?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
nsswitch: Fix pam_set_data()/pam_get_data() to use pointers to a time_t, not try...
[Samba.git] / source4 / libnet / libnet_passwd.c
blobb17614bcd97bf6b2050c8a1f318110d74389cfc8
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
11
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
16
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "libnet/libnet.h"
23 #include "libcli/auth/libcli_auth.h"
24 #include "librpc/gen_ndr/ndr_samr_c.h"
25 #include "source4/librpc/rpc/dcerpc.h"
26 #include "auth/credentials/credentials.h"
27 #include "libcli/smb/smb_constants.h"
28 #include "librpc/rpc/dcerpc_samr.h"
29 #include "source3/rpc_client/init_samr.h"
30 #include "lib/param/loadparm.h"
31 #include "lib/param/param.h"
32
33 #include "lib/crypto/gnutls_helpers.h"
34 #include <gnutls/gnutls.h>
35 #include <gnutls/crypto.h>
36
37 static NTSTATUS libnet_ChangePassword_samr_aes(TALLOC_CTX *mem_ctx,
38 struct dcerpc_binding_handle *h,
39 struct lsa_String *server,
40 struct lsa_String *account,
41 const char *old_password,
42 const char *new_password,
43 const char **error_string)
44 {
45 #ifdef HAVE_GNUTLS_PBKDF2
46 struct samr_ChangePasswordUser4 r;
47 uint8_t old_nt_key_data[16] = {0};
48 gnutls_datum_t old_nt_key = {
49 .data = old_nt_key_data,
50 .size = sizeof(old_nt_key_data),
51 };
52 uint8_t cek_data[16] = {0};
53 DATA_BLOB cek = {
54 .data = cek_data,
55 .length = sizeof(cek_data),
56 };
57 struct samr_EncryptedPasswordAES pwd_buf = {
58 .cipher_len = 0
59 };
60 DATA_BLOB salt = {
61 .data = pwd_buf.salt,
62 .length = sizeof(pwd_buf.salt),
63 };
64 gnutls_datum_t salt_datum = {
65 .data = pwd_buf.salt,
66 .size = sizeof(pwd_buf.salt),
67 };
68 uint64_t pbkdf2_iterations = generate_random_u64_range(5000, 1000000);
69 NTSTATUS status;
70 int rc;
71
72 E_md4hash(old_password, old_nt_key_data);
73
74 generate_nonce_buffer(salt.data, salt.length);
75
76 rc = gnutls_pbkdf2(GNUTLS_MAC_SHA512,
77 &old_nt_key,
78 &salt_datum,
79 pbkdf2_iterations,
80 cek.data,
81 cek.length);
82 BURN_DATA(old_nt_key_data);
83 if (rc < 0) {
84 status = gnutls_error_to_ntstatus(rc, NT_STATUS_WRONG_PASSWORD);
85 }
86
87 status = init_samr_CryptPasswordAES(mem_ctx,
88 new_password,
89 &salt,
90 &cek,
91 &pwd_buf);
92 data_blob_clear(&cek);
93 if (!NT_STATUS_IS_OK(status)) {
94 goto done;
95 }
96
97 pwd_buf.PBKDF2Iterations = pbkdf2_iterations;
98
99 r.in.server = server;
100 r.in.account = account;
101 r.in.password = &pwd_buf;
102
103 status = dcerpc_samr_ChangePasswordUser4_r(h, mem_ctx, &r);
104 if (!NT_STATUS_IS_OK(status)) {
105 goto done;
106 }
107 if (!NT_STATUS_IS_OK(r.out.result)) {
108 *error_string = talloc_asprintf(mem_ctx,
109 "samr_ChangePasswordUser4 for "
110 "'%s\\%s' failed: %s",
111 server->string,
112 account->string,
113 nt_errstr(status));
114 status = r.out.result;
115 goto done;
116 }
117
118 done:
119 BURN_DATA(pwd_buf);
120
121 return status;
122 #else /* HAVE_GNUTLS_PBKDF2 */
123 return NT_STATUS_NOT_IMPLEMENTED;
124 #endif /* HAVE_GNUTLS_PBKDF2 */
125 }
126
127 static NTSTATUS libnet_ChangePassword_samr_rc4(TALLOC_CTX *mem_ctx,
128 struct dcerpc_binding_handle *h,
129 struct lsa_String *server,
130 struct lsa_String *account,
131 const char *old_password,
132 const char *new_password,
133 const char **error_string)
134 {
135 struct samr_OemChangePasswordUser2 oe2;
136 struct samr_ChangePasswordUser2 pw2;
137 struct samr_ChangePasswordUser3 pw3;
138 struct samr_CryptPassword nt_pass, lm_pass;
139 uint8_t old_nt_hash[16], new_nt_hash[16];
140 uint8_t old_lm_hash[16], new_lm_hash[16];
141 struct samr_Password nt_verifier, lm_verifier;
142 struct lsa_AsciiString a_server, a_account;
143 gnutls_cipher_hd_t cipher_hnd = NULL;
144 gnutls_datum_t nt_session_key = {
145 .data = old_nt_hash,
146 .size = sizeof(old_nt_hash),
147 };
148 gnutls_datum_t lm_session_key = {
149 .data = old_lm_hash,
150 .size = sizeof(old_lm_hash),
151 };
152 struct samr_DomInfo1 *dominfo = NULL;
153 struct userPwdChangeFailureInformation *reject = NULL;
154 NTSTATUS status;
155 int rc;
156
157 E_md4hash(old_password, old_nt_hash);
158 E_md4hash(new_password, new_nt_hash);
159
160 E_deshash(old_password, old_lm_hash);
161 E_deshash(new_password, new_lm_hash);
162
163 /* prepare samr_ChangePasswordUser3 */
164 encode_pw_buffer(lm_pass.data, new_password, STR_UNICODE);
165
166 rc = gnutls_cipher_init(&cipher_hnd,
167 GNUTLS_CIPHER_ARCFOUR_128,
168 &nt_session_key,
169 NULL);
170 if (rc < 0) {
171 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
172 goto done;
173 }
174
175 rc = gnutls_cipher_encrypt(cipher_hnd,
176 lm_pass.data,
177 516);
178 gnutls_cipher_deinit(cipher_hnd);
179 if (rc < 0) {
180 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
181 goto done;
182 }
183
184 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
185 if (rc != 0) {
186 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
187 goto done;
188 }
189
190 encode_pw_buffer(nt_pass.data, new_password, STR_UNICODE);
191
192 rc = gnutls_cipher_init(&cipher_hnd,
193 GNUTLS_CIPHER_ARCFOUR_128,
194 &nt_session_key,
195 NULL);
196 if (rc < 0) {
197 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
198 goto done;
199 }
200
201 rc = gnutls_cipher_encrypt(cipher_hnd,
202 nt_pass.data,
203 516);
204 gnutls_cipher_deinit(cipher_hnd);
205 if (rc < 0) {
206 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
207 goto done;
208 }
209
210 rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
211 if (rc != 0) {
212 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
213 goto done;
214 }
215
216 pw3.in.server = server;
217 pw3.in.account = account;
218 pw3.in.nt_password = &nt_pass;
219 pw3.in.nt_verifier = &nt_verifier;
220 pw3.in.lm_change = 1;
221 pw3.in.lm_password = &lm_pass;
222 pw3.in.lm_verifier = &lm_verifier;
223 pw3.in.password3 = NULL;
224 pw3.out.dominfo = &dominfo;
225 pw3.out.reject = &reject;
226
227 /* 2. try samr_ChangePasswordUser3 */
228 status = dcerpc_samr_ChangePasswordUser3_r(h, mem_ctx, &pw3);
229 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
230 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw3.out.result)) {
231 status = pw3.out.result;
232 }
233 if (!NT_STATUS_IS_OK(status)) {
234 *error_string = talloc_asprintf(
235 mem_ctx,
236 "samr_ChangePasswordUser3 failed: %s",
237 nt_errstr(status));
238 *error_string =
239 talloc_asprintf(mem_ctx,
240 "samr_ChangePasswordUser3 for "
241 "'%s\\%s' failed: %s",
242 server->string,
243 account->string,
244 nt_errstr(status));
245 }
246 goto done;
247 }
248
249 /* prepare samr_ChangePasswordUser2 */
250 encode_pw_buffer(lm_pass.data, new_password, STR_ASCII | STR_TERMINATE);
251
252 rc = gnutls_cipher_init(&cipher_hnd,
253 GNUTLS_CIPHER_ARCFOUR_128,
254 &lm_session_key,
255 NULL);
256 if (rc < 0) {
257 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
258 goto done;
259 }
260
261 rc = gnutls_cipher_encrypt(cipher_hnd,
262 lm_pass.data,
263 516);
264 gnutls_cipher_deinit(cipher_hnd);
265 if (rc < 0) {
266 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
267 goto done;
268 }
269
270 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
271 if (rc != 0) {
272 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
273 goto done;
274 }
275
276 encode_pw_buffer(nt_pass.data, new_password, STR_UNICODE);
277
278 rc = gnutls_cipher_init(&cipher_hnd,
279 GNUTLS_CIPHER_ARCFOUR_128,
280 &nt_session_key,
281 NULL);
282 if (rc < 0) {
283 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
284 goto done;
285 }
286 rc = gnutls_cipher_encrypt(cipher_hnd,
287 nt_pass.data,
288 516);
289 gnutls_cipher_deinit(cipher_hnd);
290 if (rc < 0) {
291 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
292 goto done;
293 }
294
295 rc = E_old_pw_hash(new_nt_hash, old_nt_hash, nt_verifier.hash);
296 if (rc != 0) {
297 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
298 goto done;
299 }
300
301 pw2.in.server = server;
302 pw2.in.account = account;
303 pw2.in.nt_password = &nt_pass;
304 pw2.in.nt_verifier = &nt_verifier;
305 pw2.in.lm_change = 1;
306 pw2.in.lm_password = &lm_pass;
307 pw2.in.lm_verifier = &lm_verifier;
308
309 /* 3. try samr_ChangePasswordUser2 */
310 status = dcerpc_samr_ChangePasswordUser2_r(h, mem_ctx, &pw2);
311 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
312 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pw2.out.result)) {
313 status = pw2.out.result;
314 }
315 if (!NT_STATUS_IS_OK(status)) {
316 *error_string =
317 talloc_asprintf(mem_ctx,
318 "samr_ChangePasswordUser2 for "
319 "'%s\\%s' failed: %s",
320 server->string,
321 account->string,
322 nt_errstr(status));
323 }
324 goto done;
325 }
326
327
328 /* prepare samr_OemChangePasswordUser2 */
329 a_server.string = server->string;
330 a_account.string = account->string;
331
332 encode_pw_buffer(lm_pass.data, new_password, STR_ASCII);
333
334 rc = gnutls_cipher_init(&cipher_hnd,
335 GNUTLS_CIPHER_ARCFOUR_128,
336 &lm_session_key,
337 NULL);
338 if (rc < 0) {
339 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
340 goto done;
341 }
342
343 rc = gnutls_cipher_encrypt(cipher_hnd,
344 lm_pass.data,
345 516);
346 gnutls_cipher_deinit(cipher_hnd);
347 if (rc < 0) {
348 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
349 goto done;
350 }
351
352 rc = E_old_pw_hash(new_lm_hash, old_lm_hash, lm_verifier.hash);
353 if (rc != 0) {
354 status = gnutls_error_to_ntstatus(rc, NT_STATUS_ACCESS_DISABLED_BY_POLICY_OTHER);
355 goto done;
356 }
357
358 oe2.in.server = &a_server;
359 oe2.in.account = &a_account;
360 oe2.in.password = &lm_pass;
361 oe2.in.hash = &lm_verifier;
362
363 /* 4. try samr_OemChangePasswordUser2 */
364 status = dcerpc_samr_OemChangePasswordUser2_r(h, mem_ctx, &oe2);
365 if (!NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
366 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(oe2.out.result)) {
367 status = oe2.out.result;
368 }
369 if (!NT_STATUS_IS_OK(oe2.out.result)) {
370 *error_string =
371 talloc_asprintf(mem_ctx,
372 "samr_OemChangePasswordUser2 "
373 "for '%s\\%s' failed: %s",
374 server->string,
375 account->string,
376 nt_errstr(status));
377 }
378 goto done;
379 }
380
381 status = NT_STATUS_OK;
382 done:
383 return status;
384 }
385
386 /*
387 * do a password change using DCERPC/SAMR calls
388 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
389 * 2. try samr_ChangePasswordUser3
390 * 3. try samr_ChangePasswordUser2
391 * 4. try samr_OemChangePasswordUser2
392 */
393 static NTSTATUS libnet_ChangePassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
394 {
395 NTSTATUS status;
396 struct libnet_RpcConnect c;
397 struct lsa_String server, account;
398
399 ZERO_STRUCT(c);
400
401 /* prepare connect to the SAMR pipe of the users domain PDC */
402 c.level = LIBNET_RPC_CONNECT_PDC;
403 c.in.name = r->samr.in.domain_name;
404 c.in.dcerpc_iface = &ndr_table_samr;
405 c.in.dcerpc_flags = DCERPC_ANON_FALLBACK;
406
407 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
408 status = libnet_RpcConnect(ctx, mem_ctx, &c);
409 if (!NT_STATUS_IS_OK(status)) {
410 r->samr.out.error_string = talloc_asprintf(mem_ctx,
411 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
412 r->samr.in.domain_name, nt_errstr(status));
413 return status;
414 }
415
416 /* prepare password change for account */
417 server.string = talloc_asprintf(mem_ctx, "\\\\%s", dcerpc_server_name(c.out.dcerpc_pipe));
418 account.string = r->samr.in.account_name;
419
420 status = libnet_ChangePassword_samr_aes(
421 mem_ctx,
422 c.out.dcerpc_pipe->binding_handle,
423 &server,
424 &account,
425 r->samr.in.oldpassword,
426 r->samr.in.newpassword,
427 &(r->samr.out.error_string));
428 if (NT_STATUS_IS_OK(status)) {
429 goto disconnect;
430 } else if (NT_STATUS_EQUAL(status,
431 NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE) ||
432 NT_STATUS_EQUAL(status, NT_STATUS_NOT_SUPPORTED) ||
433 NT_STATUS_EQUAL(status, NT_STATUS_NOT_IMPLEMENTED)) {
434 /*
435 * Don't fallback to RC4 based SAMR if weak crypto is not
436 * allowed.
437 */
438 if (lpcfg_weak_crypto(ctx->lp_ctx) ==
439 SAMBA_WEAK_CRYPTO_DISALLOWED) {
440 goto disconnect;
441 }
442 } else {
443 /* libnet_ChangePassword_samr_aes is implemented and failed */
444 goto disconnect;
445 }
446
447 status = libnet_ChangePassword_samr_rc4(
448 mem_ctx,
449 c.out.dcerpc_pipe->binding_handle,
450 &server,
451 &account,
452 r->samr.in.oldpassword,
453 r->samr.in.newpassword,
454 &(r->samr.out.error_string));
455 if (!NT_STATUS_IS_OK(status)) {
456 goto disconnect;
457 }
458
459 disconnect:
460 /* close connection */
461 talloc_unlink(ctx, c.out.dcerpc_pipe);
462
463 return status;
464 }
465
466 static NTSTATUS libnet_ChangePassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
467 {
468 NTSTATUS status;
469 union libnet_ChangePassword r2;
470
471 r2.samr.level = LIBNET_CHANGE_PASSWORD_SAMR;
472 r2.samr.in.account_name = r->generic.in.account_name;
473 r2.samr.in.domain_name = r->generic.in.domain_name;
474 r2.samr.in.oldpassword = r->generic.in.oldpassword;
475 r2.samr.in.newpassword = r->generic.in.newpassword;
476
477 status = libnet_ChangePassword(ctx, mem_ctx, &r2);
478
479 r->generic.out.error_string = r2.samr.out.error_string;
480
481 return status;
482 }
483
484 NTSTATUS libnet_ChangePassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_ChangePassword *r)
485 {
486 switch (r->generic.level) {
487 case LIBNET_CHANGE_PASSWORD_GENERIC:
488 return libnet_ChangePassword_generic(ctx, mem_ctx, r);
489 case LIBNET_CHANGE_PASSWORD_SAMR:
490 return libnet_ChangePassword_samr(ctx, mem_ctx, r);
491 case LIBNET_CHANGE_PASSWORD_KRB5:
492 return NT_STATUS_NOT_IMPLEMENTED;
493 case LIBNET_CHANGE_PASSWORD_LDAP:
494 return NT_STATUS_NOT_IMPLEMENTED;
495 case LIBNET_CHANGE_PASSWORD_RAP:
496 return NT_STATUS_NOT_IMPLEMENTED;
497 }
498
499 return NT_STATUS_INVALID_LEVEL;
500 }
501
502 static NTSTATUS libnet_SetPassword_samr_handle_26(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
503 {
504 NTSTATUS status;
505 struct samr_SetUserInfo2 sui;
506 union samr_UserInfo u_info;
507 DATA_BLOB session_key;
508
509 if (r->samr_handle.in.info21) {
510 return NT_STATUS_INVALID_PARAMETER_MIX;
511 }
512
513 /* prepare samr_SetUserInfo2 level 26 */
514 ZERO_STRUCT(u_info);
515 u_info.info26.password_expired = 0;
516
517 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
518 if (!NT_STATUS_IS_OK(status)) {
519 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
520 "dcerpc_fetch_session_key failed: %s",
521 nt_errstr(status));
522 return status;
523 }
524
525 status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
526 &session_key,
527 &u_info.info26.password);
528 if (!NT_STATUS_IS_OK(status)) {
529 r->samr_handle.out.error_string =
530 talloc_asprintf(mem_ctx,
531 "encode_rc4_passwd_buffer failed: %s",
532 nt_errstr(status));
533 return status;
534 }
535
536 sui.in.user_handle = r->samr_handle.in.user_handle;
537 sui.in.info = &u_info;
538 sui.in.level = 26;
539
540 /* 7. try samr_SetUserInfo2 level 26 to set the password */
541 status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
542 /* check result of samr_SetUserInfo2 level 26 */
543 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
544 status = sui.out.result;
545 }
546 if (!NT_STATUS_IS_OK(status)) {
547 r->samr_handle.out.error_string
548 = talloc_asprintf(mem_ctx,
549 "SetUserInfo2 level 26 for [%s] failed: %s",
550 r->samr_handle.in.account_name, nt_errstr(status));
551 }
552
553 return status;
554 }
555
556 static NTSTATUS libnet_SetPassword_samr_handle_25(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
557 {
558 NTSTATUS status;
559 struct samr_SetUserInfo2 sui;
560 union samr_UserInfo u_info;
561 DATA_BLOB session_key;
562
563 if (!r->samr_handle.in.info21) {
564 return NT_STATUS_INVALID_PARAMETER_MIX;
565 }
566
567 /* prepare samr_SetUserInfo2 level 25 */
568 ZERO_STRUCT(u_info);
569 u_info.info25.info = *r->samr_handle.in.info21;
570 u_info.info25.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
571
572 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
573 if (!NT_STATUS_IS_OK(status)) {
574 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
575 "dcerpc_fetch_session_key failed: %s",
576 nt_errstr(status));
577 return status;
578 }
579
580 status = encode_rc4_passwd_buffer(r->samr_handle.in.newpassword,
581 &session_key,
582 &u_info.info25.password);
583 if (!NT_STATUS_IS_OK(status)) {
584 r->samr_handle.out.error_string =
585 talloc_asprintf(mem_ctx,
586 "encode_rc4_passwd_buffer failed: %s",
587 nt_errstr(status));
588 return status;
589 }
590
591
592 sui.in.user_handle = r->samr_handle.in.user_handle;
593 sui.in.info = &u_info;
594 sui.in.level = 25;
595
596 /* 8. try samr_SetUserInfo2 level 25 to set the password */
597 status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
598 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
599 status = sui.out.result;
600 }
601 if (!NT_STATUS_IS_OK(status)) {
602 r->samr_handle.out.error_string
603 = talloc_asprintf(mem_ctx,
604 "SetUserInfo2 level 25 for [%s] failed: %s",
605 r->samr_handle.in.account_name, nt_errstr(status));
606 }
607
608 return status;
609 }
610
611 static NTSTATUS libnet_SetPassword_samr_handle_24(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
612 {
613 NTSTATUS status;
614 struct samr_SetUserInfo2 sui;
615 union samr_UserInfo u_info;
616 DATA_BLOB session_key;
617 gnutls_cipher_hd_t cipher_hnd = NULL;
618 gnutls_datum_t enc_session_key;
619 int rc;
620
621 if (r->samr_handle.in.info21) {
622 return NT_STATUS_INVALID_PARAMETER_MIX;
623 }
624
625 /* prepare samr_SetUserInfo2 level 24 */
626 ZERO_STRUCT(u_info);
627 encode_pw_buffer(u_info.info24.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
628 u_info.info24.password_expired = 0;
629
630 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
631 if (!NT_STATUS_IS_OK(status)) {
632 r->samr_handle.out.error_string = talloc_asprintf(mem_ctx,
633 "dcerpc_fetch_session_key failed: %s",
634 nt_errstr(status));
635 return status;
636 }
637
638 enc_session_key = (gnutls_datum_t) {
639 .data = session_key.data,
640 .size = session_key.length,
641 };
642
643 rc = gnutls_cipher_init(&cipher_hnd,
644 GNUTLS_CIPHER_ARCFOUR_128,
645 &enc_session_key,
646 NULL);
647 if (rc < 0) {
648 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
649 goto out;
650 }
651
652 rc = gnutls_cipher_encrypt(cipher_hnd,
653 u_info.info24.password.data,
654 516);
655 gnutls_cipher_deinit(cipher_hnd);
656 if (rc < 0) {
657 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
658 goto out;
659 }
660
661 sui.in.user_handle = r->samr_handle.in.user_handle;
662 sui.in.info = &u_info;
663 sui.in.level = 24;
664
665 /* 9. try samr_SetUserInfo2 level 24 to set the password */
666 status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
667 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
668 status = sui.out.result;
669 }
670 if (!NT_STATUS_IS_OK(status)) {
671 r->samr_handle.out.error_string
672 = talloc_asprintf(mem_ctx,
673 "SetUserInfo2 level 24 for [%s] failed: %s",
674 r->samr_handle.in.account_name, nt_errstr(status));
675 }
676
677 out:
678 data_blob_clear(&session_key);
679 return status;
680 }
681
682 static NTSTATUS libnet_SetPassword_samr_handle_23(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
683 {
684 NTSTATUS status;
685 struct samr_SetUserInfo2 sui;
686 union samr_UserInfo u_info;
687 DATA_BLOB session_key;
688 gnutls_cipher_hd_t cipher_hnd = NULL;
689 gnutls_datum_t _session_key;
690 int rc;
691
692 if (!r->samr_handle.in.info21) {
693 return NT_STATUS_INVALID_PARAMETER_MIX;
694 }
695
696 /* prepare samr_SetUserInfo2 level 23 */
697 ZERO_STRUCT(u_info);
698 u_info.info23.info = *r->samr_handle.in.info21;
699 u_info.info23.info.fields_present |= SAMR_FIELD_NT_PASSWORD_PRESENT;
700 encode_pw_buffer(u_info.info23.password.data, r->samr_handle.in.newpassword, STR_UNICODE);
701
702 status = dcerpc_fetch_session_key(r->samr_handle.in.dcerpc_pipe, &session_key);
703 if (!NT_STATUS_IS_OK(status)) {
704 r->samr_handle.out.error_string
705 = talloc_asprintf(mem_ctx,
706 "dcerpc_fetch_session_key failed: %s",
707 nt_errstr(status));
708 return status;
709 }
710
711 _session_key = (gnutls_datum_t) {
712 .data = session_key.data,
713 .size = session_key.length,
714 };
715
716 rc = gnutls_cipher_init(&cipher_hnd,
717 GNUTLS_CIPHER_ARCFOUR_128,
718 &_session_key,
719 NULL);
720 if (rc < 0) {
721 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
722 goto out;
723 }
724
725 rc = gnutls_cipher_encrypt(cipher_hnd,
726 u_info.info23.password.data,
727 516);
728 data_blob_clear_free(&session_key);
729 gnutls_cipher_deinit(cipher_hnd);
730 if (rc < 0) {
731 status = gnutls_error_to_ntstatus(rc, NT_STATUS_CRYPTO_SYSTEM_INVALID);
732 goto out;
733 }
734
735 sui.in.user_handle = r->samr_handle.in.user_handle;
736 sui.in.info = &u_info;
737 sui.in.level = 23;
738
739 /* 10. try samr_SetUserInfo2 level 23 to set the password */
740 status = dcerpc_samr_SetUserInfo2_r(r->samr_handle.in.dcerpc_pipe->binding_handle, mem_ctx, &sui);
741 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sui.out.result)) {
742 status = sui.out.result;
743 }
744 if (!NT_STATUS_IS_OK(status)) {
745 r->samr_handle.out.error_string
746 = talloc_asprintf(mem_ctx,
747 "SetUserInfo2 level 23 for [%s] failed: %s",
748 r->samr_handle.in.account_name, nt_errstr(status));
749 }
750
751 out:
752 return status;
753 }
754
755 /*
756 * 1. try samr_SetUserInfo2 level 26 to set the password
757 * 2. try samr_SetUserInfo2 level 25 to set the password
758 * 3. try samr_SetUserInfo2 level 24 to set the password
759 * 4. try samr_SetUserInfo2 level 23 to set the password
760 */
761 static NTSTATUS libnet_SetPassword_samr_handle(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
762 {
763
764 NTSTATUS status;
765 enum libnet_SetPassword_level levels[] = {
766 LIBNET_SET_PASSWORD_SAMR_HANDLE_26,
767 LIBNET_SET_PASSWORD_SAMR_HANDLE_25,
768 LIBNET_SET_PASSWORD_SAMR_HANDLE_24,
769 LIBNET_SET_PASSWORD_SAMR_HANDLE_23,
770 };
771 unsigned int i;
772
773 for (i=0; i < ARRAY_SIZE(levels); i++) {
774 r->generic.level = levels[i];
775 status = libnet_SetPassword(ctx, mem_ctx, r);
776 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_INFO_CLASS)
777 || NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER_MIX)
778 || NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
779 /* Try another password set mechanism */
780 continue;
781 }
782 break;
783 }
784
785 return status;
786 }
787 /*
788 * set a password with DCERPC/SAMR calls
789 * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
790 * is it correct to contact the the pdc of the domain of the user who's password should be set?
791 * 2. do a samr_Connect to get a policy handle
792 * 3. do a samr_LookupDomain to get the domain sid
793 * 4. do a samr_OpenDomain to get a domain handle
794 * 5. do a samr_LookupNames to get the users rid
795 * 6. do a samr_OpenUser to get a user handle
796 * 7 call libnet_SetPassword_samr_handle to set the password
797 */
798 static NTSTATUS libnet_SetPassword_samr(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
799 {
800 NTSTATUS status;
801 struct libnet_RpcConnect c;
802 struct samr_Connect sc;
803 struct policy_handle p_handle;
804 struct samr_LookupDomain ld;
805 struct dom_sid2 *sid = NULL;
806 struct lsa_String d_name;
807 struct samr_OpenDomain od;
808 struct policy_handle d_handle;
809 struct samr_LookupNames ln;
810 struct samr_Ids rids, types;
811 struct samr_OpenUser ou;
812 struct policy_handle u_handle;
813 union libnet_SetPassword r2;
814
815 ZERO_STRUCT(c);
816 /* prepare connect to the SAMR pipe of users domain PDC */
817 c.level = LIBNET_RPC_CONNECT_PDC;
818 c.in.name = r->samr.in.domain_name;
819 c.in.dcerpc_iface = &ndr_table_samr;
820
821 /* 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation) */
822 status = libnet_RpcConnect(ctx, mem_ctx, &c);
823 if (!NT_STATUS_IS_OK(status)) {
824 r->samr.out.error_string = talloc_asprintf(mem_ctx,
825 "Connection to SAMR pipe of PDC of domain '%s' failed: %s",
826 r->samr.in.domain_name, nt_errstr(status));
827 return status;
828 }
829
830 /* prepare samr_Connect */
831 ZERO_STRUCT(p_handle);
832 sc.in.system_name = NULL;
833 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
834 sc.out.connect_handle = &p_handle;
835
836 /* 2. do a samr_Connect to get a policy handle */
837 status = dcerpc_samr_Connect_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &sc);
838 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sc.out.result)) {
839 status = sc.out.result;
840 }
841 if (!NT_STATUS_IS_OK(status)) {
842 r->samr.out.error_string = talloc_asprintf(mem_ctx,
843 "samr_Connect failed: %s",
844 nt_errstr(status));
845 goto disconnect;
846 }
847
848 /* prepare samr_LookupDomain */
849 d_name.string = r->samr.in.domain_name;
850 ld.in.connect_handle = &p_handle;
851 ld.in.domain_name = &d_name;
852 ld.out.sid = &sid;
853
854 /* 3. do a samr_LookupDomain to get the domain sid */
855 status = dcerpc_samr_LookupDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ld);
856 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ld.out.result)) {
857 status = ld.out.result;
858 }
859 if (!NT_STATUS_IS_OK(status)) {
860 r->samr.out.error_string = talloc_asprintf(mem_ctx,
861 "samr_LookupDomain for [%s] failed: %s",
862 r->samr.in.domain_name, nt_errstr(status));
863 goto disconnect;
864 }
865
866 /* prepare samr_OpenDomain */
867 ZERO_STRUCT(d_handle);
868 od.in.connect_handle = &p_handle;
869 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
870 od.in.sid = *ld.out.sid;
871 od.out.domain_handle = &d_handle;
872
873 /* 4. do a samr_OpenDomain to get a domain handle */
874 status = dcerpc_samr_OpenDomain_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &od);
875 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(od.out.result)) {
876 status = od.out.result;
877 }
878 if (!NT_STATUS_IS_OK(status)) {
879 r->samr.out.error_string = talloc_asprintf(mem_ctx,
880 "samr_OpenDomain for [%s] failed: %s",
881 r->samr.in.domain_name, nt_errstr(status));
882 goto disconnect;
883 }
884
885 /* prepare samr_LookupNames */
886 ln.in.domain_handle = &d_handle;
887 ln.in.num_names = 1;
888 ln.in.names = talloc_array(mem_ctx, struct lsa_String, 1);
889 ln.out.rids = &rids;
890 ln.out.types = &types;
891 if (!ln.in.names) {
892 r->samr.out.error_string = "Out of Memory";
893 return NT_STATUS_NO_MEMORY;
894 }
895 ln.in.names[0].string = r->samr.in.account_name;
896
897 /* 5. do a samr_LookupNames to get the users rid */
898 status = dcerpc_samr_LookupNames_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ln);
899 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ln.out.result)) {
900 status = ln.out.result;
901 }
902 if (!NT_STATUS_IS_OK(status)) {
903 r->samr.out.error_string = talloc_asprintf(mem_ctx,
904 "samr_LookupNames for [%s] failed: %s",
905 r->samr.in.account_name, nt_errstr(status));
906 goto disconnect;
907 }
908
909 /* check if we got one RID for the user */
910 if (ln.out.rids->count != 1) {
911 r->samr.out.error_string = talloc_asprintf(mem_ctx,
912 "samr_LookupNames for [%s] returns %d RIDs",
913 r->samr.in.account_name, ln.out.rids->count);
914 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
915 goto disconnect;
916 }
917
918 if (ln.out.types->count != 1) {
919 r->samr.out.error_string = talloc_asprintf(mem_ctx,
920 "samr_LookupNames for [%s] returns %d RID TYPEs",
921 r->samr.in.account_name, ln.out.types->count);
922 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
923 goto disconnect;
924 }
925
926 /* prepare samr_OpenUser */
927 ZERO_STRUCT(u_handle);
928 ou.in.domain_handle = &d_handle;
929 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
930 ou.in.rid = ln.out.rids->ids[0];
931 ou.out.user_handle = &u_handle;
932
933 /* 6. do a samr_OpenUser to get a user handle */
934 status = dcerpc_samr_OpenUser_r(c.out.dcerpc_pipe->binding_handle, mem_ctx, &ou);
935 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ou.out.result)) {
936 status = ou.out.result;
937 }
938 if (!NT_STATUS_IS_OK(status)) {
939 r->samr.out.error_string = talloc_asprintf(mem_ctx,
940 "samr_OpenUser for [%s] failed: %s",
941 r->samr.in.account_name, nt_errstr(status));
942 goto disconnect;
943 }
944
945 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
946 r2.samr_handle.in.account_name = r->samr.in.account_name;
947 r2.samr_handle.in.newpassword = r->samr.in.newpassword;
948 r2.samr_handle.in.user_handle = &u_handle;
949 r2.samr_handle.in.dcerpc_pipe = c.out.dcerpc_pipe;
950 r2.samr_handle.in.info21 = NULL;
951
952 status = libnet_SetPassword(ctx, mem_ctx, &r2);
953
954 r->generic.out.error_string = r2.samr_handle.out.error_string;
955
956 disconnect:
957 /* close connection */
958 talloc_unlink(ctx, c.out.dcerpc_pipe);
959
960 return status;
961 }
962
963 static NTSTATUS libnet_SetPassword_generic(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
964 {
965 NTSTATUS status;
966 union libnet_SetPassword r2;
967
968 r2.samr.level = LIBNET_SET_PASSWORD_SAMR;
969 r2.samr.in.account_name = r->generic.in.account_name;
970 r2.samr.in.domain_name = r->generic.in.domain_name;
971 r2.samr.in.newpassword = r->generic.in.newpassword;
972
973 r->generic.out.error_string = "Unknown Error";
974 status = libnet_SetPassword(ctx, mem_ctx, &r2);
975
976 r->generic.out.error_string = r2.samr.out.error_string;
977
978 return status;
979 }
980
981 NTSTATUS libnet_SetPassword(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, union libnet_SetPassword *r)
982 {
983 enum smb_encryption_setting encryption_state =
984 cli_credentials_get_smb_encryption(ctx->cred);
985 NTSTATUS status = NT_STATUS_INVALID_LEVEL;
986
987 switch (r->generic.level) {
988 case LIBNET_SET_PASSWORD_GENERIC:
989 status = libnet_SetPassword_generic(ctx, mem_ctx, r);
990 break;
991 case LIBNET_SET_PASSWORD_SAMR:
992 status = libnet_SetPassword_samr(ctx, mem_ctx, r);
993 break;
994 case LIBNET_SET_PASSWORD_SAMR_HANDLE:
995 status = libnet_SetPassword_samr_handle(ctx, mem_ctx, r);
996 break;
997 case LIBNET_SET_PASSWORD_SAMR_HANDLE_26:
998 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
999 GNUTLS_FIPS140_SET_LAX_MODE();
1000 }
1001 status = libnet_SetPassword_samr_handle_26(ctx, mem_ctx, r);
1002 break;
1003 case LIBNET_SET_PASSWORD_SAMR_HANDLE_25:
1004 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
1005 GNUTLS_FIPS140_SET_LAX_MODE();
1006 }
1007 status = libnet_SetPassword_samr_handle_25(ctx, mem_ctx, r);
1008 break;
1009 case LIBNET_SET_PASSWORD_SAMR_HANDLE_24:
1010 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
1011 GNUTLS_FIPS140_SET_LAX_MODE();
1012 }
1013 status = libnet_SetPassword_samr_handle_24(ctx, mem_ctx, r);
1014 break;
1015 case LIBNET_SET_PASSWORD_SAMR_HANDLE_23:
1016 if (encryption_state == SMB_ENCRYPTION_REQUIRED) {
1017 GNUTLS_FIPS140_SET_LAX_MODE();
1018 }
1019 status = libnet_SetPassword_samr_handle_23(ctx, mem_ctx, r);
1020 break;
1021 case LIBNET_SET_PASSWORD_KRB5:
1022 status = NT_STATUS_NOT_IMPLEMENTED;
1023 break;
1024 case LIBNET_SET_PASSWORD_LDAP:
1025 status = NT_STATUS_NOT_IMPLEMENTED;
1026 break;
1027 case LIBNET_SET_PASSWORD_RAP:
1028 status = NT_STATUS_NOT_IMPLEMENTED;
1029 break;
1030 }
1031
1032 GNUTLS_FIPS140_SET_STRICT_MODE();
1033 return status;
1034 }
Samba GIT mirror