fill in the old keys */
550 pkb3->num_old_keys = old_pkb3->num_keys;
551 pkb3->old_keys = old_pkb3->keys;
552
553 return LDB_SUCCESS;
554 }
555
556 static int setup_primary_kerberos_newer(struct setup_password_fields_io *io,
557 const struct supplementalCredentialsBlob *old_scb,
558 struct package_PrimaryKerberosBlob *pkb)
559 {
560 struct ldb_context *ldb;
561 struct package_PrimaryKerberosCtr4 *pkb4 = &pkb->ctr.ctr4;
562 struct supplementalCredentialsPackage *old_scp = NULL;
563 struct package_PrimaryKerberosBlob _old_pkb;
564 struct package_PrimaryKerberosCtr4 *old_pkb4 = NULL;
565 uint32_t i;
566 enum ndr_err_code ndr_err;
567
568 ldb = ldb_module_get_ctx(io->ac->module);
569
570 /*
571 * prepare generation of keys
572 *
573 * ENCTYPE_AES256_CTS_HMAC_SHA1_96
574 * ENCTYPE_AES128_CTS_HMAC_SHA1_96
575 * ENCTYPE_DES_CBC_MD5
576 * ENCTYPE_DES_CBC_CRC
577 */
578 pkb->version = 4;
579 pkb4->salt.string = io->g.salt;
580 pkb4->default_iteration_count = 4096;
581 pkb4->num_keys = 4;
582
583 pkb4->keys = talloc_array(io->ac,
584 struct package_PrimaryKerberosKey4,
585 pkb4->num_keys);
586 if (!pkb4->keys) {
587 ldb_oom(ldb);
588 return LDB_ERR_OPERATIONS_ERROR;
589 }
590
591 pkb4->keys[0].iteration_count = 4096;
592 pkb4->keys[0].keytype = ENCTYPE_AES256_CTS_HMAC_SHA1_96;
593 pkb4->keys[0].value = &io->g.aes_256;
594 pkb4->keys[1].iteration_count = 4096;
595 pkb4->keys[1].keytype = ENCTYPE_AES128_CTS_HMAC_SHA1_96;
596 pkb4->keys[1].value = &io->g.aes_128;
597 pkb4->keys[2].iteration_count = 4096;
598 pkb4->keys[2].keytype = ENCTYPE_DES_CBC_MD5;
599 pkb4->keys[2].value = &io->g.des_md5;
600 pkb4->keys[3].iteration_count = 4096;
601 pkb4->keys[3].keytype = ENCTYPE_DES_CBC_CRC;
602 pkb4->keys[3].value = &io->g.des_crc;
603
604 /* initialize the old keys to zero */
605 pkb4->num_old_keys = 0;
606 pkb4->old_keys = NULL;
607 pkb4->num_older_keys = 0;
608 pkb4->older_keys = NULL;
609
610 /* if there're no old keys, then we're done */
611 if (!old_scb) {
612 return LDB_SUCCESS;
613 }
614
615 for (i=0; i < old_scb->sub.num_packages; i++) {
616 if (strcmp("Primary:Kerberos-Newer-Keys", old_scb->sub.packages[i].name) != 0) {
617 continue;
618 }
619
620 if (!old_scb->sub.packages[i].data || !old_scb->sub.packages[i].data[0]) {
621 continue;
622 }
623
624 old_scp = &old_scb->sub.packages[i];
625 break;
626 }
627 /* Primary:Kerberos-Newer-Keys element of supplementalCredentials */
628 if (old_scp) {
629 DATA_BLOB blob;
630
631 blob = strhex_to_data_blob(io->ac, old_scp->data);
632 if (!blob.data) {
633 ldb_oom(ldb);
634 return LDB_ERR_OPERATIONS_ERROR;
635 }
636
637 /* TODO: use ndr_pull_struct_blob_all(), when the ndr layer handles it correct with relative pointers */
638 ndr_err = ndr_pull_struct_blob(&blob, io->ac,
639 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
640 &_old_pkb,
641 (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
642 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
643 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
644 ldb_asprintf_errstring(ldb,
645 "setup_primary_kerberos_newer: "
646 "failed to pull old package_PrimaryKerberosBlob: %s",
647 nt_errstr(status));
648 return LDB_ERR_OPERATIONS_ERROR;
649 }
650
651 if (_old_pkb.version != 4) {
652 ldb_asprintf_errstring(ldb,
653 "setup_primary_kerberos_newer: "
654 "package_PrimaryKerberosBlob version[%u] expected[4]",
655 _old_pkb.version);
656 return LDB_ERR_OPERATIONS_ERROR;
657 }
658
659 old_pkb4 = &_old_pkb.ctr.ctr4;
660 }
661
662 /* if we didn't found the old keys we're done */
663 if (!old_pkb4) {
664 return LDB_SUCCESS;
665 }
666
667 /* fill in the old keys */
668 pkb4->num_old_keys = old_pkb4->num_keys;
669 pkb4->old_keys = old_pkb4->keys;
670 pkb4->num_older_keys = old_pkb4->num_old_keys;
671 pkb4->older_keys = old_pkb4->old_keys;
672
673 return LDB_SUCCESS;
674 }
675
676 static int setup_primary_wdigest(struct setup_password_fields_io *io,
677 const struct supplementalCredentialsBlob *old_scb,
678 struct package_PrimaryWDigestBlob *pdb)
679 {
680 struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
681 DATA_BLOB sAMAccountName;
682 DATA_BLOB sAMAccountName_l;
683 DATA_BLOB sAMAccountName_u;
684 const char *user_principal_name = io->u.user_principal_name;
685 DATA_BLOB userPrincipalName;
686 DATA_BLOB userPrincipalName_l;
687 DATA_BLOB userPrincipalName_u;
688 DATA_BLOB netbios_domain;
689 DATA_BLOB netbios_domain_l;
690 DATA_BLOB netbios_domain_u;
691 DATA_BLOB dns_domain;
692 DATA_BLOB dns_domain_l;
693 DATA_BLOB dns_domain_u;
694 DATA_BLOB digest;
695 DATA_BLOB delim;
696 DATA_BLOB backslash;
697 uint8_t i;
698 struct {
699 DATA_BLOB *user;
700 DATA_BLOB *realm;
701 DATA_BLOB *nt4dom;
702 } wdigest[] = {
703 /*
704 * See
705 * http://technet2.microsoft.com/WindowsServer/en/library/717b450c-f4a0-4cc9-86f4-cc0633aae5f91033.mspx?mfr=true
706 * for what precalculated hashes are supposed to be stored...
707 *
708 * I can't reproduce all values which should contain "Digest" as realm,
709 * am I doing something wrong or is w2k3 just broken...?
710 *
711 * W2K3 fills in following for a user:
712 *
713 * dn: CN=NewUser,OU=newtop,DC=sub1,DC=w2k3,DC=vmnet1,DC=vm,DC=base
714 * sAMAccountName: NewUser2Sam
715 * userPrincipalName: NewUser2Princ@sub1.w2k3.vmnet1.vm.base
716 *
717 * 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
718 * b7ec9da91062199aee7d121e6710fe23 => newuser2sam:sub1:TestPwd2007
719 * 17d290bc5c9f463fac54c37a8cea134d => NEWUSER2SAM:SUB1:TestPwd2007
720 * 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
721 * 5d57e7823938348127322e08cd81bcb5 => NewUser2Sam:sub1:TestPwd2007
722 * 07dd701bf8a011ece585de3d47237140 => NEWUSER2SAM:sub1:TestPwd2007
723 * e14fb0eb401498d2cb33c9aae1cc7f37 => newuser2sam:SUB1:TestPwd2007
724 * 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
725 * f52da1266a6bdd290ffd48b2c823dda7 => newuser2sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
726 * d2b42f171248cec37a3c5c6b55404062 => NEWUSER2SAM:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
727 * fff8d790ff6c152aaeb6ebe17b4021de => NewUser2Sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
728 * 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
729 * 2a7563c3715bc418d626dabef378c008 => NEWUSER2SAM:sub1.w2k3.vmnet1.vm.base:TestPwd2007
730 * c8e9557a87cd4200fda0c11d2fa03f96 => newuser2sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
731 * 221c55284451ae9b3aacaa2a3c86f10f => NewUser2Princ@sub1.w2k3.vmnet1.vm.base::TestPwd2007
732 * 74e1be668853d4324d38c07e2acfb8ea => (w2k3 has a bug here!) newuser2princ@sub1.w2k3.vmnet1.vm.base::TestPwd2007
733 * e1e244ab7f098e3ae1761be7f9229bbb => NEWUSER2PRINC@SUB1.W2K3.VMNET1.VM.BASE::TestPwd2007
734 * 86db637df42513039920e605499c3af6 => SUB1\NewUser2Sam::TestPwd2007
735 * f5e43474dfaf067fee8197a253debaa2 => sub1\newuser2sam::TestPwd2007
736 * 2ecaa8382e2518e4b77a52422b279467 => SUB1\NEWUSER2SAM::TestPwd2007
737 * 31dc704d3640335b2123d4ee28aa1f11 => ??? changes with NewUser2Sam => NewUser1Sam
738 * 36349f5cecd07320fb3bb0e119230c43 => ??? changes with NewUser2Sam => NewUser1Sam
739 * 12adf019d037fb535c01fd0608e78d9d => ??? changes with NewUser2Sam => NewUser1Sam
740 * 6feecf8e724906f3ee1105819c5105a1 => ??? changes with NewUser2Princ => NewUser1Princ
741 * 6c6911f3de6333422640221b9c51ff1f => ??? changes with NewUser2Princ => NewUser1Princ
742 * 4b279877e742895f9348ac67a8de2f69 => ??? changes with NewUser2Princ => NewUser1Princ
743 * db0c6bff069513e3ebb9870d29b57490 => ??? changes with NewUser2Sam => NewUser1Sam
744 * 45072621e56b1c113a4e04a8ff68cd0e => ??? changes with NewUser2Sam => NewUser1Sam
745 * 11d1220abc44a9c10cf91ef4a9c1de02 => ??? changes with NewUser2Sam => NewUser1Sam
746 *
747 * dn: CN=NewUser,OU=newtop,DC=sub1,DC=w2k3,DC=vmnet1,DC=vm,DC=base
748 * sAMAccountName: NewUser2Sam
749 *
750 * 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
751 * b7ec9da91062199aee7d121e6710fe23 => newuser2sam:sub1:TestPwd2007
752 * 17d290bc5c9f463fac54c37a8cea134d => NEWUSER2SAM:SUB1:TestPwd2007
753 * 4279815024bda54fc074a5f8bd0a6e6f => NewUser2Sam:SUB1:TestPwd2007
754 * 5d57e7823938348127322e08cd81bcb5 => NewUser2Sam:sub1:TestPwd2007
755 * 07dd701bf8a011ece585de3d47237140 => NEWUSER2SAM:sub1:TestPwd2007
756 * e14fb0eb401498d2cb33c9aae1cc7f37 => newuser2sam:SUB1:TestPwd2007
757 * 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
758 * f52da1266a6bdd290ffd48b2c823dda7 => newuser2sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
759 * d2b42f171248cec37a3c5c6b55404062 => NEWUSER2SAM:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
760 * fff8d790ff6c152aaeb6ebe17b4021de => NewUser2Sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
761 * 8dadc90250f873d8b883f79d890bef82 => NewUser2Sam:sub1.w2k3.vmnet1.vm.base:TestPwd2007
762 * 2a7563c3715bc418d626dabef378c008 => NEWUSER2SAM:sub1.w2k3.vmnet1.vm.base:TestPwd2007
763 * c8e9557a87cd4200fda0c11d2fa03f96 => newuser2sam:SUB1.W2K3.VMNET1.VM.BASE:TestPwd2007
764 * 8a140d30b6f0a5912735dc1e3bc993b4 => NewUser2Sam@sub1.w2k3.vmnet1.vm.base::TestPwd2007
765 * 86d95b2faae6cae4ec261e7fbaccf093 => (here w2k3 is correct) newuser2sam@sub1.w2k3.vmnet1.vm.base::TestPwd2007
766 * dfeff1493110220efcdfc6362e5f5450 => NEWUSER2SAM@SUB1.W2K3.VMNET1.VM.BASE::TestPwd2007
767 * 86db637df42513039920e605499c3af6 => SUB1\NewUser2Sam::TestPwd2007
768 * f5e43474dfaf067fee8197a253debaa2 => sub1\newuser2sam::TestPwd2007
769 * 2ecaa8382e2518e4b77a52422b279467 => SUB1\NEWUSER2SAM::TestPwd2007
770 * 31dc704d3640335b2123d4ee28aa1f11 => ???M1 changes with NewUser2Sam => NewUser1Sam
771 * 36349f5cecd07320fb3bb0e119230c43 => ???M1.L changes with newuser2sam => newuser1sam
772 * 12adf019d037fb535c01fd0608e78d9d => ???M1.U changes with NEWUSER2SAM => NEWUSER1SAM
773 * 569b4533f2d9e580211dd040e5e360a8 => ???M2 changes with NewUser2Princ => NewUser1Princ
774 * 52528bddf310a587c5d7e6a9ae2cbb20 => ???M2.L changes with newuser2princ => newuser1princ
775 * 4f629a4f0361289ca4255ab0f658fcd5 => ???M3 changes with NewUser2Princ => NewUser1Princ (doesn't depend on case of userPrincipal )
776 * db0c6bff069513e3ebb9870d29b57490 => ???M4 changes with NewUser2Sam => NewUser1Sam
777 * 45072621e56b1c113a4e04a8ff68cd0e => ???M5 changes with NewUser2Sam => NewUser1Sam (doesn't depend on case of sAMAccountName)
778 * 11d1220abc44a9c10cf91ef4a9c1de02 => ???M4.U changes with NEWUSER2SAM => NEWUSER1SAM
779 */
780
781 /*
782 * sAMAccountName, netbios_domain
783 */
784 {
785 .user = &sAMAccountName,
786 .realm = &netbios_domain,
787 },
788 {
789 .user = &sAMAccountName_l,
790 .realm = &netbios_domain_l,
791 },
792 {
793 .user = &sAMAccountName_u,
794 .realm = &netbios_domain_u,
795 },
796 {
797 .user = &sAMAccountName,
798 .realm = &netbios_domain_u,
799 },
800 {
801 .user = &sAMAccountName,
802 .realm = &netbios_domain_l,
803 },
804 {
805 .user = &sAMAccountName_u,
806 .realm = &netbios_domain_l,
807 },
808 {
809 .user = &sAMAccountName_l,
810 .realm = &netbios_domain_u,
811 },
812 /*
813 * sAMAccountName, dns_domain
814 */
815 {
816 .user = &sAMAccountName,
817 .realm = &dns_domain,
818 },
819 {
820 .user = &sAMAccountName_l,
821 .realm = &dns_domain_l,
822 },
823 {
824 .user = &sAMAccountName_u,
825 .realm = &dns_domain_u,
826 },
827 {
828 .user = &sAMAccountName,
829 .realm = &dns_domain_u,
830 },
831 {
832 .user = &sAMAccountName,
833 .realm = &dns_domain_l,
834 },
835 {
836 .user = &sAMAccountName_u,
837 .realm = &dns_domain_l,
838 },
839 {
840 .user = &sAMAccountName_l,
841 .realm = &dns_domain_u,
842 },
843 /*
844 * userPrincipalName, no realm
845 */
846 {
847 .user = &userPrincipalName,
848 },
849 {
850 /*
851 * NOTE: w2k3 messes this up, if the user has a real userPrincipalName,
852 * the fallback to the sAMAccountName based userPrincipalName is correct
853 */
854 .user = &userPrincipalName_l,
855 },
856 {
857 .user = &userPrincipalName_u,
858 },
859 /*
860 * nt4dom\sAMAccountName, no realm
861 */
862 {
863 .user = &sAMAccountName,
864 .nt4dom = &netbios_domain
865 },
866 {
867 .user = &sAMAccountName_l,
868 .nt4dom = &netbios_domain_l
869 },
870 {
871 .user = &sAMAccountName_u,
872 .nt4dom = &netbios_domain_u
873 },
874
875 /*
876 * the following ones are guessed depending on the technet2 article
877 * but not reproducable on a w2k3 server
878 */
879 /* sAMAccountName with "Digest" realm */
880 {
881 .user = &sAMAccountName,
882 .realm = &digest
883 },
884 {
885 .user = &sAMAccountName_l,
886 .realm = &digest
887 },
888 {
889 .user = &sAMAccountName_u,
890 .realm = &digest
891 },
892 /* userPrincipalName with "Digest" realm */
893 {
894 .user = &userPrincipalName,
895 .realm = &digest
896 },
897 {
898 .user = &userPrincipalName_l,
899 .realm = &digest
900 },
901 {
902 .user = &userPrincipalName_u,
903 .realm = &digest
904 },
905 /* nt4dom\\sAMAccountName with "Digest" realm */
906 {
907 .user = &sAMAccountName,
908 .nt4dom = &netbios_domain,
909 .realm = &digest
910 },
911 {
912 .user = &sAMAccountName_l,
913 .nt4dom = &netbios_domain_l,
914 .realm = &digest
915 },
916 {
917 .user = &sAMAccountName_u,
918 .nt4dom = &netbios_domain_u,
919 .realm = &digest
920 },
921 };
922
923 /* prepare DATA_BLOB's used in the combinations array */
924 sAMAccountName = data_blob_string_const(io->u.sAMAccountName);
925 sAMAccountName_l = data_blob_string_const(strlower_talloc(io->ac, io->u.sAMAccountName));
926 if (!sAMAccountName_l.data) {
927 ldb_oom(ldb);
928 return LDB_ERR_OPERATIONS_ERROR;
929 }
930 sAMAccountName_u = data_blob_string_const(strupper_talloc(io->ac, io->u.sAMAccountName));
931 if (!sAMAccountName_u.data) {
932 ldb_oom(ldb);
933 return LDB_ERR_OPERATIONS_ERROR;
934 }
935
936 /* if the user doesn't have a userPrincipalName, create one (with lower case realm) */
937 if (!user_principal_name) {
938 user_principal_name = talloc_asprintf(io->ac, "%s@%s",
939 io->u.sAMAccountName,
940 io->ac->status->domain_data.dns_domain);
941 if (!user_principal_name) {
942 ldb_oom(ldb);
943 return LDB_ERR_OPERATIONS_ERROR;
944 }
945 }
946 userPrincipalName = data_blob_string_const(user_principal_name);
947 userPrincipalName_l = data_blob_string_const(strlower_talloc(io->ac, user_principal_name));
948 if (!userPrincipalName_l.data) {
949 ldb_oom(ldb);
950 return LDB_ERR_OPERATIONS_ERROR;
951 }
952 userPrincipalName_u = data_blob_string_const(strupper_talloc(io->ac, user_principal_name));
953 if (!userPrincipalName_u.data) {
954 ldb_oom(ldb);
955 return LDB_ERR_OPERATIONS_ERROR;
956 }
957
958 netbios_domain = data_blob_string_const(io->ac->status->domain_data.netbios_domain);
959 netbios_domain_l = data_blob_string_const(strlower_talloc(io->ac,
960 io->ac->status->domain_data.netbios_domain));
961 if (!netbios_domain_l.data) {
962 ldb_oom(ldb);
963 return LDB_ERR_OPERATIONS_ERROR;
964 }
965 netbios_domain_u = data_blob_string_const(strupper_talloc(io->ac,
966 io->ac->status->domain_data.netbios_domain));
967 if (!netbios_domain_u.data) {
968 ldb_oom(ldb);
969 return LDB_ERR_OPERATIONS_ERROR;
970 }
971
972 dns_domain = data_blob_string_const(io->ac->status->domain_data.dns_domain);
973 dns_domain_l = data_blob_string_const(io->ac->status->domain_data.dns_domain);
974 dns_domain_u = data_blob_string_const(io->ac->status->domain_data.realm);
975
976 digest = data_blob_string_const("Digest");
977
978 delim = data_blob_string_const(":");
979 backslash = data_blob_string_const("\\");
980
981 pdb->num_hashes = ARRAY_SIZE(wdigest);
982 pdb->hashes = talloc_array(io->ac, struct package_PrimaryWDigestHash,
983 pdb->num_hashes);
984 if (!pdb->hashes) {
985 ldb_oom(ldb);
986 return LDB_ERR_OPERATIONS_ERROR;
987 }
988
989 for (i=0; i < ARRAY_SIZE(wdigest); i++) {
990 struct MD5Context md5;
991 MD5Init(&md5);
992 if (wdigest[i].nt4dom) {
993 MD5Update(&md5, wdigest[i].nt4dom->data, wdigest[i].nt4dom->length);
994 MD5Update(&md5, backslash.data, backslash.length);
995 }
996 MD5Update(&md5, wdigest[i].user->data, wdigest[i].user->length);
997 MD5Update(&md5, delim.data, delim.length);
998 if (wdigest[i].realm) {
999 MD5Update(&md5, wdigest[i].realm->data, wdigest[i].realm->length);
1000 }
1001 MD5Update(&md5, delim.data, delim.length);
1002 MD5Update(&md5, io->n.cleartext_utf8->data, io->n.cleartext_utf8->length);
1003 MD5Final(pdb->hashes[i].hash, &md5);
1004 }
1005
1006 return LDB_SUCCESS;
1007 }
1008
1009 static int setup_supplemental_field(struct setup_password_fields_io *io)
1010 {
1011 struct ldb_context *ldb;
1012 struct supplementalCredentialsBlob scb;
1013 struct supplementalCredentialsBlob _old_scb;
1014 struct supplementalCredentialsBlob *old_scb = NULL;
1015 /* Packages + (Kerberos-Newer-Keys, Kerberos, WDigest and CLEARTEXT) */
1016 uint32_t num_names = 0;
1017 const char *names[1+4];
1018 uint32_t num_packages = 0;
1019 struct supplementalCredentialsPackage packages[1+4];
1020 /* Packages */
1021 struct supplementalCredentialsPackage *pp = NULL;
1022 struct package_PackagesBlob pb;
1023 DATA_BLOB pb_blob;
1024 char *pb_hexstr;
1025 /* Primary:Kerberos-Newer-Keys */
1026 const char **nkn = NULL;
1027 struct supplementalCredentialsPackage *pkn = NULL;
1028 struct package_PrimaryKerberosBlob pknb;
1029 DATA_BLOB pknb_blob;
1030 char *pknb_hexstr;
1031 /* Primary:Kerberos */
1032 const char **nk = NULL;
1033 struct supplementalCredentialsPackage *pk = NULL;
1034 struct package_PrimaryKerberosBlob pkb;
1035 DATA_BLOB pkb_blob;
1036 char *pkb_hexstr;
1037 /* Primary:WDigest */
1038 const char **nd = NULL;
1039 struct supplementalCredentialsPackage *pd = NULL;
1040 struct package_PrimaryWDigestBlob pdb;
1041 DATA_BLOB pdb_blob;
1042 char *pdb_hexstr;
1043 /* Primary:CLEARTEXT */
1044 const char **nc = NULL;
1045 struct supplementalCredentialsPackage *pc = NULL;
1046 struct package_PrimaryCLEARTEXTBlob pcb;
1047 DATA_BLOB pcb_blob;
1048 char *pcb_hexstr;
1049 int ret;
1050 enum ndr_err_code ndr_err;
1051 uint8_t zero16[16];
1052 bool do_newer_keys = false;
1053 bool do_cleartext = false;
1054
1055 ZERO_STRUCT(zero16);
1056 ZERO_STRUCT(names);
1057
1058 ldb = ldb_module_get_ctx(io->ac->module);
1059
1060 if (!io->n.cleartext_utf8) {
1061 /*
1062 * when we don't have a cleartext password
1063 * we can't setup a supplementalCredential value
1064 */
1065 return LDB_SUCCESS;
1066 }
1067
1068 /* if there's an old supplementaCredentials blob then parse it */
1069 if (io->o.supplemental) {
1070 ndr_err = ndr_pull_struct_blob_all(io->o.supplemental, io->ac,
1071 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1072 &_old_scb,
1073 (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
1074 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1075 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1076 ldb_asprintf_errstring(ldb,
1077 "setup_supplemental_field: "
1078 "failed to pull old supplementalCredentialsBlob: %s",
1079 nt_errstr(status));
1080 return LDB_ERR_OPERATIONS_ERROR;
1081 }
1082
1083 if (_old_scb.sub.signature == SUPPLEMENTAL_CREDENTIALS_SIGNATURE) {
1084 old_scb = &_old_scb;
1085 } else {
1086 ldb_debug(ldb, LDB_DEBUG_ERROR,
1087 "setup_supplemental_field: "
1088 "supplementalCredentialsBlob signature[0x%04X] expected[0x%04X]",
1089 _old_scb.sub.signature, SUPPLEMENTAL_CREDENTIALS_SIGNATURE);
1090 }
1091 }
1092 /* Per MS-SAMR 3.1.1.8.11.6 we create AES keys if our domain functionality level is 2008 or higher */
1093 do_newer_keys = (dsdb_functional_level(ldb) >= DS_DOMAIN_FUNCTION_2008);
1094
1095 if (io->ac->status->domain_data.store_cleartext &&
1096 (io->u.userAccountControl & UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED)) {
1097 do_cleartext = true;
1098 }
1099
1100 /*
1101 * The ordering is this
1102 *
1103 * Primary:Kerberos-Newer-Keys (optional)
1104 * Primary:Kerberos
1105 * Primary:WDigest
1106 * Primary:CLEARTEXT (optional)
1107 *
1108 * And the 'Packages' package is insert before the last
1109 * other package.
1110 */
1111 if (do_newer_keys) {
1112 /* Primary:Kerberos-Newer-Keys */
1113 nkn = &names[num_names++];
1114 pkn = &packages[num_packages++];
1115 }
1116
1117 /* Primary:Kerberos */
1118 nk = &names[num_names++];
1119 pk = &packages[num_packages++];
1120
1121 if (!do_cleartext) {
1122 /* Packages */
1123 pp = &packages[num_packages++];
1124 }
1125
1126 /* Primary:WDigest */
1127 nd = &names[num_names++];
1128 pd = &packages[num_packages++];
1129
1130 if (do_cleartext) {
1131 /* Packages */
1132 pp = &packages[num_packages++];
1133
1134 /* Primary:CLEARTEXT */
1135 nc = &names[num_names++];
1136 pc = &packages[num_packages++];
1137 }
1138
1139 if (pkn) {
1140 /*
1141 * setup 'Primary:Kerberos-Newer-Keys' element
1142 */
1143 *nkn = "Kerberos-Newer-Keys";
1144
1145 ret = setup_primary_kerberos_newer(io, old_scb, &pknb);
1146 if (ret != LDB_SUCCESS) {
1147 return ret;
1148 }
1149
1150 ndr_err = ndr_push_struct_blob(&pknb_blob, io->ac,
1151 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1152 &pknb,
1153 (ndr_push_flags_fn_t)ndr_push_package_PrimaryKerberosBlob);
1154 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1155 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1156 ldb_asprintf_errstring(ldb,
1157 "setup_supplemental_field: "
1158 "failed to push package_PrimaryKerberosNeverBlob: %s",
1159 nt_errstr(status));
1160 return LDB_ERR_OPERATIONS_ERROR;
1161 }
1162 pknb_hexstr = data_blob_hex_string_upper(io->ac, &pknb_blob);
1163 if (!pknb_hexstr) {
1164 ldb_oom(ldb);
1165 return LDB_ERR_OPERATIONS_ERROR;
1166 }
1167 pkn->name = "Primary:Kerberos-Newer-Keys";
1168 pkn->reserved = 1;
1169 pkn->data = pknb_hexstr;
1170 }
1171
1172 /*
1173 * setup 'Primary:Kerberos' element
1174 */
1175 *nk = "Kerberos";
1176
1177 ret = setup_primary_kerberos(io, old_scb, &pkb);
1178 if (ret != LDB_SUCCESS) {
1179 return ret;
1180 }
1181
1182 ndr_err = ndr_push_struct_blob(&pkb_blob, io->ac,
1183 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1184 &pkb,
1185 (ndr_push_flags_fn_t)ndr_push_package_PrimaryKerberosBlob);
1186 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1187 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1188 ldb_asprintf_errstring(ldb,
1189 "setup_supplemental_field: "
1190 "failed to push package_PrimaryKerberosBlob: %s",
1191 nt_errstr(status));
1192 return LDB_ERR_OPERATIONS_ERROR;
1193 }
1194 pkb_hexstr = data_blob_hex_string_upper(io->ac, &pkb_blob);
1195 if (!pkb_hexstr) {
1196 ldb_oom(ldb);
1197 return LDB_ERR_OPERATIONS_ERROR;
1198 }
1199 pk->name = "Primary:Kerberos";
1200 pk->reserved = 1;
1201 pk->data = pkb_hexstr;
1202
1203 /*
1204 * setup 'Primary:WDigest' element
1205 */
1206 *nd = "WDigest";
1207
1208 ret = setup_primary_wdigest(io, old_scb, &pdb);
1209 if (ret != LDB_SUCCESS) {
1210 return ret;
1211 }
1212
1213 ndr_err = ndr_push_struct_blob(&pdb_blob, io->ac,
1214 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1215 &pdb,
1216 (ndr_push_flags_fn_t)ndr_push_package_PrimaryWDigestBlob);
1217 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1218 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1219 ldb_asprintf_errstring(ldb,
1220 "setup_supplemental_field: "
1221 "failed to push package_PrimaryWDigestBlob: %s",
1222 nt_errstr(status));
1223 return LDB_ERR_OPERATIONS_ERROR;
1224 }
1225 pdb_hexstr = data_blob_hex_string_upper(io->ac, &pdb_blob);
1226 if (!pdb_hexstr) {
1227 ldb_oom(ldb);
1228 return LDB_ERR_OPERATIONS_ERROR;
1229 }
1230 pd->name = "Primary:WDigest";
1231 pd->reserved = 1;
1232 pd->data = pdb_hexstr;
1233
1234 /*
1235 * setup 'Primary:CLEARTEXT' element
1236 */
1237 if (pc) {
1238 *nc = "CLEARTEXT";
1239
1240 pcb.cleartext = *io->n.cleartext_utf16;
1241
1242 ndr_err = ndr_push_struct_blob(&pcb_blob, io->ac,
1243 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1244 &pcb,
1245 (ndr_push_flags_fn_t)ndr_push_package_PrimaryCLEARTEXTBlob);
1246 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1247 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1248 ldb_asprintf_errstring(ldb,
1249 "setup_supplemental_field: "
1250 "failed to push package_PrimaryCLEARTEXTBlob: %s",
1251 nt_errstr(status));
1252 return LDB_ERR_OPERATIONS_ERROR;
1253 }
1254 pcb_hexstr = data_blob_hex_string_upper(io->ac, &pcb_blob);
1255 if (!pcb_hexstr) {
1256 ldb_oom(ldb);
1257 return LDB_ERR_OPERATIONS_ERROR;
1258 }
1259 pc->name = "Primary:CLEARTEXT";
1260 pc->reserved = 1;
1261 pc->data = pcb_hexstr;
1262 }
1263
1264 /*
1265 * setup 'Packages' element
1266 */
1267 pb.names = names;
1268 ndr_err = ndr_push_struct_blob(&pb_blob, io->ac,
1269 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1270 &pb,
1271 (ndr_push_flags_fn_t)ndr_push_package_PackagesBlob);
1272 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1273 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1274 ldb_asprintf_errstring(ldb,
1275 "setup_supplemental_field: "
1276 "failed to push package_PackagesBlob: %s",
1277 nt_errstr(status));
1278 return LDB_ERR_OPERATIONS_ERROR;
1279 }
1280 pb_hexstr = data_blob_hex_string_upper(io->ac, &pb_blob);
1281 if (!pb_hexstr) {
1282 ldb_oom(ldb);
1283 return LDB_ERR_OPERATIONS_ERROR;
1284 }
1285 pp->name = "Packages";
1286 pp->reserved = 2;
1287 pp->data = pb_hexstr;
1288
1289 /*
1290 * setup 'supplementalCredentials' value
1291 */
1292 ZERO_STRUCT(scb);
1293 scb.sub.num_packages = num_packages;
1294 scb.sub.packages = packages;
1295
1296 ndr_err = ndr_push_struct_blob(&io->g.supplemental, io->ac,
1297 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1298 &scb,
1299 (ndr_push_flags_fn_t)ndr_push_supplementalCredentialsBlob);
1300 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1301 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1302 ldb_asprintf_errstring(ldb,
1303 "setup_supplemental_field: "
1304 "failed to push supplementalCredentialsBlob: %s",
1305 nt_errstr(status));
1306 return LDB_ERR_OPERATIONS_ERROR;
1307 }
1308
1309 return LDB_SUCCESS;
1310 }
1311
1312 static int setup_last_set_field(struct setup_password_fields_io *io)
1313 {
1314 /* set it as now */
1315 unix_to_nt_time(&io->g.last_set, time(NULL));
1316
1317 return LDB_SUCCESS;
1318 }
1319
1320 static int setup_given_passwords(struct setup_password_fields_io *io,
1321 struct setup_password_fields_given *g)
1322 {
1323 struct ldb_context *ldb;
1324 bool ok;
1325
1326 ldb = ldb_module_get_ctx(io->ac->module);
1327
1328 if (g->cleartext_utf8) {
1329 char **cleartext_utf16_str;
1330 struct ldb_val *cleartext_utf16_blob;
1331 size_t converted_pw_len;
1332
1333 cleartext_utf16_blob = talloc(io->ac, struct ldb_val);
1334 if (!cleartext_utf16_blob) {
1335 ldb_oom(ldb);
1336 return LDB_ERR_OPERATIONS_ERROR;
1337 }
1338 if (!convert_string_talloc_convenience(io->ac,
1339 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1340 CH_UTF8, CH_UTF16,
1341 g->cleartext_utf8->data,
1342 g->cleartext_utf8->length,
1343 (void *)&cleartext_utf16_str,
1344 &converted_pw_len, false)) {
1345 ldb_asprintf_errstring(ldb,
1346 "setup_password_fields: "
1347 "failed to generate UTF16 password from cleartext UTF8 password");
1348 return LDB_ERR_OPERATIONS_ERROR;
1349 }
1350 *cleartext_utf16_blob = data_blob_const(cleartext_utf16_str,
1351 converted_pw_len);
1352 g->cleartext_utf16 = cleartext_utf16_blob;
1353 } else if (g->cleartext_utf16) {
1354 char *cleartext_utf8_str;
1355 struct ldb_val *cleartext_utf8_blob;
1356 size_t converted_pw_len;
1357
1358 cleartext_utf8_blob = talloc(io->ac, struct ldb_val);
1359 if (!cleartext_utf8_blob) {
1360 ldb_oom(ldb);
1361 return LDB_ERR_OPERATIONS_ERROR;
1362 }
1363 if (!convert_string_talloc_convenience(io->ac,
1364 lp_iconv_convenience(ldb_get_opaque(ldb, "loadparm")),
1365 CH_UTF16MUNGED, CH_UTF8,
1366 g->cleartext_utf16->data,
1367 g->cleartext_utf16->length,
1368 (void *)&cleartext_utf8_str,
1369 &converted_pw_len, false)) {
1370 /* We can't bail out entirely, as these unconvertable passwords are frustratingly valid */
1371 talloc_free(cleartext_utf8_blob);
1372 } else {
1373 *cleartext_utf8_blob = data_blob_const(cleartext_utf8_str,
1374 converted_pw_len);
1375 g->cleartext_utf8 = cleartext_utf8_blob;
1376 }
1377 }
1378
1379 if (g->cleartext_utf16) {
1380 struct samr_Password *nt_hash;
1381
1382 nt_hash = talloc(io->ac, struct samr_Password);
1383 if (!nt_hash) {
1384 ldb_oom(ldb);
1385 return LDB_ERR_OPERATIONS_ERROR;
1386 }
1387 g->nt_hash = nt_hash;
1388
1389 /* compute the new nt hash */
1390 mdfour(nt_hash->hash,
1391 g->cleartext_utf16->data,
1392 g->cleartext_utf16->length);
1393 }
1394
1395 if (g->cleartext_utf8 &&
1396 lp_lanman_auth(ldb_get_opaque(ldb, "loadparm"))) {
1397 struct samr_Password *lm_hash;
1398
1399 lm_hash = talloc(io->ac, struct samr_Password);
1400 if (!lm_hash) {
1401 ldb_oom(ldb);
1402 return LDB_ERR_OPERATIONS_ERROR;
1403 }
1404
1405 /* compute the new lm hash */
1406 ok = E_deshash((char *)g->cleartext_utf8->data, lm_hash->hash);
1407 if (ok) {
1408 g->lm_hash = lm_hash;
1409 } else {
1410 talloc_free(lm_hash);
1411 }
1412 }
1413
1414 return LDB_SUCCESS;
1415 }
1416
1417 static int setup_password_fields(struct setup_password_fields_io *io)
1418 {
1419 struct ldb_context *ldb;
1420 int ret;
1421
1422 ldb = ldb_module_get_ctx(io->ac->module);
1423
1424 /* transform the old password (for password changes) */
1425 ret = setup_given_passwords(io, &io->og);
1426 if (ret != LDB_SUCCESS) {
1427 return ret;
1428 }
1429
1430 /* transform the new password */
1431 ret = setup_given_passwords(io, &io->n);
1432 if (ret != LDB_SUCCESS) {
1433 return ret;
1434 }
1435
1436 if (io->n.cleartext_utf8) {
1437 ret = setup_kerberos_keys(io);
1438 if (ret != LDB_SUCCESS) {
1439 return ret;
1440 }
1441 }
1442
1443 ret = setup_nt_fields(io);
1444 if (ret != LDB_SUCCESS) {
1445 return ret;
1446 }
1447
1448 ret = setup_lm_fields(io);
1449 if (ret != LDB_SUCCESS) {
1450 return ret;
1451 }
1452
1453 ret = setup_supplemental_field(io);
1454 if (ret != LDB_SUCCESS) {
1455 return ret;
1456 }
1457
1458 ret = setup_last_set_field(io);
1459 if (ret != LDB_SUCCESS) {
1460 return ret;
1461 }
1462
1463 return LDB_SUCCESS;
1464 }
1465
1466 static int check_password_restrictions(struct setup_password_fields_io *io)
1467 {
1468 struct ldb_context *ldb;
1469 int ret;
1470 enum samr_ValidationStatus stat;
1471
1472 ldb = ldb_module_get_ctx(io->ac->module);
1473
1474 /* First check the old password is correct, for password changes */
1475 if (!io->ac->pwd_reset && !io->ac->change_old_pw_checked) {
1476 /* we need to old nt or lm hash given by the client */
1477 if (!io->og.nt_hash && !io->og.lm_hash) {
1478 ldb_asprintf_errstring(ldb,
1479 "check_password_restrictions: "
1480 "You need to provide the old password "
1481 "in order to change your password!");
1482 return LDB_ERR_UNWILLING_TO_PERFORM;
1483 }
1484
1485 if (io->og.nt_hash) {
1486 if (!io->o.nt_hash) {
1487 ldb_asprintf_errstring(ldb,
1488 "check_password_restrictions: "
1489 "There's no old nt_hash, which is needed "
1490 "in order to change your password!");
1491 return LDB_ERR_UNWILLING_TO_PERFORM;
1492 }
1493
1494 /* The password modify through the NT hash is encouraged
1495 and has no problems at all */
1496 if (memcmp(io->og.nt_hash->hash, io->o.nt_hash->hash, 16) != 0) {
1497 ldb_asprintf_errstring(ldb,
1498 "check_password_restrictions: "
1499 "The old password specified doesn't match!");
1500 return LDB_ERR_UNWILLING_TO_PERFORM;
1501 }
1502 } else if (io->og.lm_hash) {
1503 struct loadparm_context *lp_ctx =
1504 (struct loadparm_context *)ldb_get_opaque(ldb, "loadparm");
1505
1506 if (!lp_lanman_auth(lp_ctx)) {
1507 ldb_asprintf_errstring(ldb,
1508 "check_password_restrictions: "
1509 "The password change through the LM hash is deactivated!");
1510 return LDB_ERR_UNWILLING_TO_PERFORM;
1511 }
1512
1513 if (!io->o.lm_hash) {
1514 ldb_asprintf_errstring(ldb,
1515 "check_password_restrictions: "
1516 "There's no old lm_hash, which is needed "
1517 "in order to change your password!");
1518 return LDB_ERR_UNWILLING_TO_PERFORM;
1519 }
1520
1521 if (memcmp(io->og.lm_hash->hash, io->o.lm_hash->hash, 16) != 0) {
1522 ldb_asprintf_errstring(ldb,
1523 "check_password_restrictions: "
1524 "The old password specified doesn't match!");
1525 return LDB_ERR_UNWILLING_TO_PERFORM;
1526 }
1527 }
1528 }
1529
1530 if (io->u.restrictions == 0) {
1531 /* FIXME: Is this right? */
1532 return LDB_SUCCESS;
1533 }
1534
1535 /*
1536 * Fundamental password checks done by the call
1537 * "samdb_check_password".
1538 * It is also in use by "dcesrv_samr_ValidatePassword".
1539 */
1540 if (io->n.cleartext_utf8 != NULL) {
1541 stat = samdb_check_password(io->n.cleartext_utf8,
1542 io->ac->status->domain_data.pwdProperties,
1543 io->ac->status->domain_data.minPwdLength);
1544 switch (stat) {
1545 case SAMR_VALIDATION_STATUS_SUCCESS:
1546 /* perfect -> proceed! */
1547 break;
1548
1549 case SAMR_VALIDATION_STATUS_PWD_TOO_SHORT:
1550 ldb_asprintf_errstring(ldb,
1551 "check_password_restrictions: "
1552 "the password is too short. It should be equal or longer than %i characters!",
1553 io->ac->status->domain_data.minPwdLength);
1554
1555 io->ac->status->reject_reason = SAM_PWD_CHANGE_PASSWORD_TOO_SHORT;
1556 return LDB_ERR_CONSTRAINT_VIOLATION;
1557
1558 case SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH:
1559 ldb_asprintf_errstring(ldb,
1560 "check_password_restrictions: "
1561 "the password does not meet the complexity criterias!");
1562 io->ac->status->reject_reason = SAM_PWD_CHANGE_NOT_COMPLEX;
1563
1564 return LDB_ERR_CONSTRAINT_VIOLATION;
1565
1566 default:
1567 ldb_asprintf_errstring(ldb,
1568 "check_password_restrictions: "
1569 "the password doesn't fit by a certain reason!");
1570
1571 return LDB_ERR_CONSTRAINT_VIOLATION;
1572 }
1573 }
1574
1575 if (io->ac->pwd_reset) {
1576 return LDB_SUCCESS;
1577 }
1578
1579 if (io->n.nt_hash) {
1580 uint32_t i;
1581
1582 /* checks the NT hash password history */
1583 for (i = 0; i < io->o.nt_history_len; i++) {
1584 ret = memcmp(io->n.nt_hash, io->o.nt_history[i].hash, 16);
1585 if (ret == 0) {
1586 ldb_asprintf_errstring(ldb,
1587 "check_password_restrictions: "
1588 "the password was already used (in history)!");
1589
1590 io->ac->status->reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1591
1592 return LDB_ERR_CONSTRAINT_VIOLATION;
1593 }
1594 }
1595 }
1596
1597 if (io->n.lm_hash) {
1598 uint32_t i;
1599
1600 /* checks the LM hash password history */
1601 for (i = 0; i < io->o.lm_history_len; i++) {
1602 ret = memcmp(io->n.nt_hash, io->o.lm_history[i].hash, 16);
1603 if (ret == 0) {
1604 ldb_asprintf_errstring(ldb,
1605 "check_password_restrictions: "
1606 "the password was already used (in history)!");
1607
1608 io->ac->status->reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1609
1610 return LDB_ERR_CONSTRAINT_VIOLATION;
1611 }
1612 }
1613 }
1614
1615 /* are all password changes disallowed? */
1616 if (io->ac->status->domain_data.pwdProperties & DOMAIN_REFUSE_PASSWORD_CHANGE) {
1617 ldb_asprintf_errstring(ldb,
1618 "check_password_restrictions: "
1619 "password changes disabled!");
1620 return LDB_ERR_CONSTRAINT_VIOLATION;
1621 }
1622
1623 /* can this user change the password? */
1624 if (io->u.userAccountControl & UF_PASSWD_CANT_CHANGE) {
1625 ldb_asprintf_errstring(ldb,
1626 "check_password_restrictions: "
1627 "password can't be changed on this account!");
1628 return LDB_ERR_CONSTRAINT_VIOLATION;
1629 }
1630
1631 /* Password minimum age: yes, this is a minus. The ages are in negative 100nsec units! */
1632 if (io->u.pwdLastSet - io->ac->status->domain_data.minPwdAge > io->g.last_set) {
1633 ldb_asprintf_errstring(ldb,
1634 "check_password_restrictions: "
1635 "password is too young to change!");
1636 return LDB_ERR_CONSTRAINT_VIOLATION;
1637 }
1638
1639 return LDB_SUCCESS;
1640 }
1641
1642 static int setup_io(struct ph_context *ac,
1643 const struct ldb_message *orig_msg,
1644 const struct ldb_message *searched_msg,
1645 struct setup_password_fields_io *io)
1646 {
1647 const struct ldb_val *quoted_utf16, *old_quoted_utf16, *lm_hash, *old_lm_hash;
1648 struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
1649 int ret;
1650
1651 ZERO_STRUCTP(io);
1652
1653 /* Some operations below require kerberos contexts */
1654
1655 if (smb_krb5_init_context(ac,
1656 ldb_get_event_context(ldb),
1657 (struct loadparm_context *)ldb_get_opaque(ldb, "loadparm"),
1658 &io->smb_krb5_context) != 0) {
1659 return LDB_ERR_OPERATIONS_ERROR;
1660 }
1661
1662 io->ac = ac;
1663
1664 io->u.userAccountControl = samdb_result_uint(searched_msg, "userAccountControl", 0);
1665 io->u.pwdLastSet = samdb_result_nttime(searched_msg, "pwdLastSet", 0);
1666 io->u.sAMAccountName = samdb_result_string(searched_msg, "sAMAccountName", NULL);
1667 io->u.user_principal_name = samdb_result_string(searched_msg, "userPrincipalName", NULL);
1668 io->u.is_computer = ldb_msg_check_string_attribute(searched_msg, "objectClass", "computer");
1669
1670 if (io->u.sAMAccountName == NULL) {
1671 ldb_asprintf_errstring(ldb,
1672 "setup_io: sAMAccountName attribute is missing on %s for attempted password set/change",
1673 ldb_dn_get_linearized(searched_msg->dn));
1674
1675 return LDB_ERR_CONSTRAINT_VIOLATION;
1676 }
1677
1678 /* FIXME: fix to don't break provision */
1679 io->ac->hash_values = true;
1680
1681 /* Only non-trust accounts have restrictions (possibly this test is the
1682 * wrong way around, but we like to be restrictive if possible */
1683 io->u.restrictions = !(io->u.userAccountControl
1684 & (UF_INTERDOMAIN_TRUST_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT
1685 | UF_SERVER_TRUST_ACCOUNT));
1686
1687 if ((io->u.userAccountControl & UF_PASSWD_NOTREQD) != 0) {
1688 /* see [MS-ADTS] 2.2.15 */
1689 io->u.restrictions = 0;
1690 }
1691
1692 ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, "userPassword",
1693 &io->n.cleartext_utf8, &io->og.cleartext_utf8);
1694 if (ret != LDB_SUCCESS) {
1695 ldb_asprintf_errstring(ldb,
1696 "setup_io: "
1697 "it's only allowed to set the old password once!");
1698 return ret;
1699 }
1700
1701 ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, "clearTextPassword",
1702 &io->n.cleartext_utf16, &io->og.cleartext_utf16);
1703 if (ret != LDB_SUCCESS) {
1704 ldb_asprintf_errstring(ldb,
1705 "setup_io: "
1706 "it's only allowed to set the old password once!");
1707 return ret;
1708 }
1709
1710 /* this rather strange looking piece of code is there to
1711 handle a ldap client setting a password remotely using the
1712 unicodePwd ldap field. The syntax is that the password is
1713 in UTF-16LE, with a " at either end. Unfortunately the
1714 unicodePwd field is also used to store the nt hashes
1715 internally in Samba, and is used in the nt hash format on
1716 the wire in DRS replication, so we have a single name for
1717 two distinct values. The code below leaves us with a small
1718 chance (less than 1 in 2^32) of a mixup, if someone manages
1719 to create a MD4 hash which starts and ends in 0x22 0x00, as
1720 that would then be treated as a UTF16 password rather than
1721 a nthash */
1722
1723 ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, "unicodePwd",
1724 &quoted_utf16, &old_quoted_utf16);
1725 if (ret != LDB_SUCCESS) {
1726 ldb_asprintf_errstring(ldb,
1727 "setup_io: "
1728 "it's only allowed to set the old password once!");
1729 return ret;
1730 }
1731
1732 /* Checks and converts the actual "unicodePwd" attribute */
1733 if (quoted_utf16 &&
1734 quoted_utf16->length >= 4 &&
1735 quoted_utf16->data[0] == '"' &&
1736 quoted_utf16->data[1] == 0 &&
1737 quoted_utf16->data[quoted_utf16->length-2] == '"' &&
1738 quoted_utf16->data[quoted_utf16->length-1] == 0) {
1739 struct ldb_val *quoted_utf16_2;
1740
1741 if (io->n.cleartext_utf16) {
1742 /* refuse the change if someone wants to change with
1743 with both UTF16 possibilities at the same time... */
1744 ldb_asprintf_errstring(ldb,
1745 "setup_io: "
1746 "it's only allowed to set the cleartext password as 'unicodePwd' or as 'clearTextPassword'");
1747 return LDB_ERR_UNWILLING_TO_PERFORM;
1748 }
1749
1750 /*
1751 * adapt the quoted UTF16 string to be a real
1752 * cleartext one
1753 */
1754 quoted_utf16_2 = talloc(io->ac, struct ldb_val);
1755 if (quoted_utf16_2 == NULL) {
1756 ldb_oom(ldb);
1757 return LDB_ERR_OPERATIONS_ERROR;
1758 }
1759
1760 quoted_utf16_2->data = quoted_utf16->data + 2;
1761 quoted_utf16_2->length = quoted_utf16->length-4;
1762 io->n.cleartext_utf16 = quoted_utf16_2;
1763 io->n.nt_hash = NULL;
1764
1765 } else {
1766 /* We have only the hash available -> so no plaintext here */
1767 if (!ac->hash_values) {
1768 /* refuse the change if someone wants to change
1769 the hash without control specified... */
1770 ldb_asprintf_errstring(ldb,
1771 "setup_io: "
1772 "it's not allowed to set the NT hash password directly'");
1773 /* this looks odd but this is what Windows does:
1774 returns "UNWILLING_TO_PERFORM" on wrong
1775 password sets and "CONSTRAINT_VIOLATION" on
1776 wrong password changes. */
1777 if (old_quoted_utf16 == NULL) {
1778 return LDB_ERR_UNWILLING_TO_PERFORM;
1779 }
1780
1781 return LDB_ERR_CONSTRAINT_VIOLATION;
1782 }
1783
1784 if (quoted_utf16 != NULL) {
1785 io->n.nt_hash = talloc(io->ac, struct samr_Password);
1786 memcpy(io->n.nt_hash->hash, quoted_utf16->data,
1787 MIN(quoted_utf16->length, sizeof(io->n.nt_hash->hash)));
1788 }
1789 }
1790
1791 /* Checks and converts the previous "unicodePwd" attribute */
1792 if (old_quoted_utf16 &&
1793 old_quoted_utf16->length >= 4 &&
1794 old_quoted_utf16->data[0] == '"' &&
1795 old_quoted_utf16->data[1] == 0 &&
1796 old_quoted_utf16->data[old_quoted_utf16->length-2] == '"' &&
1797 old_quoted_utf16->data[old_quoted_utf16->length-1] == 0) {
1798 struct ldb_val *old_quoted_utf16_2;
1799
1800 if (io->og.cleartext_utf16) {
1801 /* refuse the change if someone wants to change with
1802 both UTF16 possibilities at the same time... */
1803 ldb_asprintf_errstring(ldb,
1804 "setup_io: "
1805 "it's only allowed to set the cleartext password as 'unicodePwd' or as 'clearTextPassword'");
1806 return LDB_ERR_UNWILLING_TO_PERFORM;
1807 }
1808
1809 /*
1810 * adapt the quoted UTF16 string to be a real
1811 * cleartext one
1812 */
1813 old_quoted_utf16_2 = talloc(io->ac, struct ldb_val);
1814 if (old_quoted_utf16_2 == NULL) {
1815 ldb_oom(ldb);
1816 return LDB_ERR_OPERATIONS_ERROR;
1817 }
1818
1819 old_quoted_utf16_2->data = old_quoted_utf16->data + 2;
1820 old_quoted_utf16_2->length = old_quoted_utf16->length-4;
1821
1822 io->og.cleartext_utf16 = old_quoted_utf16_2;
1823 io->og.nt_hash = NULL;
1824 } else {
1825 /* We have only the hash available -> so no plaintext here */
1826 if (!ac->hash_values) {
1827 /* refuse the change if someone wants to change
1828 the hash without control specified... */
1829 ldb_asprintf_errstring(ldb,
1830 "setup_io: "
1831 "it's not allowed to set the NT hash password directly'");
1832 return LDB_ERR_UNWILLING_TO_PERFORM;
1833 }
1834
1835 if (old_quoted_utf16 != NULL) {
1836 io->og.nt_hash = talloc(io->ac, struct samr_Password);
1837 memcpy(io->og.nt_hash->hash, old_quoted_utf16->data,
1838 MIN(old_quoted_utf16->length, sizeof(io->og.nt_hash->hash)));
1839 }
1840 }
1841
1842 /* Handles the "dBCSPwd" attribute (LM hash) */
1843 io->n.lm_hash = NULL; io->og.lm_hash = NULL;
1844 ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, "dBCSPwd",
1845 &lm_hash, &old_lm_hash);
1846 if (ret != LDB_SUCCESS) {
1847 ldb_asprintf_errstring(ldb,
1848 "setup_io: "
1849 "it's only allowed to set the old password once!");
1850 return ret;
1851 }
1852
1853 if (((lm_hash != NULL) || (old_lm_hash != NULL)) && (!ac->hash_values)) {
1854 /* refuse the change if someone wants to change the hash
1855 without control specified... */
1856 ldb_asprintf_errstring(ldb,
1857 "setup_io: "
1858 "it's not allowed to set the LM hash password directly'");
1859 return LDB_ERR_UNWILLING_TO_PERFORM;
1860 }
1861 if (lm_hash != NULL) {
1862 io->n.lm_hash = talloc(io->ac, struct samr_Password);
1863 memcpy(io->n.lm_hash->hash, lm_hash->data, MIN(lm_hash->length,
1864 sizeof(io->n.lm_hash->hash)));
1865 }
1866
1867 if (old_lm_hash != NULL) {
1868 io->og.lm_hash = talloc(io->ac, struct samr_Password);
1869 memcpy(io->og.lm_hash->hash, old_lm_hash->data, MIN(old_lm_hash->length,
1870 sizeof(io->og.lm_hash->hash)));
1871 }
1872
1873 /* refuse the change if someone wants to change the clear-
1874 text and supply his own hashes at the same time... */
1875 if ((io->n.cleartext_utf8 || io->n.cleartext_utf16)
1876 && (io->n.nt_hash || io->n.lm_hash)) {
1877 ldb_asprintf_errstring(ldb,
1878 "setup_io: "
1879 "it's only allowed to set the password in form of cleartext attributes or as hashes");
1880 return LDB_ERR_UNWILLING_TO_PERFORM;
1881 }
1882
1883 /* refuse the change if someone wants to change the password
1884 using both plaintext methods (UTF8 and UTF16) at the same time... */
1885 if (io->n.cleartext_utf8 && io->n.cleartext_utf16) {
1886 ldb_asprintf_errstring(ldb,
1887 "setup_io: "
1888 "it's only allowed to set the cleartext password as 'unicodePwd' or as 'userPassword' or as 'clearTextPassword'");
1889 return LDB_ERR_UNWILLING_TO_PERFORM;
1890 }
1891
1892 /* refuse the change if someone wants to compare against a plaintext
1893 or hash at the same time for a "password modify" operation... */
1894 if ((io->og.cleartext_utf8 || io->og.cleartext_utf16)
1895 && (io->og.nt_hash || io->og.lm_hash)) {
1896 ldb_asprintf_errstring(ldb,
1897 "setup_io: "
1898 "it's only allowed to provide the old password in form of cleartext attributes or as hashes");
1899 return LDB_ERR_UNWILLING_TO_PERFORM;
1900 }
1901
1902 /* refuse the change if someone wants to compare against both
1903 * plaintexts at the same time for a "password modify" operation... */
1904 if (io->og.cleartext_utf8 && io->og.cleartext_utf16) {
1905 ldb_asprintf_errstring(ldb,
1906 "setup_io: "
1907 "it's only allowed to provide the old cleartext password as 'unicodePwd' or as 'userPassword' or as 'clearTextPassword'");
1908 return LDB_ERR_UNWILLING_TO_PERFORM;
1909 }
1910
1911 /* refuse the change if someone wants to compare against both
1912 * hashes at the same time for a "password modify" operation... */
1913 if (io->og.nt_hash && io->og.lm_hash) {
1914 ldb_asprintf_errstring(ldb,
1915 "setup_io: "
1916 "it's only allowed to provide the old password in hash format as 'unicodePwd' or as 'dBCSPwd'");
1917 return LDB_ERR_UNWILLING_TO_PERFORM;
1918 }
1919
1920 /* Decides if we have a password modify or password reset operation */
1921 if (ac->req->operation == LDB_ADD) {
1922 /* On "add" we have only "password reset" */
1923 ac->pwd_reset = true;
1924 } else if (ac->req->operation == LDB_MODIFY) {
1925 if (io->og.cleartext_utf8 || io->og.cleartext_utf16
1926 || io->og.nt_hash || io->og.lm_hash
1927 || ac->change_old_pw_checked) {
1928 /* If we have an old password or the "change old
1929 * password checked" control specified then for sure it
1930 * is a user "password change" */
1931 ac->pwd_reset = false;
1932 } else {
1933 /* Otherwise we have also here a "password reset" */
1934 ac->pwd_reset = true;
1935 }
1936 } else {
1937 /* this shouldn't happen */
1938 return LDB_ERR_OPERATIONS_ERROR;
1939 }
1940
1941 return LDB_SUCCESS;
1942 }
1943
1944 static struct ph_context *ph_init_context(struct ldb_module *module,
1945 struct ldb_request *req)
1946 {
1947 struct ldb_context *ldb;
1948 struct ph_context *ac;
1949
1950 ldb = ldb_module_get_ctx(module);
1951
1952 ac = talloc_zero(req, struct ph_context);
1953 if (ac == NULL) {
1954 ldb_set_errstring(ldb, "Out of Memory");
1955 return NULL;
1956 }
1957
1958 ac->module = module;
1959 ac->req = req;
1960
1961 return ac;
1962 }
1963
1964 static void ph_apply_controls(struct ph_context *ac)
1965 {
1966 struct ldb_control *ctrl;
1967
1968 ac->change_status = false;
1969 ctrl = ldb_request_get_control(ac->req,
1970 DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID);
1971 if (ctrl != NULL) {
1972 ac->change_status = true;
1973
1974 /* Mark the "change status" control as uncritical (done) */
1975 ctrl->critical = false;
1976 }
1977
1978 ac->hash_values = false;
1979 ctrl = ldb_request_get_control(ac->req,
1980 DSDB_CONTROL_PASSWORD_HASH_VALUES_OID);
1981 if (ctrl != NULL) {
1982 ac->hash_values = true;
1983
1984 /* Mark the "hash values" control as uncritical (done) */
1985 ctrl->critical = false;
1986 }
1987
1988 ac->change_old_pw_checked = false;
1989 ctrl = ldb_request_get_control(ac->req,
1990 DSDB_CONTROL_PASSWORD_CHANGE_OLD_PW_CHECKED_OID);
1991 if (ctrl != NULL) {
1992 ac->change_old_pw_checked = true;
1993
1994 /* Mark the "change old password checked" control as uncritical
1995 * (done) */
1996 ctrl->critical = false;
1997 }
1998 }
1999
2000 static int ph_op_callback(struct ldb_request *req, struct ldb_reply *ares)
2001 {
2002 struct ph_context *ac;
2003
2004 ac = talloc_get_type(req->context, struct ph_context);
2005
2006 if (!ares) {
2007 return ldb_module_done(ac->req, NULL, NULL,
2008 LDB_ERR_OPERATIONS_ERROR);
2009 }
2010
2011 if (ares->type == LDB_REPLY_REFERRAL) {
2012 return ldb_module_send_referral(ac->req, ares->referral);
2013 }
2014
2015 if ((ares->error != LDB_ERR_OPERATIONS_ERROR) && (ac->change_status)) {
2016 /* On success and trivial errors a status control is being
2017 * added (used for example by the "samdb_set_password" call) */
2018 ldb_reply_add_control(ares,
2019 DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID,
2020 false,
2021 ac->status);
2022 }
2023
2024 if (ares->error != LDB_SUCCESS) {
2025 return ldb_module_done(ac->req, ares->controls,
2026 ares->response, ares->error);
2027 }
2028
2029 if (ares->type != LDB_REPLY_DONE) {
2030 talloc_free(ares);
2031 return ldb_module_done(ac->req, NULL, NULL,
2032 LDB_ERR_OPERATIONS_ERROR);
2033 }
2034
2035 return ldb_module_done(ac->req, ares->controls,
2036 ares->response, ares->error);
2037 }
2038
2039 static int password_hash_add_do_add(struct ph_context *ac);
2040 static int ph_modify_callback(struct ldb_request *req, struct ldb_reply *ares);
2041 static int password_hash_mod_search_self(struct ph_context *ac);
2042 static int ph_mod_search_callback(struct ldb_request *req, struct ldb_reply *ares);
2043 static int password_hash_mod_do_mod(struct ph_context *ac);
2044
2045 static int get_domain_data_callback(struct ldb_request *req,
2046 struct ldb_reply *ares)
2047 {
2048 struct ldb_context *ldb;
2049 struct ph_context *ac;
2050 struct loadparm_context *lp_ctx;
2051 int ret;
2052
2053 ac = talloc_get_type(req->context, struct ph_context);
2054 ldb = ldb_module_get_ctx(ac->module);
2055
2056 if (!ares) {
2057 ret = LDB_ERR_OPERATIONS_ERROR;
2058 goto done;
2059 }
2060 if (ares->error != LDB_SUCCESS) {
2061 return ldb_module_done(ac->req, ares->controls,
2062 ares->response, ares->error);
2063 }
2064
2065 switch (ares->type) {
2066 case LDB_REPLY_ENTRY:
2067 if (ac->status != NULL) {
2068 talloc_free(ares);
2069
2070 ldb_set_errstring(ldb, "Too many results");
2071 ret = LDB_ERR_OPERATIONS_ERROR;
2072 goto done;
2073 }
2074
2075 /* Setup the "status" structure (used as control later) */
2076 ac->status = talloc_zero(ac->req,
2077 struct dsdb_control_password_change_status);
2078 if (ac->status == NULL) {
2079 talloc_free(ares);
2080
2081 ldb_oom(ldb);
2082 ret = LDB_ERR_OPERATIONS_ERROR;
2083 goto done;
2084 }
2085
2086 /* Setup the "domain data" structure */
2087 ac->status->domain_data.pwdProperties = samdb_result_uint(ares->message, "pwdProperties", -1);
2088 ac->status->domain_data.pwdHistoryLength = samdb_result_uint(ares->message, "pwdHistoryLength", -1);
2089 ac->status->domain_data.maxPwdAge = samdb_result_int64(ares->message, "maxPwdAge", -1);
2090 ac->status->domain_data.minPwdAge = samdb_result_int64(ares->message, "minPwdAge", -1);
2091 ac->status->domain_data.minPwdLength = samdb_result_uint(ares->message, "minPwdLength", -1);
2092 ac->status->domain_data.store_cleartext =
2093 ac->status->domain_data.pwdProperties & DOMAIN_PASSWORD_STORE_CLEARTEXT;
2094
2095 talloc_free(ares);
2096
2097 /* For a domain DN, this puts things in dotted notation */
2098 /* For builtin domains, this will give details for the host,
2099 * but that doesn't really matter, as it's just used for salt
2100 * and kerberos principals, which don't exist here */
2101
2102 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
2103 struct loadparm_context);
2104
2105 ac->status->domain_data.dns_domain = lp_dnsdomain(lp_ctx);
2106 ac->status->domain_data.realm = lp_realm(lp_ctx);
2107 ac->status->domain_data.netbios_domain = lp_sam_name(lp_ctx);
2108
2109 ac->status->reject_reason = SAM_PWD_CHANGE_NO_ERROR;
2110
2111 ret = LDB_SUCCESS;
2112 break;
2113
2114 case LDB_REPLY_REFERRAL:
2115 /* ignore */
2116 talloc_free(ares);
2117 ret = LDB_SUCCESS;
2118 break;
2119
2120 case LDB_REPLY_DONE:
2121 talloc_free(ares);
2122 /* call the next step */
2123 switch (ac->req->operation) {
2124 case LDB_ADD:
2125 ret = password_hash_add_do_add(ac);
2126 break;
2127
2128 case LDB_MODIFY:
2129 ret = password_hash_mod_do_mod(ac);
2130 break;
2131
2132 default:
2133 ret = LDB_ERR_OPERATIONS_ERROR;
2134 break;
2135 }
2136 break;
2137 }
2138
2139 done:
2140 if (ret != LDB_SUCCESS) {
2141 struct ldb_reply *new_ares;
2142
2143 new_ares = talloc_zero(ac->req, struct ldb_reply);
2144 if (new_ares == NULL) {
2145 ldb_oom(ldb);
2146 return ldb_module_done(ac->req, NULL, NULL,
2147 LDB_ERR_OPERATIONS_ERROR);
2148 }
2149
2150 new_ares->error = ret;
2151 if ((ret != LDB_ERR_OPERATIONS_ERROR) && (ac->change_status)) {
2152 /* On success and trivial errors a status control is being
2153 * added (used for example by the "samdb_set_password" call) */
2154 ldb_reply_add_control(new_ares,
2155 DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID,
2156 false,
2157 ac->status);
2158 }
2159
2160 return ldb_module_done(ac->req, new_ares->controls,
2161 new_ares->response, new_ares->error);
2162 }
2163
2164 return LDB_SUCCESS;
2165 }
2166
2167 static int build_domain_data_request(struct ph_context *ac)
2168 {
2169 /* attrs[] is returned from this function in
2170 ac->dom_req->op.search.attrs, so it must be static, as
2171 otherwise the compiler can put it on the stack */
2172 struct ldb_context *ldb;
2173 static const char * const attrs[] = { "pwdProperties",
2174 "pwdHistoryLength",
2175 "maxPwdAge",
2176 "minPwdAge",
2177 "minPwdLength",
2178 NULL };
2179
2180 ldb = ldb_module_get_ctx(ac->module);
2181
2182 return ldb_build_search_req(&ac->dom_req, ldb, ac,
2183 ldb_get_default_basedn(ldb),
2184 LDB_SCOPE_BASE,
2185 NULL, attrs,
2186 NULL,
2187 ac, get_domain_data_callback,
2188 ac->req);
2189 }
2190
2191 static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
2192 {
2193 struct ldb_context *ldb;
2194 struct ph_context *ac;
2195 struct ldb_message_element *userPasswordAttr, *clearTextPasswordAttr,
2196 *ntAttr, *lmAttr;
2197 int ret;
2198
2199 ldb = ldb_module_get_ctx(module);
2200
2201 ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_add\n");
2202
2203 if (ldb_dn_is_special(req->op.add.message->dn)) { /* do not manipulate our control entries */
2204 return ldb_next_request(module, req);
2205 }
2206
2207 /* If the caller is manipulating the local passwords directly, let them pass */
2208 if (ldb_dn_compare_base(ldb_dn_new(req, ldb, LOCAL_BASE),
2209 req->op.add.message->dn) == 0) {
2210 return ldb_next_request(module, req);
2211 }
2212
2213 /* nobody must touch password histories and 'supplementalCredentials' */
2214 if (ldb_msg_find_element(req->op.add.message, "ntPwdHistory")) {
2215 return LDB_ERR_UNWILLING_TO_PERFORM;
2216 }
2217 if (ldb_msg_find_element(req->op.add.message, "lmPwdHistory")) {
2218 return LDB_ERR_UNWILLING_TO_PERFORM;
2219 }
2220 if (ldb_msg_find_element(req->op.add.message, "supplementalCredentials")) {
2221 return LDB_ERR_UNWILLING_TO_PERFORM;
2222 }
2223
2224 /* If no part of this touches the 'userPassword' OR 'clearTextPassword'
2225 * OR 'unicodePwd' OR 'dBCSPwd' we don't need to make any changes. */
2226
2227 userPasswordAttr = ldb_msg_find_element(req->op.add.message, "userPassword");
2228 clearTextPasswordAttr = ldb_msg_find_element(req->op.add.message, "clearTextPassword");
2229 ntAttr = ldb_msg_find_element(req->op.add.message, "unicodePwd");
2230 lmAttr = ldb_msg_find_element(req->op.add.message, "dBCSPwd");
2231
2232 if ((!userPasswordAttr) && (!clearTextPasswordAttr) && (!ntAttr) && (!lmAttr)) {
2233 return ldb_next_request(module, req);
2234 }
2235
2236 /* Make sure we are performing the password set action on a (for us)
2237 * valid object. Those are instances of either "user" and/or
2238 * "inetOrgPerson". Otherwise continue with the submodules. */
2239 if ((!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "user"))
2240 && (!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "inetOrgPerson"))) {
2241
2242 if (ldb_msg_find_element(req->op.add.message, "clearTextPassword") != NULL) {
2243 ldb_set_errstring(ldb,
2244 "'clearTextPassword' is only allowed on objects of class 'user' and/or 'inetOrgPerson'!");
2245 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2246 }
2247
2248 return ldb_next_request(module, req);
2249 }
2250
2251 ac = ph_init_context(module, req);
2252 if (ac == NULL) {
2253 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
2254 return LDB_ERR_OPERATIONS_ERROR;
2255 }
2256 ph_apply_controls(ac);
2257
2258 /* get user domain data */
2259 ret = build_domain_data_request(ac);
2260 if (ret != LDB_SUCCESS) {
2261 return ret;
2262 }
2263
2264 return ldb_next_request(module, ac->dom_req);
2265 }
2266
2267 static int password_hash_add_do_add(struct ph_context *ac)
2268 {
2269 struct ldb_context *ldb;
2270 struct ldb_request *down_req;
2271 struct ldb_message *msg;
2272 struct setup_password_fields_io io;
2273 int ret;
2274
2275 /* Prepare the internal data structure containing the passwords */
2276 ret = setup_io(ac, ac->req->op.add.message, ac->req->op.add.message, &io);
2277 if (ret != LDB_SUCCESS) {
2278 return ret;
2279 }
2280
2281 msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
2282 if (msg == NULL) {
2283 return LDB_ERR_OPERATIONS_ERROR;
2284 }
2285
2286 /* remove attributes that we just read into 'io' (handle also superfluous
2287 * "password modify" trials - multiple attributes with the same name -
2288 * on add operations) */
2289 while (ldb_msg_find_element(msg, "userPassword") != NULL) {
2290 ldb_msg_remove_attr(msg, "userPassword");
2291 }
2292 while (ldb_msg_find_element(msg, "clearTextPassword") != NULL) {
2293 ldb_msg_remove_attr(msg, "clearTextPassword");
2294 }
2295 while (ldb_msg_find_element(msg, "unicodePwd") != NULL) {
2296 ldb_msg_remove_attr(msg, "unicodePwd");
2297 }
2298 while (ldb_msg_find_element(msg, "dBCSPwd") != NULL) {
2299 ldb_msg_remove_attr(msg, "dBCSPwd");
2300 }
2301
2302 ldb_msg_remove_attr(msg, "pwdLastSet");
2303
2304 ldb = ldb_module_get_ctx(ac->module);
2305
2306 ret = setup_password_fields(&io);
2307 if (ret != LDB_SUCCESS) {
2308 return ret;
2309 }
2310
2311 ret = check_password_restrictions(&io);
2312 if (ret != LDB_SUCCESS) {
2313 return ret;
2314 }
2315
2316 if (io.g.nt_hash) {
2317 ret = samdb_msg_add_hash(ldb, ac, msg,
2318 "unicodePwd", io.g.nt_hash);
2319 if (ret != LDB_SUCCESS) {
2320 return ret;
2321 }
2322 }
2323 if (io.g.lm_hash) {
2324 ret = samdb_msg_add_hash(ldb, ac, msg,
2325 "dBCSPwd", io.g.lm_hash);
2326 if (ret != LDB_SUCCESS) {
2327 return ret;
2328 }
2329 }
2330 if (io.g.nt_history_len > 0) {
2331 ret = samdb_msg_add_hashes(ac, msg,
2332 "ntPwdHistory",
2333 io.g.nt_history,
2334 io.g.nt_history_len);
2335 if (ret != LDB_SUCCESS) {
2336 return ret;
2337 }
2338 }
2339 if (io.g.lm_history_len > 0) {
2340 ret = samdb_msg_add_hashes(ac, msg,
2341 "lmPwdHistory",
2342 io.g.lm_history,
2343 io.g.lm_history_len);
2344 if (ret != LDB_SUCCESS) {
2345 return ret;
2346 }
2347 }
2348 if (io.g.supplemental.length > 0) {
2349 ret = ldb_msg_add_value(msg, "supplementalCredentials",
2350 &io.g.supplemental, NULL);
2351 if (ret != LDB_SUCCESS) {
2352 return ret;
2353 }
2354 }
2355 ret = samdb_msg_add_uint64(ldb, ac, msg,
2356 "pwdLastSet",
2357 io.g.last_set);
2358 if (ret != LDB_SUCCESS) {
2359 return ret;
2360 }
2361
2362 ret = ldb_build_add_req(&down_req, ldb, ac,
2363 msg,
2364 ac->req->controls,
2365 ac, ph_op_callback,
2366 ac->req);
2367 if (ret != LDB_SUCCESS) {
2368 return ret;
2369 }
2370
2371 return ldb_next_request(ac->module, down_req);
2372 }
2373
2374 static int password_hash_modify(struct ldb_module *module, struct ldb_request *req)
2375 {
2376 struct ldb_context *ldb;
2377 struct ph_context *ac;
2378 const char *passwordAttrs[] = { "userPassword", "clearTextPassword",
2379 "unicodePwd", "dBCSPwd", NULL }, **l;
2380 unsigned int attr_cnt, del_attr_cnt, add_attr_cnt, rep_attr_cnt;
2381 struct ldb_message_element *passwordAttr;
2382 struct ldb_message *msg;
2383 struct ldb_request *down_req;
2384 int ret;
2385
2386 ldb = ldb_module_get_ctx(module);
2387
2388 ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_modify\n");
2389
2390 if (ldb_dn_is_special(req->op.mod.message->dn)) { /* do not manipulate our control entries */
2391 return ldb_next_request(module, req);
2392 }
2393
2394 /* If the caller is manipulating the local passwords directly, let them pass */
2395 if (ldb_dn_compare_base(ldb_dn_new(req, ldb, LOCAL_BASE),
2396 req->op.mod.message->dn) == 0) {
2397 return ldb_next_request(module, req);
2398 }
2399
2400 /* nobody must touch password histories and 'supplementalCredentials' */
2401 if (ldb_msg_find_element(req->op.mod.message, "ntPwdHistory")) {
2402 return LDB_ERR_UNWILLING_TO_PERFORM;
2403 }
2404 if (ldb_msg_find_element(req->op.mod.message, "lmPwdHistory")) {
2405 return LDB_ERR_UNWILLING_TO_PERFORM;
2406 }
2407 if (ldb_msg_find_element(req->op.mod.message, "supplementalCredentials")) {
2408 return LDB_ERR_UNWILLING_TO_PERFORM;
2409 }
2410
2411 /* If no part of this touches the 'userPassword' OR 'clearTextPassword'
2412 * OR 'unicodePwd' OR 'dBCSPwd' we don't need to make any changes.
2413 * For password changes/set there should be a 'delete' or a 'modify'
2414 * on these attributes. */
2415 attr_cnt = 0;
2416 for (l = passwordAttrs; *l != NULL; l++) {
2417 if (ldb_msg_find_element(req->op.mod.message, *l) != NULL) {
2418 ++attr_cnt;
2419 }
2420 }
2421 if (attr_cnt == 0) {
2422 return ldb_next_request(module, req);
2423 }
2424
2425 ac = ph_init_context(module, req);
2426 if (!ac) {
2427 DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
2428 return LDB_ERR_OPERATIONS_ERROR;
2429 }
2430 ph_apply_controls(ac);
2431
2432 /* use a new message structure so that we can modify it */
2433 msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
2434 if (msg == NULL) {
2435 ldb_oom(ldb);
2436 return LDB_ERR_OPERATIONS_ERROR;
2437 }
2438
2439 /* - check for single-valued password attributes
2440 * (if not return "CONSTRAINT_VIOLATION")
2441 * - check that for a password change operation one add and one delete
2442 * operation exists
2443 * (if not return "CONSTRAINT_VIOLATION" or "UNWILLING_TO_PERFORM")
2444 * - check that a password change and a password set operation cannot
2445 * be mixed
2446 * (if not return "UNWILLING_TO_PERFORM")
2447 * - remove all password attributes modifications from the first change
2448 * operation (anything without the passwords) - we will make the real
2449 * modification later */
2450 del_attr_cnt = 0;
2451 add_attr_cnt = 0;
2452 rep_attr_cnt = 0;
2453 for (l = passwordAttrs; *l != NULL; l++) {
2454 while ((passwordAttr = ldb_msg_find_element(msg, *l)) != NULL) {
2455 if (passwordAttr->flags == LDB_FLAG_MOD_DELETE) {
2456 ++del_attr_cnt;
2457 }
2458 if (passwordAttr->flags == LDB_FLAG_MOD_ADD) {
2459 ++add_attr_cnt;
2460 }
2461 if (passwordAttr->flags == LDB_FLAG_MOD_REPLACE) {
2462 ++rep_attr_cnt;
2463 }
2464 if ((passwordAttr->num_values != 1) &&
2465 (passwordAttr->flags != LDB_FLAG_MOD_REPLACE)) {
2466 talloc_free(ac);
2467 ldb_asprintf_errstring(ldb,
2468 "'%s' attributes must have exactly one value!",
2469 *l);
2470 return LDB_ERR_CONSTRAINT_VIOLATION;
2471 }
2472 ldb_msg_remove_attr(msg, *l);
2473 }
2474 }
2475 if ((del_attr_cnt > 0) && (add_attr_cnt == 0)) {
2476 talloc_free(ac);
2477 ldb_set_errstring(ldb,
2478 "Only the delete action for a password change specified!");
2479 return LDB_ERR_CONSTRAINT_VIOLATION;
2480 }
2481 if ((del_attr_cnt == 0) && (add_attr_cnt > 0)) {
2482 talloc_free(ac);
2483 ldb_set_errstring(ldb,
2484 "Only the add action for a password change specified!");
2485 return LDB_ERR_UNWILLING_TO_PERFORM;
2486 }
2487 if ((del_attr_cnt > 1) || (add_attr_cnt > 1)) {
2488 talloc_free(ac);
2489 ldb_set_errstring(ldb,
2490 "Only one delete and one add action for a password change allowed!");
2491 return LDB_ERR_UNWILLING_TO_PERFORM;
2492 }
2493 if ((rep_attr_cnt > 0) && ((del_attr_cnt > 0) || (add_attr_cnt > 0))) {
2494 talloc_free(ac);
2495 ldb_set_errstring(ldb,
2496 "Either a password change or a password set operation is allowed!");
2497 return LDB_ERR_UNWILLING_TO_PERFORM;
2498 }
2499
2500 /* if there was nothing else to be modified skip to next step */
2501 if (msg->num_elements == 0) {
2502 return password_hash_mod_search_self(ac);
2503 }
2504
2505 ret = ldb_build_mod_req(&down_req, ldb, ac,
2506 msg,
2507 req->controls,
2508 ac, ph_modify_callback,
2509 req);
2510 if (ret != LDB_SUCCESS) {
2511 return ret;
2512 }
2513
2514 return ldb_next_request(module, down_req);
2515 }
2516
2517 static int ph_modify_callback(struct ldb_request *req, struct ldb_reply *ares)
2518 {
2519 struct ph_context *ac;
2520
2521 ac = talloc_get_type(req->context, struct ph_context);
2522
2523 if (!ares) {
2524 return ldb_module_done(ac->req, NULL, NULL,
2525 LDB_ERR_OPERATIONS_ERROR);
2526 }
2527
2528 if (ares->type == LDB_REPLY_REFERRAL) {
2529 return ldb_module_send_referral(ac->req, ares->referral);
2530 }
2531
2532 if (ares->error != LDB_SUCCESS) {
2533 return ldb_module_done(ac->req, ares->controls,
2534 ares->response, ares->error);
2535 }
2536
2537 if (ares->type != LDB_REPLY_DONE) {
2538 talloc_free(ares);
2539 return ldb_module_done(ac->req, NULL, NULL,
2540 LDB_ERR_OPERATIONS_ERROR);
2541 }
2542
2543 talloc_free(ares);
2544
2545 return password_hash_mod_search_self(ac);
2546 }
2547
2548 static int ph_mod_search_callback(struct ldb_request *req, struct ldb_reply *ares)
2549 {
2550 struct ldb_context *ldb;
2551 struct ph_context *ac;
2552 int ret;
2553
2554 ac = talloc_get_type(req->context, struct ph_context);
2555 ldb = ldb_module_get_ctx(ac->module);
2556
2557 if (!ares) {
2558 ret = LDB_ERR_OPERATIONS_ERROR;
2559 goto done;
2560 }
2561 if (ares->error != LDB_SUCCESS) {
2562 return ldb_module_done(ac->req, ares->controls,
2563 ares->response, ares->error);
2564 }
2565
2566 /* we are interested only in the single reply (base search) */
2567 switch (ares->type) {
2568 case LDB_REPLY_ENTRY:
2569 /* Make sure we are performing the password change action on a
2570 * (for us) valid object. Those are instances of either "user"
2571 * and/or "inetOrgPerson". Otherwise continue with the
2572 * submodules. */
2573 if ((!ldb_msg_check_string_attribute(ares->message, "objectClass", "user"))
2574 && (!ldb_msg_check_string_attribute(ares->message, "objectClass", "inetOrgPerson"))) {
2575 talloc_free(ares);
2576
2577 if (ldb_msg_find_element(ac->req->op.mod.message, "clearTextPassword") != NULL) {
2578 ldb_set_errstring(ldb,
2579 "'clearTextPassword' is only allowed on objects of class 'user' and/or 'inetOrgPerson'!");
2580 ret = LDB_ERR_NO_SUCH_ATTRIBUTE;
2581 goto done;
2582 }
2583
2584 ret = ldb_next_request(ac->module, ac->req);
2585 goto done;
2586 }
2587
2588 if (ac->search_res != NULL) {
2589 talloc_free(ares);
2590
2591 ldb_set_errstring(ldb, "Too many results");
2592 ret = LDB_ERR_OPERATIONS_ERROR;
2593 goto done;
2594 }
2595
2596 ac->search_res = talloc_steal(ac, ares);
2597 ret = LDB_SUCCESS;
2598 break;
2599
2600 case LDB_REPLY_REFERRAL:
2601 /* ignore anything else for now */
2602 talloc_free(ares);
2603 ret = LDB_SUCCESS;
2604 break;
2605
2606 case LDB_REPLY_DONE:
2607 talloc_free(ares);
2608
2609 /* get user domain data */
2610 ret = build_domain_data_request(ac);
2611 if (ret != LDB_SUCCESS) {
2612 return ldb_module_done(ac->req, NULL, NULL, ret);
2613 }
2614
2615 ret = ldb_next_request(ac->module, ac->dom_req);
2616 break;
2617 }
2618
2619 done:
2620 if (ret != LDB_SUCCESS) {
2621 return ldb_module_done(ac->req, NULL, NULL, ret);
2622 }
2623
2624 return LDB_SUCCESS;
2625 }
2626
2627 static int password_hash_mod_search_self(struct ph_context *ac)
2628 {
2629 struct ldb_context *ldb;
2630 static const char * const attrs[] = { "objectClass",
2631 "userAccountControl",
2632 "pwdLastSet",
2633 "sAMAccountName",
2634 "objectSid",
2635 "userPrincipalName",
2636 "supplementalCredentials",
2637 "lmPwdHistory",
2638 "ntPwdHistory",
2639 "dBCSPwd",
2640 "unicodePwd",
2641 NULL };
2642 struct ldb_request *search_req;
2643 int ret;
2644
2645 ldb = ldb_module_get_ctx(ac->module);
2646
2647 ret = ldb_build_search_req(&search_req, ldb, ac,
2648 ac->req->op.mod.message->dn,
2649 LDB_SCOPE_BASE,
2650 "(objectclass=*)",
2651 attrs,
2652 NULL,
2653 ac, ph_mod_search_callback,
2654 ac->req);
2655
2656 if (ret != LDB_SUCCESS) {
2657 return ret;
2658 }
2659
2660 return ldb_next_request(ac->module, search_req);
2661 }
2662
2663 static int password_hash_mod_do_mod(struct ph_context *ac)
2664 {
2665 struct ldb_context *ldb;
2666 struct ldb_request *mod_req;
2667 struct ldb_message *msg;
2668 const struct ldb_message *orig_msg, *searched_msg;
2669 struct setup_password_fields_io io;
2670 int ret;
2671 NTSTATUS status;
2672
2673 ldb = ldb_module_get_ctx(ac->module);
2674
2675 /* use a new message structure so that we can modify it */
2676 msg = ldb_msg_new(ac);
2677 if (msg == NULL) {
2678 return LDB_ERR_OPERATIONS_ERROR;
2679 }
2680
2681 /* modify dn */
2682 msg->dn = ac->req->op.mod.message->dn;
2683
2684 orig_msg = ac->req->op.mod.message;
2685 searched_msg = ac->search_res->message;
2686
2687 /* Prepare the internal data structure containing the passwords */
2688 ret = setup_io(ac, orig_msg, searched_msg, &io);
2689 if (ret != LDB_SUCCESS) {
2690 return ret;
2691 }
2692
2693 /* Get the old password from the database */
2694 status = samdb_result_passwords(io.ac,
2695 ldb_get_opaque(ldb, "loadparm"),
2696 discard_const_p(struct ldb_message, searched_msg),
2697 &io.o.lm_hash, &io.o.nt_hash);
2698 if (!NT_STATUS_IS_OK(status)) {
2699 return LDB_ERR_OPERATIONS_ERROR;
2700 }
2701
2702 io.o.nt_history_len = samdb_result_hashes(io.ac, searched_msg, "ntPwdHistory", &io.o.nt_history);
2703 io.o.lm_history_len = samdb_result_hashes(io.ac, searched_msg, "lmPwdHistory", &io.o.lm_history);
2704 io.o.supplemental = ldb_msg_find_ldb_val(searched_msg, "supplementalCredentials");
2705
2706 ret = setup_password_fields(&io);
2707 if (ret != LDB_SUCCESS) {
2708 return ret;
2709 }
2710
2711 ret = check_password_restrictions(&io);
2712 if (ret != LDB_SUCCESS) {
2713 return ret;
2714 }
2715
2716 /* make sure we replace all the old attributes */
2717 ret = ldb_msg_add_empty(msg, "unicodePwd", LDB_FLAG_MOD_REPLACE, NULL);
2718 ret = ldb_msg_add_empty(msg, "dBCSPwd", LDB_FLAG_MOD_REPLACE, NULL);
2719 ret = ldb_msg_add_empty(msg, "ntPwdHistory", LDB_FLAG_MOD_REPLACE, NULL);
2720 ret = ldb_msg_add_empty(msg, "lmPwdHistory", LDB_FLAG_MOD_REPLACE, NULL);
2721 ret = ldb_msg_add_empty(msg, "supplementalCredentials", LDB_FLAG_MOD_REPLACE, NULL);
2722 ret = ldb_msg_add_empty(msg, "pwdLastSet", LDB_FLAG_MOD_REPLACE, NULL);
2723
2724 if (io.g.nt_hash) {
2725 ret = samdb_msg_add_hash(ldb, ac, msg,
2726 "unicodePwd", io.g.nt_hash);
2727 if (ret != LDB_SUCCESS) {
2728 return ret;
2729 }
2730 }
2731 if (io.g.lm_hash) {
2732 ret = samdb_msg_add_hash(ldb, ac, msg,
2733 "dBCSPwd", io.g.lm_hash);
2734 if (ret != LDB_SUCCESS) {
2735 return ret;
2736 }
2737 }
2738 if (io.g.nt_history_len > 0) {
2739 ret = samdb_msg_add_hashes(ac, msg,
2740 "ntPwdHistory",
2741 io.g.nt_history,
2742 io.g.nt_history_len);
2743 if (ret != LDB_SUCCESS) {
2744 return ret;
2745 }
2746 }
2747 if (io.g.lm_history_len > 0) {
2748 ret = samdb_msg_add_hashes(ac, msg,
2749 "lmPwdHistory",
2750 io.g.lm_history,
2751 io.g.lm_history_len);
2752 if (ret != LDB_SUCCESS) {
2753 return ret;
2754 }
2755 }
2756 if (io.g.supplemental.length > 0) {
2757 ret = ldb_msg_add_value(msg, "supplementalCredentials",
2758 &io.g.supplemental, NULL);
2759 if (ret != LDB_SUCCESS) {
2760 return ret;
2761 }
2762 }
2763 ret = samdb_msg_add_uint64(ldb, ac, msg,
2764 "pwdLastSet",
2765 io.g.last_set);
2766 if (ret != LDB_SUCCESS) {
2767 return ret;
2768 }
2769
2770 ret = ldb_build_mod_req(&mod_req, ldb, ac,
2771 msg,
2772 ac->req->controls,
2773 ac, ph_op_callback,
2774 ac->req);
2775 if (ret != LDB_SUCCESS) {
2776 return ret;
2777 }
2778
2779 return ldb_next_request(ac->module, mod_req);
2780 }
2781
2782 _PUBLIC_ const struct ldb_module_ops ldb_password_hash_module_ops = {
2783 .name = "password_hash",
2784 .add = password_hash_add,
2785 .modify = password_hash_modify
2786 };